The Outlook Outage and Spam - A Shadow Future of the Internet

Look Out! Outlooks out!

Well, its back now, for good or for ill.

However we feel about Outlook going down, or coming back up, the impact this single, privately owned service had on the ability of millions of people to use email across a vast number of organizations says something profound about how centralized email, the one-time paragon of the decentralized protocol governed communication service, has become. I am hardly the first to point this out. Citing all the others would take all day, they are many.

What I want to point out, however, is that this centralization is not solely the result of centralized corporate capture of the once Free and Open Internet. It's not just "enshittification." It's also the result of a vast, unruly, decentralized force nipping at the heels of every electronic communication and community.

Spam.

In his wonderfully argued and researched 2013 book, Spam: A Shadow History of the Internet, Finn Brunton defines spam as "the project of leveraging information technology to exploit existing gatherings of attention." He argues that spam is a consistent "nemesis" of communities online, from the earliest usenet and email networks to social media. "Communities and spam as a whole," he writes, "are projects of the allocation of attention, and spam is the difference - the shear - between what we as humans are capable of evaluating and giving our attention, and the volume of material our machines are capable of generating and distributing when taken to their functional extremes."

More about that shear in just a moment.

But first to connect the dots on email. In his conclusion, Brunton summarizes one of his key take-aways from his history of spam as "spammers take advantage of existing infrastructure in ways that make it difficult to extirpate them without making changes for which we would pay a high price, whether in hobbling our technologies or in contradicting the values that informed their design."

Here, Brunton is pointing out how spam is a sort of Hegelian self-contained contradiction lurking at the heart of the principle values that shaped the Open Internet. These values could perhaps be best briefly conveyed via Jon Postel's famous "Robustness Principle," which asks that internet software should ideally be "liberal in what you accept from others" while being conservative in what it "does."

In other words, this calls for a kind of technological tolerance. A principle that one should be accepting of the information transmitted by others, that one should not subject that information to restraint, in the interest of a free and flexible decentralized network.

Spammers, and their cousins griefers who explicitly exploit collected attention to do intentional harm, make this principle of openness untenable. We can see how this has happened in the case of email. While email remains an open protocol, and in principle anyone can still set up a server and send email to anyone else, the expense and difficulty of engaging with email has increased dramatically, because spam.

Case in point, this very newsletter. To get this newsletter to all of you successfully, I had to enter into an agreement with a service called "Mailgun." Why did I have to do this? Could my server not send email to you on its own? No, of course not. I could spin up an SMTP email server and send it on my own. Would take maybe 20 minutes. And you would never get those emails because any sensible email provider will block email from such an unknown sender immediately. Because spam. What I buy from Mailgun isn't the service of sending email, its the service of validating email.

So of course, we can understand why the IT departments of universities and businesses are happy to buy a contract for Microsoft 365 364 and leave the difficult process, not of sending email but of sorting and blocking and preventing spam email, to a corporate vendor rather than run the servers themselves. Works great.

Until the vendor pushes a possibly-AI-authored patch to production without checking to make sure if it works, and the entire world loses email service.

Which brings us back to "the shear between what we as humans are capable of evaluating and giving our attention, and the volume of material our machines are capable of generating and distributing when taken to their functional extremes." This shear is, of course, getting worse and poised to get worse still. AI writes spam really, really well. Its hard to auto-detect. Its hard to manually detect. It arrives as email, as journal submissions, as student homework, as social media posts...

... as software patches.

Rapidly human attention is overwhelmed, with a variety of consequences. Most broadly, a threat that humans might lose agency over their technological systems, even if those systems do not break. It is easy to imagine how, under the flood of automatically produced information we might turn to automatic validation of information. Right now the easiest critique of these automatic forms of validation is that they do not consistently work. When they fail, things break. That may remain the case! But in some sense, this is the easier scenario to imagine. We would "simply" (not really simple in a competitive environment) need to slow down and ensure expert human review.

What happens if they did work is stranger to contemplate. What would it mean for there to be no "human in the loop" in our software and information systems? For us to have "knowledge" no one understands?

Right now, that second scenario is probably getting ahead of ourselves. Some of the much vaunted products of automated information production in math, for example, are looking a bit shakier on closer examination.

On the flip side, we might decide we need to strictly limit machine information, excluding AI produced text and images by establishing provenance for documents using cryptographic signatures or other means (even biometrics!) to establish human authorship. Certainly in the realm of images, photographers are deeply interested in having a working content authority system (which C2PA promises but does not yet provide) to prove that an image is real, made in camera, and not an AI fake.

We might ultimately decide such precautions are necessary, but we should not dismiss their costs, to privacy and participation, out of hand. We should think about and design for these costs carefully.

In short, Spam is the history, present, and future of the Internet. We need to grapple with how we will deal with that.