I wanted to take a moment to respond to the New York Times article that appeared on their website on May 10th with respect to mobile phone spam.

Largely up to this point the United States has missed the boat as it relates to mobile phone spam.  This is largely because the problem pales in comparison in the US to the rest of the world.  When it is more of an issue here, however it will definitely become more problematic for consumers.  In the United States your cell phone number very much becomes tied to your identity.  If you change your cell phone number it is a real pain to have to make sure you notify everyone in your contact list (family members, friends, colleagues, etc) that you can no longer be reached at your old number.  This combined with cell phone number portability that was introduced a few years ago makes it simple to even switch carriers and keep your number, which hadn't previously been possible.  In some other countries, like Japan where mobile spam is a huge problem, cell phone numbers are throwaway.  When the Japanese start getting spam on their cell phone, they change numbers until the new number starts getting spammed.  Rinse and repeat.

In the United States there has mostly been a wait and see mentality as it relates to mobile spam, but few who have gotten spam on their mobile phone would disagree that it isn't an issue that needs to be addressed. 

Let's look at it from the carrier's perspective first though.  The article states that "Communications companies say they are not interested in spam as a profit center."  I would say that "publicly" this is true, but if you look at it from a sheer numbers perspective, they carrier's are already making big money as a result of mobile spam.  Let's use the following statement from the article: "getting as few as 10 unsolicited text messages a month at 20 cents each would cost an extra $24 a year". 

Here is where the numbers game really kicks in. 

If you assume 10 unsolicited text messages per month (which is a lot in my opinion!) this equates to $2 per month (using their pricing model).  Surely some people will wait on the phone on principle alone in order to fight this additional $2 charge on their bill every month, however many will say that the long telephone waits in order to fight the charge and get it removed is simply not a productive use of their time and will leave it alone.  This, of course, begs the question what the breaking point is?  At what point do the lines cross whereby it is an efficient use of time to fight the charge.  The answer to that question will lie with each individual consumer.

Where was I?  Oh, yes!  Security!

The article mentions that "The carriers regularly adjust spam filters to block offending messages. At Sprint, more than 65 percent of all text messages sent over its network are identified and blocked as spam before they reach customers."  Spammers are aware that spam filtering for SMS spam is still not very mature.  As such, it is a target that is more easily exploited than spam over email.  To look at this as a cynic, is this also something that cell phone companies are putting considerable money towards stopping considering the amount of revenue being generated? 

I as well as many others across the security industry have been predicting the wider scale movement of spam to mobile devices for the past couple of years now and have also discussed how much easier that movement is becoming due to the inbox and the personal computer becoming a lot more mobile.  I wouldn't yet say that we have turned the corner as it relates to mobile spam nor would I say that we are on the verge of an epic increase, but the problem definitely continues to grow as the filtering technology lags behind.  Mobile malware continues to grow also, albeit not nearly at the same rate as personal computer based malware.   Now that most phones are coming with internet access, however the protections on those devices need to be at least on par with what is being provided for PCs.