By Caron Schwartz Ellis, Staff Writer
February 18, 2005

E-mail spam is a lot like the weather — everyone talks about it, but no one does anything about it.

Actually, people do a lot of things to mitigate the deluge of spam. Some install anti-spam software or hardware. Some rely on their Internet service providers. Others use spam filtering service providers. Congress made it illegal with the CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography and Marketing Act), which has provisions for fines up to $11,000 and the possibility of criminal charges.

But many just complain, said David Young, a partner with Free Range Geeks, a Boulder-based information technology consulting firm. “It’s very hit and miss in terms of company policies. Some companies have already thought it through and have implemented some kind of spam filter at server or required employees to use filters in Outlook ... Mostly we hear those complaints.”

Affordable anti-spam programs often choice for smaller companies
For a single home office or a very small company, David Young, a partner with Boulder-based Free Range Geeks, says a desktop solution is “just fine.” He recommends Outlook 2003 because it has a good junk e-mail filter or a third-party program like SpamBayes, a freeware spam filter.

For Free Range Geeks’ clients that have the company manage their internal mail server or host their mail remotely, Young uses a freeware package called ASSP (which stands for Anti-Spam SMTP Proxy). ASSP and other server-based anti-spam software blocks spam corporatewide before it winds up in users’ e-mail boxes. “It’s one of several open-source packages that’s very smart,” he says. “ASSP blocks generally about 50 percent of all incoming mail, and the false positive rate is very low.”

A false positive is when the filter rejects legitimate e-mail as spam.

Small companies often rely on their Internet service provider to provide spam protection.

Boulder-based ISP RockyNet has an optional service called SpamNet. According to account representative Mitchell Rogers, the setup fee is $15, and the service costs 99 cents per mailbox per month.

SpamNet is a private-label software package RockyNet purchased to provide spam blocking for its 2,000 customers Rogers said.

RockyNet’s current version of SpamNet was launched in January, Rogers said. Prior to that, the ISP offered a more expensive, less-effective solution that wasn’t very popular with customers, he admitted. “I have a feeling this will be better so that number will increase,” he said.

Jade Sund, owner of Viking Roofing Inc. in Broomfield, relies on her ISP to keep her small network spamfree.

“We get estimates over the Web,” Sund said. “I own two other e-based businesses, and I need to be able to read my e-mail.”

Louisville-based New West Solutions provides an anti-spam solution that Sund said saves her three to five hours of e-mail sifting per week.

Prior to New West, Sund used a Florida-based ISP that left her with 50 to 150 daily unsolicited e-mails, she said.

Randy Treece, president and chief executive of Boulder-based Astralux Inc., also relies on his ISP for spam control. The six-employee company uses Pittsburgh-based Pair Networks’ spam filter, which Treece said does an “OK sorting job, and you can kind of teach it.”

Louisville-based startup StillSecure provides a suite of network security products that protects against network intrusions by identifying and repairing security holes including viruses, but it doesn’t scan e-mail for spam, said spokeswoman Sonya Hausafus.

For its own e-mail, the company uses a server-based freeware package called SpamAssassin. StillSecure, founded in 2000, does not reveal exact employee headcount.

Boulder network security firm Applied Trust Engineering often helps clients choose spam mitigation tools. The 14-employee company uses SpamAssassin, which it recommends to clients as well, said Ned McClain, vice president of engineering.

Outsourced solutions can help larger firms battle unwanted e-mail
For larger companies, Ned McClain, vice president of engineering at StillSecure, recommends outsourced anti-spam solutions like Denver-based MX Logic Inc.**

“The ones that can afford it prefer the outsourced,” McClain said. “Those folks see traffic for thousands of different companies” and can head off problems before they hit users.

MX Logic provides a full e-mail defense service including spam blocking and virus detection for about $1 per user per month, said spokeswoman Sheila O’Neill. The company targets small- to medium-size companies with its managed service. It also offers a software solution for Internet service providers to resell to their clients. “We have about 3,500 customers, and we process billions of messages each month on behalf of our customers,” O’Neill said.

Boulder-based Spectra Logic is an MX Logic customer, said Jeff Biley, Spectra Logic’s vice president of information technology. The service costs the company between 75 cents and $1.30 per seat per month, he said.

The 300-employee company also has a written e-mail acceptable use policy that is “pretty open,” Biley said. “As long as it doesn’t affect your job we let it go at that. We send out a monthly IT bulletin and a weekly reminder on new viruses so new users get a list of what not to do and what’s out there. We do a lot of user education.”

Jim Veith, information systems manager for Boulder-based Roche Colorado Corp., said because the 300-employee company is part of the Roche Group, a large international corporation based in Basel, Switzerland, it bases its spam mitigation on a companywide standard. The company uses NetIQ Corp.’s MailMarshal, which was first piloted at the global office and then in the Nutley, N.J. office, Veith said.

MailMarshal is a server-based e-mail filtering software product. Since Roche’s U.S. e-mail server in Nutley, Veith said there’s no local cost associated with it.

Roche also has a “common sense” e-mail policy, Veith said, including “Do not open e-mail if you don’t know the sender,” he said. “Some (spammers) will even send it from a Roche address so it looks legitimate. But you have to be aware. So if you don’t know the sender or if the content doesn’t make any sense you just delete it. You should also contact the IT department.”

Contact Caron Schwartz Ellis at (303) 440-4950 or e-mail This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

** Ned McClain was mistakenly referred to as an employee of StillSecure; he is vice president of engineering at Applied Trust Engineering.