Clamping down on spammers

The long view of security strategies for your network.

Many of us have more than one e-mail account, and according to a statistic quoted in a summary from PowerPro Direct, "Nearly 70% of respondents said they had multiple email accounts. - AOL/Beta Research Corporation (June 2008)"

It's reasonable to segregate one's private e-mail from one's work-related e-mail; for example, I have a Norwich University .edu account which I try to reserve for student and colleague messages relating to academic business but I use a GMAIL account for everything else. Some people go further and define a marketing-e-mail account reserved just for potential junk e-mail. When they sign up for newsletters and the like, they use the special e-mail address: "Overall just 12 percent of US consumers report to have a dedicated e-mail account for marketing messages as compared to 20 percent of UK consumers. e-Dialog 'Manifesto for E-mail Marketers: Consumer Demand Relevance' (2010)" quoted in EmailStatCenter's summary of e-mail usage and penetration.

Recently I received a well designed, perfectly acceptable advertisement for online meeting services provided by Cisco webex and offering a white paper entitled "Ramp up revenue and jump start growth with online meetings: Four tips from grooving businesses with an eye on the bottom line." Unfortunately, the message was sent to my .edu address, so I clicked on the "unsubscribe here" link, which brought me to a Web page created by Marketfish.com. The opt-out button immediately cut me out of all future messages from Cisco, or at least, the advertising platform for Cisco which sent me that particular message. Wanting to ensure that no one send any further messages from any of their clients to my .edu address, I looked around their Web site. Ideally, I would have found a form to fill out for a change of e-mail address or for a global do-not-send list for all of their clients.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Many of us have more than one e-mail account, and according to a statistic quoted in a summary from PowerPro Direct, "Nearly 70% of respondents said they had multiple email accounts. - AOL/Beta Research Corporation (June 2008)"

It's reasonable to segregate one's private e-mail from one's work-related e-mail; for example, I have a Norwich University .edu account which I try to reserve for student and colleague messages relating to academic business but I use a GMAIL account for everything else. Some people go further and define a marketing-e-mail account reserved just for potential junk e-mail. When they sign up for newsletters and the like, they use the special e-mail address: "Overall just 12 percent of US consumers report to have a dedicated e-mail account for marketing messages as compared to 20 percent of UK consumers. e-Dialog 'Manifesto for E-mail Marketers: Consumer Demand Relevance' (2010)" quoted in EmailStatCenter's summary of e-mail usage and penetration.

Recently I received a well designed, perfectly acceptable advertisement for online meeting services provided by Cisco webex and offering a white paper entitled "Ramp up revenue and jump start growth with online meetings: Four tips from grooving businesses with an eye on the bottom line." Unfortunately, the message was sent to my .edu address, so I clicked on the "unsubscribe here" link, which brought me to a Web page created by Marketfish.com. The opt-out button immediately cut me out of all future messages from Cisco, or at least, the advertising platform for Cisco which sent me that particular message. Wanting to ensure that no one send any further messages from any of their clients to my .edu address, I looked around their Web site. Ideally, I would have found a form to fill out for a change of e-mail address or for a global do-not-send list for all of their clients.

No such form. Where was the global opt-out button?

After corresponding with Marketfish executives, I learned that they have no global do-not-send list because they do not own any distribution lists. They serve exclusively as facilitators for e-mail campaigns using e-mail lists supplied to them by their clients. The service recommends that recipients of e-mail sent by Marketfish contact each client separately to be removed from all further communications from that particular client because "This assures that he will never get another unsolicited email despite whom a list owner works with to send third party offers in the future."

After corresponding with the Marketfish experts, it is clear that there is no mechanism for these operators to provide global opt-out services for recipients of their efforts.

• For example, there is no easy way for such a company to check the status of all the e-mail addresses described as opted-in by all the suppliers of distribution lists. Checking on the actual opt-in status of even some e-mail addresses by demanding documentary evidence of the opt-in would take effort, time and money. Marketfish executives are emphatic in their sense of responsibility about the lists that they contract to use temporarily for specific clients: "It's our policy to check the opt-in status of every list supplier. We state this clearly on our Website. We also don't allow non-permissioned lists onto our platform. List owners also legally warrant that they've received permission. We have the right to audit this status at any time, and if a list owner misrepresents this [status], we will not work with them again."

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services and teaching. He is Chief Technical Officer of Adaptive Cyber Security Instruments, Inc. and Associate Professor of Information Assurance in the School of Business and Management at Norwich University. Visit his Web site for white papers and course materials.