WASHINGTON -- Spam campaigns continue to increase, despite a new federal antispam law that took effect in January, says a recent survey from antispam vendor Commtouch Software.
Much of the problem with the new Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act is that 40 percent of spam e-mail comes from outside the U.S., say Avner Amram, Commtouch executive vice president.
Scam Trends
Commtouch's spam detection center doesn't measure the total number of spam messages sent, but rather the number of spam "outbreaks." The company defines an outbreak as the bulk sending of one spam message. Still, outbreaks rose from about 350,000 per day at the end of 2003 to about 400,000 per day in March, Amram says.
"There's certainly not a slowdown in volume," Amram says.
Commtouch has also seen more "phishing" scams targeting e-mail users. Phishing scams typically send a fraudulent e-mail telling recipients they must update their credit card numbers at an e-commerce site. The phishing e-mail links to a bogus Web site that mimics the look of the real e-commerce site, and the spammers then harvest credit card numbers from the unsuspecting customers.
CAN-SPAM requires that spam e-mail include a working return e-mail address, a valid postal address for the sending company, a working opt-out mechanism, and a relevant subject line. The law also directs the Federal Trade Commission to study setting up a national do-not-spam list, similar to the national do-not-call telemarketing list now in effect.
Other Findings
In January, Commtouch found that only 1 percent of the spam e-mail it surveyed complied with CAN-SPAM. That figure has increased: E-mail complying with the law has risen to 3.5 percent, according to Commtouch's study.
Of the 1 million spam messages Commtouch tracked in March, 40 percent came from outside the U.S., spread across IP addresses in 152 nations, according to Commtouch.
The biggest offender outside the U.S. was China, with 6 percent of spam coming from IP addresses there. South Korea generated 5 percent of spam tracked by Commtouch, Canada generated 4 percent, and Brazil 3 percent.
Backers of CAN-SPAM say eventual prosecutions under the new law may help curb the amount of spam. The Federal Trade Commission and state attorneys general can bring civil complaints against spammers, resulting in fines of up to $6 million. The law also allows criminal penalties of up to five years in prison for spammers who violate such provisions as hacking into someone else's computer to send spam, and falsifying header information in bulk spam.
The FTC is pursuing cases against spammers, but spammers use false header information and open relays to hide their identities.
"We have said that it's very difficult to find spammers," says an FTC spokesperson. "That's why spam cases are resource intensive and aren't very quick."
Commtouch's Amram agrees that spam prosecutions could help CAN-SPAM enforcement.
"Certainly, it's going to help, because when people hear about enforcement, they will be afraid," he says. "It's not going to help to the maximum extent, because there are many ways CAN-SPAM can't be enforced."
