CAN SPAM: techniques to filter out unwanted e-mail.

For some, spam is like ants at a picnic: uninvited, ubiquitous and annoying. For many others, whose uninvited e-mails flood their computer mailbox, it's an expensive headache. Try as you might, technology can't entirely eliminate spam. But stay with us and we'll share with you the best and easiest ways to filter most of it out of your mail.

How serious is spam? The Postini Resource Center says 10 out of 12 e-mails are spam and The Wall Street Journal estimates it costs business $8.9 billion a year for the software and labor to separate it from regular mail. But the Direct Marketing Association says there's a positive side to unsolicited e-mail. In a recent 12-month period, 45.8 million Americans (9% of all mail users) made a purchase in response to an e-mail ad, yielding $7.1 billion in sales.

Efforts to outlaw spam have failed mostly because it's hard to define. Microsoft says spam is "unsolicited commercial e-mail sent to advertise a product or a service," but merchants contend that most advertising--through the mail, magazines, radio or television--is unsolicited. Federal Trade Commissioner Orson Swindle has adapted the oft-used definition of pornography: "It's anything I don't like."

The technical name for spam is unwanted commercial e-mail. Using the name spare for junk e-mail comes from a Monty Python skit in which a song containing the word was repeated many times.

REDUCE THE CLUTTER

Although you can't totally beat the spammers, here are some defensive steps you can take to reduce the clutter:

STEP 1: Never reply to spam. This includes clicking any link from sources you don't recognize inviting you to unsubscribe.

STEP 2: Use "plus-addressing." You can obtain several addresses, each with a slight change, from any of several free e-mail services, including www.hotmail.com, www.juno.com and www.yahoo.com. So in addition to [e-mail], you can use rjones1@ sbc.net or [e-mail]. When registering online for content or services, use one of the plus-addresses--and keep your regular address private.

STEP 3: Use the spam filters provided by your e-mail software--Outlook, Eudora and Thunderbird, as well as antivirus software and firewalls. Or check whether your e-mail Internet service provider (ISP) is using spam-filtering techniques. If not, consider switching.

STEP 4: Consider not using the preview pane in your e-mail package. When you open a message in which that feature, showing the first few lines of each e-mail, is activated, it reports back to the spammer that your account is active and valid.

STEP 5: Do not include links to your e-mail address on your Web site.

STEP 6: Use antivirus protection and firewalls to protect your computer from being used by spammers.

STEP 7: When registering for information or content on the Web, uncheck boxes that invite mailings.

STEP 8: Don't forward chain letters, petitions or virus warnings from sources you don't trust. They're used by spammers to collect addresses.

MANAGEMENT STRATEGIES

The second line of defense is to attack spam at the organizational level by educating employees, establishing an e-mail address on which they can report spam to the IT department and installing software to minimize it. It's possible to block about 90% of spam at an acceptable level of errors.

One of the headaches caused by spam-fighting programs is false negatives that fail to block spare and false positives, where the software labels a legitimate e-mail as advertising. Manage false positives by using software that blocks suspect messages in a quarantined area while letting users set up lists of trusted sources.

Remember to test your antispam strategy and software prior to full implementation. You can create shadow e-mail accounts and try out your antispam program on them.

Some day spam may be a thing of the past. In the meantime, the only defense is constant vigilance, and the best it can achieve is keeping the annoyance under control.

Glossary of Spam Terminology

Black list: A list of domain names or IP addresses that are known to be spam senders.

Challenge/Response: A method used to validate that the sender of an e-mail is a legitimate source. For e-mails with unknown sender addresses, reply messages that contain some type of simple test to validate the sender are generated. Original senders then must respond in a positive manner to the challenge.

False negative: Messages that were delivered to the user, but should have been stopped by the filtering software.

False positive: Messages that are intercepted, but should have been allowed to pass into the mailbox.

HTML filtering: A filtering technique that reviews codes embedded in your e-mail to identify potential spam.

Spambot: Software that scans the Internet for e-mail addresses by looking for the standard @ symbol and format of e-mail addresses.

Spidering: The process of harvesting e-mail addresses from Web sites, chat rooms and other Web-based areas.

White list: A set of domain names or IP addresses that are known to be legitimate and trusted e-mail senders.

AICPA RESOURCES

Information Technology Center, http://infotech.aicpa.org.

Infobytes

Spam Control (# BYT-XXJA). For more information, go to www.cpa2biz.com or call the Institute at 888-777-7077.

DOUGLAS HAVELKA is an assistant professor of management information systems at Miami University in Oxford, Ohio. His e-mail address is [e-mail]. CATHERINE S. NEAL is an assistant professor of business ethics and business law at Northern Kentucky University in Highland Heights. Her e-mail address is [e-mail].