28.02.2005 / Eugene Spafford, Purdue University:

Some experts including Bill Gates believe that spam can be eradicated in a couple of years. What are your thoughts?





Spafford: I think it can be reduced with some effort, but I do not see how it can be eliminated without also eliminating e-mail, or radically changing the way we run the Internet. Spam is, in part, subjective – what is spam to one person may be a great idea to another. Thus, there will always be some people who actually want some of it!





The biggest problem with spam right now is that the spammers refuse to abide by some procedure that will let users opt out of getting it. The fraud used in sending spam – both deceptive titles and hijack of machines – compounds the problem. If we can cut down on the fraudulent use of servers, and impose some really strong authentication on the advertisements that remain, then perhaps we can control spam ... but it is doubtful we will be able to eliminate it completely in only a few years.




This problem is so large and complex, it was named as one of the CRA Grand Challenges. Those four challenges are:




* Eliminate epidemic-style attacks – worms, viruses, spam, phishing and denial of service attacks.




* Discover how to design and build large-scale, distributed computing systems that must be highly reliable even in the face of probable attack. Examples include medical health records, law enforcement databases, and financial system computing.


* Develop quantitative cyber risk measurement techniques to a point at least the equal of current quantitative financial risk measurement techniques. This will allow us to compare security solutions, measure risk appropriately, and invest the right amounts into protection of our cyber assets.




* Develop mechanisms to allow computing users to set their own levels of data protection and privacy in understandable, repeatable, and reliable manners. Thus, we want each person to be able to interact with systems in a way that allows them to choose how much information to entrust to the systems, and at what level to protect it.

Those interfaces should be understandable and simple to use.