What is the point of spam e-mail?

ACCORDING to internet folklore, the very first spam e-mail was sent in 1978, to around 400 recipients. The sender was given a ticking-off and told not to do it again. Alas for that golden age. These days, a torrent of poorly spelled e-mails promising to cure wrinkles, enlarge penises, banish fat or wire millions in unclaimed offshore wealth is the fate of almost everyone with an e-mail address. Other e-mails aim to harvest usernames and passwords or contain obfuscated links to malicious software designed to capture a user's computer. According to one estimate from SecureList, a cyber-security firm, roughly 60% of all e-mail is spam. But why? What is the point of the avalanche of spam?

In a word, money. Spam is the digital cousin of ordinary, paper-based junk mail. Firms send this out because they think it will drum up business. By reducing the cost of communication, the internet turbocharges that business model. Real-world junk mail might be profitable if only one recipient in a thousand decides she needs double-glazed windows or a greasy pizza. But sending an e-mail is far cheaper than sending a piece of paper. Consumer internet packages cost dozens of dollars, for data allowances measured in the hundreds of gigabytes. Spending that on e-mail would yield a cost of a tiny fraction of a dollar per message, plus a little surcharge for the electricity necessary to run the computer. (And bandwidth for consumers is relatively expensive; businesses or big users get bulk discounts). Even if only one user in a million is conned into buying some dubious pills, the revenues far outweigh the costs.

The relative anonymity offered by the internet also allows spammers to hide their identities, which allows more obviously criminal uses of e-mail. Phishing e-mails, which try to persuade users to enter sensitive details such as banking passwords into convincing-looking, but fake, websites, can be very profitable since the data they harvest can allow their controllers to loot bank accounts or go on buying sprees with stolen credit-card information. Malicious attachments can subvert a user’s machine, perhaps recruiting it into a “botnet”, a horde of compromised machines that can be used by attackers to knock websites offline. Others encrypt all the files on victims’ computer, then display instructions asking them to pay the senders if they want their files back. All this is made possible by giant lists of e-mail addresses that are bought, sold and swapped between spammers. Those, in turn, are generated from leaks, hacks, guesswork and addresses collected from users of shady websites and subsequently sold on.

Busts are not unheard of (a big Nigerian spammer believed to be behind thousands of online scams, earning more than $60m, was arrested in August 2016). But they are not common enough to put a meaningful dent in the business. Instead, computer firms such as Microsoft and Google have become locked in an arms race with the spammers. Spam filters began appearing in the 1990s, as the internet gained mainstream popularity. Spammers altered their tactics to work around them (this is why spam is full of deliberate misspellings such as “v1agr*”). For now, tech firms have the advantage: artificial intelligence filters can be trained to recognise the characteristics of spam messages and reroute them to spam folders. Training those filters requires them to have plenty of examples to practise on. With spam, at least, that is not a problem.

Today's explainer was suggested by Marjan Mashhadi and Mark Chamberlain. This is the third in a series of five. Other explainers in this series include: