Death By Email Blog

Software Sales Drop Due to the Price of Gasoline

2008-06-25T20:26:44-04:00

Today, InBoxer may have become the first software company to lose a sale due to the price of gasoline.
Software and gasoline? I admit to our investors that I had never figured that $4 per gallon gas would impact software sales so directly. After all, we don't ship software in a big truck.

But, InBoxer is one of the leading suppliers of email archiving to schools. Our customers range from small districts to large metropolitan areas, such as Little Rock, Arkansas, Montgomery, Alabama, and Duluth, Minnesota.

A school district today told me that almost all of their IT budget was being diverted to gasoline. It would seem that the district's budget is fixed for the year. So, to supply gasoline to school buses, the money needs to come from someplace. Today, it came from an InBoxer Anti-Risk Appliance.

I don't know if it is the first software license sale lost due to gas prices. But, I never heard of another one.

Farewell, George Carlin

2008-06-23T21:28:00-04:00

Comedian George Carlin died Sunday at the age of 71. He is a comic legend who added many hours of joy to my life. But, he also provided lots of material that I used to promote the InBoxer Anti-Risk Appliance. I have often said that InBoxer can find offensive email using technology that goes far beyond finding "George Carlin's “Seven Words You Can Never Say on Television.”

In his honor, as a thank you, and as a farewell, I would like to share with you his great comedy routine:

(Play recording)

I love words. I thank you for hearing my words.
I want to tell you something about words that I think is important.
They're my work, they're my play, they're my passion.
Words are all we have, really. We have thoughts but thoughts are fluid.
then we assign a word to a thought and we're stuck with that word for
that thought, so be careful with words. I like to think that the same
words that hurt can heal, it is a matter of how you pick them.
There are some people that are not into all the words.
There are some that would have you not use certain words.
There are 400,000 words in the English language and there are 7
of them you can't say on television. What a ratio that is.
399,993 to 7. They must really be bad. They'd have to be outrageous
to be seperated from a group that large. All of you over here,you 7,
Bad Words. That's what they told us they were, remember?
"That's a bad word!" No bad words, bad thoughts, bad intentions,
and words. You know the 7, don't you, that you can't say on television?
"Shit, Piss, Fuck, Cunt, CockSucker, MotherFucker, and Tits"
Those are the heavy seven. Those are the ones that'll infect your soul,
curve your spine, and keep the country from winning the war.
"Shit, Piss, Fuck, Cunt, CockSucker, MotherFucker, and Tits"
Wow! ...and Tits doesn't even belong on the list. That is such a friendly
sounding word. It sounds like a nickname, right? "Hey, Tits, come here,
man. Hey Tits, meet Toots. Toots, Tits. Tits, Toots." It sounds like a
snack, doesn't it? Yes, I know, it is a snack. I don't mean your sexist
snack. I mean New Nabisco Tits!, and new Cheese Tits, Corn Tits,
Pizza Tits, Sesame Tits, Onion Tits, Tater Tits. "Betcha Can't Eat Just
One." That's true. I usually switch off. But I mean, that word does
not belong on the list. Actually none of the words belong on the list,
but you can understand why some of them are there. I'm not
completely insensetive to people's feelings. I can understand why
some of those words got on the list, like CockSucker and
MotherFucker. Those are heavyweight words. There is a lot going on
there. Besides the literal translation and the emotional feeling.
I mean, they're just busy words. There's a lot of syllables to contend
with. And those Ks, those are agressive sounds. They just jump out at
you like "coCKsuCKer, motherfuCKer. coCKsuCKer, motherfuCKer."
It's like an assualt on you. We mentioned Shit earlier, and 2 of the
other 4-letter Anglo-Saxon words are Piss and Cunt, which go
together of course. A little accedental humor there. The reason that
Piss and Cunt are on the list is because a long time ago, there were
certain ladies that said "Those are the 2 I am not going to say. I
don't mind Fuck and Shit but 'P' and 'C' are out.", which led to such
stupid sentences as "Okay you fuckers, I'm going to tinckle now."
And, of course, the word Fuck. I don't really, well that's more
accedental humor, I don't wanna get into that now because I think
it takes to long. But I do mean that. I think the word Fuck is a very
imprortant word. It is the beginning of life, yet it is a word we use to
hurt one another quite often. People much wiser than I am said,
"I'd rather have my son watch a film with 2 people making love
than 2 people trying to kill one another. I, of course, can agree. It is
a great sentence. I wish I knew who said it first. I agree with that but
I like to take it a step further. I'd like to substitute the word Fuck for
the word Kill in all of those movie cliches we grew up with. "Okay,
Sherrif, we're gonna Fuck you now, but we're gonna Fuck you slow."
So maybe next year I'll have a whole fuckin' ramp on the N word.
I hope so. Those are the 7 you can never say on television, under any
circumstanses. You just cannot say them ever ever ever. Not even
clinically. You cannot weave them in on the panel with Doc, and Ed,
and Johnny. I mean, it is just impossible. Forget tHose 7. They're out.
But there are some 2-way words, those double-meaning words.
Remember the ones you giggled at in sixth grade? "...And the cock
CROWED 3 times" "Hey, tha cock CROWED 3 times. ha ha ha ha. Hey, it's in
the bible. ha ha ha ha. There are some 2-way words, like it is okay for
Kirk Youdi to say "Roberto Clametti has 2 balls on him.", but he can't
say "I think he hurt his balls on that play, Tony. Don't you? He's holding
them. He must've hurt them, by God." and the other 2-way word that
goes with that one is Prik. It's okay if it happens to your finger. You
can prik your finger but don't finger your prik. No,no.

(Source: Lyrics Box)

Does Hosted Email Archiving and E-discovery Violate the 4th Amendment?

2008-06-20T07:53:00-04:00

Prior to Wednesday, if somebody asked me whether companies could legally get copies of email sent from business accounts hosted by Google and others, I would have said "absolutely." I would have said, "if the company provides the email device and contracts with the email service, then the content belongs to the company." I am confident that with Google's acquisition of Postini and lots of start-ups like Fortiva and Sonian, this logic was widespread.

But, in what could be a major Fourth Amendment ruling on Wednesday, the Ninth U.S. Circuit Court of Appeals in San Francisco unanimously ruled in favor of a police officer and others who claimed that the city of Ontario, Calif., violated their Fourth Amendment rights by reading the contents of their text messages, which had been held by a hosted carrier, Arch Wireless. (Complete ruling)

Specifically, the unanimous decision stated:

"Do users of text messaging services such as those provided by Arch Wireless have a reasonable expectation of privacy in their text messages stored on the service provider’s network? We hold that they do."

"As with letters and e-mails, it is not reasonable to expect privacy in the information used to “address” a text message, such as the dialing of a phone number to send a message. However, users do have a reasonable expectation of privacy in the content of their text messages vis-a-vis the service provider." (Bold added.)

"Even if your employer pays for your use of third party text or email services, your boss can’t get copies of your messages from that provider without your permission. Wow.," said the Electronic Frontier Foundation. "The holding that text messages and email are protected by the Fourth Amendment is an immensely important one which gives the victims of unlawful searches the ability to suppress illegally obtained evidence. It protects the privacy of employees who use a messaging service paid for by their company."

I am not an attorney, but I believe that the scope of this ruling may have significant impact on the business models of many companies. Google is an email service provider, for example. Postini, which was acquired by Google, does handle email searches, in addition to other things. Can Postini continue its email search business without violating the Fourth Amendment? Put another way, can enterprises deploy Google and Postini while meeting their compliance and FRCP obligations, without violating the Fourth Amendment? What about companies like Fortiva and Sonian that provide hosted storage? Are they a service provider -- even if they do not transmit messages?

I am not an attorney and there are several interesting complexities to the case. For example, while the city paid for the communications devices and basic services, it only paid for the first 25,000 characters of the text messages. Any overage was paid by the employee. Does this mean that the payment of the overage proved that the organization knew that the system was being used for personal messages? What if the city purchased and paid for an unlimited messaging plan? Would the expectation of privacy have changed? (It would seem to me that most companies know that some personal messages are sent on their email system. Few with policies against that actually enforce them, which may create a de facto expectation.)

Enterprises that use outsourced email services need to be wary. We do know that the court ruling says nothing about enterprises that locally monitor and/or archive messages. But soon, once it is outsourced -- say to Google -- companies may no longer have access to their messages once they are in transit.

Bear Stearns Prosecution Focuses on Email

2008-06-19T10:01:00-04:00

Matthew Tannin of Bear Stearns may soon join such illustrious names as Henry Blodget of Merrill Lynch, Jack Grubman of Citigroup, and Frank Quattrone of Credit Suisse First Boston, as poster children for being caught by email. The latest entrant in the Death by Email Hall of Fame wrote in a personal email that they should close their fund just four days before telling fund managers that he was "quite comfortable" with their holdings. Here is the relevant email:

“[T]he subprime market looks pretty damn ugly . . .. If we believe [our internal modeling] is ANYWHERE CLOSE to accurate I think we should close the funds now. The reason for this is that if [our internal modeling] is correct then the entire subprime market is toast . . .. If AAA bonds are systematically downgraded then there is simply no way for us to make money - ever.” (Emphasis in original) -- Department of Justice Press Release

This email could be the "crucial document in the case," according to today's Wall Street Journal.

Spam King Ordered to Pay $6-million to MySpace

2008-06-17T07:03:00-04:00

Scott Richter of Westminster, Colorado, the reputed "Spam King", was ordered by arbitration yesterday to pay $6-million to MySpace, including $4.8 million in damages and $1.2 million in legal fees. Richter was once accused of pumping out more than 100 million spam messages per day.

Yankee Group Says Email Approaching Landline Use

2008-06-16T23:11:37-04:00

Roger Matus

White House Wins Email Secrecy Ruling

2008-06-16T15:02:19-04:00

U.S. District Judge Colleen Kollar-Kotelly ruled today that the White House Office of Administration does not have to turn over records about millions of so-called missing email messages. In the ruling, the judge said that the Office of Administration is not subject to the Freedom of Information Act.

Since its creation in 1978, the Office of Administration has responded to FOIA requests. But the Bush White House reversed that policy in August 2007, reports the Associated Press. This change, now ratified by the courts, means that secrecy can remain in tact. The possibly lost emails include the time when the U.S. went to war with Iraq.

"The Bush administration is using the legal system to prevent the American people from discovering the truth about the millions of missing White House e-mails," said Melanie Sloan, the executive director of the watchdog organization, Citizens for Responsibility and Ethics in Washington (CNN).

Fortunately, the White House legal issues regarding the lost emails are not over. Legal remains as to whether the White House violated record keeping laws.

Does Email Destroy Political Careers?

2008-06-12T07:23:00-04:00

I just read that Hollywood starlet Scarlett Johansson regularly communicates with Presidential candidate Barack Obama via email. She says that she offers advice and that he replies with specific, detailed replies.

"You'd imagine that someone like the senator who is constantly traveling and constantly 'on' - how can he return these personal emails?" she told the Politico website. "But he does..."

On the other hand, President George Bush claims that he has not written a single email message in eight years. He told a small group of friends just days before being sworn in, "Since I do not want my private conversations looked at by those out to embarrass, the only course of action is not to correspond in cyberspace." (Australian IT)

It is not that Bush is a technophobe. He is known to have regularly communicated by email while he was governor of Texas. And, he told reporters last week that he will sign-on once again after his term of office is over.

"I stayed in touch with all kinds of people around the country, firing off emails at all times of the day to stay in touch with my pals. There's no better way to communicate," Bush said.

So what will Obama do? Writing things down electronically is dangerous. Words can be taken out of context and spread rapidly. But, being disconnected from the generation that is used to email has its disadvantages too? Will he go to the other extreme and document everything. Can you imagine that he will Twitter "Going to meet the Joint Chiefs" or blog about his meeting with the Israeli prime minister? What would his Facebook friends look like? (What will his Facebook wall look like?)

Unfortunately, I am going to expect that he will disconnect. In one debate, the presidential candidates were asked to state the price of milk, eggs and bread at the local store. I guess you give up going to the local store when you become a national political figure. But, what happens in the next debate when you are asked how many LinkedIn connections you have?

Sweden May Approve Far Reaching Wiretap Bill

2008-06-09T07:15:00-04:00

Many of us think of Sweden as the home of super liberal thought and government policies. So, what could happen that would make Google's global privacy counsel say suggest that Sweden was in danger of embarking on a path usually reserved for dictatorial regimes?

"The proposal stems from a tradition begun by Saudi Arabia and China and simply has no place in a Western democracy."

The Swedish parliament seems close to passing a far reaching wiretap bill that will enable the government to read any email that goes in or out of Sweden. This week, the Swedish Parliamentary Committee on Defense approved the En anpassad försvarsunderrättelseverksamhet bill, which loosely translates to "a better adapted military intelligence gathering." A debate and vote by the entire Parliament is expected June 17th.

The bill gives Sweden's National Defence Radio Establishment (FRA) direct access to all electronic communications that passes through Sweden's border. Note that this includes any email, fax or VOIP call that happens to go through a server in Sweden -- even if the email was not sent or received by somebody in Sweden.

"Once intercepted, the data will be searched for certain keywords, and those that contain the words will be pulled aside for additional scrutiny. A broad array of organizations will have use of the system, including the Department of Transportation, the Department of Agriculture, the police, secret service and customs, and in some cases major businesses. The bill allows Swedes to be singled out, as well," states the Register.

Search engine giant Google slammed Sweden's proposed wiretapping legislation as illiberal and incompatible with Western democracy, according to The Local, Sweden's News in English.

"We have contacted Swedish authorities to give our view of the proposal and we have made it clear that we will never place any servers inside Sweden's borders if the proposal goes through," Google's global privacy counsel, Peter Fleische, said on a trip to Sweden last week.

Even though its still only a bill, it has already had repercussions. Last year TeliaSonera in Finland moved e-mail servers and 500,000 accounts from Sweden to Finland. The move was finalized in April this year, reported PC World.

Congress Investigates VA Email

2008-06-06T07:00:00-04:00

“Given that we are having more and more compensation-seeking veterans, I’d like to suggest you refrain from giving a diagnosis of PTSD (post-traumatic stress disorder) straight out,” reads the recently-surfaced, March 20th email from Norma J. Perez, the former PTSD coordinator at the Veterans Affairs hospital in Temple, Texas. Instead, she suggested that “adjustment disorder” was appropriate. This diagnosis saves money because it disqualifies veterans from receiving PTSD disability benefits.

PTSD is a serious problem and our veterans deserve the treatment and care that they have earned. But, this is a blog about email. And, here is an email that gets you to testify before the Senate Committee on Veterans Affairs and probably in front of the courts. Look at what her email launched:

The Senate Committee on Veterans Affairs started hearings yesterday to see if our country's obligations to veterans regarding PTSD is being met. The Committee called Ms. Perez to testify as to whether her email represented a personal opinion or official Bush Administration policy.
U.S. District Court Judge Samuel Conti may re-open a trial that ended last month ago because of the email. The lawsuit that alleges the VA inadequately addressed a "rising tide" of mental health problems, especially post-traumatic stress disorder and suicides. The judge said "the email raises potentially serious questions that may warrant further attention." He ordered lawyers for both sides to appear in court Tuesday to discuss whether the email has any bearing on the case. (AP)

In speeches and in this blog, I have warned people about what could happen if one of their emails got printed widely. Well, Ms. Perez was certainly caught by email. It got the attention of the courts and Congress. I am guessing that the President knows about it too.

Ms. Perez's email will cause her to answer questions under oath that will help to determine whether her email was a personal opinion or whether it was official Bush Administration policy. What a position to be put in.

36 Quick Checks Before Sending That Email

2008-06-05T21:34:30-04:00

Kudos to Seth Godin, a well known marketing writer and blogger, for today's fun and valuable blog entry, Email Checklist. The 36 item checklist reminds you of things to think about before sending an email. Here are a few to think about:

15. Am I blind-ccing my boss? If so, what will happen if the recipient finds out?
16. Is there anything in this email I don't want the attorney general, the media or my boss seeing? (If so, hit delete).
23. Have I attached any files that are very big? (If so, Google something like 'send big files' and consider your options.)

And, perhaps the most valuable:

36. If I had to pay 42 cents to send this email, would I?

(Thanks to Eric McCarthy for pointing out this post to me.)

Cop Out May Wipe Out Key Precedent

2008-06-04T15:31:21-04:00

A few days ago, this blog reported about a landmark case in which New Jersey State Superior Court Judge Innes determined that emails sent and received on a private email service by Governor Jon S. Corzine are indeed public records that are subject to the state's Freedom of Information Act. At the time, I stated that the ruling was likely to have wide impact nationally and would further open government (Emails In Private Accounts May Be Public).

In an cop-out of major proportions yesterday, Tom Wilson, the New Jersey state Republican Party chairman, said he'll dismiss his lawsuit seeking the emails if Corzine releases them and pays Wilson's $40,000 in legal costs. The impact is that dropping the case would avoid having the judge's Friday decision become legal precedent in disputes over executive privilege (AP) and the freedom of information.

A legal precedent, however, is exactly what we need. Otherwise, we will be going through these same issues again and again to ensure open government and real accountability.

Corzine may be ashamed of what he did. But, Tom Wilson has now proved that his quest was one for political gain and not for open government. I am not sure who to be more upset with.

Email Reports Birth of Angelina Jolie's Twins. Is It True?

2008-06-04T15:14:59-04:00

"Our story begins in the glittering offices of Entertainment Tonight, where a young researcher logged on to her email only to discover that the story of the year - nay, her entire career - had dropped into her inbox: Angelina Jolie had given birth. Oh we can almost hear the angels singing!," reports The Independent.

But, did she? Entertainment Tonight did not miss a heartbeat and quickly put the story on the air.

“A random individual has engaged in a scheme to intentionally harm my client and deceive her fans, the public and the media through illegal and tortuous impersonation of Ms. Jolie’s longtime assistant, Holly (Goline)," a warning letter from law firm, Lavely & Singer, sent to roughly two dozen news media outlets on Monday, reported today's New York Times.

But, did she? Entertainment Tonight refuses to retract their story.

"... this is where the going really gets good - one of the show's executives does, in fact, know Ms Goline. Before going on air, said exec emailed Ms Goline on her personal address for confirmation of the story... and Goline replied," reports the Independent. The person responded by BlackBerry, saying she had been in the room for the birth.

Why is this important? Angelina Jolie and her partner Brad Pitt sell newspapers. Entertainment Tonight saw a huge spike in web traffic when the article was reported. People magazine and OK! are are reportedly in a bidding war for first exclusive shot of the twins -- with current bid price at $15-million. And, it all began with an email.

The first photographs of the twins will undoubtedly sell for seven figures, and online reports say that the bidding war is already well under way. News about the newborns will also drive viewers and readers to entertainment television shows, Web sites and magazines (as it apparently has already)." (Times)

Emails In Private Accounts May Be Public

2008-05-30T17:40:00-04:00

In a major ruling today, New Jersey State Superior Court Judge Innes determined that emails sent and received on a private email service by Governor Jon S. Corzine are indeed public records that are subject to the state's Freedom of Information Act. This ruling, which is likely to have wide impact nationally, relates to emails that the Governor exchanged with Carla Katz, a state union leader he once dated are indeed public records.

The order reportedly required Gov. Corzine to release at least 745 documents within two weeks, though an exact date has not been set.

“The public has a right to know whether the relationship between the governor and Ms. Katz had any improper influence on the governor’s paramount obligation to serve the interest of the citizens of New Jersey first,” wrote Judge Innes.

Corzine is expected to ask the court to delay release of the emails while an appeal is pending. Corzine's general counsel, Ed McBride, said Corzine has nothing to hide but is fighting to retain executive privileges, according to the Associated Press.

This blog reported on the details of the Corzine email case last July (almost a year ago). If the emails had been logged by the State's archiving system, then it would likely have been clearer that the emails were public record. The question is whether the emails, which were sent using a private service, avoided the state law -- either intentionally or unintentionally.

"it was revealed that you maintain a private email server and that both you and your Chief of Staff have used that server since taking office January 2006. The existence of this non-government email server raises a number of questions as it relates to OPRA and the maintenance and the retention of records," New Jersey Republican State Committee Chairman Tom Wilson wrote to the Governor at the time (full text).

Although the decision is binding only on this one case in New Jersey, it will certainly become a precedent for use nationally. It is easy to see how this can establish case law that would extend access to private email accounts. Let me engage in some conjecture here:

Could the same argument be made to release all the emails in the Republican National Committee email server in regards to the firing of U.S. attorneys? Would Democrats get the chance to review what emails were and were not released?
What would have happened if the Governor's email was hosted by Google? Could a demand be made to the ISP to release the email?
Can this same logic be extended to business email? For example, a company was in litigation, could a request for relevant emails be extended from business accounts to all personal accounts, too?

My advice has always been to make sure that all of your personal communications use a personal email account. Now, you may also have to make sure that your personal email never mentions your business. What does that mean if you write something personal to a business contact? I am sure that we will find out.

(Thank you, Catherine Longwell, for alerting me to the news of the ruling.)

Email Paralyzes Juarez, Mexico

2008-05-27T06:50:00-04:00

At least 25 people -- including two police officers -- were found dead during the weekend in Juarez, Mexico -- a border town across from El Paso, Texas -- after an email warned "the bloodiest and most violent weekend in the history of Juarez," according to the El Paso Times.

The email told residents to stay in their homes, refrain from going to nightclubs and avoid major streets. The message, which spread on both sides of the border, stated that there would be shootings and execution-style killings throughout the city in what was being called 'la limpia,' or the cleansing in response to threats by the 'Juarez drug cartel' or 'La Linea,' . (La Linea is reputed to be a "line" of corrupt police officers protecting drug traffickers.)

The email warning practically shut down this city of 1.4-million people over the weekend. Shops, bars and restaurants have shut and soldiers are patrolling the streets, giving a surreal and dangerous tone, according to Agence France-Presse, a global news agency. The risk was so serious that the US embassy to Mexico has told US citizens that the message represented a "potential threat" and that public places should be avoided.

Juarez was already reeling from a surge in murders that has claimed around 400 lives so far this year, several of them police officers and members of rival narcotics gangs. More than 33 people were killed in the week before the Memorial Day weekend, compared with 25 slayings the previous week.

Dangerous Email

2008-05-24T11:59:19-04:00

While researching an email topic using Google, I stumbled across a web page entitled Dangerous Email that contains a collection of stories, goofs, and email mistakes from the late 1998 to 2001. Links go to the New York Times, BusinessWeek, and more. I am sure that I will find years of material for articles and presentations to come.

Here is an example of one of the links:

By the Water Cooler in Cyberspace, the Talk Turns Ugly
New York Times
This is an important article about the risks companies face from discussions around the electronic water coolers - electronic bulletin boards. More and more disgruntled employees are making their comments public by posting innuendo, personal attacks, sexual comments, and unfounded rumors on Web sites. You should be paying attention to this problem, if for no other reason than to see what some of your employees are saying when they think they're anonymous (they really aren't). You may also need to defend individual employees from attack and prepare for sexual harassment suits. In at least one case, a company has been sued for sexually harassing comments made on a bulletin board over which it had no control.

New Proofpoint Study Released

2008-05-23T12:11:00-04:00

The new Proofpoint study, Outbound Email and Data Loss Prevention in Today's Enterprise, 2008, is out. Each year, I have relied on the study for interesting insights into the marketplace. Here are some of the interesting findings from this year:

44% of surveyed companies reporting that they investigated an email leak of confidential information in the past 12 months.
41% of the largest companies surveyed (those with 20,000 or more employees) reported that they employ staff to read or otherwise analyze the contents of outbound email. 22% of these companies said they employ staff primarily or exclusively for this purpose.
26% of companies surveyed terminated an employee for violating email policies in the last 12 months.
23% of U.S. companies surveyed said their business was impacted by the exposure of sensitive or embarrassing information in the last 12 months.
34% of the largest companies (20,000 employees or more) reported that employee email was subpoenaed in the last 12 months.

Email is not the only source of risk for information leakage. Respondents to the survey indicated significant risk resulting from employee use of blogs, message boards and media sharing sites (such as YouTube), as well as mobile devices. Some of the key findings include:

27% of companies surveyed had investigated the exposure of confidential, sensitive or private information from lost or stolen mobile devices in the past 12 months.
11% of U.S. companies surveyed disciplined employees for improper use of blogs/message boards in the past 12 months.
13% of surveyed companies disciplined employees for social network violations and 14% for improper use of media sharing sites in the past 12 months.
14% of publicly traded companies surveyed had investigated the exposure of material financial information (such as unannounced financial results) on blogs or message board postings in the last 12 months.

6 Best Practices That Reduce Email Overload and Costs

2008-05-14T11:30:04-04:00

80% of all the problems caused in corporate email comes from just 1% of the users, according to a new white paper entitled "6 Best Practices That Reduce Email Overload and Costs" released today by Permessa Corporation. (I am one of the authors of the report.)

I was particularly interested in the section about the effect of email message size limits. Many enterprises place size quotas on messages to limit storage and bandwidth costs. A 10MB limit is common. But, based on 15 years of working with large enterprises, Permessa concludes that these limits are not effective. Messages over 10MB account for just 7.6% of the total volume, according to the study. Blocking them may yield minimal resource savings.

Yet, messages that are 1-5MB in size account for 59.6% of total email volume.

How can this be?

Permessa’s analysis of messages sent at large enterprises shows that the most significant burden comes when a medium sized message is sent to a list of recipients or bounces back and forth during a conversation involving multiple people. This volume can be caused by sending a normal file to a distribution list or a reply-to-all. Avoiding the problem can be accomplished easily just by using a team collaboration software tool, such as IBM Quickr or Microsoft Sharepoint.

On the other hand, blocking large files may cause business proplems. Large files are often sent to one person. For example, it may be a PowerPoint presentation to a customer from sales. Yet, these tend to be more urgent. If these large messages are blocked, a critical communication may be delayed. Therefore, the IT savings can have unwelcome business impact.

The whitepaper addresses topic areas to control email volume and cost, such as handling reply-to-all and managing distribution lists. Copies are available for free.

30th Anniversary of Unsolicited Bulk Messages

2008-05-01T00:01:00-04:00

This is it! Tomorrow is the 30th Anniversary of the first message that we have come to know as "Spam." The message sent on May 2, 1978 is attributed to Gary Thuerk, a marketer for the Digital Equipment Corporation. (DEC was my former employer.) It is amazing to think how much spam became part of our vocabulary in such a short period of time.

What was the message that gives Mr. Thuerk a place in history? Was it for some body part enlargement? Was it fund raising for Africa? Nope, 1978 was a simpler time. Here is the text of the very very very first spam message:

-------------------------------------------------------------------------

DIGITAL WILL BE GIVING A PRODUCT PRESENTATION OF THE NEWEST MEMBERS OF THE
DECSYSTEM-20 FAMILY; THE DECSYSTEM-2020, 2020T, 2060, AND 2060T. THE
DECSYSTEM-20 FAMILY OF COMPUTERS HAS EVOLVED FROM THE TENEX OPERATING SYSTEM AND THE DECSYSTEM-10 <PDP-10> COMPUTER ARCHITECTURE. BOTH THE DECSYSTEM-2060T AND 2020T OFFER FULL ARPANET SUPPORT UNDER THE TOPS-20 OPERATING SYSTEM. THE DECSYSTEM-2060 IS AN UPWARD EXTENSION OF THE CURRENT DECSYSTEM 2040 AND 2050 FAMILY. THE DECSYSTEM-2020 IS A NEW LOW END MEMBER OF THE DECSYSTEM-20 FAMILY AND FULLY SOFTWARE COMPATIBLE WITH ALL OF THE OTHER DECSYSTEM-20 MODELS.

WE INVITE YOU TO COME SEE THE 2020 AND HEAR ABOUT THE DECSYSTEM-20 FAMILY AT THE TWO PRODUCT PRESENTATIONS WE WILL BE GIVING IN CALIFORNIA THIS MONTH. THE LOCATIONS WILL BE:

            TUESDAY, MAY 9, 1978 - 2 PM
               HYATT HOUSE (NEAR THE L.A. AIRPORT)
               LOS ANGELES, CA

            THURSDAY, MAY 11, 1978 - 2 PM
               DUNFEY'S ROYAL COACH
               SAN MATEO, CA
               (4 MILES SOUTH OF S.F. AIRPORT AT BAYSHORE, RT 101 AND RT 92)

A 2020 WILL BE THERE FOR YOU TO VIEW. ALSO TERMINALS ON-LINE TO OTHER DECSYSTEM-20 SYSTEMS THROUGH THE ARPANET. IF YOU ARE UNABLE TO ATTEND, PLEASE FEEL FREE TO CONTACT THE NEAREST DEC OFFICE FOR MORE INFORMATION ABOUT THE EXCITING DECSYSTEM-20 FAMILY.

-------------------------------------------------------------------------

Even though the mail was simpler, the reaction was swift and strong. Here is one message recorded in Brad Tempelton's home page:

ON 2 MAY 78 DIGITAL EQUIPMENT CORPORATION (DEC) SENT OUT AN ARPANET MESSAGE ADVERTISING THEIR NEW COMPUTER SYSTEMS. THIS WAS A FLAGRANT VIOLATION OF THE USE OF ARPANET AS THE NETWORK IS TO BE USED FOR OFFICIAL U.S. GOVERNMENT BUSINESS ONLY. APPROPRIATE ACTION IS BEING TAKEN TO PRECLUDE ITS OCCURRENCE AGAIN.

IN ENFORCEMENT OF THIS POLICY DCA IS DEPENDENT ON THE ARPANET SPONSORS, AND HOST AND TIP LIAISONS. IT IS IMPERATIVE YOU INFORM YOUR USERS AND CONTRACTORS WHO ARE PROVIDED ARPANET ACCESS THE MEANING OF THIS POLICY.

THANK YOU FOR YOUR COOPERATION.

MAJOR RAYMOND CZAHOR

CHIEF, ARPANET MANAGEMENT BRANCH, DCA

-------------------------------------------------------------------------

A few years ago, Templeton had the chance to talk to Thuerk. Here is an excerpt:

"Thuerk thought, and maintains to this day that he didn't think he was doing anything wrong -- even though he gets a moderate amount of spam on his current E-mail account. He felt the Dec-20 was really relevant news to the Arpanet community, the first major system with Arpanet software built into it. Indeed, some of those who commented on the message felt it was definitely more of interest than other small mass mailings they had seen, with baby announcements and personal trivia."

I don't know the appropriate way to observe tomorrow's anniversary. Anyone with some ideas?

Data Mining Employee Email Contacts

2008-04-22T07:25:00-04:00

When you think about it, your contact list contains a tremendous amount of useful business information. If you need to find somebody at a certain company, don't you check both your contact list and your incoming emails for likely people to know?

What about doing this on an enterprise-wide scale? What if the company needed to find a contact at a large prospect? The Wall Street Journal reports....

Financial information giants Thomson Corp. and Dun & Bradstreet Corp. each recently bought small software companies that make products for this purpose. Thomson, of Toronto, bought Contact Networks Inc. in January, while D&B, of Short Hills, N.J., acquired Visible Path Inc., both for undisclosed terms. The software is supposed to help companies drum up business by allowing employees to make use of each others' contacts. For example, salespeople can pitch to a co-worker's contacts, while corporate recruiters could use the program to target employees' friends and acquaintances.

The products work by examining the contact lists on employees' email programs, as well as other information such as lawyers' billing records or contacts stored on special programs for managing customer relationships. Then it checks how often individuals email the contacts and whether they have appointments for face-to-face meetings or phone calls on their calendars. The software uses that information to determine how strong a relationship a person has with the contact. For example, individual emails that get replies rank higher than a blast email sent to many people.

Of course, this raises all sorts of privacy and account management concerns. What if that person you know at General Electric was your ex-spouse? And, how do you prevent somebody from calling that contact that asked you to leave them alone?

Still, it sounds like these issues can be resolved with clever software checks and balances. It would be a new way to get value from email.

Spear-Phishing in the Army

2008-04-14T12:57:00-04:00

On Friday, I wrote about a military test. 30% of those with military addresses fell victim to a phishing attack in a military-sponsored exercise named Bulwark Defender 08. Initially, I thought this was a story about phishing education. I did not realize that this was a tip to a story about espionage as dangerous as any Cold War movie thriller.

On Saturday, I found in my mailbox a huge Business Week cover story on "e-spionage" and attacks against the U.S. military using email. What makes these messages different is that they target a receiver with content that seems familiar to them. The attachments contain a sophisticated "digital intruder rendering traditional defenses—firewalls and updated antivirus software—virtually useless."

It is not your typical Nigerian email scam.

Spear-phishing is a narrowly focused form of phishing, according to Business Week. The spear-phishers "gather information about people's jobs and social networks, often from publicly available information and data stolen from other infected computers, and then trick them into opening an email." Often, the information used is commonly available from Google searches.

The article starts off describing an email addressed to a Booz Allen Hamilton executive:

The email message addressed to a Booz Allen Hamilton executive was mundane—a shopping list sent over by the Pentagon of weaponry India wanted to buy. But the missive turned out to be a brilliant fake. Lurking beneath the description of aircraft, engines, and radar equipment was an insidious piece of computer code known as "Poison Ivy" designed to suck sensitive data out of the $4 billion consulting firm's computer network. ...

Its authors knew enough about the "sender" and "recipient" to craft a message unlikely to arouse suspicion. Had the Booz Allen executive clicked on the attachment, his every keystroke would have been reported back to a mysterious master at the Internet address cybersyndrome.3322.org, which is registered through an obscure company headquartered on the banks of China's Yangtze River.

The U.S. government, and its sprawl of defense contractors, have been the victims of an unprecedented rash of similar cyber attacks over the last two years, say current and former U.S. government officials.

"It's espionage on a massive scale," says Paul B. Kurtz, a former high-ranking national security official. Government agencies reported 12,986 cyber security incidents to the U.S. Homeland Security Dept. last fiscal year, triple the number from two years earlier.

And later on, a more chilling discussion ....

By itself, the bid to steal digital secrets from Booz Allen might not be deeply troubling. But Poison Ivy is part of a new type of digital intruder rendering traditional defenses—firewalls and updated antivirus software—virtually useless. (emphasis added)

Sophisticated hackers, say Pentagon officials, are developing new ways to creep into computer networks sometimes before those vulnerabilities are known. "The offense has a big advantage over the defense right now," says Colonel Ward E. Heinke, director of the Air Force Network Operations Center at Barksdale Air Force Base.

Only 11 of the top 34 antivirus software programs identified Poison Ivy when it was first tested on behalf of BusinessWeek in February. Malware-sniffing software from several top security firms found "no virus" in the India fighter-jet e-mail, the analysis showed.

Over the past two years thousands of highly customized e-mails akin to Stephen Moree's have landed in the laptops and PCs of U.S. government workers and defense contracting executives. According to sources familiar with the matter, the attacks targeted sensitive information on the networks of at least seven agencies—the Defense, State, Energy, Commerce, Health & Human Services, Agriculture, and Treasury departments—and also defense contractors Boeing (BA), Lockheed Martin, General Electric (GE), Raytheon (RTW), and General Dynamics (GD), say current and former government network security experts. Laura Keehner, a spokeswoman for the Homeland Security Dept., which coordinates protection of government computers, declined to comment on specific intrusions. In written responses to questions from BusinessWeek, Keehner says: "We are aware of and have defended against malicious cyber activity directed at the U.S. Government over the past few years. We take these threats seriously and continue to remain concerned that this activity is growing more sophisticated, more targeted, and more prevalent." Spokesmen for Lockheed Martin, Boeing, Raytheon, General Dynamics, and General Electric declined to comment. Several cited policies of not discussing security-related matters.

How might they get us to open it?

Spear-phish tap into a cyber espionage tactic that security experts call "Net reconnaissance." In the attempted attack on Booz Allen, attackers had plenty of information about Moree: his full name, title (Northeast Asia Branch Chief), job responsibilities, and e-mail address. Net reconnaissance can be surprisingly simple, often starting with a Google (GOOG) search. (A lookup of the Air Force's Pentagon e-mail address on Apr. 9, for instance, retrieved 8,680 e-mail addresses for current or former Air Force personnel and departments.) The information is woven into a fake e-mail with a link to an infected Web site or containing an attached document. All attackers have to do is hit their send button. Once the e-mail is opened, intruders are automatically ushered inside the walled perimeter of computer networks—and malicious code such as Poison Ivy can take over.

Be careful what email you open.