The Taming of the Internet

http://www.businessweek.com/magazine/content/03_50/b3862091_mz063.htm

DECEMBER 15, 2003<= /span>

INFORMATION TECHNOLOGY

The Taming Of The Internet =

A deluge of spam is forcing new rules and controls on the once wide-open Web

Paul Prentice was under siege. All through last winter and spring, the mana= ger of security and directory services at Steelcase Inc. was frantically fighting = the rising tide of spam pouring into the Grand Rapids (Mich.) office-furniture company. At the same time, he was fielding a flood of angry e-mail from executives and workers. They all begged him to get spam under control. Like many of his colleagues throughout the corporate world, Prentice hired a spam-filtering company, in his case, Postini Inc., to stem the flow.

Spam is down to a trickle in Grand Rapids these days. But what began as a campaign against junk mail has evolved into a company-wide revamp of Intern= et communications. The filtering system that scrutinizes each piece of mail, Prentice quickly saw, can handle lots of other jobs. Now he's broadening its mandate. The system is searching mail for competitive leaks, ferreting out inappropriate attachments such as MP3 files or porn, and even keeping an ey= e on personal correspondence. In short, the company is asserting much more contr= ol over employees' use of the Net. "People have already been notified that our e-mail is monitored," Prentice says.

The scourge of spam, which clogs the Internet with some 15 billion e-mail messages a day, is provoking powerful responses. It's pushing companies and individuals alike to install new tools and adopt norms for online behavior. These responses are turning cyberspace into a place with tougher rules, thi= cker walls, and new laws. On Nov. 25, Congress leaped into action as the Senate passed sweeping anti-spam legislation that awaits President George W. Bush's signature. While many predict that the law will leave most spammers unscath= ed, it marks a large and ambitious step to regulate the Internet and e-commerce= .

WAKE-UP CALL

3D"0350_78inftec.gif" These new laws and barricades are shaping a new stage= in the short history of the Net. While in its infancy, the Internet was marked= by its soaring potential, this new era is defined by limits and defenses. The = last year alone has provided a sobering wake-up call. Not only has spam quadrupl= ed but the spammers' technology and methods also have been adopted by virus writers, grifters, and thieves. Now they can deliver their poison to hundre= ds of millions of inboxes. Brightmail, a leading spam-blocking company, estima= tes that fully 13% of the spams circulating are not just advertisements, but sc= ams. Web giants from Amazon.com to eBay Inc. are seeing spammers swipe their identities, sowing distrust among shoppers in the $3.9 trillion global e-commerce market. The result, says Aviel Rubin, director of Information Security Institute at Johns Hopkins University: "We're going to change= the way we use the Internet."

Say good-bye to the unruly Internet of old. It's heading straight to obedie= nce school, safety classes -- you name it. This is the taming of the Net. Where traditional Internet communications are unfettered, open, and chaotic, look= for the next generation to be far more regulated, orderly, and closed. Mailings from work, friends, and e-tailers will plop down into separate mailboxes, a= nd many of these addresses will be closely held secrets. Already, 70% of people online avoid giving out their e-mail addresses, according to a recent surve= y by the Pew Research Center.

END OF LETHARGY

For this next stage of the Net, security is quickly becoming the new growth industry. Companies that can of= fer safe and foolproof connections stand to rise to the top. "It's the key differentiator," says Ted Leonsis, vice-chairman of America Online. AOL and Microsoft Corp. are pouring research into state-of-the-art spam filters= and child-protection guards. And financiers in Silicon Valley are stirring from their post-crash lethargy to bankroll a veritable rush of startups, each of them intent on developing the perfect fortress for customers. Sales of anti-spam software alone are expected to reach $653 million in 2003 and to double in two years, according to Radicati Group Inc., a researcher in Palo Alto, Calif. "I'd estimate that there are 1,000 businesses selling anti-spam software," says Felix Lin, CEO of Qurb Inc., a spam-fighting= startup in San Mateo, Calif. About a dozen, say venture capitalists, have lined up venture funding.

Only a few of those companies are likely to land with a splash. But those t= hat do will be contributing to a cyberworld bristling with class and privilege = -- a place where insiders trade information in trusted circles while outsiders m= ust fill in passwords and submit to iris scans. "It's a bifurcation between who you know and who you don't know," says Kevin Doerr, who heads Microsoft's 20-person spam-fighting team. The changes are akin to defenses = in the physical world. With each e-mail address that's hidden, each filter installed to block intruders, the Internet's homesteader heritage fades. It= 's fast becoming a place with doors that lock, ringing alarms, and thousands o= f neighborhood-watch programs.

In fact, the whole bedrock of the cyber-terrain is shifting. It no longer matters if an online offering is cool, fun, useful, and easy-to-use if it's= not secure. This has grave implications for the Internet. Think of the crucial technologies just taking shape, the powerful peer-to-peer networks linking researchers and music fans, the new wireless links circling the globe, and = the massive grids hitching together the computer systems of hundreds of compani= es. Each of these visions is built upon unhindered communication coursing betwe= en hundreds or millions of users -- each one of them a security risk. Experts = say that new systems must now be engineered with the assumption that everyone i= s a possible hacker or thief. "If you can't trust your neighbor, a lot of = the Internet's promise goes up in smoke," says Neil Iscoe, former manager = of advanced technology at tech-services giant Electronic Data Systems Inc. and= now director of technology commercialization at the University of Texas.

Growing distrust also spells trouble for startups. In a world teeming with = spam and viruses, such companies' outgoing e-mail is likely to be filtered, zapp= ed, or ignored. And while a handful of companies will succeed in building trust= ed brands, unknowns face suspicion. Consider the case of Compu-Net Enterprises= , an Internet service provider (ISP) in Paris, Tenn. When spammers appropriated,= or "spoofed," the company's address earli= er this year and started firing off millions of e-mails under its domain name,= the big Internet companies blocked mail coming from Compu-Net. Innocent custome= rs briefly saw their communications paralyzed. No one dares block all the mail from giant rivals such as AOL or EarthLink. "The mom-and-pop businesses get ignored," says Bill Larson, Compu-Net's network administrator.

Businesses, large and small, are rethinking how they market on the Net to c= ope with the gathering storm of spam. Most have given up on mass e-mailings aft= er getting lumped in with gambling solicitations and Viagra offers. Instead, l= ook for them to gain entry to e-mailboxes by lavishing the public with coupons = and freebies. US Airways Group Inc. (UAIR ), for example, g= ives 1,000 frequent-flier miles to passengers who sign up for the company's promotional e-mail messages. "Our big retail clients are planning sweepstakes and promotions to build their [e-mail] lists," says Chris Henger, senior vice-president for sales and marketing at Performics, a Web consulting company in Chicago. "It separates them from the spam."=

In the new, tamer Net, defense is the rallying call. And it can turn traditional Net communication on its head. Consider one of the most popular anti-spam techniques. The so-called white list accepts e-mail only from a l= ist of approved contacts. The downside? An effective= white list shuts the doors on the vast population online -- a big part of the Internet's magic -- and limits contact to a cloistered group. Pavni Diwanji, CEO of MailFrontier, a Palo Alto spam-blocking software company, predicts t= hat the Internet population will congregate into zillions of small, gated communities. Trusted members, she says, "will be able to walk in witho= ut even ringing the door." Others will line up outside while a digital gu= ard sifts through their documents.

EarthLink Inc., (ELNK ) the No. 3 Internet service provider in the U.S., is already building this future. Its "challenge-response" system blocks every mailing that comes from outside the user's white list. It sends a form back to the sender with a simple question to answer, or even a word to type. Human senders can handle this -- the spammers' automated computers cannot. Once the Earthlink system receives a satisfactory response, it lets the mail through. This met= hod effectively blocks most of the spam. But like all other defenses, it comes = at a cost. If the sender steps away from the computer, the message is delayed. Important automatic mailings from eBay or Expedia Inc. (IACI ) can hang in lim= bo. The possibility of such glitches saps confidence in e-mail. Indeed, 30% of e-mailers fret that spam filters block key messages, according to the Pew survey.

How else to sidestep the deluge? By creating alternate identities. Some 12% of AOL subscribers, according to a company surv= ey, have established a separate e-mail account for e-commerce. The idea? Web surfers' interactions in the hurly-burly online marketplace generate a lot of spam. A second, dedicated e-address leaves the personal i= nbox cleaner -- but makes it harder for legitimate e-businesses to connect with customers.

In time, say analysts, many Web surfers will run a full stable of identitie= s -- some cosseted, others fast and loose. This means= one address for work, another for friends, one for e-commerce, and perhaps a hi= dden box for porn or gambling. Many of these accounts will be throwaways: When t= hey draw too much spam, they're discarded.

THE NEW MATH

The focus on defense, though, spells the demise of e-= mail as a tool for stirring up new business. In the early years of e-mail, unsolicited mails yielded responses topping 10%, say consultants. It was a crucial tool for startups.

Now it's hell. Last summer, Elizabeth McCarthy, vice-president for marketin= g at Brava LLC in Coconut Grove, Fla., planned to send out e-mail pitching the company's enhancement bras. She was confident she could set Brava apart from the countless miracle pills and sexual come-ons. She spent June designing a serious, informative online brochure. And in July, she launched a trial campaign of 3D"0350_78inftec_a.gif" 20,000 mailings. The response: one solitary e-mail. A frustrated McCarthy concluded that her mailing got lost, zapped, or filtere= d. She pulled the plug on the campaign. "Spam killed our test," she says.

In truth, McCarthy hadn't adjusted to the new math that spammers have broug= ht to e-mail. Sending out 20,000 ads was the cyber equivalent of knocking on t= wo or three doors. For spammers, one in 20,000 is cause for rip-roaring celebration. That comes to 5 per 100,000, 50 per million. A spammer working that ratio could send out 10 million e-mails in a few hours and, theoretica= lly, harvest 500 responses within days -- a veritable gold mine. Alan Ralsky, a spammer in the Detroit suburb of West Bloomfield, Mich. -- and one of the r= are ones to speak publicly -- says that sheer volume of messages pays off. "Even a blind squirrel," he says, "can find a nut."

Spammers looking for a quicker payoff are retooling their spam-spewing machinery for theft. With each month, the spoofs appearing to come from eBa= y, Citibank, and others are becoming slicker -- and endangering confidence in e-commerce. Last spring, the early spoofs encouraged customers to enter the= ir bank data on crude copies of company sites. They were full of misspellings and b= ad grammar and were topped by Web addresses unrelated to the company. These da= ys, the fake sites are nearly perfect. They come complete with privacy logos established by the industry -- supposedly to ensure security. Worse, the sp= am thieves are using authentic company Web sites. They simply gather data by serving up their own forms, which appear to pop up from the company site.
CLANDESTINE

These spamming thieves hop over borders with a click = of the mouse. Secure Science Corp., a security startup in Los Angeles, has tracked= a recent flurry of scams targeting eBay and Citibank customers. They involve computers in Delaware and Russia that stay up only for a couple of hours so that authorities don't have time to track them down. But they gather plenty= of bank data. And, according to the FBI, they sell the credit-card numbers at clandestine Web sites for $1 apiece. "These sites move constantly,&quo= t; says Bill Murray, spokesman for the FBI's cybercrime division. "They'r= e up for a day, and they move."

Even if they're not pushing scams, many spammers are busily adapting to all= the filters and obstacles that corporations and consumers put in their path. Ra= lsky says he has three Lithuanian computer whizzes who devise ways to break thro= ugh filters. And with the spam revenue pouring in, many of the biggest operatio= ns are beefing up their computer assets and using them to bombard the defenses. Ralsky, for one, says business is booming.

High-powered spammer programs, say experts, sidestep filters by customizing each of the tens of millions of messages they send. This can confuse filter= s, which are often programmed to look for certain word combinations. Spammers = also unleash torrents of e-mails at anti-spam companies and consumer groups, hop= ing to cripple their servers with so-called denial-of-service attacks. Two grou= ps that organized "block lists" to sideline spam, Compu-Net and Infi= nite Monkeys & Co., both withdrew from the battle last summer after suffering withering spam attacks. "The spammers are winning the war to control t= he inboxes," says Compu-Net's Larson.

Equally menacing, spammers have extended the battlefield to the entire Internet. As recently as two years ago, ISPs could block most spam by targe= ting the domains that were generating it. But in the past year, spammers have released viruses which turn computers around the world into mail-serving zombies. Instead of a handful of domains, the spam can come from just about anywhere. The SoBig worm launched in August, say industry experts, represen= ted an escalation of the battle. It harnessed the contact lists of its victims = and sent millions of spams to all their friends and families. "They're dismantling the defenses," says Karl Jacob, CEO of Cloudmark, a San Francisco spam-blocking company.

This is leading companies such as AT&T (T ) to create premium ser= vices. The idea? To encrypt mail and provide companies = with guaranteed delivery -- a cyber answer to FedEx Corp. (FDX ) "Today's Int= ernet is coach class," says Hossein Eslambolchi, chief technology officer at AT&T. "What we're building is first class and business class." AT&T expects to start selling a service next year 3D"0350_78inftec_b.gif" that will let corporations pay a subscription fee to = make sure their e-mail winds its way past security and gets safely to the intend= ed recipients.

Betrayal. That's what pioneering computer scient= ists feel when they see what has happened to the Internet. They built a miraculo= us system with a foundation of trust, and it's being overrun by scoundrels. "It's a downgrading of the Net and its culture," says David Farber, professor of computer science at Carnegie Mellon University. "And I don't see any gangbuster alternative. That's what bothers me."

Already, scientists are working on new, improved Internet standards to make communications on the network more secure. But by the time they settle on n= ew protocols -- late this decade at the earliest -- the rest of the world prob= ably will already have improvised a secure Internet for these troubled times.

It sounds like grim work, focusing on fences and digital locks instead of f= un and games. But if tech companies develop a host of safe and secure spam-free systems, they will bolster the Internet's position as a pillar of the global economy. Security is the missing link. If it takes the spammers and virus-pushers to ignite an effective response -- who would have guessed it? -- that clutter of obscene ad= s may yet prove to be good for something.

By Stephen Baker in New York