Slashdot Mirror
Disgruntled Fan Arrested, Indicted For Spam Attacks
An anonymous reader submits: "A *very* interesting precedent here might get set here. A California man has been arrested by the FBI for sending spam spoofing the From: email address of several Philadelphia-area newspaper editors and writers. The charges relate to the damage caused by having the bounces sent back to the Philadelphia Inquirer and Daily News, with a total of more than 160,000 bounced emails. Maximum penalties: 471 years in federal prison, $117 million in fines." And not just arrested, either -- Reader red_dragon points to the indictment (PDF linked from this U.S. Attorney's Office release).
Sending spam is bad.
That being said, does it seem a little unfair that the indictment charges him with "hacking", when in fact he just spoofed his email address?
"Oh, beautiful for spacious skies...."
gah.
have you been seen on slash?
471 years in prison for spamming? 100s of millions in fines?
I dont care how much you nerds hate spam. Prison is for people dangerous to society. Murderers, rapists, other assorted thugs. Society isn't helped because a spammer is in jail.
Why this the first case they pick up on, because this guy dared to screw with the media? (Think Lamo and the NYT thing). Government/media go hand in hand these days.
I don't need no instructions to know how to rock!!!!
A *very* interesting precendent here might get set here.
This might *not* have been read by a slashdot editor might *not* have read this.
If I were king of the universe, rather, WHEN I am king of the universe, spammers will get the death penalty.
If tits were wings it'd be flying around.
Thus the old maxim:
Never tick off people who buy paper by the roll and ink by the barral.
-Daniel
Ownyourphone.com. Custom ringtones, cheap and easy
For forged bounced emails, the fine is 1 day in prison and/or $734. Per email.
:)
I got 500 bounced emails from a university in Canada once, should I sue them using this as a precedent?
I could *really* use $365,000. I'd even accept it in Canadian dollars (in fact, that would be easier, given that I am Canadian).
It's a scare tactic. They'll rub the accused's nose in his 471 years, which will convince him to take a plea bargain on only a few counts. He'll most likely serve only a few years and face minimal fines.
471 years in jail, eh? What's so wrong with lifetime?
And isn't prison about rehabilitation? Will this guy rehabilitate by never in his life having a chance of getting out.
Or is prison just about hot male on male action nowadays? I'd say so...
I hope Arnold will create some kind of prison reform.
Oh, and there's a word I didn't know in the article(and I won't even bother checking some book). What does 'scatological' mean?
$117mil/160k mails = $731.25 per email.
Now, I've had spammers use my address as a from: address a couple of times, resulting in a couple of thousand bounces in my inbox.
When should I expect my check for $1,462,500 to arrive?
This is crazy - bounced emails don't cause $117 million damage.
The guy could have raped, pillaged and murdered and still do less jail time / fines.
Last.fm - join the social music revolution
When people like Steve Hardigree have done orders of magnitude more damage, are just as easy to find, and have all the evidence ever needed for such an indictment stored at spamhaus.org? It doesn't make sense. Even if you can't get a conviction, which seems unlikely, wouldn't it put a serious dent in the spam problem if some of these worthless spammers were handed an indictment of this size?
Do you have ESP?
You know if the guy just went on a killing spree, he probably would have gotten less jail time. Makes you think how valuable your life is in the eyes of government.
Given the disparity of penalties between, say, a mugging and this spam attack, it's clear that the government would prefer that we express our rage with assault and battery. Most murderers get off with less than 471 years. Lemme know your favorite assault weapon so I can start settling my scores the gov't approved way. note to humor impaired: that's sarcasm there. I agree with General Clark: if you want assault weapons, join the Army -- they've got lot's of 'em.
--- Often in error; never in doubt!
If that, in and of itself, can constitute a crime then pretty much every spammer ever is guilty of the same thing -- just spread about amongst different people. Instead of one company incuring all the "financial damage" of bounced emails, it's many thousands with the "damage" spread around.
Still . . . I have to believe that there is something more to this story than is posted here. If the hacking charge truly comes from simply lying in the "From:" portion of an email, then I will have lost all faith in humanity.
And of couse, the punishment is obviously completely absurd. I'm torn about what to do with this guy myself. Clearly what he did constitutes a DOS attack of sorts, and yet what he did is essentially no different than what every spammer does everyday. IANAL, but if this case is sucessfully prosucuted, wouldn't that give precedent for prosecuting every spammer out there?
The penalties aren't for the spam he sent, but rather for spoofing the sender's address. Many (hundreds of thousands) of the spam emails he sent out were to bad/non-existent addresses, and were bounced back to the real addresses he faked as his own. The people who received the "returned" emails are suing him, not those that got spammed.
That being said, I agree that the maximum penalties are harsh, to say the least. Then again, they are maximum penalities, and I'd be surprised if he goes to jail for more than 5-10 years, if at all. There's no doubt that he caused damages, but not 117 million dollars worth.
Maybe he should kill off the FBI that have evidence / charging him. Least he'd get a lower maximum sentence.
I've left to find myself. If you happen to see me, please, keep me there until I return.
"Carlson faces a maximum sentence of 471 years imprisonment and $117,250,000 in fines."
Well damn, I'm heading out to the gun store, gonna rob me some banks, shoot me up some people up and still get out of prison faster than this guy.
Is it just me or has the US Guhvumment been totally hijacked by corporate interests to the point where the US Constitution is just a minor inconvenience?
What happened to no cruel nor unusual punishment, the punishment fitting the crime, our inaliable rights?
The only time I have heard of such a possible maximum has been in the case of multiple-murder and serial child molestation. And even if they give him say... 5 years, he will be financially ruined forever at even a fraction of the proposed monetary damages. So his life might as well be over.. quite lliterally made a slave to the corporations he will have to pay this "restitution" to...
And wasn't slavery constitutionally abolished over 100 years ago? Well as long as he isn't black I guess it's all ok.
Why did the article authors mention the guy being a possible white supremacist? They say that in the first paragraph, as if it were something important, and then don't bother going on to connect that to the events described in the article.
I mean, generally speaking, most people agree that any form of racist supremacy is bad, but if it doesn't have anything to do with the charges against him, then mentioning it just incites the audience unfairly. If his political views do have something to do with his actions, then they should have let us know instead of leaving us hanging.
I could have expected this from a Flyers fan, but a Phillies fan?
What's this world coming to?
Someone you trust is one of us.
Let's look at California penal code.
How about throwing acid in someone's face?
OK, let's see, what if I attack someone with a knife?
Hell, given that Arnie is now governator of California what happens if I start spraying machinegun fire around?
So, four years in jail for permanently disfiguring someone, four years for cutting somebody up with a knife, twelve for machinegunning people and... 471 years for spoofing a From: email header.
Ah, yes, justice...
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
Prison is for people dangerous to society. Murderers, rapists, other assorted thugs. Society isn't helped because a spammer is in jail.
Well, it's not helped by leaving them out of jail. They are a public nuisance to millions of people. And in this case, cost someone money. Now, having them taken out and shot, or having their kneecaps broken, would probably be better way to deal with spammers than throwing them in jail, but we have this "cruel and unusual" clause here in the US, so jail it is.
And yes, the Media has some protected status here in the US; pragmatically, because the government desires to keep anything powerful from getting too pissed at it, but also on the principle that people interfering with First-Amendment protected organizations are Bad.
//Information does not want to be free; it wants to breed.
I highly recommend following the DOJ links to the indictment. This guy hacked into other computers to send out tens of thousands of bogus emails that caused massive boucebacks to the victims. Sure, the "maximum" sentences look absurd, but that's where the interesting part of this case will come in. The guy clearly needs to have the book thrown at him, and spend some time in "federal, pound-me-in-the-ass prison." Just how much remains to be seen...
Stop by my site where I write about ERP systems & more
The part about hacking into people's computers should arguably be a prosecutable offense. But "spoofing" the from address should not be: the "From:" line is currently pretty much only advisory and will remain so until there are significant technical changes to the email infrastructure.
And it's too easy to put in the wrong "From:" line accidentally when configuring mail systems. For example, I was using the right account name with the wrong domain name for a week once in my From: line (I thought my mail was broken). Someone else actually got some of the responses intended for me.
Prison is for people dangerous to society. Murderers, rapists, other assorted thugs. Society isn't helped because a spammer is in jail
Research shows that many inmates tend to become even more hardened criminals once they are sent to prison.
When he gets out in 2471, society better watch out.
Where does the school board find them and why do they keep sending them to ME?
This is a civil matter. The newspapers should sue the guy, he did something wrong, but there is no point in putting the guy in jail for the rest of his life and make him bankrupt. After all, putting someone in prison will acomplish nothing, they are meant to correct people or keep dangerous ones out of society. This will just spend more of tax payers money needlessly. Putting someone in prison for the rest of his life is expensive, and after all don't we have better things to pay for like an illegal war based on lies?
-Seriv
It isn't *just* that he sent thousands of spams. He allegedly hacked into others' PCs and sent the spams from them. Doing so with a bogus return address would have been bad enough, but he allegedly forged return addresses to redirect bounces to Philadelphia sportswriters. Unlike most spammers, this guy had an axe to grind, which made him far more traceable. Also, unlike most spammers, he attacked a very targeted group of people.
The clown involved in this mess is well known on the rec.sport.baseball newsgroup (and presumably in the Phillies newsgroup, as well). Nobody there is shedding a tear over his apprehension. He's a crank and a racist and nobody will miss his lunatic rants.
That said, if he were just a crank and a racist and hadn't done anything specifically illegal, this would be a good time to complain about the preferential treatment received by some in our society. But this particular case is about a guy who broke the law and did so in a way that pointed the finger right back at him. I have a hard time feeling outraged on his behalf.
How nice of the US Attorney's Office to publish the defendant's FULL NAME, CURRENT ADDRESS and DATE OF BIRTH prominently on the web, for all to see.(See linked PDF in topic) Even better, this guy is going to be out of the house for a while, so it should be no problem to pick up his mail.
I swear, the only thing protecting this guy's ID now is his new-found criminal record.
News Flash: China, in a desperate attempt to keep up with the United States has introduced a wave of new registration including the death penalty for spamming. A seperate bill, also introduced, proposes 30 years hard labor for trolling Slashdot.
For those of you comparing the maximum sentences for robbery, theft, arson, assualts and so on to this guy's maximum sentence, I'd like to point something out.
What's more harmful to society? The murder of a single person or 160,000 bounced e-mails?
The point here is how poorly constructed these laws are. They are built upon antiquated views that simply don't realize the limits these laws can be taken to; as we now see in this case.
It should not be a per-email offense, it should be a per-incident offense with a bit of leeway in sentencing to handle light (a few dozen spoofed mails) to heavy (a few million spoofed mails) incidents.
Did this guy do something wrong? Yeah. But does it warrant 500 years in prison and millions of dollars in fines? No way.
This should fall under existing harrassment laws and this spoofed e-mail law be nixed.
I wonder what would have happened if this guy put 10,000 letters into the mail system with a bogus address and a return address of these newpaper editors?
A friend of mine is the webmaster of PhilaPhans.com, and was also affected by Allan Carlson's activities. He pointed me to this little note (scroll down to "Elysian Valley, Burbank"), where the guy's name pops up again:
Virginia de la Torre found a hate message in Aug. tucked inside a frozen chicken dinner. Robert Kennedy, a Long Beach lawyer representing the California Grocers Association says that since 1992, there have been more than 800 incidents of hate messages found inside products sold in stores in Ventura, Los Angeles and Orange counties. "You name the store, you name the product, and they've been hit," he said. "The slurs are against Jews and blacks and Hispanics. It's an ongoing problem." A Los Angeles Superior Court judge issued an injunction against Allan Eric Carlson of Glendale, prohibiting him from putting such pamphlets into packages in any of the 1,100 stores in the three-county area that are members of the grocers association. Carlson had been arrested and is on probation for two similar incidents; in one he vandalized notebooks and books with WAR [White Aryan Resistance] stickers and stamps; in a second, he assaulted a school custodian after being caught stuffing flyers into student lockers in Simi Valley.
So there you have it. Like McSpew said, he's a crank and a racist.
In Soviet Russia, Jesus asks: "What Would You Do?"
Spammers and other net vermin (cowards all) cause a small to moderate amount of harm to millions of people. They are getting away with it because they are not held accountable.
If the harm product of Spammers and other shitheads (defined as harm * number of victims) were held constant, and the number of victims reduced, to say 10 thousand people, then spammers would be hanging from electric poles in every neighborhood.
If a person hurts one other person, then they deserve punishment. When spammers and joe jobbers hurt millions of people, that punishment should be multiplied..
I personally favor eating spammers brains while they are still alive ( a lot like raw oysters, actually, with a wedge of lemon or a splash of tabasco) but then again I am a moderate softie, and my friends and coworkers make fun of me for being such a wuss.
EEEEeeeeeeew. I'm hoping that was intended to be the pun it turned out to be.
The rest was for being a die-hard Phillies fan. Come on.
...but trust me, having at least linear punishment (3x the crime => at least 3x the punishment) is very useful. Here in Norway, we have a law that I'd basicly call the "quantity dicount law" which means that you'll by default get less punishment than the sum of your crimes taken separately.
Frankly, the results of it are silly. If you've got e.g. 10 outstanding shoplifting charges already, your 11th will add almost nothing to your punishment because even though there's one more charge, you get less for each. In other words, once you've become a criminal, keep up!
Of course, I don't think this guy is concerned about the 472nd year in prison, so it has pretty much lost its effect. But for punishments inside a normal lifespan, I'd say it's fairly effective. Then you can use common sense (what judges and juries are for) to do reasonable corrections, as I'm sure they will in this case.
Kjella
Live today, because you never know what tomorrow brings
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
"Maximum penalties: 471 years in federal prison, $117 million in fines."
That's the fine and penalties when your spam hurts some high-profile, moneyed public figure. If the guy had forged the e-mail address of some average Joe, we wouldn't be reading about it here. If he had caused you or I to get 160,000 bounces and numerous angry e-mails, we would have been lucky to get his ISP to issue a warning -- much less get the FBI investigating and prosecuting.
I'll be impressed when the same level of interest is shown when some poor sap at home is the victim. But I'm not holding my breath.
General clark is paraphrasing Himmler (along with other NAZI sources).
(Clark had to join the Democrats once he uttered his version. There's no longer a chance he could collect enough Republican primary votes to secure a presidential nomination.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Give him some webmail account that he can access over dialup from prison. Publish that email far and
wide so it'll end up on every spam list in the world.
Then, tell him that once a year he'll get an email with a password that if he gives the prison guard, he can leave at any time.
This email can come in any form, with any subject heading, very likely disguised as spam. His webmail account will also have a 5Mb limit, and if the email bounces because it just happens to come when the mailbox is full, he'll have to wait for the next year.
Looking for a computer support specialist for your small business? Check out
Well, fines aren't meant to be indicitive of what monetary damages were done, but are rather meant to be set at a level high enough to keep you from doing it. The last time I got caught speeding, I didn't do $80 in damages to anyone, but I still got ticketed for that.
As for the jail time, he won't serve anywhere close to that. Even if he gets the maximum sentence on each count, those sentences will almost certainly be served concurrently, not consecutively. It's not uncommon for white collar crimes to add up to rediculously high maximum jail terms, because they usually involve violating a whole bunch of different laws. It's easy to be guilty of 300 counts of fraud, but a lot harder to be guilty of 300 counts of murder. On the other hand, 300 counts of fraud will in almost every case be served concurrently, and 300 counts of murder would very likely be served consecutively.
"If English was good enough for Jesus, it's good enough for everyone else."
Although in America not much critical thought is given to the best way to punish criminals (not much critical thought given to laws either) with non-violent crimes such as this one a wider range of options are available instead of prison. Maybe Ethics courses, extremely restricted computer access, public servitude, or strictly monetary fines would be better. Why throw away $40k a year to keep a spammer away from a computer in prison (i don't think they have those yet) when you could just force him or her to tell all future neighbors with an email address of their past history?
Posthuman since 2001.
I can't say I blame them for arresting this guy (although the idiotic federal multipliers for sentencing are almost silly), but isn't this just another lame PR exercise? This guy was just pissed, not a deliberate long-term spammer -- it was a one off offense, and while deserving of punishment it unfortunately will give the impression the FBI is doing something about it, when it clearly isn't.
When will we learn that you can't apply traditional laws that are designed to scale in a linear way to the Internet where you can effect such different orders of magnitude?
/.ers have been saying...
It just doesn't work. How do you apply traditional laws to some hypothetical situations...
If I send 10 fake emails but they cause all 10 computers to erase themselves.
If I sent 100 fake emails? 1,000,000? 1,000,000,000? If i managed to send a billion emails its certainly worse than a million, but do I deserve 1000x the punishment?
What about if I send a 1Million but they all bounce off of some well setup server, which barely notes a blip in the logs and it doesn't really effect it? What if I send 10,000 but they all have huge attachments that crashes a server? Is this the same?
My point is what many other
#1 The punishment should fit the crime.
#2 Jail time is an outmoded punishment for non-violent internet crimes.
But, is the punishment fitting for the crime? What punishment will the CEOs/CFOs of Enrons, Worldcoms, etc. get compared to this misguided fool? Sure this Phillies fan sent out tons of spam, but unlike Ken Lay, he didn't bilk people out of billions of dollars.
Do you really think that rape is an apropriate punishment for any crime, if so why not make it at public spectacle. Then I'm sure it will really scare all the criminals into law abiding citicens.
It is sickening the way people on slashdot seem to find the barbaric conditions of the american prison system one big joke. Do you really think that you are immune to the justice system, and that you never ever could end up in prison yourself - The same way every heroin addict never believed that he could be addicted, when he tried that first fix.
Rape is not a joke, no matter what the sex of the victim!
it is exactly that kind of thinking that leads to subjective sentencing and state extortion. If you've been following Ashcroft, you know that they're trying to force the courts to follow the law when sentencing and mandating minimum sentences.
If it is ridiculous to be sentenced to 471 years in jail for whatever number of disgruntled emails sent, then it should NOT BE IN THE LAW. It is the same with contracts and leases, etc, when there are wholly one-sided clauses that are just their for one party's 'protection', 'the lawyers make us put that there' -- It is the people's fault for not complaining when things get added or signed into law in the first place.
The point is, for a system of law to be effective and respected, it has to be consistent and fair. If the sentencing is the judge's discretion, then you deal with issues of race and sexuality & politics, etc. But if they are included into the law in the first place, and everyone agrees, then everyone can agree later to accept the punishments or work to change them again. If you want room for extenuating circumstances, think of what they could be, and add them into the law. It may make for a wordy penal code, but the clarity will help prevent discrimination and promote a sense of equality in the people.
It is ridiculously simple to influence the politicians, as you saw with the Do-not-call registry. All you have to do is contact them. They even make it easy for you, they give you their phone number, address, and email address. If a large enough amount of people want something, they do it, because above-all, they don't want to lose their seat.
Don't forget that's the MAXIMUM penalty. For every bounced e-mail there is a certain penalty, they add up and form a maximum penalty. A judge will set a MUCH MUCH lower penalty based on the crime and the damage done. The only reason the penalty was so high is because everything is automated, it's a lot easier for a computer to commit a crime 160,000 times.
If you made a script that raped or murdered 160,000 people your maximum penalty would be quite high too. I think it's about 4 million years in prison for 160,000 second degree murder charges. And I think the minimum sentence for 160,000 rape charges would be a bit under 3 million years. It wasn't that the penalty for this persons crimes should be over 400 years in prison, it's just that the maximum penalties add up to that and the fines also just happen to add up to over 100 million.
Already been tried. On atheists.
That our laws are not just for punishment. They are also to deter. Think about it this way; lets say I have a 50% chance of getting caught if I mug somebody (hey, there are cameras everywhere and the victim can make a positive ID).
If the penalty is (I'm making stuff up here) $10,000, then I'd only want to rob somebody if I can make off with $5,000. Thus, I'd only be on the lookout for blind billionares.
But, spamming is much harder to catch. You don't have to be anywhere special to spam (you don't have to reveal your identity unless you're an idiot). So let's say there's a 1% chance of getting caught. Thus, if the fine is $10,000, then I'll only spam if I can get 100 back. Not so hard.
So, we can either increase the probability of getting caught (pretty hard) or increase the fine (just pass a law - very easy). So if we make the fine $500,000, then I'll spam only if I can get $5,000 out of it.
Thus, you deter spammers to the same extent as you deter muggers. It just sounds strange when it's applied to an idividual.
----------
I am an expert in electricity. My father held the chair of applied electricity at the state prision.
As a victim of this guy's antics, I say it's about time this guy is put behind bars. My dad, who runs the software business for which I handle IT, was impersonated by this guy after proving the guy wrong on a couple of points on the old forum on the Phillies' homepage. Apparently this ticked the guy off, and he went on a forged usenet post rampage, posting spam messages appearing to come from our company, as well as trying to portray my dad as a child pornographer. It was all we could do to stop the flood of bad PR coming our way. After the guy started impersonating reporters and Phillies officials, the FBI got involved, and my dad was able to give them information about what IP address he was posting from, what ISP he used, etc.
Click here for a thread on a forum that I run that has more details on some of this guy's antics.
OK, funny either way, but was that r a typo or were you poking fun at some folks probrems pronouncing certain letters?
I just hope China doesn't have a presidential election soon.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Geez, buddy ... I hate spam as much as anything else but equating one spam to one murder is a bit extreme, don't you think?
... we're still looking for Saddam Hussein.
Besides
The higher the technology, the sharper that two-edged sword.
I'm glad they finally shut down this annoying person, as I was one of the people who kept getting his rants. [So if 100,000 messages bounced back, how many of them went through?]
Here's a sample of one of his rants ...
Build it, and they will come^Hplain.
160,000 bounced mails... less than 60 megabytes of traffic, about as much as three people running windows update or five people downloading Mozilla. Laughable. If they put people like him in the same league with Bin Laden then they should be taken outside and have their bare asses whipped with a rubber hose until they have stopped screaming and started giggling.