Guilty Plea in AOL Engineer's Address Theft Case

ScentCone writes "Jason Smathers, a former AOL software engineer has pleaded guilty in his theft of 92 million in-house account screen names. He'll be paying $200-400k, and serving a year or two of federal time. Smathers used another employee's account to steal the data, and sold it to a Vegas-based online casino operator. Interestingly, one of the charges was 'interstate transportation of stolen property.'"

Comments

Interstate?

[Bongoots]

If he was charged with 'interstate transportation of stolen property', does that mean that he printed out all 92 million screen names and took them in his car across state borders?

Re:Interstate?

[shark72]

"If he was charged with 'interstate transportation of stolen property', does that mean that he printed out all 92 million screen names and took them in his car across state borders?"

Doubtful. A sometimes common perception among Slashdotters is that the law is immutable and easily defeated by technology, but a look at how the law has changed over the past several hundred years shows that the law does eventually catch up. It's my understanding that interstate transport can now include e-mail as well as the historic methods of postal mail and, as you've mentioned, cars. And, of course, you probably already knew that that database is AOL's property whether it's printed or not.

Other examples: it took several years after the advent of motion pictures before copyright law caught up with them. There were a few years in which films weren't copyrightable, but the law did catch up. When the first cars started being built, there were no vehicle codes (or if there were, they covered things like carriages), but the vehicle codes eventually caught up. And, for most of our history of copyright law, it was basically legal to redistribute copyrighted material without compensation; the law didn't need to cover this because it was simply impractical to print a thousand books and give them away for free. When technology began allowing somebody to put a file on an FTP site and allow widespread duplication, copyright law finally caught up several years later, in the form of the NET act.

You've got jail!

[ShatteredDream]

Sorry, couldn't help it...

What?

[VeryApt]

Textual representations of AOL customenrs email addresses are considered AOL's property? As much as I hate spammers, that is insane.

I'd like to know

[www.sorehands.com]

I'd like to know which gambling sites that this was used to promote. I'd love to file lawsuits against some of these spamming, gambling, sites.

Maybe, they'd learn that when spamming, the sysadmin wins.

Re:Deserved it

[ryanjensen]

Don't worry, they have installment plans for that. Kinda like winning the Publisher's Clearing House sweepstakes, but in reverse.

I'm sorry, but this is crap...

[j1bb3rj4bb3r]

The guy who gives the email addresses to the spammers is forced to pay restitution costs to AOL for the amount they spent on dealing with email that the spammer's sent. This is bullshit. If anyone should have to pay, it is the spammers. The guy can go to jail for theft of property (if you consider email lists property... which the government seems to... but this is another issue), but he didn't directly cost AOL any money. This is a crap example of a big company getting money from this little guy because getting the money from the spammers is nigh impossible. He plead guilty, so I think that keeps him from being able to appeal.

Re:I'm sorry, but this is crap...

[YrWrstNtmr]

This is a crap example of a big company getting money from this little guy because getting the money from the spammers is nigh impossible.

I know it's a chore to actually read the article, but:
"Smathers told the judge that he accepted $28,000 from someone who wanted to pitch an offshore gambling site to AOL customers, knowing that the list of screen names might make its way to others who would send e-mail solicitations."

It's not like he is an innocent party in this.

"Smathers allegedly sold the list to Sean Dunaway, of Las Vegas, who used it to send unwanted gambling advertisements to subscribers of AOL, the world's largest Internet provider. Charges are pending against Dunaway."

Say what you want about AOL, but they do appear to be going after these clowns.

Re:Obvious

[YrWrstNtmr]

Do we know for how much he sold the stolen list?

We who RTFA do.
$28,000

Re:That's federal pound me in the ass prison.

[Anonymous Coward]

Doesn't it seem wrong that extra-judicial rape in our prison system is not only tolerated, but sort of cheered on?

Why don't we just go to a system of corporeal punishment, like in Singapore? At least there, the amount of physical punishment you take bears some relationship to the crime you've committed, whereas in our system you're punished according to your physical strength, ability to join a gang, etc. that have nothing to with the severity of the crime you've committed.

If you think prison rape is just fine, then you should stop kidding yourself and start advocating an official corporeal punishment system. There are not disadvantages to the system we currently have. It's much fairer. If you find this argument absurd and/or don't want to repeal the 8th amendment, then you should not sit idly by and let this absurdity rage on unabated.

Later in the prison showers...

[leathered]

'You've got male!'

mandatory restitution?

[brian.glanz]

Smathers is only paying "the amount the government estimates AOL spent as a result of the e-mails," which is that $200,000 to $400,000. Is our government unable to represent those who suffered significantly more harm than AOL, the people?

Sufferers may primarily be AOLamers and maybe all of us here will laugh that off to some extent, but consider "The stolen list of 92 million AOL addresses included multiple addresses used by each of AOL's estimated 30 million customers. It is believed to be still circulating among spammers." AOLamers or not, these are our grandparents and grade school teachers; training-wheeled users who if anything, need more protection than we do.

This penalty does them no good, whatsover. TFA makes it clear that a signficant number of them are still getting ruined by the crime, as_we_type. IANAL; can someone add whether "the people" can expect to be served a piece of Smathers?

If this is it, it sure as hell isn't what I'd call "restitution." Anyone want to wager that we also get nothing out of Sean Dunaway, the guy to whom Smathers sold?

BG

Re:mandatory restitution?

[mccrew]

Smathers is only paying "the amount the government estimates AOL spent as a result of the e-mails," which is that $200,000 to $400,000. Is our government unable to represent those who suffered significantly more harm than AOL, the people?

2 quick points

1. Yes, the regular folks who recieve spam were harmed, but it is pretty hard to come up with some number to quantify. Another slashdotter hit the nail on the head in the other story today about how spam costs $22 billion per year.

2. The restitution does seem rather low - we all would have a self-satisfied chuckle if it had been a huge unreachable range like $200M to $400M. But it is low enough that there is a realistic chance he will actually have to pay off the whole thing off, perhaps have his wages garnished for the rest of his life. That does sound like serious consequences.

Punished?

[ckemp.org]

Damn, man. The guy deserves a thank you. Those casino sites rock. Really.

Re:For Chrissake, Slashdot

[Tatarize]

Sshh, dear, don't cause a fuss. I'll have your spam. I love it. I'm having spam spam spam spam spam spam spam beaked beans spam spam spam and spam!

Re:For Chrissake, Slashdot

[MillionthMonkey]

If this wasn't about spam, people on here would be jumping up and down screaming their guts out about how the punishment doesn't fit the crime.

$400k for 92 million screen names? That's less than a half-cent per compromised screen name- what a deal! The year in prison is on top of that but that's probably on the order of magnitude of about $500k (judging from how much you'd have to pay me to go) so we're still at less than a cent per screen name. Ask anyone whose screen name was compromised, with a punishment of less than a cent. This guy got off easy.

For christ's sake, spam is NOT that big of a deal.

Yes it is.

Re:But wait...

[shark72]

" Its not theft, right? AOL wasn't deprived of any property!"

If you use the Slashdot groupthink definition of "stolen property," well then sure. You often see this come up in Slashdot discussions regarding copyright protection. Nonetheless, in the world of trade secrets, mailing lists, and the like, these are the terms that are used. If you leave a company and take with you a copy of a customer list, trade secret, or other confidential or proprietary information, you cannot use the "the company still has a copy so I didn't deprive them of anything" defense. In the real world, this claim can get you a +5, Astute from the Slashdot crowd, but that's about it.

Re:Prison is a place of punishment

[KillerDeathRobot]

A prison is supposed to be a place of punishment.

Not necessarily. There are a number of philosophies regarding the reason for prisons; other than punishment, prisons can be said to be places of rehabilitation, places to simply remove the dangerous element from society, and probably other things.

Re:Wait

[shark72]

"As I understand it Facts are not copyrightable. A huge list of email addresses is just a big list of facts. If they can't have a copyright on the list of email addresses they can't assert that they've been stolen."

I'm not sure how you made that last logical connection. This isn't a copyright infringement case; it's one of trade secrets and proprietary information. This is the modern equivalent of the old days where somebody might sneak out a big list of customer names and snail-mail addresses -- they're not copyrightable either, but it sure as hell is legally actionable.

18-24 Months?

[RockClimb]

In November of 2003 I was getting about 175 spams per day. In December of 2003 I installed Spamassassin, set up ip# and domain name block lists, tweaked the rules and wrote my own, and wrote a user email/spam report system. I spent a good deal of time getting this set up and working out the bugs. My email server received over 145,000 connections in 2004, over 143,000 were spam.

I have the ability and resources to do these things but many internet users do not. While I don't have an AOL account, I still think he should have received more hard time. Put him away for a long time, maybe his cell mate will be a disgruntled AOL user who lost it after getting "one too many spams".... make other spammers and their helpers think twice.

Re:Prison is a place of punishment

[timeOday]

Quite frankly, I don't care what goes on in there as long as people fear getting into one.

That's crazy. You can go to jail for lots of things, for instance stealing email addresses. Or for that matter, you can be falsely convicted. It happens.

He sold it?

[AstroDrabb]

Smathers used another employee's account to steal the data, and sold it to a Vegas-based online casino operator.

So this guy sold this information and is getting in trouble for it? Well that sounds fair. However, what about the Vegas company that purchased the "goods"? Are any legal proceedings taking place against them? Or is anything a corporation does "OK" with the government and the DA's office?

I haven't heard anything against the Vegas company that purchased this information. Why is it OK for a company to carry out these acts but if a citizen does the same acts, he/she is fined a few hundred grand and sent to jail for a year or two?

Re:Wait

[afidel]

You are correct. This site has some good information including some applicable federal statutes involving theft of trade secrets and economic espionage. This guy was looking at up to 10 years in prison and 500K in fines so he got off relativly lightly. I never knew that theft of trade secrets carried criminal attachment, I thought it was purely a civil tort, shows how much you might not know about the law if you're not a lawyer.

AOL

[xmp_phrack]

so easy to abuse, no wonder it's number one!