Thu Jun 24, 2004 2:16 pm
AOL Traitor
AOL Worker Is Accused of Selling 93 Million E-Mail Names
By SAUL HANSELL
An engineer working for America Online was arrested yesterday and charged with stealing 92 million e-mail addresses of AOL customers and selling them to spammers that were peddling penis enlargement pills and online gambling sites.
The engineer, Jason Smathers, 24, was arrested at his home in Harpers Ferry, W.Va., yesterday. Sean Dunaway, 21, who was described by prosecutors as a broker of e-mail lists for spam, was arrested in Las Vegas. The United States attorney in Manhattan charged them both with violating the new federal antispam law.
The case is among the first criminal prosecutions under the new law, which took effect Jan. 1. Each defendant faces a maximum sentence of five years in prison and a fine of $250,000 or twice the gross gain or loss from their activities.
According to the complaint, Mr. Smathers used the identity of another AOL employee, who is based in Tucson, to gain access to the list of the "screen names" - AOL's name for e-mail addresses - of its members in May 2003. The list also included the telephone number, ZIP code and the type of credit card used by each AOL member. It did not include the actual credit card numbers, which are kept in a separate database.
Mr. Dunaway bought the list from Mr. Smathers to promote his own Internet gambling site and, in turn, sold the list to other spammers for $52,000. Later, last March, Mr. Dunaway paid Mr. Smathers $100,000 for an updated list.
The complaint said that Mr. Smathers sold the list to others, but it does not detail the buyers or the terms of those sales.
AOL said in a statement that Mr. Smathers's wrongdoing was first detected earlier this year by AOL as it was pursuing a civil lawsuit against a group of spammers. In the process of discovery for that lawsuit, AOL interviewed someone who said he bought addresses of its members from an insider and used it to send spam for penis enlargement pills, according to the complaint.
AOL passed that information to the Secret Service. The pill vendor told the Secret Service that he purchased a list of names from Mr. Dunaway, who had told him they came from an employee of AOL.
America Online, a unit of Time Warner, was able to determine the identity of the insider by looking at the dates from a copy of the stolen list provided by the pill vendor, according to the complaint. Once it determined the date that the list was stolen, it looked at its log of users and determined that the computer of Mr. Smathers was involved in looking up e-mail addresses on that date.
America Online searched the laptop computer of Mr. Smathers, who was fired yesterday, and discovered e-mail discussions about the profits that can be earned from sending spam as well as evidence that he had broken into AOL's database, the complaint said.
The pill vendor, who was not identified, also said he used secretly hijacked computers to relay the spam, which would be a violation of the new antispam law. The complaint said he was providing information to prosecutors in hopes of receiving leniency related to his actions in the case.
Mr. Smathers appeared in court yesterday in Virginia and was scheduled to spend the night in jail. Mr. Dunaway is expected to appear in court today in Las Vegas. A spokeswoman for the United States attorney's office said she did not know if Mr. Dunaway or Mr. Smathers had hired lawyers.
In a statement, AOL said, "We deeply regret what has taken place and are thoroughly reviewing and strengthening our internal procedures as a result of this investigation and arrest."
By SAUL HANSELL
An engineer working for America Online was arrested yesterday and charged with stealing 92 million e-mail addresses of AOL customers and selling them to spammers that were peddling penis enlargement pills and online gambling sites.
The engineer, Jason Smathers, 24, was arrested at his home in Harpers Ferry, W.Va., yesterday. Sean Dunaway, 21, who was described by prosecutors as a broker of e-mail lists for spam, was arrested in Las Vegas. The United States attorney in Manhattan charged them both with violating the new federal antispam law.
The case is among the first criminal prosecutions under the new law, which took effect Jan. 1. Each defendant faces a maximum sentence of five years in prison and a fine of $250,000 or twice the gross gain or loss from their activities.
According to the complaint, Mr. Smathers used the identity of another AOL employee, who is based in Tucson, to gain access to the list of the "screen names" - AOL's name for e-mail addresses - of its members in May 2003. The list also included the telephone number, ZIP code and the type of credit card used by each AOL member. It did not include the actual credit card numbers, which are kept in a separate database.
Mr. Dunaway bought the list from Mr. Smathers to promote his own Internet gambling site and, in turn, sold the list to other spammers for $52,000. Later, last March, Mr. Dunaway paid Mr. Smathers $100,000 for an updated list.
The complaint said that Mr. Smathers sold the list to others, but it does not detail the buyers or the terms of those sales.
AOL said in a statement that Mr. Smathers's wrongdoing was first detected earlier this year by AOL as it was pursuing a civil lawsuit against a group of spammers. In the process of discovery for that lawsuit, AOL interviewed someone who said he bought addresses of its members from an insider and used it to send spam for penis enlargement pills, according to the complaint.
AOL passed that information to the Secret Service. The pill vendor told the Secret Service that he purchased a list of names from Mr. Dunaway, who had told him they came from an employee of AOL.
America Online, a unit of Time Warner, was able to determine the identity of the insider by looking at the dates from a copy of the stolen list provided by the pill vendor, according to the complaint. Once it determined the date that the list was stolen, it looked at its log of users and determined that the computer of Mr. Smathers was involved in looking up e-mail addresses on that date.
America Online searched the laptop computer of Mr. Smathers, who was fired yesterday, and discovered e-mail discussions about the profits that can be earned from sending spam as well as evidence that he had broken into AOL's database, the complaint said.
The pill vendor, who was not identified, also said he used secretly hijacked computers to relay the spam, which would be a violation of the new antispam law. The complaint said he was providing information to prosecutors in hopes of receiving leniency related to his actions in the case.
Mr. Smathers appeared in court yesterday in Virginia and was scheduled to spend the night in jail. Mr. Dunaway is expected to appear in court today in Las Vegas. A spokeswoman for the United States attorney's office said she did not know if Mr. Dunaway or Mr. Smathers had hired lawyers.
In a statement, AOL said, "We deeply regret what has taken place and are thoroughly reviewing and strengthening our internal procedures as a result of this investigation and arrest."
