The Radicati Group, Inc. The Real Cost The Real Cost of Spam Masha Khmartseva Senior Analyst The Radicati Group, Inc.

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Agenda Implicit costs – fraud Types of spam Conclusions Cost of spam Explicit costs – IT & soft costs Q & A

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Spam is electronic messages unwelcome by either the end user or the company that provides him or her with an account Both unsolicited and solicited (messages that users signed up for receiving) can be classified as spam by a company Definition

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Commercial Advertising (73%)  Unsolicited Messages are mass mailed to users without their permission  Solicited Even though messages are mass-mailed to opt-in users, they serve as a source of a major distraction when received at work  Fraud (15%)  Chain Letters Commercial Pyramid schemes Non-Commercial Good fortune letters Petition-signing for different causes  Con Schemes Messages asking to support non-existing causes, or to invest in a “highly profitable” non-existing venture; identity theft Other (12%) Jokes, Malicious spam, etc. Types of Spam

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Cost of Spam

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Total Cost of Spam = Explicit Costs: IT Costs (Servers to be deployed and maintained) Soft Costs (User productivity time lost dealing with spam) Implicit Costs: Fraud and Identity Theft

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Explicit Costs of Spam

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. IT Cost of Spam – Percentage of Spam Messages The numbers are projected on a worldwide basis Total Corporate Messages Volume (Billon of messages/day) % Spam After Deploying an Anti-Spam Solution for Corporations 17%15%13%11%9% Corporate Spam Messages Growth (Billion of messages/day)

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. IT Cost of Spam – TCO Model Key Assumptions  Period of depreciation: 3-year straight line  User productivity: considered “soft costs” and is not included  Salaries: $60/hour for IT administrators $35/user for employees Based on the number of servers needed to support spam messages Costs in order to support the number of servers engaged include:  Acquisition costs  Maintenance costs  Administration costs  Migration/update costs  Downtime costs  Training costs

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. The model assumes that 34 servers are deployed in a 10,000-user organization in 2004 (MS Exchange Servers) 6 of these 34 servers are “Spam Servers” (processing the 17% of messages that spam filters do not catch) IT Cost of Spam – Number of Servers

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. In 2004, out of 34 servers deployed, 6 are dedicated to processing spam (in corporations deploying an anti-spam filter) By 2008 the number of servers needed will grow to 87, 8 of which will be processing spam IT Cost of Spam – Number of Servers Needed % of spam messages after deploying an anti-spam solution for corporations 17%15%13%11%9% Total number of servers for a 10,0000-user company Number of servers processing legitimate traffic Additional servers deployed due to spam traffic 66778

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. IT Cost of Spam – Upkeep Costs per Server The total upkeep costs for one server come to $96,758 per year Upkeep Costs per Server per Year Migration/ Upgrade $5,400 Administration $20,442 Maintenance $6,467 Downtime Cost $63,064 Training Cost $1,385

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. IT Cost of Spam – Spam Server Costs Assumes that 6 servers will be consumed with processing spam in 2004 Assumes that 8 servers will be consumed with processing spam in 2008

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. IT Cost of Spam – Worldwide 2007 In 2004 the total number of corporate mailboxes is estimated to be 479 million, resulting in a financial loss of almost $26.8 billion In 2008 the total number of corporate mailboxes is estimated to reach 861 million, resulting in a financial loss of $66 billion Number of Corporate Mailboxes (M) Cost of Spam Per Mailbox After Deploying a Filter $56$61$67 $73 $77 Worldwide Financial Loss Due to Spam (B) $26.8 $33.5 $42.1 $53.4 $

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Soft Costs of Spam – User Time Wasted In 2004 the typical user spends 4 minutes dealing with spam messages/day (64 $35/hour) resulting in a financial loss of over $268 billion In 2008 the typical user is estimated to spend 7 minutes dealing with spam/day, resulting in a financial loss of over $843 billion Number of Corporate Mailboxes (Million) Cost of Dealing With Spam/User/Year After Deploying a Filter $ 560 $ 630 $700 $840 $ 980 Worldwide Financial Loss Due to Spam (Billion) $ $ $ $ $ 843.8

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Total EXPLICIT Hard IT and Soft Costs of Dealing with Spam Per User Per Year In 2004, the total financial loss due to spam for the typical corporate user amounts to $616 In 2008, we estimate that the total financial loss due to spam for the typical corporate user will amount to $1,057

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Implicit Costs of Dealing with Spam

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Implicit Costs – Fraud & Identity Theft fraud is messages mass mailed to users to trick them into paying for non-existent goods and services or disclosing their personal and financial information

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Most common fraud categories include the following: Chain letters Work on the principle of a pyramid scheme, asking users to send an X number of dollars to an X number of people, promising astronomical returns. Con schemes Users are asked to support a non-existing cause (cancer victims, etc.), invest in a non-existing venture, help with money transfer (Nigerian letter), etc. Identity theft Users are asked to confirm their personal and financial information (SS #s, bank accounts, PINs, credit card numbers, etc.) Types of Fraud

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. What is the Solution? An anti-spam filter is the only way to significantly reduce the volume of spam messages, to curtail both implicit & explicit costs

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Projected Rate of Anti-Spam Filter Deployments

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Anti-spam laws and regulations exist in the US and Europe: US 36 States signed laws to regulate the distribution of unsolicited messages, starting with Nevada in 1997 The federal anti-spam law – CAN SPAM ACT- became effective January 1, 2004 Europe Regulations were passed affecting the members of the European Union, as well as individual countries Some individual counties that have passed these laws include Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Luxembourg, Netherlands, Norway, Portugal, Spain, Sweden and the UK What About the Legislation?

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. What the Results Have Been So Far? It’s too early to tell about the effect the act will have on the volume of spam We haven't noticed a significant reduction in the total volume of spam yet So far we’ve seen mostly legitimate marketers taking note by offering more clear opt-out instruction in the messages they send to their users None of the users we’ve talked to believes that the legislation alone, without any technology in place will make a major difference in stopping the volume of spam

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. Final Thoughts Spam is more than just a nuisance – it costs corporations and service providers billions of dollars. In addition, spam is quickly becoming a new avenue for criminal activity, such as identity theft and con schemes. We have yet to see a filter that can completely eliminate spam. Tougher legislation may be of great help, however alone it won’t help solve the problem. While the spam market today is a confusing space, with over 300 vendors and service providers, we’re expecting to see its active consolidation over the next 3 years. During this time anti-spam solutions will be transformed from stand-alone products to integrated parts of messaging security suites.

Copyright © May 2004, The Radicati Group, Inc. The Radicati Group, Inc. References – This presentation includes data from the following reports: Anti-Spam Market Trends, Market Numbers Summary Update, Q Messaging Software Market Trends, Messaging Total Cost of Ownership 2003 Q & A