Simply put, spam is Internet "junk mail", only with a twist -- the cost of it is ultimately borne by the receiver instead of the sender. Spam has become the generic term applied to unsolicited bulk mailings using the Internet (especially email) as the broadcast mechanism. Most spam is commercial advertising, although chain letters, political messages, and other forms of non-commercial mailings are often included under the same umbrella. Spam used to be composed mostly of get-rich-quick schemes, ads for products of dubious quality or services of questionable legality, and pornographic come-ons. More recently it appears that many mainstream direct marketers have gotten involved. Some of what appears to be spam (it is certainly unsolicited) might actually be sent by computer viruses.

For the spammer, flooding the Internet with this trash costs practically nothing. That is what makes this "marketing" avenue so appealing. Spam is an Internet-wide phenomenon, and the amount of spam being transmitted over the 'net has been growing at a truly alarming rate.

Your email address is probably on a mailing list used by the spammer, although this is not a certainty {some mailers use automatically generated lists of possible addresses, attaching various combinations of names or even random characters to known host addresses). How might your address have ended up on such a list? There are many different ways for this to happen. You may have provided your address once for some seemingly legitimate purpose. You may have posted something to a discussion list once. If your address exists on a web page somewhere, it could have been picked off by a web-crawling robot program. Once your address is on one list, it is likely to end up on others. These lists are bought and sold frequently.

The administrators of the email system are doing all we can to block the flood of spam from reaching your mailbox, but this is a difficult, time-consuming, and somewhat complex task.

Consider that actually defining spam is not that simple. How is it possible for the mail server to know whether or not you purposely signed up for those stock tips, or that you are truly interested in receiving information about those wonder vitamins? Who do you trust to make decisions about what messages are legitimate?

When we as system administrators are made aware of unsolicited mailings being received, we can attempt certain steps to block them. This involves tedious work in tracing the original source of the mail and either blocking mail from that site or contacting the administrators and informing them of the abuse. Neither of these options are foolproof.

It is not possible to block all sites that produce spam, as some of them are also the source of legitimate email. Spammers can be clever and often take steps to hide the true source of the mail by routing it through legitimate domains. These Internet Service Providers often have misconfigured mail servers which allow this to happen. Sometimes the administrators are responsive to addressing the problems, and sometimes they are not. Spammers often sign up for free mail accounts through legitimate ISPs. By the time the ISP becomes aware of the spam activity, the spammer has abandoned that account and signed up for a different one.

However, the news is not all bad. The university's spam scanning system is an attempt to make the spam problem more manageable without blocking legitimate messages.

NO. The University does not provide lists of email addresses to any external parties. Your address may be available through the University directories, however. Student addresses are available through the web-based directory only for those who have given permission (see the UA email management service). Faculty and staff email addresses are available in both printed and web-based directories. This information is considered public knowledge, similar to an office phone number. In all cases, we will attempt to make it difficult for a web robot to automatically harvest the addresses.

NO. Your email address is exactly the same as it was before the conversion. It has not been published anywhere that would be more accessible to spammers. To the rest of the world, the UA mail system looks just the same as it always did. Spammers neither know nor care what kind of mail system we are using. The amount of spam on the Internet is increasing in general.

Sorry, but no. Your University email address is meant to be permanent during your time here. Changing email addresses in response to spam would be a quick but temporary fix. If everyone is permitted to change addresses at will, there will be mass confusion in the email system and University communications will suffer greatly as a result.

The system receives each message and tries to determine of it is spam. If it determines that it is probably spam, it puts this at the beginning of the message's "Subject" line:

{SPAM?} 

{SPAM!}

All incoming messages to @uakron.edu addresses arrive from off campus at what we call our mail gateway, which runs our mail scanning and routing software. For some time, the gateway has been scanning for (and blocking) viruses. Now it is also examining the content of each message and looking for indications that the message might be spam. It does this by using a variety of criteria to assign points to a message. The more points the message has, the more likely it is that the message is spam. The points are assigned for various things, including the stuff you see, like giving points for certain words or phrases that occur mostly in Spam and taking away points for words that mostly appear only in legitimate mail. It also uses things most users don't see, inluding where the message came from, and what kind of email program was used to send the message. The system puts all these criteria together to form a score for the message. As a starting point, we are marking messages with 7 or more points as {SPAM?} and 20 or more points as {SPAM!}.

It is not possible to determine, based on a single email message, whether that message is legitimate with 100% confidence. For example, the fact is that most spam messages are advertisements, and much of spam scanning consists of looking for messages that look like advertisements. However, marking everything that looks vaguely like an advertisement will also mark every message about a sale or special offer about which users have requested to be informed. We call this incorrect marking of a legitimate message a "false positive".

Any system that is sensitive enough to mark every single spam message will also end up with many, many false positives. Likewise, any system permissive enough to never mark a legitimate message will miss a great deal of spam. We've tried to strike a balance, keeping the number of false positives extremely low, while still trying to mark the vast majority of spam. In the pilot program for our spam scanning system, the vast majority of false positives were solicited advertisements. At the same time, recognizing that false positives will occur, we have elected not to block any messages, leaving the user the option of looking through every message and making his or her own determination.

We are continuing to tune this system to minimize false positives and maximize the percentage of spam that is marked. You can send us mislabeled messages at spam@uakron.edu for spam messages and notspam@uakron.edu for false positives. Please be aware that (unlike the automated scanning detailed above) a human being will be looking over messages that are sent to these addresses, and the messages will be archived for some period of time. They will not be made public, but you may not want to send messages of a highly sensitive or extremely personal nature.

Spam is a growing problem for just about everyone connected to the Internet. Consider writing your congressperson about it (seriously), in support of meaningful and well-considered legislation. Our lawmakers are certainly being lobbied hard by those who want to continue producing spam, but anti-spam legislative action is starting to pick up steam at both the state and national levels.

You may lessen the chance of ending up on some email address list by being careful about providing your email address. Be especially wary of those who ask permission to offer your address to related businesses or third parties who would like to send you information about their products. Once you are on a mailing list, there is no known way to get yourself removed. Mailings which offer an "unsubscribe" option cannot necessarily be trusted -- sometimes that option is just a ruse to determine which addresses are really valid.

It can actually be helpful to complain to the Internet Service Provider where the mail originated, providing you can determine where that is. This involves deciphering the information in the email headers, and then forwarding the mail (with headers included) to the abuse address at that ISP. The Internet-standard abuse address is abuse@domain_name, for example abuse@uakron.edu, abuse@yahoo.com, abuse@aol.com, etc.

In general terms, we recommend setting up what is called a 'filter' in your email program, also called an email client. A filter is a rule that you can set up that tells your email program what to di with certain types of messages. In this case, you would set up a rule telling your email program to move messages starting with '{SPAM?}' or '{SPAM!}' to a folder. We would recommend that you peruse the messages in this folder periodically to catch anything that is flagged incorrectly. You will probably find that messages flagged with '{SPAM!}' are never legitimate messages, and so you may want to change your filter to send these messages directly into your trash.
Specific instructions and examples of how to set up filters for several different email clients are available at the Software Training web pages:
Faculty and Staff Resources
Student Resources

You can report spam that the scanning system missed to spam@uakron.edu. False positives (legitimate messages mislabeled as spam) can be sent to notspam@uakron.edu.