Executive Conversation: Why Cloudmark Took the Path Less Traveled
Spam, spim, spoofs-¦will it ever end? Cloudmark believes that spam and all of its incarnations will indeed disappear through a combination of carefully harvested human feedback and ground-breaking tools. Having taken an unorthodox approach to building their company, in two short years Cloudmark has provided innovative ways to wage war against spam for over one million users.
Karl Jacob, Chief Executive Officer for Cloudmark shares his insight into the birth and growth of the company, and the dedicated path they chose to follow.
“We took a tough approach in that we chose not to follow anyone else’s lead. We decided to build and design brand new technology on both the consumer and enterprise side of the market. We got a lot of heat when we first launched SpamNet, and it was the classic case of disbelief. I’m happy to say that the dissention went away as our product led the industry in both accuracy and the lack of false positives.”
Cloudmark’s SpamNet was recently named “Best Buy” in PC Magazine’s June 2004 Desktop Anti-Spam Roundup, and was also the only product to receive five stars for accuracy in the recent February, PC Magazine spam filtering roundup.
It is these types of accolades that have silenced disbelievers. It’s apparent that the industry in general didn’t doubt real, working technology could be developed, but rather, could it actually put a dent in spam, the everlasting parasite of the email world? We’re a jaded bunch, and evidence clearly shows that the more sleek the technology designed to stop spam, the more sophisticated spam becomes. It’s a race that so far, no one seems to be winning.
The road to success hasn’t been without its struggles, and as Jacob explained, it was the commitment and vision of Cloudmark’s two founders, Vipul Ved Prakash, Chief Scientist, and Jordan Ritter, Chief Technology Officer, that kept the flame alive during many dark and doubtful hours.
“I remember some moments where we had long, late night discussions surrounding whether we should go a certain direction because everyone else was doing it. Vipul and Jordan really convinced me that the approach that they had dreamed up was the right way to go.”
Cloudmark held true to their belief that things such as “challenge response”, were not going to be long term solutions that would survive the onslaught of spammers. Eventually, their notable predictions proved to be true.
“Vipul early on highlighted the fact that challenge response, being based on email addresses that were unable to be authenticated, would eventually be overcome by the spammers. Sure enough that happened. “SoBig’ and “My Doom’ and many others are great examples of how that system has been subverted,” says Jacob.
Cloudmark also stands firm on their general dislike of the ominous White Lists and Black Lists, believing that it employs a sledgehammer approach to killing a fly. Their opinion is that by trying to get one spammer with an IP address block, a company may end up blocking entire sites, and in some cases, entire companies from communicating with them. It’s easy to see why this may lead to bigger issues than those a company initially set out to conquer. Due to mistakes in the listing process, inadvertent blocking, and inevitable damage to reputations, several lawsuits are currently pending against ISP’s and service providers. The repercussions of false positives aren’t always pleasant and the spammers themselves are fighting back with both eloquence and vehemence. In our Capitalist society, making money isn’t a bad thing, and though one’s choice of career may be annoying to 99.9 percent of the public, it is in most cases, not illegal. In an ironic twist of fate, preventing the legitimate spammers from doing business where they’re allowed, isn’t legal.
As Mr. Jacobs pointed out, many issues are often caused by technology that was developed five or more years ago, sufficient for use in the early days of spam but no longer meeting the needs of today’s companies. As the world has seen over the past year, spammers have found their way around almost every anti-spam system the industry has been able to implement. In the cases where spammers can’t go through technology, they merely go around it through phishing; well-planned bouts of social engineering, for which, quite unfortunately, there is no cure.
In response to whether Cloudmark believes in the importance of email authentication, Mr. Jacob says, “We actually think authentication in the email system is a good thing, however we are not as willing as others to believe that it’s going to be adopted overnight. The other issue here is at what level the authentication happens. The easier way to do it is authentication around domain names or IP addresses but of course the issue that you run into is that email is a very personal thing. I’m not really interested in trusting the whole of CitiGroup to send me all the right messages that they’re supposed to send me. As a consumer, I want to be able to select what I authenticate. I want to choose what I should get and what I shouldn’t get. Until those systems address those issues, they will only be of use at the very high levels between ISP’s where they can authenticate everyone at Comcast or Yahoo or wherever.” For Cloudmark, authentication is just the beginning. They are true believers that in order to have a successful system one has to be able to have authentication as well as reputation. Knowing who a sender is, is one thing, but knowing their reputation should be the deciding factor on whether or not they are allowed through the door. They take a merciful stance when it comes to forgiving spammers for past misdeeds and support their desire to become legitimate.
As Jacob says, “Understanding people who’ve gotten their act together is another key to a successful system. A problem with a lot of today’s systems is that they presume once you’re out of the club, you’re out of the club forever. It’s difficult to imagine a small spammer dealing with legal wranglings, filling out all types of forms to get themselves removed from a “bad sender” list. If you end up on the other side of a large company’s black list, good luck trying to get off any sooner than two weeks.”
Cloudmark has made a reputation for themselves with their peer-to-peer technology. Yet peer-to-peer hasn’t always been embraced as the next best thing and is often confused with illegal activity such as sharable/downloadable music files. When asked why he feels the peer-to-peer architecture works, Jacob answers – “In my opinion, the reason peer-to-peer works is the same reason that ebay works. When you empower individuals, even in a tiny way, and take that and lash it together in a community so that one click turns into ten clicks, turns into millions of clicks. We’re still seeing what the power to peer-to-peer is actually. It leverages all the power of all the machines in the network and also, interestingly enough, leverages the people, and it turns what would normally be an insignificant deleting of a message into a powerful piece of feedback for the network, which helps that person and helps everyone connected to the network.”
The key difference between Cloudmark’s peer-to-peer technology and say, a file-sharing peer-to-peer technology, is that Cloudmark shares fingerprints, the secure one-way hashes that can’t be turned into the content they represent. They do not ship content around the network, which adds up to a big difference. Cloudmark is essentially shipping around people’s opinions about spam, which people are willing to share freely. One of the challenges that Cloudmark learned early on is that as powerful as the peer-to-peer network seemed to be, the overall opinion of running a peer-to-peer network inside their company didn’t really inspire many folks in the enterprise world. These doubts were channeled that into what Cloudmark calls their spam DNA technology, which has been distilled down to something that can be run at the gateway. At the enterprise level, the same level of spam protection is provided without having to run SpamNet on all the desktops.
“Part of our core advantage is what we call the evolution engine. We have a genetic classifier that is about a generation beyond what other people call Bayesian classifiers. Other companies kind of train the classifier and then send it out to their customers. The problem with that is that with problems and feedback you go through this long iteration that makes improvement a very slow process. What we’ve done is simulate that process, using evolutionary techniques. We literally take the spam DNA cartridge, allow the system to make changes to it and then repeat the process. This is how we get the highest accuracy and lowest false positives,” explains Jacob.
No matter what the engines are that power Cloudmark’s mind-bending technology, from genetic maps to one way hash computations, it matters most that the product works. People are more than ready to start seeing results and stop discussing how to make results happen.
“The bottom line is that people want products that work. We’ve had that with SpamNet since day one. You install it and it just works. On the enterprise side it’s a much higher bar. We feel that the simplicity of our product and its functionality speaks for itself. We often run into vendors touting amazingly complex products that update 500 times a day and have tens of thousands of rules. Companies are very concerned that the ease of use and simplicity of our products. Some people have a hard time believing in things that aren’t overly complicated. To them, it’s a really difficult problem and so they want to see all this complex gear to address it.”
“In reality, it’s a sign of where we’re at in history. In terms of anti-spam, we’re at the very beginnings of the technology evolution. We all know where this ends up; sleek and sophisticated offerings that make our lives an easier place to be. Yet nobody wants to believe in this trend, especially anti-spam vendors who think that the more complicated and voodoo they can make their product, the easier it will be to smother the simpler solutions that really work,” ends Jacob.
Cloudmark’s groundbreaking, P2P solution (initially Vipul’s Razor) proven effective at fighting spam since 1998 and now called Cloudmark SpamNet, is the first and largest SpamFighting community in the world with more than one million users. Most recently, Cloudmark introduced Cloudmark Exchange Edition, a server-side anti-spam solution that takes advantage of real-time automatic updates from the SpamNet community to deliver maintenance-free, instant spam protection to SMBs.
Melisa LaBancz-Bleasdale is a freelance technology writer busily deleting spam while living in the San Francisco Bay Area.