Do you have charming nieces, aged six to 12? I have several who I'd let you have. Take Sheri. She's the one who is already tagged to be a computer wiz, yet has to ask me: "Why does everybody hate spam?" I make allowances; Sheri is seven years old, and thus a tad young for rampant e-mail traffic (although these days, who knows if she's too young?), so her question is appropriate. Still, how would you describe the problem of spam to a seven-year-old?

I wanted to say, "It's junk e-mail." and let it go at that, probably because I find the subject of spam irritating on so many levels. However, doing justice to questions from young people is a high priority. So I stooped to analogy: "Sheri, the problem with spam is like a problem with birthday parties." This statement instantly drew one of those suspicious looks that only little girls of seven going on 27 can give you.

I asked her, "You've had birthday parties, maybe a couple of big ones?" She nodded. "Did you invite everybody you know to the party?" She shook her head. "Suppose you had this really nice party, but then a whole bunch of kids you didn't know--ugly, mean kids--started coming in. What would you do about it? You could ask your mom to be at the front door and only let in the kids you invited. But how would she know which ones to let in? The mean kids would just lie and say you invited them.

"Spam is sort of like the mean kids. It doesn't play by the rules. Your mom and dad get e-mail. I get e-mail every day and most of it is spam. Those are messages we don't want--advertisements and messages from very ugly people. But we need e-mail, so we have to do something about the spam. What makes us so mad is that we have to spend time and effort to do that, and we shouldn't have to. We didn't invite the spam. We don't want it. We get angry, Sheri, just like you would if a lot of kids crashed your party."

I'm not sure about the effectiveness of analogies but my niece seemed to get the point. Here's another analogy: Dealing with spam is like choosing between a silver bullet and buckshot. This too needs elaboration. Spam is an ugly reality for everyone involved with e-mail. What to do about it is the issue. For several years companies and users have been looking for the way to kill spam. I think because spam is such a hassle everybody would love to have a single solution--a piece of software, perhaps--that does the job. This would be the proverbial silver bullet. Right now we have many proposed silver bullets. Here's a sampling, along with some of the difficulties with each of them.

Opt out

After several years of training, people never to reply to an "opt out" question at the end of a spam message--most spammers simply used it as a confirmation of your email address and promptly shop it around. Several solutions, including the "Can-Spam" legislation in Congress, favor such an approach. The direct marketing industry likes the approach, because it more or less gets them off the hook. The consumer becomes responsible, and that requires joining opt-out lists or otherwise indicating that a particular e-mail sender is not wanted. Unfortunately, spammers change their sender names on virtually every message. So how many dozens of opt-out lists do you want to fill out?

Filtering

At least as old an approach as opt-out, filtering usually looks at the subject (and sometimes content) of a message and blocks anything containing words or phrases from a forbidden list. At one time, this was a simple method to get rid of the rampant Viagra and other sex-related spam. Unfortunately, most filters are very literal. Viagra gets blocked, but V.I.A.G.R.A. does not (at least until you add it to your block list). This leads to a game of "hide and seek the forbidden word" that is usually won by the spammers. It also leads to the blocking of perfectly harmless or even desirable email that just happens to contain a forbidden word--for example, a news story titled "Mayo Clinic Finds Viagra Only Partially Effective in Yearlong Study."

Blacklist

A blacklist is employed either in software on your PC or at a server. Essentially it blocks any e-mail from a "known spammer"--that is, any e-mail address, sender name, or other identifier that has been associated with spam. There are (at least) two problems with this approach: One, maintaining the blacklist is difficult and expensive, meaning that it takes a lot of work for an individual or a lot of money to have it done commercially. Second, who is a spammer? As in real life, one person's unpalatable Spam (the kind Hormel makes) is another person's yummy sandwich meat. You may even want a certain kind of message from a source (such as e-mail news), but not the advertising messages.

Whitelist

Of all the approaches, this one is the most draconian because it kills (either by deleting, refusing, or otherwise keeping from your view) any e-mail message that doesn't carry a known and approved address or other ID. I will testify that this approach works. Let's say that in come 50 messages; into the trash go 45 items of spam (must be Saturday night) without a single click from me. I will also testify that you have to faithfully and accurately scan the trash to make sure that you didn't delete some "false positive"--a message that you want but from a changed, or unknown sender.

Challenge and response

To counter the problem of false positives (blocks), a currently hot scheme involves "challenge and response." The approach usually starts with a white list. When an unknown address or other ID appears, a reply (challenge) message is sent, asking for the sender to confirm their identity (response message).

This approach has several variations and several weaknesses. The most interesting weakness I call the Loop 22. Mail systems that use challenge and response must accept challenge messages for the concept to work, but that means spammers and other hackers will soon learn how to use challenge messages to get to your inbox. Besides, think of those billions of challenge and response messages added to already overloaded email servers.

Throw the book at 'em

Finally, state and federal legislatures are cooking up anti-spam laws of almost every stripe and color. Some of these paper tigers even have teeth. This can be useful, because it's at at least a club that can be used to beat spammers that get caught. The problem is in the catching. Most spammers already know that what they do is illegal, or at least unwelcome. More laws won't change their attitude. Spammers are notoriously difficult to track down, and with the ever-increasing power of technology, it won't get any easier. Besides, spam is global, and as always, we have a big problem with enforcing anything on a global basis.

Lots of approaches, none perfect--at least not so far. There are many others I haven't mentioned, but it doesn't look like there are lurking winners. Thinking about all these solutions, one overriding thought occurs: Perhaps if no one approach is effective, a combination of approaches might do the job. This is the buckshot approach. Certainly laws that are capable of enforcement are helpful. Various schemes that identify spammers, such as challenge and response, also help. Individuals can use a variety of antispam techniques, as can companies with servers. If at each point, a certain percentage of spam drops out, we might not get 100 percent, but we'd at least have a welcome overall reduction.

Now if we could just figure out how to orchestrate the combinations so they could be globally effective. Like I told my niece, "Sheri, this is nasty stuff. Spam just isn't child's play."