As technology executives hunker down for a prolonged battle against spammers and virus writers, they caution that their products can only go so far to protect consumers against the proliferation of "phishing" scams and virus-spreading e-mails. Instead, they say, some of the responsibility for spam prevention is on the shoulders of Internet users.
"This is an awareness problem, not a product problem," Symantec CEO John Thompson said during a panel discussion keyed to the launch of CNET Networks Editor at Large Esther Dyson's Release 1.0 Web site. CNET Networks is the publisher of ZDNet Australia.
If Thompson is right, it's a problem not given to quick solution. Despite advances in the last couple of years, other executives on the panel -- which took place last week at the headquarters of CNET Networks -- agreed that the tech industry has a long way to go in raising this awareness.
Some panel participants, such as Brad Garlinghouse, vice-president of communication products at Yahoo, and Meng Weng Wong, founder of PoBox.com, floated the idea of primary e-mail providers such as Yahoo, Microsoft and America Online giving users incentives to be more careful about how they share information online and what they download.
"We, as an industry, can give you incentives not to be lazy," said Yahoo's Garlinghouse. "By working collectively we can attack this."
Spam, once merely a nuisance that clogged in-boxes, has evolved into a tool for criminals intent on stealing credit card numbers or launching viruses.
The US Congress and a few states have passed laws that would impose jail time for some offenders. Last Tuesday, the legislature of Ohio passed a bill that could bring out-of-state spammers to trial and impose harsh financial penalties and jail sentences. The bill, which has yet to be signed by the governor, follows the example of the federal government's Can-Spam bill, which went into effect at the beginning of 2004. Can-Spam would impose punishments based on falsified email headers and "sexually oriented" messages that are not properly labelled as such.
At the same time, e-mail providers are taking their own steps to battle spam, steps that aren't necessarily in line with one another.
Yahoo and Cisco have both created e-mail systems that use digital signatures to verify the sender's authenticity, called "DomainKeys" and "Identified Internet Mail", respectively. While the two products compete against each other, the companies are in discussions to establish some common ground, according to Cisco executive David Rossetti.
 |
Microsoft in May merged its "Caller ID for email" technology with Pobox.com's SPF, or "Sender Permitted From" approach.
Microsoft submitted the merged technology, called "Sender ID", to the IETF standards body but faced resistance when people in the open-source community claimed Microsoft could charge royalties.
Microsoft eventually retracted its changes after open-source groups; America Online, which supports SPF; and Wong's Pobox.com pulled their support for Sender ID. Wong himself has filed with the IETF to standardise SPF. Yahoo has also filed to standardise DomainKeys.
Despite disagreements on how to tackle the spam problem, industry executives agree that spam can never be fully eradicated. Instead, companies, service providers and consumers alike will need to make their own contributions to reduce and prevent spam from harming their computers.
"There is no silver bullet to this problem," said Richard Gingras, CEO of Goodmail.
