"Employees are knowingly or unknowingly giving out their corporate email addresses to spammers," says Rick Romkey, general manager of U.S. operations at Integralis, Inc., a network security firm with American headquarters in East Hartford, Conn. "They're sitting at work registering for online services, signing up for mailing lists, trying to win a car off Yahoo.com or subscribing to the joke of the week. Sometimes end users aren't educated enough to stop giving their email out to everyone who asks...and sometimes it's purposeful, but they're inundating their network with noise.
"It hurts productivity in many ways," adds Romkey.
Spam is an escalating problem that affects ISPs and consumers, filling mail servers and mailboxes with junk mail ranging from enticements for pornographic Web sites to burn-fat and grow-hair scams.
|More On Spam In The Enterprise|
|Spam Tops Job-Related Email In Workplace Secure Your Network Against Viruses, Spam Can Spam Be Stopped? Wanted: A Leader in the Battle Against Spam|
And part of the problem, according to some, is that employees are doing more than their work with their Internet connections.
Extracurricular Activites Leave Email Trail
Seventy-eight percent of companies polled in a recent Computer Security Institute/FBI survey reported that they detected employee abuse of their Internet access privileges.
The misuse ranged from playing games in the office to downloading bandwidth-sucking movies or porn, gambling, trading stock, emailing sexually explicit or racist jokes and even sending out critical corporate information.
And that misuse is littering employees' email addresses all over the Internet, making them vulnerable to spammers who are always looking for fresh victims.
"With email and the Net, you can't check your common sense at the door," says Kelly Thompson, a privacy and responsible email activist and co-founder of Forum for Responsible and Ethical Email. "You have to think critically about the things you're signing up for, the things you're OKing when you're on a Web site...You wouldn't give your credit card number to anybody without at least knowing how it's going to be used, so you should take at least that much care with your email address."
But some anti-spam activists and industry analysts say pointing the finger at wayward employees is akin to blaming the victim.
"I'd advocate stronger Web filtering, but not blaming the user," says Chris Christiansen, an analyst at Framingham, Mass.-based IDC. "Nobody I know ever signed up for some of the incredibly offensive email that I get. Even the subject lines are incredibly offensive."
And Margie Arbon, manager of market and business development at Mail-Abuse Prevention Systems (MAPS), a spam-fighting organization, agrees that employees are not to blame for the heated spam problem.
"This is a really good case of shifting the blame for spam onto the end user," says Arbon. "I sign up for work-related things with my work email address...but that doesn't explain the quantity of stuff that we get here. That doesn't explain how a person may sign up for a legitimate list and end up on 50,000 other lists."
Arbon explains that a lot of spammers scrape Web sites, figure out how major companies set up their email addresses, and do dictionary runs against servers for user names. Most spammers, she says, aren't getting the millions of email addresses by legitimate means.
But Integralis' Romkey says employees can't be blamed for causing spam but they can be -- and often are -- part of the problem.
"Certainly, [employees] are not helping the situation," says Romkey. "We get the funny jokes and we look at them and we giggle. I'll forward it around. The important thing is that companies know this is happening and most of them are just sitting there taking it."
Steps To Limit Spam In Your Network
And all of the industry watchers say the last thing most companies should do is resign themselves to simply putting up with it. As Christiansen points out, these steps won't stop spam but they can help limit it. Here's what they generally agree can be done:
"Will this stop it all? No. But will it help? Yes," says Romkey. "You've got to be proactive about this and do as much as you can before it ever reaches the company. It's within our control to limit the amount of noise that makes its way back in."