Q2 2009 Spam Trends
Editor's Note: The spam data cited in this post is drawn from the network of Google email security and archiving services, powered by Postini, which provide email security to more than 50,000 organizations, including businesses of all sizes, government agencies, and educational institutions.
Context & Ripple Effects
This report is a product of Google's 2007 acquisition of Postini, whose hosted email security and archiving services now cover more than 50,000 businesses, government agencies, and educational institutions — making Google's own filter network a live sensor for global spam volume.
The Q2 numbers land against a volatile backdrop: spam surged in late 2008 when Google's CAPTCHA defenses were bypassed by spammers, then collapsed with the McColo hosting shutdown before Postini recorded spam climbing again within months. A quarterly trend report from this network is effectively the industry's scoreboard on whether that post-McColo recovery is holding.
First-order effects
- More than 50,000 Postini-protected organizations get their filtering rules recalibrated to whatever Q2's data shows about spam sources and techniques, directly changing what reaches their inboxes.
- Google converts its defensive infrastructure into published market intelligence, positioning itself as the reference point journalists and IT buyers use to gauge spam conditions.
Second-order effects
- Rival email security vendors face pressure to publish equivalent network-scale telemetry, since a vendor whose dataset is smaller cannot credibly contest Google's characterization of spam trends.
- Botnet operators reading the same quarterly signals can time infrastructure moves around the visibility gap between takedowns like McColo's and the traffic rebuilds Postini has already documented twice.
Third-order effects
- Email security continues shifting from on-premises appliances to hosted services whose value compounds with network size — the larger the filter mesh, the better both the protection and the data it yields.
- If hosted providers become the accepted arbiters of spam statistics, regulators and enterprises will increasingly rely on private corporate telemetry rather than independent measurement for judging email-borne threats.
The trend: Spam is becoming a war measured and reported by the largest hosted email-security networks themselves, with Postini's acquired footprint turning Google into both defender and de facto statistician.