Under Pressure, ISP Savvis Agrees to Boot Spammers Off Its Networks

News Story by Jaikumar Vijayan

SEPTEMBER 13, 2004 (COMPUTERWORLD) - Antispam campaigners scored a notable victory last week when they helped prod Internet service provider Savvis Communications Inc. to agree to pull the plug on 40 customers that the company acknowledged were using its networks to send out e-mail spam.
St. Louis-based Savvis also announced that it will work with The Spamhaus Project, a London-based antispam group, to identify and disconnect other clients who engage in spamming activities.

Spamhaus CEO Steve Linford said the moves are a step in the right direction for Savvis, which has customers in more than 40 countries and claims 75 of the top 100 banks worldwide among its client base. Over the past few months, Savvis had emerged as one of the world's largest hosts of spam operators, according to Linford.

But the companies being given the boot represent only a portion of the 137 spammers that Spamhaus has identified as being hosted by the service provider, Linford added. "The 40 that Savvis is getting rid of are only the real hard-core elements of the spammer community that no other network will touch," he said.

Savvis CEO Rob McCormick said the timing of the company's announcement wasn't driven by pressure from Spamhaus and other antispam groups alone. Savvis has always had strong spam-related policies, McCormick said, adding that many of the recent problems involved customers the company inherited when it acquired Cable & Wireless PLC's U.S. Web hosting operations in January.

"We bought a new company, and we were focused on cutting costs and getting it back to profitability," McCormick said. It has taken time for Savvis to figure out which of the new customers didn't meet its acceptable-use policy, he noted. But now the company will enforce its standard policies with the former Cable & Wireless customer base, McCormick said.

Outside Influence

Savvis' pledge to rid its networks of spammers is an indication of the pressure that antispam groups can put on companies, said Peter Christy, an analyst at NetsEdge Research Group in Los Altos, Calif.

Several antispam groups, including Spamhaus and the anonymously run Spam Prevention Early Warning System (SPEWS), had begun blacklisting entire blocks of IP addresses owned by Savvis. Adding to the pressure was the fact that groups such as SPEWS were "overblocking" Savvis' IP addresses, which results in even nonspammers finding themselves on antispam blacklists.

Several internal memos posted on a whistle-blower Web site by a former Savvis employee suggested that the company may have succumbed to such pressure. In one internal memo, a Savvis executive likened SPEWS to a "vigilante organization with a diffuse international existence." In another, a Savvis executive cautioned about the business problems that such extensive blacklisting can cause and questioned Savvis' ability to continue selling its services to major users. McCormick didn't dispute the authenticity of the memos.

Real-time blacklists, many of which are freely available, are widely used by companies to block e-mail from known spammers. For instance, Spamhaus claims that its blacklists are used by an estimated 260 million Internet users.

Christy said that although many antispam groups have high standards when it comes to blacklisting, others are run by "overenthusiastic" volunteers who sometimes "make judgments that may or may not be a reasonable view" of a company's e-mail activities.