Six Reasons Why Can't We Stop Email Spam
1. Spammers invest in ways to get their email past your defenses.
They have a two-pronged strategy. First, they misspell words, use images, and do everything they can to get past the text filters that most people use. If they went to all that effort, but sent their email messages from only a few computers, it would be easy to knock those computers off the internet or blacklist them. Therefore, spammers employ a second technique—sending their spam from many different "zombie" computers. Because spammers control a shifting pool of hundreds, thousands, or even hundreds of thousands of zombie machines, their operations are very hard to shut down. Spammers may live in places where their money goes further than it would in New York City. It may make sense for them to invest months of effort for a few thousand dollars. This "cost advantage" enables attacks that many people would dismiss as not worth the effort.
2. A lots of countries where spamming is not illegal
Some countries have made sending spam illegal. The problem is that in lots of other places, spamming is not illegal. Even where it is illegal, there is competition for police resources. Spam is not as important to the police as a mugging or an assault. Catching one spammer takes much time and effort, and the payoff may seem small, especially if the spammer is in another country. Thus, the risks to a spammer are low, because the deterrent effect of the law is so small.
3. Owner of PC is used to send spam doesn't directly suffer the consequences
Economists speak of externalities, in which the costs of a transaction are not carried entirely by the people involved. People who drive sport utility vehicles (SUVs) that emit more fumes than smaller cars don't experience any more smog than anyone else. SUV owners don't personally experience the consequences of their actions in a proportional manner. The same problem exists with the security of home PCs. When a PC is turned into a zombie and is used to send spam, the owner of the PC doesn't directly suffer the consequences.
4. There is no software marketed as preventing a home PC from being turned into a zombie, because consumers would be unlikely to purchase it.
Luckily, most antivirus products provide a reasonable level of defense against a home computer being turned into a zombie. Consumers do pay for antivirus software, because they don't want to lose their files to a virus. This is bundling, which we discussed in Chapter 2 as a strategy for increasing the adoption of security technologies.
5. Unfortunately, not every home computer connected to the internet has up to date antivirus software installed.
The remainder represent many millions of computers—more than enough for spammers to take advantage of. Even a small fraction of all computers connected to the internet represents a massive number.
6. Unscrupulous people are making lots of money sending spam.
Spammers face hardly any risk of being caught. The combination of these incentives and the externalities, magnified by the size of the internet, means that it is perhaps impossible to stop spam.
