Legitimate businesses fall foul of anti-spam blacklists

Companies claim their e-mails are being stopped unfairly but those responsible accuse them of blatant spamming, says Rhymer Rigby

A few weeks ago Alex Proud, owner of London's Proud Galleries, discovered he had a problem. Most of his e-mails were bouncing back, including staff messages and the photographic gallery's newsletters. He soon discovered the reason for this: the gallery's e-mail address had appeared on an anti-spam blacklist.

The list was run by Spamhaus, a UK-based organisation dedicated to stamping out spam. Along with organisations such as SpamCop, it keeps regularly updated "real-time black hole lists" of the unique internet protocol (IP) addresses of known spammers.

Such lists are used by businesses and internet service providers to filter their incoming e-mail. Not every company uses them, but the number is sufficient to create problems for those on the blacklist.

Proud contacted Spamhaus, assuming that removal from the list would be a simple matter. He was not, after all, sending out millions of e-mails for herbal Viagra or diet pills.

But it was not that easy. Spamhaus told him that some of his mailing list of about 20,000 was in fact unsolicited bulk e-mail or spam. Eventually he was taken off, but he had to promise to stop using his regular mailing list.

"It's outrageous," says Proud. "They are a quasi-legal entity and everyone is at their mercy."

Proud Galleries is not the only business to have fallen foul of anti-spammers. Postini, a California-based managed service provider, also found itself blacklisted. "It is a bit ironic," says Andrew Lochart, senior director of marketing, "as we are in the business of stopping spam. But, sadly, that is the way the real-time black hole list works. Sometimes all it takes is a single complaint."

Moreover, he adds: "real-time black hole lists are a flawed technology. The nature of spam is so dynamic that this manual approach is outdated. It smacks of being judge, jury and executioner."

Thomas Smith of Cloud Eight Internet, an e-mail stationery site, has similarly found his IP address in the blacklisters' bad books: "We regularly get people saying we haven't fulfilled our software orders and then we discover it is because their service providers are using blacklists that we've somehow been put on. We don't have a chance to object."

Steve Linford, founder of Spamhaus, sees matters differently. "We don't list anyone for making a little error: we list IPs that are blatantly spamming and they know it." Each of Spamhaus's listings, he continues, "contains the full evidence showing the spam. We do not list without evidence. If we did, we could be sued".

Spamhaus takes a zero tolerance stance. "We don't agree to close an eye to a 'little bit of spamming' because the company doing it thinks their spam is somehow different from the stereotypical Viagra, stock-hype or porn spam," says Linford, adding that spam is illegal in many jurisdictions, including the Republic in certain situations, and the regulations are enforced by the Data Protection Commissioner.

Indeed, anti-spam advocates note the minimum degree of authentication necessary for legitimate mail lists: the e-mail recipient must confirm that they are happy for their address to be included on the list by responding to an e-mail.

Yet although this definition of spam is clear, others say there is a big difference between an ordinary business sending out 10,000 newsletters to a less-than-perfect mailing list and the spam kings of Florida who flood our in-boxes with millions of junk mails. Indeed, according to Spamhaus itself, 200 known spammers are responsible for 80 per cent of spam - which makes up more than 80 per cent of total worldwide e-mail.

There are other nuances. Small businesses and individuals may share an e-mail server with a spammer. If the spammer is blacklisted then so is everyone else on the server; the only recourse is to get the service provider to dump the spammer or change to a dedicated IP. Yet for all this, it is difficult to see how Spamhaus can be anything other than absolute in its definition of spam.

It is an imperfect world, says Jonathan Zittrain, professor of internet governance and regulation at Oxford University. "In my experience, Spamhaus et al intend to go at primarily unambiguous spammers, such as those who sell Viagra, and the net's a better place for them," he says.

But, he explains, "there are trickier areas, such as organisations who believe that what they are sending out is what people actually want. This often happens with 'recommend a friend' type schemes".

"I think there is enough disdain for spammers," he continues, "that some types of collateral damage will remain acceptable and to some extent everyone pays the price for bad apples. But spam is so pernicious that most people don't care that blacklists may be imperfect."