January 27-February 2, 2005

loose canon

Most Unwanted

THE SPAM MASTER: Wong's weapon in the war against spam has political implications.

Can Meng Weng Wong eliminate spam forever? That depends on the government.

by Bruce Schimmel

Philadelphia's Meng Weng Wong recently achieved international recognition by building a better spam blaster. But for Wong's system to work, he says that the federal government will have to begin regulating Internet service providers (ISPs). Until now, ISPs have been left alone. To begin regulating them now, in this political climate, should give pause to us all.

Wong has reason, more than most, to hate spam. Every day, his company's servers in Chinatown are deluged with about a million e-mails, of which about 20 percent emerge as spam. Started in 1994, Wong's company, www.pobox.com, now grosses about a million dollars a year as an e-mail forwarding service for clients who want a permanent e-mail address.

At the moment, though, what Wong is running is a virtual cleaning service. While this might seem to be a good way for the 29-year-old Wong and his five employees to make a living, he's dissatisfied with the usual means of finding trash. Most anti-spam software now looks inside each message for suspicious content. It's slow, costly and increasingly fails to catch all the trash. It's a war, Wong says, that we're losing.

"Spamming has evolved into a kind of arms race," says Wong on the phone from Atlanta, Ga., where he is currently a visiting fellow at Earthlink. As spammers learn to disguise their content, inspections get tougher as servers strip-search each piece of incoming mail.

More costly still is the hidden cost of accidentally tossing away what's valuable, he says. "The real costs [of spam blocking] are the false positives, where you're throwing away something you really need." First Amendment advocates like the Electronic Freedom Foundation warn that servers that trash legitimate bulk mail messages can cripple virtual activist groups.

So Wong came up with another means of spotting spam — SPF. When Wong published this open-source protocol last year, several Internet service companies, including AOL and Earthlink, signed on. Even Microsoft, which was developing a competing Sender ID system, announced they'd be scrapping their own proprietary schemes and adopting Wong's plans.

His system matches an e-mail's origin information with the server that supposedly sent it. Wong analogizes the process with snail mail: "If I send you a letter, I put a stamp and a return address on the envelope. I drop it in the mailbox and the post office then stamps the same zip code of my return address on the envelope. If the post office's stamp matches the zip code on the envelope, that's good. But if that postmark comes from Nigeria," Wong's system could flag that message as potential spam.

To make SPF work, sending servers must make certain data available. In the United States, providing that data is now optional. Wong argues that "governments need to get involved. Rolling out a standards change really falls to the government. It's like getting people to wear seat belts. It will take government to fund, educate and recommend" these changes.

Swiftly becoming a standard, Wong's system continues to raise free speech and privacy issues. SPF matches e-mail envelope data to a particular server and could potentially reveal a user's real identity. Many activists fear that in time, ISPs could become agents of the police. And groups like the Electronic Freedom Foundation still fear that SPF could block political mass-mailings.

While it's clear that the Internet e-mail system is staggering under the weight of spam, it may still be wise to step back and examine all the political implications of building a better spam blaster — before it blows up in our faces.