If you think spam is about selling the products being advertised, in most cases you’d be wrong. The real spam business is very different.

By definition, spam is any unsolicited or indiscriminate bulk message sent electronically. That covers email advertising, yes, but also messages sent by SMS or instant messaging, or posted in blog comments. It also covers non-commercial content such as political or religious messages, or attempts to defraud you or others, or to infect your computer. Those last few are where the real money lives.

An estimated 94% of all email is spam: over 100 billion messages every day. Some of that is advertising by businesses who don’t realise it’s wrong or, imagining a sudden surge of business, don’t care.

But over 80% of spam is sent by fewer than 200 people using networks of “borrowed” computers called botnets. These zombie computers have been infected with a virus or Trojan horse that hands control of the computer to the bad guys. Ironically, that infection is itself usually delivered via spam, or surreptitiously installed by an infected website promoted by spam.

All this happens on a vast scale.

Internet pioneer Vint Cerf reckons up to a quarter of all computers on the internet are already part of botnets, their owners unaware. In April 2008 it was claimed the Kraken botnet consisted of 495,000 zombie computers capable of sending 9 billion spam messages a day. In late 2007, the Storm botnet may have been even larger, with more than a million zombies.

The amount of spam we receive each day varies wildly as new botnets come online or are dismantled, or as spammers learn new tricks to fool the spam filters. At least until the spam-fighters work out a countermeasure.

The Srizbi botnet was around 450,000 computers, but could send 60 billion messages a day. When internet hosting provider McColo was shut down in November 2008, taking Srizbi’s controlling computers with it, global spam volumes dropped 75% overnight.

In 2008, investigators infiltrated Storm and reported that 350 million spam emails resulted in a mere 28 sales, a conversion rate well under 0.00001%. “All but one were for male-enhancement products and the average purchase price was close to $100,” the researchers said. Total revenue: $2,731.88. Yet this is such a tiny percentage of Storm’s capacity that it translates into potential annual revenues of $3.5 million, even without repeat sales. Not bad for using hacked computers for free.

That all still assumes sales are the aim. As Joe St Sauver pointed out in 2003, though, “the mechanism by which [spammers] make money often has nothing to do with the sale and delivery of an actual product or service.”

Often, the aim is to gather your name, address, credit card details and anything else which allows the attacker to steal your identity. Identity theft and the resulting fraud is now bigger business globally than the illegal drug trade.

Heard of the Nigerian Scam? Or of phishing?

Another possibility is pump and dump stock market fraud.

Sending spam is illegal in Australia. The Spam Act 2003 applies when there’s any “Australian link” — that is, if the message is sent from or commissioned here, or if the recipient accesses their address from Australia. You can only send commercial messages with the recipient’s explicit consent, and only if the message identifies the sender and has a functioning unsubscribe facility.

There’s a few narrow exemptions for “implied consent”, such as when there’s an established, ongoing business relationship, or for purely “factual messages”. There are also some exemptions for government, political parties, religious organisations and registered charities, as well as educational institutions contacting current or former students.

Hacking other people’s computers to send spam is a crime, of course, as is engaging in stock market or credit card fraud via any medium.

Bonus video: Why is it called “spam” anyway? Blame Monty Python’s Flying Circus.