Why Spam Filters Do not Work
The best analogy might be comparing a spam filter to a cigarette filter -- the heaviest duty cigarette filters still let toxins, fibers and tar through.
By Brian Cartnell, SpamArrest

Editor's Note: About eight months ago, I wrote a blog about the inconsistency of Internet users (including me) who regularly employ a challenge/response system for instant messaging, but who eschew such a system for e-mail (see Internet Users Have BIG Minds). The folks at SpamArrest have always believed me to be way off base on this, and have recently asked to make their case, so here it is. -- John Dickinson, Editor, Messaging Pipeline

Over the past decade, e-mail spam has come perilously close to destroying one of the most c
onvenient and efficient communication methods yet devised. A postal box can be stuffed only so far as its physical dimensions will allow, and there is an actual cost associated with the printing and postage for postal junk mail. But an e-mail inbox has no physical limitations on the amount of junk e-mail it can contain, and the costs of sending out tens of thousands, or even millions, of e-mail spam are negligible.

In response to this situation, numerous methods have been devised to prevent the proliferation of spam. These methods include keyword-matching filters, genetic algorithms, e-mail bombs and lawsuits, to name just a few. To date, none have worked completely, and have left e-mail users feeling like they're armed with only a squirt gun at a pyromaniac convention.

It was only a few years ago that I was receiving thousands of junk e-mails on a daily basis. At the time, I tried everything -- from constantly modifying my own e-mail filters to wasting hours out of every day sorting through spam. In order to uncover my valid messages within the sea of daily e-mail, I realized that something more effective than mere filtering had to be done to combat what had become an unacceptable obstacle to communicating effectively via e-mail with my list of business and personal associates. This is where the challenge/response solution entered the picture.

Some of the best e-mail filters eliminate 90 to 98 percent of spam, which at first blush sounds pretty good -- that is, until you realize that a single spamming operation can easily send out 100 million messages a day, which means that between two and ten million messages are still getting past even the most effective filtering systems, causing major headaches for everyone in the spammer's path.

Tar, Nicotine, and Spam
The best analogy might be comparing a spam filter to a cigarette filter. The heaviest duty cigarette filters still let toxins, fibers and tar through -- much like the best e-mail filters still let two to ten percent of all junk e-mail through. So the answer to the health problems associated with smoking is not to keep tweaking the cigarette filter, but to stop smoking
entirely.

Similarly, the solution to the spam problem is not another filter, but to utilize a different method entirely -- the challenge/response system.
When I founded SpamArrest back in 2001, I realized the challenge/response method was the only available means of controlling the "Trouble With Tribbles"-like proliferation of spam. An estimated 85 percent of the customers who presently sign up to SpamArrest already have spam filters installed on their computers, or use services with spam filters built in, but because of the sheer number of spammers pushing their junk e-mail across the Internet, the filters can't keep up. As a result, e-mail users still find themselves inundated with spam. Challenge/response is the only method for blocking spam that truly works.

When someone sends an e-mail to a person who's using a challenge/response system like SpamArrest, they're greeted with a message (the "challenge") which asks them to complete a task, such as going to a website and typing in a set of characters graphically represented on their computer screen. Successfully completing this task (the "response") adds their e-mail address to the recipient's authorized contact list, and from then on, all their e-mails are allowed through to the recipient with no further challenges. This method requires a human to be at the sending end of the e-mail -- and as a result, blocks 100 percent of all auto-generated junk mail.

Note To Critics: It's Worth That Little Inconvenience!
The challenge/response system has its critics, with some complaining that the burden of keeping a customer's e-mail inbox spam-free is then placed on real e-mail senders. It's also been said that it makes mailing lists a hassle, and that two challenge/response messages could bounce back and forth in an eternal loop. But problems like these are simple enough to solve once the larger spam problem itself has been dealt with. For example, SpamArrest has functions that automatically authorize anyone a SpamArrest customer e-mails. Our system also allows clients to import their entire address books so that all known contacts are pre-approved before a challenge e-mail even needs to be sent.

Today, challenge/response systems may not be for everyone, but as a growing amount of spam continues to find its way into mailboxes, I believe that challenge/response systems will be at the forefront of spam solutions as the public does whatever it takes to eliminate junk e-mail, and, in the end, take back control of their time and their communications.

Brian Cartmell is the president and CEO of SpamArrest, which makes a well-known challenge/response spam prevention system.