One of the main issues with the original development of email is that it was never designed to be secure. The focus of email was mainly to be functional and easy to use. Today these core functions, which made the invention of email successful, are now the root cause of the problem.   Spammers can send millions of messages for a minimal cost.  At the same time spammers can hide or falsify their identity information. For this reason the prohibition to send commercial electronic messages disguising or concealing identity information is included in all the anti spam legislative instruments currently implemented.

This requirement is thought to be essential in combating the use of spam to spread scams, frauds, or viruses. At the same time, however, it is one of the most difficult provisions to enforce, as once the sender has disguised or falsified the header information, it will be very difficult for an enforcement agency to identify them, and investigations are usually complex, expensive and time consuming. In this context, it is important to ensure that enforcement bodies possess technical expertise, and that physical and financial evidence should be admitted for the enforcement of anti-spam laws or in taking action against spammers. In addition, technical instruments should be developed to support the legislative effort. The development and implementation of email authentication solutions are continuously being studied and its merits and shortcomings should be analyzed in more detail in the section dealing with “technical counter measures”.

It is easy to consider spam as an activity only undertaken by the person who hits the “send” button. Spam initiation should be considered in a much broader scope. Often spam is sent on behalf of a third party, who hopes to sell products or services to people clicking on the web site links within the messages. Most often spam campaigns are set up to remove the person sending the message from the person or entity that pays for the message or those who may profit from responses to spam. There is potential for a regulatory response to target the people who decide to send spam, or who collaborate in its sending, as well as the person physically responsible for sending it. There are a number of activities that serve to enable people to undertake spam campaigns.  These activities include:

• The sale of email address lists.

• The operation of “spammer friendly” domain hosting companies.

• The utilization of harvesting software to collect e-mail addresses from the Internet.