Spam and Beyond: An Information-Economic Analysis of Unwanted Commercial Messages

Abstract

The phenomenon of unwanted commercial messages (UCM), including e-mail spam and emerging forms that target other Internet communications facilities, is analyzed from an information-economics perspective. UCM traffic pays off for its senders when it is noticed and consumed by Internet users; the industry is, therefore, dependent on a common-pool resource that is accessed through an information asset. An analytical model of the industry is derived and solved computationally, and two dimensions of information quality held by the senders of UCM traffic are manipulated in the model. It is shown that such manipulations can moderate over time both the number of UCM campaigns undertaken and the amount of Internet bandwidth consumed by UCM. Manipulations of the information-quality dimensions affected by e-mail filtering reduce the amount of traffic that penetrates an Internet user's attention space but increase the amount of Internet bandwidth consumed. This is consistent with data reported by e-mail security providers as filters have been deployed. It is also shown that both public and private entities have adopted policies and practices with unintentional informational side effects. These effects may have led to more rather than less, spam e-mail traffic. It is concluded that the lessons learned from the case of e-mail spam can be applied to the development of policies and practices for mitigating newer, emerging forms of UCM, including versions targeting instant-messaging systems and Web logs.

Keywords:

• common-pool resources
• economic models
• Internet communications
• simulations
• spam
• tragedy of the commons

Notes

¹Because the Internet is a decentralized network of networks that cannot be monitored from any one location, there is considerable variation in the reported data. For example, one source states that of the roughly 31 billion daily e-mails sent globally about 12.4 billion (41%) are spam [1]. Another source suggests an even higher proportion, stating that spam made up over 60% of all e-mails sent during the first six months of 2004 [2]. Still other reports held that the spam's share of total e-mail rose from between 67% and 78% at the beginning of 2004 to between 75% and 88% at the end of the year [3]. Recent reports hold that the percentage of e-mail that consists of spam was still above 65% at the end of 2005 [4].

²It has been reported that the number of spam messages doubled and the data volume of spam tripled during the calendar year 2006. Many spam messages now use image-based payloads, which have a data volume about ten times that of a text-based message [5].

³A summary of statistics from recent reports includes statements that businesses spent $653M on spam filters in 2003 and that 50% of IT managers in a survey reported anti-spam efforts as their number-one priority. Ferris Research has estimated that the price to organizations worldwide is about $50 billion per year [9]. The FTC has concluded that these efforts have reduced the amount of spam reaching the average user's inbox [10], but some industry sources question those findings [4].

⁴As we will observe later, the marginal cost of sending spam is low, but not zero. We do not argue that UCM marketers would avoid targeting if they had salient information to use; only that the low cost of originating UCM traffic induces them to send it to recipients whom they know little or nothing about.

⁵The content of legitimate e-mail and IM traffic is usually private or proprietary, and ISPs and corporate IS departments are reluctant to make it available to researchers. Other sales-related industries, such as real-estate brokerage, advertising, and retailing are comparatively transparent. For instance, secondary data can be accessed by NAICS code from sources such as the U.S. Bureau of Economic Analysis for each of them, but there is no NAICS code for the UCM or spam industries.

⁶A survey of e-mail users uncovered considerable disagreement about what constitutes UCM traffic. Being unwanted is a necessary, but not sufficient, condition [29].

⁷This point has been recognized in the literature. For example, the attention-bond mechanism [22] assumes some recipients will release a bond deposited by senders of commercial messages; and a two-channel mechanism [30] assumes the willingness of some Internet users to voluntarily request to receive commercial e-mail.

⁸Owners of target addresses often take measures to keep them private [29]. If completely successful, they will not receive UCM traffic. We exclude any addresses from the population of interest, because they are not relevant to the UCM phenomenon.

⁹As examples, a phony e-mail address may be posted online and be harvested for use; or, an e-mail inbox's owner may stop using the inbox. In the latter case, an EMT that once was valid becomes invalid. Another example is a filter upgrade that makes a once-valid EMT invalid, because the message-content parameters no longer ensure that a message will get past filters.

¹⁰For example, a spam e-mail message that attempts to get the recipient to reveal bank-account information may have a high potential payoff, but when too many of these are being sent recipients learn to ignore them. Thus, when only a few operators are active, these high-value messages may work, but as more campaigns are sent operators will have to resort to other, less lucrative schemes, such as promoting herbal supplements. (The authors wish to thank an anonymous reviewer for contributing this example.) The s-curve shape of the average-payoff curves in Figure 2 reflects the fact that the payoff from any message must be finite (by Assumption 6). We have normalized the maximum possible payoff to 1 to conveniently scale the graph.

¹¹Here we are focusing just on cost. We realize that a main motivation for these activities is not to save money, but to hide the UCM operator's identity. We also know that responsible ISPs will not knowingly provide accounts to UCM operators, so operators sometimes pay underground providers inflated fees for access [33].

¹²More formally, because of low barriers to entry the UCM industry is competitive, and individual operators are price takers (i.e., each perceives that per-campaign revenue is not affected by the number of campaigns conducted). Following the textbook analysis of equilibrium in a competitive industry [34], equilibrium revenue per unit of output (i.e., per campaign) then equals average total cost, and economic profits are absent.

¹³A survey of e-mail users reported percentages who have reacted to large amounts of spam by obtaining obscure e-mail addresses that are resistant to dictionary attacks (14%); obtaining separate addresses to use in situations that might lead to spam (23%); and obtaining addresses that they then avoid giving out at all (73%) [29].

¹⁴When the authors did a Google query using the phrase “email mass verification software,” the first results page had links to descriptions of seven such programs for sale or download.

¹⁵A study by IDC estimates worldwide spending on anti-spam packages will increase from $300 million in 2003 to $1.7 billion in 2008 [37].

¹⁶It is also possible that the information side effects discussed would interact beneficially with enforcement efforts, as there would be fewer UCM campaigns and each would use a larger exploit list. Enforcement officers could thus concentrate their efforts on a smaller number of targets, and each target would have a larger exposure on the Internet. Future research by the authors may address this aspect of the UCM problem.