Spam, phishing and Eric Clapton's guitar

Last week, I received an email through the university server titled ‘IMPORTANT NOTICE!!!’ and advertising a number of free items from the estate of the late partner of one Mrs Caitlyn Gaviria. The email promised that the items were ‘ABSOLUTELY FREE’, although coverage of shipping costs from the US would be required.

Mrs Gaviria’s former partner clearly being a Renaissance man, these possessions included a startlingly disparate array of items: a playstation, several X-boxes, an iPad, a Macbook pro, an antique Steinway piano, a Meta Quest Oculus (I had to look that one up), a mint-condition violin, a ‘63 Firebird V guitar and, most significantly, Eric Clapton’s 1939 Martin OOO-42 guitar.

Now, I’m embarrassed to admit this publicly, but I immediately forwarded the email on to a former colleague who is in a rock band, builds guitars and has a huge collection of them. In my defence, I realised the email looked sketchy. First, barring the excessive punctuation, it’s generally safe to assume that any email titled ‘IMPORTANT NOTICE’ can be ignored.1 It also raised a host of questions. Why was Mrs Caitlyn Gaviria giving away her partner’s prized possessions to random strangers at Imperial College? How on earth did Mr Caitlyn Gaviria get Eric Clapton’s guitar in the first place? (And when did Eric Clapton get into Martins? I thought he was a Gibson and Fender man.2)

But the thing is that the email came from the account of a senior Imperial academic. ‘Ah, she must know this Mrs Caitlyn Gaviria’ I thought to myself, after diligently checking its source. In essence, the legitimacy of the apparent author of the email overrode all common sense about the unlikeliness of the scenario being presented.3 I realised it was a scam about twenty minutes later, when the same email was sent from the account of a second Imperial academic.

I‘ve since discovered that the University of Cambridge was targeted in April with the same scam, although this time the email came from a Mrs Talida State, who ‘is currently downsizing and has kindly offered her late husband’s beloved possessions… to members of our community’. The spammers were able to access university accounts because of a phishing email sent around about payslips—the systems of anyone who clicked on the email were compromised (a colleague of mine was one of many affected). IT picked up the problem quickly, because the emails soon disappeared off the server, but the incident got me thinking more about the nature of spam.

What we now call ‘spam’ is not itself a new phenomenon. Anyone born prior to the 1980s will probably remember the chain letters that used to occasionally turn up in the mail. I remember receiving one when I was 12 from someone I’d met while staying with friends in Mount Isa—a town about 1,000kms from where I lived. I guess she thought she was doing me a favour because the chain letter promised that sending copies of the letter to ten people would bring me luck. The problem was that the letter also warned that breaking the chain would bring down unspecified calamities upon my head.

I was disconcerted by the letter, and resentful of the burden my new ‘friend’ had placed upon me to pass it on. Unsure of what to do, I showed it to my mum, who promptly threw it out. I recall being simultaneously relieved and alarmed by this, in case the promised calamities were visited upon me (they weren’t). My new Mount Isa friend sent me further letters after that, but I was so turned off by the chain letter that I never responded.

As Smithsonian Magazine documents, chain letters are centuries old. Some of the earliest remaining examples are so-called letters from Heaven, whose purported source was Jesus himself. The writer Amelia Soth reports that the widely circulated ‘Sunday Letter’ threatened terrible punishments for those disobeying the commandant to honour the Sabbath. For instance, anyone riding a horse on Sunday ‘would find that horse transformed to fire between their legs in Hell’. Conversely, blessings were promised to those who copied and spread the message.

But while unsolicited and annoying communications from within our social networks may be centuries old, there’s little question that the digital era—and especially the rise of networked computers—transformed them completely. The media studies scholar Marjorie Kirby argues that email not only made it exponentially faster and easier to transmit information within networks, it resulted in ‘reduced “ownership” of what is communicated’. The consequence was a veritable avalanche of electronic spam.

Despite its ubiquity in our daily lives, spam has been the focus of surprisingly little scholarly attention,4 although a key exception can be found in Finn Brunton’s Spam: A Shadow History of the Internet. According to Brunton, the term ‘spam’ arose early in the initial era of networked computing (1970s-1995) to describe actions in which users would post meaningless text onto messaging boards, in order to push other text off the screen and take control of the conversation. Likewise, it was the term used for people who flooded chat rooms with text. It quickly became a noun (‘it’s spam’), a verb (‘they spammed me!’) and an adjective (‘spammy’).

Brunton reports that there are numerous folk etymologies for how spam got its name. One is that spam is an acronym for ‘shit posing as mail’. Another is that it’s an acronym for the Esperanto5 phrase ‘SenPete Alsendita Mes â go’, which means ‘a message sent without request’. However, the general consensus is that the term comes from a 1970 Monty Python’s Flying Circus skit featuring a café where spam is the primary item on the menu, and a group of Vikings who repeatedly break into song about its wonders.

To quote Brunton,

‘Because it’s a joke whose humor relies on repetition, and because geeks love Monty Python,6 it became a rather tedious running gag in the early culture of networked computers. By the transitive property of being annoying, “spam” then became a word for other kinds of tedious, repetitious, irritating behavior, whether produced by a person or a malfunctioning program’.

During this initial phase, spam referred to any undesirable text, whether it was ‘repetitive, excessive, or interfering’. Indeed, an early academic article by the folklorist Lee-Ellen Marvin on the aesthetics of text-based realities simply described spam as an ‘excess of communication’. An example Brunton recounts is of the LambdaMOO user ‘Minnie’, who frequently posted incoherent and inflammatory screeds on the site. A petition soon began to forcibly remove her from the game due to her ‘long history of vindictiveness, paranoia, slander, harassment, lying, and cheating; but especially her compulsive spam’.

This early definition of spam as simply an excess of communication was partially an artefact of the fragility of the infrastructures of early networked computing. Anyone old enough to remember the days of dial-up internet will recall how slow emails were to load, how expensive the internet was to use, and how frequently it cut out.7 As Brunton notes, ‘It cost nothing for someone to post a message at their local machine… but it cost other users something to receive it, in money, in disk space, in opportunity cost, and in attention’.

Brunton argues that spam’s second phase began in 1995. This era coincided with the privatisation of the network and the beginning of spam as a money-making enterprise, along with the attendant rise of ‘phishing’ as specific variant of it—a hacker term that was popularised in 1995. In this period, spam came to take on new meanings. No longer was it simply an excess of communication. It was an excess of communication of a particular type—primarily, mass emails that were commercial in orientation and sometimes deceptive. This was the era of Nigerian princes wanting to offload their millions,8 fake password requests and stock market pump and dump scams.

Although most of these scams required, in Brunton’s words, either ‘enormous gullibility or a great fondness for porn’,9 there was growing concern about the need to regulate spam during this period. However, developing a clear definition proved challenging. As Brunton observes, the problem was partly metaphoric in nature. Were spammers free-riders? Parasites? Daring entrepreneurs? The metaphors mattered because they dictated views on how the problem of spam should be addressed—i.e., whether it was a headache that must be endured in the name of free speech or a pernicious invasion that must be stopped.

According to Brunton, the second era of spam ended with the passage of the CAN-SPAM act in 2003—the first legislation to attempt to regulate the phenomenon. Taking the line that spam was a legitimate commercial activity that nevertheless demanded regulation, CAN-SPAM required that senders’ identity be authentic, that ads be clearly designated as such, and receivers had to be given the opportunity to opt out of correspondence. The act was followed by the rise of spam filters, although they further highlighted the problems with trying to define and identify spam.

Brunton argues that filters and legislation ushered in the third era of spam, by inadvertently strengthening the criminal infrastructure surrounding it. Spam now required far greater resources, because exponentially larger volumes needed to be sent in order to reach its targets. Moreover, once spam was destroyed as a reputable business model, spammers no longer needed to content themselves with sale pitches when the real money to be made was in phishing, identity theft, credit card scams, etc. The result of efforts to regulate spam was that it became, in Brunton’s words, ‘much more criminal, experimental, and massively automated’, and thereby much harder to detect.

I suspect that with the rise of AI and LLMs we’ve now entered the fourth era of spam—a topic Brunton doesn’t discuss, given that his book was published in 2013. However, in closing he mentions a new genre of machine-generated spam books beginning to colonise Amazon. This suggests that the current ‘AI slop tsunami’ might be best understood as merely the latest incarnation of spam, rather than a distinctively new phenomenon. Indeed, AI-slop fits nicely into Brunton’s definition of spam, which he suggests is, in the final analysis, ‘the use of information technology infrastructure to exploit existing aggregations of human attention’.

It’s precisely as a result of this attribute that spam is virtually impossible to eradicate. According to Brunton, getting rid of spam would require us to either hobble our technologies to the point of unusability, or transform them in ways that would fundamentally contradict the values that inform their design.

But spam also thrives on ambiguity. The most effective spam is the stuff we think might actually be ham (i.e., Eric Clapton’s guitar). It’s the messages we’re not sure about but forward on regardless—just in case—thereby enhancing their provenance and credibility. Because the real secret of successful spam is not that we blindly believe it, but that it makes spammers of us all.