Empowering the victims: insurers are dealing with a daily deluge of spam, and technology is one tool to help ward off the growing mounds of unsolicited messages.

As the number of unsolicited commercial e-mails swells, insurers--along with everyone else--are getting caught in the flood. Approximately 10% of a working day is spent dealing with unsolicited e-mail, according to MessageLabs, which provides managed e-mail security services to global businesses. In an explosive growth spurt, spam has increased from one in 11 e-mails across all industry sectors in 2002 to one in six e-mails this year. Spam has become a significant--and annoying--problem for many companies, and insurers are no exception.

Technology to the Rescue

Nearly 40% to 45% of daily e-mails coming into Prudential Financial's servers are identified as spam, accounting for nearly 100,000 messages a day.

Newark, N.J.-based Prudential relies on several anti-spam filtering mechanisms and software to identify and ward off spam, its software analyzes messages' subject lines, attachments, text and keywords, said Mark LaChac, vice president, information systems. Prudential has identified several hundred keywords, and a combination of words, to block spam via keyword analysis.

Anti-spam software is expected to grow significantly over the next several years. In fact, the Radicati Group, a consulting and market research firm, predicts that this software will become a $2.4 billion industry by 2007. Spam filters work in a number of ways, including keyword searches; signature analysis, in which signatures are matched in messages; and Bayesian analysis, which is an algorithm that can be trained to automatically differentiate aggregate textual attributes of spam and non-spam messages. Some filters analyze volumes of messages for an Internet provider address to label suspected spam.

The Guardian Life Insurance Co. relies on a rules-based system to identify spam. Once an inbound message is tagged as suspected spam, it's stored for five days in case someone in the company is expecting the message. If someone is, it's removed from quarantine and delivered, said Dennis Callahan, executive vice president and chief information officer for the New York-based company. "Over time, we've built a list of items likely to be spam, automatically filtered them out, and built a list of items once detected as spam but subsequently identified as not being spam, so we don't screen them out." The Filters also look at attachments and viruses, and there are other mechanisms that are required by various Securities and Exchange Commission rules concerning records management, storage and maintenance, and the National Association of Securities Dealers conduct codes to make sure that outbound e-mails to clients conform to regulations, he added.

In June, Guardian identified about 1.1 million spam messages out of its 3 million inbound e-mails. Technology will continue to progress so that some of the subtle techniques to bypass tilters will be caught and filtered against, and spammers will become increasingly sophisticated as well, said Callahan. "We'll continue to see in these filtering technologies and spammers the same kind of leapfrog being played that we see between hackers and vendors of firewalls and virus protection, from a regulatory perspective. Given all we have to spend on technology to protect ourselves and comply with regulations, if we can come up with a rational one-size-fits-all policy rather than a patchwork quilt of state regulations, we will all be way ahead of the game," he said.

In addition to its filtering technology, Guardian recently implemented a process for employees to send suspected spam to a central mailbox. The messages are then reviewed daily by the information systems department, and the information gathered is used to make adjustments to its filters.

Anti-spam filters are also a welcome addition to Madison, Wis.-based Cuna Mutual Group's technology operations. The company, which stops between 10,000 and 15,000 messages a day as spam, accounting for about 30% of its overall inbound traffic, employs third-party black lists and keyword filtering to identify and block annoying and costly spam messages.

"The spam problem hasn't brought us to our knees, but it's certainly an interruption of service, at a minimum," said Perry Kempf, systems development integration manager for Cuna Mutual. While Kempf said that the company has made a big splash in warding off thousands of daily unsolicited messages, the company plans to continue tightening filters to halt an even greater amount of spam. "However, we're concerned that as we turn filters tighter, it will create more false-positives and other problems," be said.

False-Positives

False-positives are a growing problem across the spam arena. Because filters ward off suspected spam from keywords, lexicon searches--which apply content filtering to each message to identify suspected spam--or other methods, there is a chance that valid e-mails will be identified as spam and won't pass through filter walls. For example, as pointed out in an antispam article by Tumbleweed Communications Corp., most organizations would categorize an e-marl containing "XXX" as pornographic spam, but to insurers, "XXX" stands for the national credit rating agency and appears in the names of several state insurance regulations. Blocking e-mails that contain such information could mean that insurers won't receive legitimate, pertinent information they need.

"What's spam to one person is business mail to another," said Prudential's LaChac. To reduce the number of false-positives, Prudential reviews blocked messages to determine if the company is being too conservative or too restrictive in its blocking approach and then makes adjustments based on that information, he added. Prudential is moving away from using public blacklist--databases of known Internet addresses used by individuals or companies sending spam--that can sometimes block good e-mail with the bad. Prudential uses a customized blacklist instead.

While there's generally no fixed rate of false-positives in anti-spam filters, research indicates that most software today has a false-positive rate of between 1% and 10%, so a large portion of legitimate mail isn't getting caught in filters. Some companies beg to differ, however, saying that as much as 40% of their e-mails are false-positives.

Burdening Costs

Lost productivity, and handling and storage costs generated from spam are putting a strain on insurers' budgets.

In addition to employees' wading through never-ending mounds of messages, the time-consuming task of information technology departments' checking thousands of inbound e-mails has a hand in lost productivity. Ferris Research predicts that in lost productivity alone, spam costs corporations $874 per employee and, adding in IT costs, will drain a total of more than $10 billion from corporations this year.

"The money we're spending now to protect Guardian from spam and unwarranted and inappropriate e-mail can be used to improve products and services instead of going in the direction of protecting the company," said Nat Perlmutter, general agent with N.Y.-based Forest Hills Financial Group, a Guardian Life agency.

Companies are also faced with rising network and storage costs as a result of the spam situation. "We size our network in order to handle certain capacity, so if haft of what is coming through our network is spam, that means we have twice the network capacity to get what's necessary through the garbage," said Callahan.

Three-Legged Stool

Anti-spam software is growing in popularity, but will technology alone be enough to stop spam?

The answer to solving the spam problem lies with a three-legged stool approach--legislation, technology and standards, said Larry Donahue, chief operating officer for FatCow, which provides Web hosting services to individuals and small to midsized companies.

Insurers agree; however, many are skeptical that federal legislative remedies will significantly solve the problem, particularly because a large portion of spam coming into companies is sent from outside U.S. borders. "Technology is now about 80% effective in stopping spam," said Prudential's LaChac, adding that while federal legislation may temporarily help shut down some sites in the United States, spammers are and will continue to set up shops overseas. "My fear is long-term if we can't control this issue well enough, it will change the way we use e-mail for business, and that can be a big problem," he said.

Companies continue to educate employees and customers on ways they can protect against falling victim to spam. As an example, many insurers are cautioning employees against putting their e-mail addresses on Web sites, either in newsgroups or on other sites, which raises the likelihood of being spammed. Cuna Mutual is educating its customer base on such measures, in addition to advising online users not to opt out of spam mailings. "This inadvertently confirms to spammers that e-mail addresses are valid," said Kempf.

Inbox

Sender                Subject

Cindy                 adv: Newest Edition ow Online!
Small                 Re: hi njkhuayhuloh
O'Donnell             Re: Your Subscriptio
mcdonal               mortgage rates are s ding
Justin                adv: The Best Lende List
sandy8802             adv: Debt Options
Howard                Excel Charts
ashleyxxx             XXX Live!!!
Tech Support          Re: #166729
Carpenter             For Your Review
Fred                  Meet people in your area
tammi492              adv: Insurance News
Harris                Re: Text for Report
marie3review          P Diddy or Metallica'
XYZinsurance          adv: Best Auto Rates
Yun Chang             Fwd: Joke of the day
Runsford              IT pricing
Jones                 Company Policy
Chris Pritchard       adv: Top 500 Job Market
Greg                  Cheap cable box converters
johnstoj              Re: commissions xaghsyxsahg
Hunter                Meeting Scheduled for 2pm Today

Sender            Date/Time          Size

Cindy             10/1/03  8:01am    1,200
Small             10/01/03 8:08am    4,457
O'Donnell         10/01/03 8:09am    2,399
mcdonal           10/01/03 8:10am    1,229
Justin            10/01/03 8:11am    1,345
sandy8802         10/01/03 8:17am    1,028
Howard            10/01/03 8:20am    4,567
ashleyxxx         10/01/03 8:22am    2,001
Tech Support      10/01/03 8:23am    2,145
Carpenter         10/01/03 8:24am   20,879
Fred              10/01/03 8:32am    1,340
tammi492          10/01/03 8:37am    1,420
Harris            10/01/03 8:40am    2,339
marie3review      10/01/03 8:41am    1,200
XYZinsurance      10/01/03 8:42am    2,457
Yun Chang         10/01/03 8:43am    2,399
Runsford          10/01/03 8:44am    1,229
Jones             10/01/03 8:45am    1,345
Chris Pritchard   10/01/03 9:00am    1,028
Greg              10/01/03 9:05am    1,567
johnstoj          10/01/03 9:13am    2,001
Hunter            10/01/03 9:18am    2,145
                                    61,720

52 Unread Messages