Is the future of e-mail under cyberattack?

For years, consumers and corporations raved about e-mail’s potential.

Now they’re fretting about its future.

By Jon Swartz, USA TODAY

http://www.usatoday.com/tech/news/2004-06-14-email_x.htm

As a major e-mail conference convenes here this week, there is a growing belief that e-mail — the vaunted "killer app" — is in deep trouble. "It increasingly is broken," Silicon Valley venture capitalist Steve Jurvetson says. "Spam, fraud, phishing schemes, all this other stuff is more than an annoyance. The future of the medium is at stake."

E-mail is evolving into a hacking tool that threatens its usefulness for communications and commerce, security experts say. An avalanche of junk e-mail, scams to filch personal information and sophisticated computer viruses cost more than $15 billion in personal losses and lost workplace productivity last year, market researchers say.

When spam reached epidemic levels last year, the industry attacked it with technology, lawsuits and legislation. But now new forms of spam, phishing attacks and viruses are being exploited by cybercrooks. The digital-crime wave has shaken trust in e-mail, forcing some companies to restrict its use and consumers to opt for other forms of online communication, such as instant messaging and personal Web diaries.

"E-mail gives criminals what they want: a degree of anonymity," says Bruce Townsend, who coordinates cybercrime investigations for the U.S. Secret Service. "Law enforcement does not have the financial or technological resources to cope with all these cases. But we have a lot of techniques" to find many.

E-mail misbehavior is so rampant that America Online, Microsoft and Yahoo are crafting a "caller ID"-like standard for e-mail messages, though the system is at least a year away. E-mail security companies, meanwhile, are rolling out products that act as early warning detectors of viruses.

"The problem had to get this bad to get Microsoft, Yahoo and AOL to work together," says Esther Dyson, editor at large for Cnet Networks.

Mucking with e-mail

For now, the bad guys are winning.

While Microsoft feverishly issues software to patch security holes, and Internet service providers fortify firewalls to shield customers from virulent e-mail, the pace of sophisticated spam and scams is accelerating. Compounding matters, many home PCs don’t have proper security software and are susceptible to abuse.

"When the system keeps getting sick, you have to question whether the platform is ill," says Chris Alden, a former journalist who is starting a company that would offer an alternative to e-mail. What ails e-mail:

•Spam. Despite a federal anti-spam law to curb billions of illegal porn and miracle-drug e-mails daily, many of the largest spammers successfully cover their tracks.

About 64% of e-mail monitored in May by spam-filtering company Brightmail was spam. That shot up from 58% in December, Brightmail says.

What that means for the bottom line: It costs companies nearly $2,000 per employee a year in lost productivity, double from a year ago, Nucleus Research says.

•Phishing. Phishing schemes take spam another step: They trick consumers into surrendering personal data by responding to spam that appears to come from a legitimate bank or e-commerce site.

Phishing attacks soared to a record 1,125 unique schemes in April, compared with 402 in March, according to trade group Anti-Phishing Working Group. Each attack can be anywhere from 50,000 to 10 million e-mail messages.

Many phishing expeditions successfully "fish" information from victims because they look real. The e-mail often includes company logos and Web links and frequently preys on customers of eBay, PayPal and Citibank.

The attacks are escalating as more Americans pay their bills online.

An estimated 63 million people, or 45% of consumers online, purchase products and bank on the Internet, says technology researcher Gartner. More than half of the nearly 2 million phishing victims said it led to identity theft, in which criminals used their personal information to pose as them and buy goods, Gartner says.

Security experts fear that such attacks, including one that targeted thousands of Royal Bank of Canada customers last week, will scare consumers from online banking and e-commerce. "It creates distrust for anyone making a financial transaction online," says Internet analyst David Ferris.

• Viruses. Nearly 1,000 viruses surfaced in May, the most since December 2001, after Nimda and Code Red hit, says computer-security company Sophos. There are 90,800 coursing over the Internet, up 11% from a year ago.

E-mail viruses like SoBig and MyDoom leave security holes in millions of PCs. Hackers can remotely command infected PCs to send spam and phishing scams.

Security experts note growing cooperation among virus writers, spammers and con artists. Many such gangs operate in Russia and Germany.

E-mail light

The pitfalls have forced consumers to use e-mail more carefully. Many are eschewing bulky attached documents out of fear they will be poached by hackers or spiked by their recipient.

"I’m less likely to attach a document knowing the recipient may delete it out of (fear) of receiving a virus," says Aaron Itzkowitz, 40, an account manager for a software company in Florida. "And I will delete an unfamiliar e-mail rather than open possibly infected e-mail."

Individuals aren’t the only ones taking extreme measures with an application they say is indispensable. Businesses are adopting stricter policies. Financial institutions like Merrill Lynch ban employees from using non-work e-mail accounts to protect their networks from security breaches.

About 40% of small businesses would consider discarding e-mail for business correspondence if spam worsens, according to a survey of 500 business owners conducted for Symantec by InsightExpress.

Arizona Employers’ Council, a non-profit that advises businesses, is considering a return to postal mail despite a cost of $500 per week. Many of its clients spike e-mail rather than risk catching a virus, says Amy Greathouse, council president.

At this week’s e-mail conference, exhibitors are expected to hawk anti-spam filters and other e-mail security software. That’s a big difference from a few years ago, when a typical e-mail show was populated with e-commerce companies trying to increase their exposure.

Tim Chiu, director of technical marketing at Mirapoint, an e-mail security company, laments, "It shows how much things have changed."