Email hoaxes, and the merits of BCC:

Everybody knows about computer viruses - but does anyone know about email hoaxes? It would seem not. Almost every week I seem to get one of these annoying messages, sent to me with some urgency and sometimes with alarming warnings.

The classic message is a virus warning which ‘has just been issued by Microsoft/McAfee’ or whoever. Sometimes the warning is about a virus email - recent ones I’ve received have been about emails from Hallmark and (very popular this) one purporting to show pictures of Osama bin Laden hanged. These emails - it is claimed - will, if opened, destroy my “C: drive” (Clever, that - as a mac user I haven’t got one). Sometimes they warn about a virus infection I might already have, and describe how to delete the offending file (with a teddy bear icon) from my windows system - a file which, incidentally, I would need, if I had a windows system. Sometimes the hoax email is less alarming and more alluring: for example the one about a free Nokia laptop, if I just forward this email to eight other people. (Nokia don’t make laptops, at least not yet). And then there are the ones with warnings of a more general kind, such as one from ‘the London ambulance service’ warning that if a car flashes you late at night do not flash back, as this is taken as an invitation to malevolence by the driver of the other car. Another warns about people getting into the back of your car at the petrol station. This is perhaps my favourite email hoax, simply because the message first appeared in the middle ages - mutatis mutandi - long before email. Some of these messages have to my mind a certain distastefulness to them - such as the one I received about a missing girl: what the message did not say was that the girl had gone missing many years earlier, in the United States, and that her suspected abducter and abuser had committed suicide. And, oh yes, the photos in the email were of a different girl. Sometimes however, the messages may be considered inspiring or amusing, depending on your tastes: powerpoints of cute animals, or inspirational scenery, or in a most recent case, a ‘miraculous’ picture of Pope John Paul II, taken after he was shot in 1980.

Now all these messages are clearly documented as hoaxes in one way or another, or at least greatly inaccurate in important details. Just googling some text from them reveals them as such.

These messages are actually quite easy to spot, and most have three striking characteristics:

1. They contain vague information, some of an alarming kind, especially when it comes to time scale - using words like ‘recently’, ‘yesterday’ - and the nature of the threat: ‘destroy your C: drive’.

2. They often claim an authority, but never precisely, and never refer directly to the authority, in other words they are always second hand messages. Whether it is ‘Microsoft’ or ‘the London Ambulance Service’ or even - in the case of the miraculous picture of John Paul II - a Vatican official, you will not find a link to an authoritative site or statement. Often, doing a search to the claimed source with some text from the email will reveal a statement denying the content of the message.

3.  They include a request - and this is the most important part - often very forcefully stated, to distribute the message to as many people as possible, even ‘everyone in your address book’.

There are other common features too, such as the use of very large fonts, and rather garish colours. The language used in these hoaxes is often very similar from hoax to hoax. Not unusually - as in the case of the Nokia ‘laptop’ and the petrol station intruder - there are earilier versions of the same hoax: the original Nokia ‘offer’ was for a mobile phone, and of course the mediaeval warning involved someone sneaking into the back of the owners cart.

Why do people fall for them? Partly because they exploit things they know to be true. Everyone knows - or should know - that attachments may be risky to open, and unsolicited emails sometimes hide viruses. Everyone also knows that bad things sometimes happen to good people, and we should all be aware of our personal safety. The message about the missing girl exploits the publicity surrounding Madeleine McCann. The messages prey upon people’s fears,  their good natures, and sometimes their greed, but it would be rash to suppose that it is only the unsophisticated who are taken in by them. Intelligent and educated people - even a senior priest in the Archdiocese of Birmingham - have sent these messages to me. I have received so many that I put a message at the base of my own emails to warn people about them.

But do they really matter? Yes, I think they do. For one thing they waste time and bandwidth. While the latter may not matter too much, the former does. People spend time sending them, receiving them, reading them, and acting upon them. They also stoke pre-existing fears and exploit their recipients. The messages may contain viruses themselves. Some claim that they actually cause greater costs to business than the viruses themselves. 

And there’s more - they are themselves viruses - because built into them is ability to spread. If each person who receives one sends them to just ten people, then by the time the message has been sent six times, it has been received by more than a million people.
And what is is that they do? When the senders send them out, they typically put all the email addresses into the To: and cc: fields. This means that if I receive one of these messages, my email address has already been sent to every other recipient too, and in a few days, a million people (who obviously I do not know) may have received an email address which I had hoped to retain for private correspondence only).

And perhaps, perhaps, here lies one of the purposes of these messages: if you can track them, you can collect the contents of the address books of millions of people - you can collect many thousands of email addresses, and also the addresses of their contacts. You can harvest email addresses for the purposes of spam, and then distribute the bots that infect many computers throughout the world. These are the bots that can be controlled to bring down servers and disrupt governments - and this particular part of the message is not alarmist: it has actually happened.

And this could all be stopped if people just followed two principles:

1) Never send messages to multiple recipients (who do not know another) using cc: If you must send them use bcc: (blind copy)

2) Delete any message that says ‘Send this everyone in your address book. Now.’

I think I might just write a hoax email to make people do just that.