What Is The Real Cost of Spam? 316
securitas writes "The NY Times has a nice feature about the diverging estimates of the costs of spam (Google). The estimates vary widely from $10 billion to $87 billion per year for American workers, and even more for global costs. Critics say that research firms' estimates vastly overstate the actual cost of spam. Public institutions like Indiana University have to be sensitive to the First Amendment rights of the spammers. And at companies like Nortel Networks, security architect Chris Lewis says that the real economic burden is the 10 to 15 percent - 5,000 to 10,000 messages a day - of the spam that still gets through, which costs the company about $1 in lost productivity per message. The costs can be much higher if a top executive is upset or mad about spam. "If someone in senior management gets spammed," Mr. Lewis said, "it could take 20 or 30 hours of everyone's time, up and down the chain." A chart of the per user amount of spam and the time spent processing it, as well as the varying estimates of the per user cost of spam are included in the article."
My own thoughts (Score:5, Interesting)
Is this real money? (Score:5, Interesting)
I can certainly see how spam costs real money in terms of bandwidth and all, but I'm wondering whether they actually did some research or just guessed.
84 seconds per spam?! (Score:5, Interesting)
And the person quoted about the cost of setting up spam filters and following up on incorrect filtering seems to ignore the fact that the effort for this person to do this is spread across all the users... thousands of them (or tens or hundreds of thousands, in this case).
Marc
Re:84 seconds per spam?! (Score:1, Interesting)
I use POPFile to filter spam/real. Then I quickly check over my spam bucket to make sure I have no false positives, then I Select All and Delete. Takes about 5 minutes (4:45 for downloading the messages, and 15 seconds to skim the folder and delete my spam)
The real issue is not now, but tomorrow (Score:5, Interesting)
The volume of spam is increasing exponentially. It will reach a point when it will start choking up Email entirely.
At that point it's too late.
Proletariat of the world, unite to kill spammers. Remember to shoot knees first, so that they can't run away while you slowly torture them to death
This is an issue. (Score:5, Interesting)
Sift through hundreds, sometimes thousands of messages a day searching for legitimate technical support issues
Only accept email from addresses belonging to customers on file.
This has had a detrimental effect, and we often do get calls from customers saying their emails never got through and that they need to know which of their email addresses is on the account because they don't remember. This is inconvenient, and these measures may have led to the loss of a few customers for us. This isn't terrible, however, compared to spending hours a day sifting through spam, which would probably cost us more than the customers we lost.
This is still unacceptable.
Is spam even effective? (Score:5, Interesting)
I wonder about the effectivity of Spam because I just chuck it all. I can't remember a single time I clicked on a spam email. Nobody I know gets any spam that's worthwhile in any regard.
I just read James Cramer's bio and he talks about how TheStreet.com did a bulk mailing that they paid $500,000 for it. End result? 5 subscribers. $100,000 per subscriber. That's a terrible conversion rate for junk mail. Now I know that was junk mail, not spam email, but I simply can't imagine the rates being all that much better for Spam.
I'd say one way to fight spam is have a "do not spam" registry ... like what's being done with telemarketers.
That's an oversimplication. (Score:3, Interesting)
Clearly total cost of Spam is much higher than, say, a nice serving of fish.
First Amendment rights my ass (Score:5, Interesting)
Secretaries used to do this (Score:4, Interesting)
But yes, execs do sometimes need handholding. Years ago, while I was still doing sysadmin, the head of one of the neighboring departments would ask me for help when his Mac wouldn't print. Hey, I was a Unix guy, not a Mac guy, though if they'd gotten me a Mac I'd have been quite happy - but 95% of the time it was a matter of rebooting the network printer frob a couple of times and it'd work....
Re:Where the dollars are... (Score:2, Interesting)
And before you say "never give out your e-mail" there are Sales and Support people that really don't have a choice.
Not to mention those public e-mail addresses on websites... "support@mycompany.com" that are just absolutely drowned with spam.
SpamAssassin/MimeDefang are a nice cost-effective combination though, and have so far proven to be quite effective.
Personnel Time costs vs. bandwidth (Score:3, Interesting)
That's also true for ISPs - web traffic carries a lot more bits than spam, and while spam email probably outnumbers real email by byte-count as well as message count, it's not really a big deal for connectivity-provider ISPs. (Email-specialist ISPs are obviously another case entirely.) On the other hand, the worker-time cost of handling spam complaints and trying to keep filters up to date is more important than the cost of the bits.
Almost all email programs let you display the sender and subject without opening the message. 90% of the time it's pretty easy to tell just from reading those whether to delete it without opening - filters can often trash many of those messages automatically, but they can also speed up the decision time by marking suspicious messages.
Re:PHB Gets Spammed (Score:2, Interesting)
E. Djiekstra, for example, had his secretary print out email, to which he would write out a reply in long hand, which would then be typed back in.
Ted Turner stated in an interview a few months ago that his secretary deals with all his email, and he never touches it.
I know Lotus Notes allows you to allow others access to read/send email on your behalf. High level management have personal attendants to do shit like delete spam.
Re:Senior management, ugh (Score:5, Interesting)
We need to move beyond email. If executive management is using email to do actual business then it needs to grow up. Messages need electronic signatures than can be examined and verified before a message is accessed. Getting a worthy signature needs to cost a bit of money. That's all it would take to kill spam. If you want to get a message to me I require that you pony up and get yourself a signature, otherwise, forget it. Send messages to people who like dysfunctional communication mechanisms.
My Rough Estimate (Score:4, Interesting)
Average user at work receives ~ 10 spam messages per day, with our spam filters catching 80%, so the user receives 2 per day.
I figure you can classify spam messages into 3 types which require varying amount of effort to determine when to delete them.
First, you have obvious spam that can be deleted by reading the subject. I figure that 25% that get though spam filters are this type. Let's say they require 5 seconds to read/delete.
Second type requires the user opening the message and reading the contents. Let's say 70% are this type and require 15 seconds.
The last type are the ones that confuse users or they think they are legit. These are the messages that users will reply to, talk to their coworkers about, or forward to IS to be verified. This would be the remaining 5% and require 5 minutes (300 seconds) of time.
With those numbers, the users spend 27 seconds per message or 54 seconds per day.
Per year, that is 5.475 hours. If the average cost of a user (pay + benefits) is $30/hour then the annual cost for spam per user is $164.25/year or $0.225/spam.
Now, we are running spam software in this situation. Figure that the spam software cost $10/user/year in licensing, and an additional $10/user/year in hardware or administrative costs. I'm also assuming that the spam load on our mail servers is minimal enough that the costs involved there are insignificant.
That puts the total now at $184.25/year. However, without antispam software, that total would sky rocket to $821.25/year since the user would have to deal with 5x the spam. Of course, this may be high since there will probably a larger percentage of those 5-seconds-to-delete messages.
About the only interesting thing about these BS numbers is that the lower one ($184) is close to Ferris Research's estimate of $168/year; while the higher number ($821) is close to Nucleus Research's $874/year.
Laws Won't Help (Score:2, Interesting)
Sensitive to First Amendment rights? BS! (Score:5, Interesting)
What kind of BS is that? No they do not.
IU and other public institutions are NOT lawmakers, nor are they free public resources. Now if individual students are doing the spamming, there may be some complexities to deal with, especially if other students are the targets of the spam. But public schools are not a resource that anyone may just freely use.
If the school does make certain facilities open for public use, then they do have to do so fairly. That means, for example, if a facility like a stadium is used for a convention by members of the public (and usually these are done on a basis of school use has first priority, student use second priority, and public use last and usually paid), then spammers would probably have to be given equal access as members of the public. So you might see a spammer's convention meeting there.
The real issues are:
Does Kinkos have a right to post signs anywhere on school property to advertise their copying services to students? No! They must follow specific rules. There might be places designated for signs to be posted. The school newspaper might be advertising supported and Kinkos could buy ad space there. The school might even sell naming rights to the gymnasium to Kinkos (if they want to buy that). But there exists no free right for anyone, not even students or faculty, to come and commandeer any resource they wish for their own purposes.
Certainly this rules out students spamming the internet, and I would argue it also gives no one in the public any particular right to communicate with a student on the school's network, even if the student grants that permission by signing up for advertising. The school owns the property and it is generally well considered to not be public use property. The school is definitely not preventing people from using their own personal property/resources when that school restricts the ways the school's property/resources are used to be limited to what the mission of the school is.
It might be a whole different matter if a government entity were setting up a network, such as an open WiFi node, for anyone in the public to make use of. That is not what public institutions of higher learning do.
Re:First amendment righats? OXDUNG. (Score:3, Interesting)
No, I think it is. But it's a difference of opinion, and I respect that other people might not find ads to be as utterly abhorrent as I do. I don't understand that position, but it's valid enough.
Anyway, this is besides the point.
Spam, on the other hand, is theft. I pay for my server space. I pay for my bandwidth. ***I*** pay for the spammers to semd me there shite, which is why spam is wrong.
And how do you _not_ pay for your telephone, mailbox, or the property leading up to your front door? You pay for people to call you, mail you, or personally solicit you, or at least are harmed by it, probably about as much as you're harmed by spam.
Barring YOU explicitly getting them to stop, those things are allowed. Spam isn't fundementally different.
Who bears the costs is irrelevant, provided that they're costs ordinarily borne in society and you're not trying to avoid such costs meaningfully. Speech doesn't hinge on such silly things as cost bearing.
Re:PHB Gets Spammed (Score:3, Interesting)
If I could track down the responsible party I would send a very professional yet very nasty message.
I knew it was pointless, but I felt a little better afterward.
*sigh* those were the days...
First amendment does not apply (Score:2, Interesting)
In an ideal world, spammers could be sued for theft of services, or could be forced to subsidize the connectivity costs of the recipient. I wouldn't mind spam so much if each piece I received deposited $0.25 or so into my paypal account. I'd still filter it, but at least I'd be paid for my troubles.
Marketers are free to put up web sites, and even pay to advertise on other sites, but they don't have a right to blast everyone on the net with random garbage.
The First Amendment guarantees each American Freedom of expression. It does not guarantee that anyone has to listen to you.
Price sounds about right (Score:3, Interesting)
"There's no way spam costs $1/message"
"It doesn't take me that long to hit the delete key."
[sarcasm]What an amazing, informative analysis[/sarcasm]
First off, they're probably figuring their cost as their take home pay. This is much too low.
Say I was to make around $25/hr. That says nothing about all the other hidden costs/tradeoffs going on. I could be making that much, but the corp. I work for could be billing for my time at a rate of $1000/day. If they have a substantial backlog of contracts, they basically are loosing out on that much money if I don't work for a day.
Now lets do some math. $1000/8hours = 125 dollars / hour * 1 hour / 60 min = $2.08 / minute
Say it takes me 15 seconds to open up outlook, see the message, realize it's spam, delete it, and go back to what I was doing. That's $.52 right there.
Then you have to add in other costs.
How much did/does it cost to store that email? How much did it cost to download it (including the gifs)? How much of your IT staff's time is devoted to reducing spam, upgrading mailservers, deleting old mail, backing up mail, etc? Is that email you just got from Hamza Kalu just spam, or an event that should be reported to corporate security? (Some businesses do have to worry about fraud/industrial espionage via forged email.) How much time did you spend thinking about that? Five seconds? Ten?
Is the spam clever enough to fool other, less tech savvy people? (I once recieved a fake email from BestBuy.com's fraud dept, the would be pretty convincing to someone who doesn't know much about conputers.) How much time do you spend warning them?
Spam is costing businesses a significant amout of money. It may cost less for some and more for others, but it seems some people have no idea how quickly the dollar signs add up when you're running a business. I know I have a tough time wrapping my brain around it.
As a tech at an ISP... (Score:4, Interesting)
It doesn't end there, either. From what users are saying, it seems like spammers trade their mailing lists which cause users to recieve increasing amounts of spam. Some users complain that it takes too long to download the spam. I kindly remind them that not only does our mail server have to download the mail but also transmit the mail to them.
Figure you are on a bit of mailing lists, and you receive 500K of spam per day (some messages are html with images). The ISP has to use 1000k (say a megabyte) for that user. Multiply that by 4,000 users, and you have 4 GB of data transfer. Think of it as a T1 simultaneously using maximum up and down bandwidth for almost THREE HOURS.
That is not even mentioning the users who get on a billion mailing lists and never check their mail/delete their messages. Say (a conservative figure) 50 users got 500K of spam per day. That's almost 750 MB/month. 9 gigs of hard drive gone in the name of unread spam in a year. It all adds up folks.
Screw the Do-Not-Call list, I would rather have had a Do-Not-Email list _first_. When an occasional telemarketer calls my home or my workplace, there is a ~30 second distraction. End of story. Nothing like a day of 20 minute phone calls walking users through setting up spam filters and explaining to them why they get so much spam. Although my job is a part-time one, I figure around $150 in labor is paid by both parties per day (the ISP and customers) to set up a *workaround* (which sometimes isn't enough for high-volume victims of spam).