Your argument sounds reasonable, but it glosses over one thing. The costs of spam aren't just the direct costs of handling and deleting the spam e-mails. The costs also include the costs of legitimate messages lost in the pile of garbage (eg. the multi-million-dollar contract lost because in trying to delete the 400 spams from their inbox someone didn't notice the RFP and deleted it unread as well), or alternatively the cost of legitimate messages incorrectly marked as spam and filtered out by the filters needed to keep inboxes down to sane levels.

I think your incredulity at the size of judgements against spammers stems from what I call the fallacy of the inconsequential: the idea that if X is so small it can be ignored, a large number of Xes added together can also be ignored. A recent Risks Digest entry made note of this same fallacy in another context, noting that with the number of commercial airline flights in the US we could expect to see 1-in-a-million events happen 7 or so times a year.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/287/29686#29686