shanen's Journal: Anti-spam idea for Gmail

How to make Gmail the spam target of absolute last resort.

The goal of this suggestion is to intelligently leverage and focus Google's expertise and credibility against the spammers and their accomplices. But where will the intelligence come from? From me, from you, from *ANYONE* who has a Gmail account and who wants to help oppose the annoying evil that is spam. Aggressively implemented, it could make Gmail into Spammer Heck--maybe to the point where only a fool would send spam to Gmail. (Yeah, there are plenty of fool spammers--but at least we'd get the laughs without the serious spammers.) Less spam = more value in Gmail.

So do you want to fight against spam? You, too, could become a WSF (wannabee spam fighter).

SpamSlam is my 'working draft' label. The idea is roughly based on other anti-spam systems--but with more smarts. Almost all email systems include one level of feedback in a Spam/NotSpam button. (For relative brevity and because it simplifies the draft implementation, I'm focusing on Web-based email here.) Think of SpamSlam as a report-spam-button on steroids. SpamSlam would report the spam, but also do much more. Essentially this Gmail feature would do some of the automatic analysis that any spam fighter has to do, get some intelligent feedback, and hopefully be able to act immediately against the spammer. Speed of action is actually crucial--cutting off the spammers' income is a key goal of this proposal.

Here is an approach to implementing it:

Clicking on SpamSlam would first trigger a low-cost automatic analysis of the email, including the headers. Let's call this Pass 0. Basically this is just using regular expressions to find things like email addresses, URLs, and phone numbers. The results would be used to generate a Pass 0 webform with comments and options (and explanations and links). This pass should also look for obfuscation and ask the wannabe spam fighter (WSF) to help break the spammers' attempts to evade the spam filters. (This is leveraging the spam's features against the spam--if a human can't figure out the spam, then the human can't send money to the spammer.) In many cases, this Pass 0 analysis may be able to suggest answers. If something like "[e-mail]" appears in the header, then the WSF should just click the option 'fake email'. Perhaps the WSF would only need to click a check box to confirm that "V/1/A/6/R/A" is a drug and categorize the spam. Other times the WSF can actually type in the answer to the spammer's quasi-CAPTCHA, and then the SpamSlam function can do something. At the bottom of the 'exploded email' in Pass 0, there will be the usual submit button.

After the WSF submits that Pass 0 form, more analysis can begin. The data is no longer raw, but partly analyzed, and the system can start checking domains, registrars, relays, fancier types of header forgery, MX records, categories of crime, email routings, and even things like countries hosting the spammer. This kind of analysis will probably take a bit of time, but a new Pass 1 form will be prepared for the WSF to consider. Basically, this would mostly be a confirmation step for the obvious counteractions. That's stuff like complaining to identified senders and webhosts, but also things like reporting open relays and spambots. It also needs more flexibility and 'other' options in the responses at this point--we all know the spammers are constantly going to try to devise new tactics. Again there will be a submit option at the bottom for this Pass 1 form.

That will probably cover most of the responses, but in some cases there may still be a need for a Pass 2 form. I imagine that would be a kind of escalation system, mostly to address new forms of spam. There is no closure on spam, there will always be new kinds of spam, and the responses to spam need to be open and flexible, too--but fast. The spammer is trying to open millions of little windows of economic opportunity--and in an ideal world we should slam all of them before a nickel gets through.

Beyond that? I think Gmail should also rate the WSFs on their spam-fighting skills. Some people are going to be much better at fighting spam. I admit that I want to earn a "Spam Fighter First Class" merit badge. Come to think of it, I also want the system to keep records of the spam I've slammed and how it was dealt with. Maybe they'd even spot cases of lawsuits against "my" spammers? Gosh, I'd love to join in and personally help put a spammer in jail. I know we're supposed to hate the spam, not the spammers--but I confess. I hate the spammers, too.

An earlier version of this idea (SuperReport) had a somewhat different focus and more details, especially for the Pass 0 webform--but obviously none of this is set in stone. If you agree with these ideas--or have some better ones, I suggest you try to call them to Google's attention. Actually, in my pursuit of this idea, I have been surprised to encounter a lot of anti-Google sentiment--though not surprised that much of the ill will was spam-related. However, I think Google is still an innovative and responsive company--and they claim they want to fight evil, too. Will they try harder to fight spam if many people like you and I write to them? I hope so, but it doesn't really matter where ideas come from or who gets credit--what matters is annoying the spammers more than they annoy us.

By the way, thanks to the people who offered thoughtful comments on the earlier draft. I'd like to thank you more personally, but you basically got lost in the flood of hopeless fools and sock puppets. That's a separate SNR problem.

As SMTP exists, we can never eliminate spam or spammers--but we can give them heck. If this suggestion is aggressively implemented, then spam sent to Gmail would almost immediately result in a flood of highly focused and thoughtful complaints against the spammer--before the spammer can get *ANY* money from the spam. Hit the spammer in his wallet *BEFORE* he can pocket anything.

The summary: Do you hate spam? Do you want to help fight the spammers? Yes, we can. If Gmail was the spam target of last choice, then it should be our email service of first choice!