Anti-Spam Program Raises Backfire Fears

NEW YORK (AP) -- It's being promoted as a surefire way to eliminate unsolicited E-mail: Force senders to prove they are human rather than one of those automated programs that inundate the Internet with spam.

Known as challenge-response, the technology obliges a sender to verify their authenticity before their electronic messages can be accepted.

But the technique has consequences far beyond stymieing spam-spitting software robots, and some leading anti-spam activists fear it could backfire and render E-mail useless if widely adopted.

EarthLink introduced challenge-response last week to its 5 million subscribers, which means legitimate senders of E-mail could now face many more hoops to get their messages delivered.

While the technique is not entirely new, usage has been limited to the thousands. But EarthLink expects half its customers will turn on the free service by year's end and other Internet providers are weighing a similar offering.

"It's sufficiently tempting that people will use it and will not realize all the bad things that will begin happening," said Steve Atkins, an anti-spam consultant in Redwood City, Calif. "Challenge-response is very, very unfriendly and rude to legitimate senders of E-mail."

It typically works like this: When a recipient gets E-mail from an unknown sender, software automatically returns a message--a challenge--requiring the sender to perform a task such as filling out a form. Presumably, spammers won't bother.

Supporters liken the technique to knocking on a door and asking permission for entry.

Recipients may pre-approve senders--the equivalent of giving them a set of keys so they won't have to knock every time. But if recipients forget, E-mail discussion lists and the people who run them could get bombarded with challenges. Some lists have thousands of subscribers.

Worse, some of those messages could get broadcast to all of a list's recipients, some of whom might send back additional challenges, creating an endless and annoying "mail loop." (Early attempts to design automated "out-of-office" messages suffered similar problems).

In light of EarthLink's announcement and the prospect of millions more users sending challenges, many list administrators already have vowed to ignore them, effectively barring recipients who employ the technique.

"They can get pretty overwhelming is a nice polite way of putting it," said David Farber, a former Federal Communications Commission chief technologist who runs a 25,000-member list on technology.

Though Farber is sympathetic to the war on spam--up to half his inbox is junk--he considers challenge-based techniques too simplistic.

EarthLink's spam filter blocks up to 80 percent of spam. But spam has increased sixfold over the past 18 months.

The company decided to offer its customers the challenge-response option because cranking up spam filtering would only cause more legitimate mailings to get tossed by mistake, said Jim Anderson, vice president of product development.

"It's as close to a silver bullet as you're going to get," Anderson said. "We're simply providing a tool for customers to retake control of the inbox from spammers."

Others deem challenge-response a knee-jerk reaction.

"I'm worried people are going to implement systems like that too quickly because they are so desperate," said Eric Thomas, chief executive of L-Soft International Inc., a Swedish company that makes the popular Listserv mailing list software. "The cure might be worse than the ailment."

America Online now blocks up to 80 percent of incoming E-mail traffic, or more than 2 billion messages a day.

But company spokesman Nicholas Graham says AOL won't adopt challenge-response because having to send out 2 billion challenges a day would tax the system. And why create delays for subscribers?

"They don't want to hear 'You got mail and you just have to wait a few minutes longer,'" Graham said. "They expect to get E-mail quickly and responses quickly."

Anderson said EarthLink has developed the system over several months to minimize the burden on users and list administrators.

Standards call for messages from mailing lists to come with a priority code marked "list" or "bulk." EarthLink's software wouldn't challenge such messages. But because spammers can easily incorporate such coding, such messages would be sorted to a "suspect mail" folder.

The pre-approved sender scheme also difficulties because it doesn't work well with Yahoo Groups and other services where multiple list members post.

Online receipts from Amazon.com and other E-commerce sites also create problems; because they are automated, they won't respond to challenges.

Robert Craddock, chief executive of challenge-response developer DirectPop.net, said that although the system requires legitimate senders to do more work, "I don't think that's a lot to ask in this day and age when everybody's E-mail box is getting inundated."

Some spam experts question whether such techniques will even work. They believe spammers will figure out how to automate responses to challenges--and also learn to make messages appear to come from pre-approved senders--or are themselves "challenges," said John Levine, a board member of the Coalition Against Unsolicited Commercial E-Mail.

"It's very easy to come up with things that look like a solution," Levine said. "Lots of people say this will solve everything, spam won't be a problem anymore. Of course, they said the same things about a variety of previous techniques."