Symantec Spam Sparks Furor

The prominent computing-tools developer claims that an unsolicited advertisement, sent to thousands of netsurfers, was a "mistake."

All products featured on WIRED are independently selected by our editors. However, we may receive compensation from retailers and/or from purchases of products through these links.

If the way to a geek's heart is through his or her hard drive, the Symantec Corp. owns some of the most coveted real estate in the software industry. The wrath of a vocal portion of Symantec's customer base turned against the company, however, when the maker of such ubiquitous computing tools as Norton Utilities, pcANYWHERE and Norton AntiVirus sent out an unsolicited email advertisement promoting its Web site builder, Visual Page.

In the jargon of Usenet newsgroups, unsolicited email advertising is loathsome "spam." The newsgroup that addresses spamming issues - news.admin.net-abuse.email - has been in an uproar since the email went out on 6 February, with similarly angry postings appearing in the conferencing area of the company's own Web site by customers who say they're going to replace Symantec software with products from other companies, and filter out all mailings from symantec.com in the future.

Now Symantec is saying it was all a mistake.

In a letter being mailed out this week to those who complained about receiving the unsolicited ad, the company offers a "sincere apology," claiming that the mailing was caused by "a procedural oversight." The letter states that Symantec's policy is "not to send unsolicited email.... We have taken steps to ensure that this does not happen again." According to Symantec, only those who sign up for email updates at the company's Web site and by snail mail, will receive ads in the future.

Amy Savage, director of corporate communications, offers the explanation that a list of those who had asked for email updates about the company's products had been accidentally combined with another list of email addresses bought from a third party list provider. "It was a mistake," Savage says. "It's caused us to take a look at how we use these lists."

The wayward list appears to have been a standard spammer's stash of addresses, including those "harvested" by Net-crawling programs from postings to Usenet newsgroups. Many Usenet regulars maintain over a dozen email addresses, and the fact that unsolicited advertising from a major Silicon Valley company arrived at addresses used only for posting to newsgroups for Java programmers and other technologically sophisticated groups sent up red flags.

"For years, people have been saying that people won't mind if the unsolicited mail is coming from a real company with a real product. Now we know they do mind," said Peter Seebach, an ISP administrator who is an outspoken opponent of spamming in dozens of high-tech newsgroups.

Seebach says the flame war ignited by the Symantec mailing could prove to be "a huge victory in the long-term goal of eliminating spam, by demonstrating that people don't want unsolicited mail from anyone" - even a company whose products are as well regarded as Symantec's.

The company's official insistence that the mailing was an "oversight" was late in coming, however, and its validity has been questioned - even by Symantec employees.

Symantec maintains a presence in the newsgroups, and on 11 February, company communications specialist Anthony Perry posted the following statement to news.admin.net-abuse and symantec.customerservice.general: "Symantec has chosen, at this time, to do mass emailings." Perry went on to say that he was "on the committee against mass emailings," and that "in the future," the company's policy about sending out spam "may change."

Perry's statements - while understood by some to be voluntary postings, not official declarations of company policy - fanned the flames, especially when another company representative posted that Symantec had an "opt-out" policy about email advertisements, allowing recipients to block future unsolicited mailings by visiting the company's Web site.

"Opt-out" filtering of unwanted advertising is a particular bête noire of anti-spam groups like the Coalition Against Unsolicited Commercial Email, which points out that netsurfers would have to opt out of tens of thousands of individual marketers' lists. Groups like CAUCE are lobbying heavily for President Clinton to endorse HR 1748, the Netizens Protection Act, which would criminalize spamming by extending prohibitions against "junk faxes" to unsolicited email.

By the time Perry posted that "he should have been much more clear about the opt-out list" in an earlier posting, the temperature of the discourse had climbed to the point where one critic testily replied, "What you should do is stop mentioning the opt-out list, period. It's a little like mentioning condoms to rape victims."

Symantec's claim that the mailing was purely accidental is further undermined by another employee's statement, made anonymously, that somebody in the marketing department had made "a really big mistake" by sending out the spam - but not an unintentional one. That employee adds, however, that there was no in-house discussion before the mailing went out, but that there has been plenty of soul-searching since.

"The end result," he says, "is that there are policies now in place so that it won't - or it better not - happen again."