In IT security, we do hear the occasional story of where a bad guy has come over to the good side and started, for example to help companies protect themselves from hack attacks. There's a parallel to this in software, when for example a program which may once have had dodgy connotations becomes something that everyone can use—peer to peer for example, in its Groove guise.

With spam checking however, things seem to be going the other way. Sure, don't get me wrong—I'm delighted that protections exist, lest I be inundated with irrelevant messages (I have all the performance-enhancing drugs I need, thank you). But—and increasingly—spam checkers seem to be stopping the good stuff, sometimes with quite unfortunate results.

I've long been reciting the mantra security equals productivity. In general, many issues are such because they might somehow prevent us from working, or may cause us unnecessary pain fixing problems. The counter, for example, is that there's no point in taking the sales guy's PDA away because of potential security issues, if that causes a significant reduction in sales. Risk management theory says we need to balance the potential risks (loss, theft) and their consequences (data leakage, fraud leading indirectly to loss of business) with the issues caused by the countermeasures (direct loss of business). All makes sense.

Enter anti-spam. Trouble is, the standard set of behaviours associated with email tends to assume that if a message doesn't bounce, it will have got through. Over the past few weeks I have sent messages which (it transpires) never arrived, some of which could have led to embarrassing apologies if a colleague hadn't spotted the issue in time. Similarly, I've found messages from clients in my spam box—or should I say spotted given the ton of other messages in there. There may be somebody right now waiting for an email which I have already sent, but which will never appear, and both sender and receiver will be none the wiser.

I don't know what the answer is, but the unfortunate truth is that the email mechanisms we have accepted are in fact woefully inadequate—and I'm not just saying that as an ex-X.400 trainer. Technologically, it would be quite straightforward to implement whitelisting mechanisms in which named correspondents are given priority, indeed I'm surprised there isn't a Facebook plugin already. Non-repudiation via encryption is also old technology, built into the majority of mail clients and sitting there idle. I wonder whether there will be an event that will force us to change our habits, but for now we'll just have to make do—and cope with the consequences.