According to stats from CSIRO’s Information Management and Technology people, there were just shy of 81 million spam and virus-laden email messages blocked during September 2006, representing more the 96% of all email traffic. In fact, less than 3.5% of all email represented legitimate messages, which paints an even bleaker picture of the email world than the numbers presented at VNUNet.com. Even other academic institutions such as Rutgers University show an average of 7% legitimate email over the past month.

In contrast with spam, virus-laden messages continue to represent a relatively small proportion of messages – there were roughly 2500 spam messages blocked for every virus-laden email that was detected, with less than 0.05% of all messages carrying virus payloads, almost an order of magnitude less than the 0.41% rate for emails processed by SoftScan. Interestingly, the CSIRO results are down from a peak in December 2005, when virus emails accounted for 0.5% of email messages.

Looking back over the past 12 months, there were close to 1 billion spam email messages received – an astounding figure for an organisation the size of CSIRO. This represents more than 150,000 spam email messages per employee per annum, or more than 400 spam email messages per employee per day. From the numbers released, we can also determine that the average number of non-spam messages received per employee is less than 20 per day. This starts to demonstrate just how significant the spam problem really is: there are at least 20 spam messages received for every legitimate email message.

To the credit of CSIRO IM&T people, very little spam is actually delivered through to my work email address – less than 10 spam messages a week on average. So, kudos to the combination of technology and resources that are applied, which I know includes IronPort Anti-Spam, and almost certainly a whole suite of other tools and techniques.

The bottom-line, however, seems to be that email protocols are broken – what other technology or infrastructure demonstrates such overwhelming mis-use to the degree that we see in email traffic?