Fired AOL Engineer gets 15 Months

n3hat writes "A former America Online software engineer was sentenced to 15 months in prison for stealing 92 million screen names and e-mail addresses and selling them to spammers who sent out up to 7 billion unsolicited e-mail messages, according to this A.P. story in the Baltimore Sun."

Comments

In a related story...

[losman]

AOL still blows and we are amazed people still use it.

I know, I know... probably a flamebait rating but come on, you know you giggled!

Re:In a related story...

[`Sean]

June 22, 2000 (from http://www.inertramblings.com/archives/000439.html ):

America Online: A sucker born every minute...

According to a corporate press release dated June 16, 2000, America Online has surpassed the 23 million member mark. Founded in 1985, AOL has been a household name to novice computer users worldwide. Unfortunately, many of these novices don't know that they're only seeing a small portion of the Internet and are being limited by AOL's proprietary and archaic interface.

Now, it's fairly safe to make the assumption that at least a quarter of AOL's 23 million customers are simply short-term users along for the free trial or jumping from service to service looking for the best deal. And, using that same line of thinking, roughly half of those 17.25 million remaining customers are probably smart enough to see AOL for what it really is and cancel their service in a desperate fit of fight or flight.

That leaves approximately 8.63 million customers that use AOL as their primary Internet Service Provider, give or take a random three quarter million people at any given time signing up or canceling. With this in mind, and approximately 7.88 million minutes in AOL's 15 year history, this proves that a sucker really is born every minute.

Re:In a related story...

[securitas]

Or maybe it means that novices sign up to become familiar with interacting with the online world.

Once they've become comfortable with using a computer and an online service, they feel that they can take the training wheels off and find things on the Web for themselves. The most common Internet activities are e-mail, Web and chat. You don't need AOL for those.

Re:In a related story...

[LnxAddct]

For all this shit people give AOL, I recommend it to every novice user I know. It has integrated spyware detection, some of the best spam and phishing blocking, comes with access to AOL's large library of music and videos, news, etc... It sets up your buddy list and everything for you. All of this is accessible by running one program, and for all of the functionality packed into it, the gui isn't half bad. For the price you pay, you can't beat it.

Most people think that it is just a regular ISP but it isn't. You get a ton of extras to go along with it (streaming music, videos, stock tracking, games, spyware removal, a clean inbox, self configuration, and alot more). Very rarely will you see spam coming from an AOL user, if you do see it, it's probably being forged from somewhere else. Considering all of the zombies that comcast and verizon let live on their networks, AOL's active approach seems refreshing. Just like credit card companies, if they notice unusual activity, they'll notify you, if its really bad they'll lock your account until you can let them know that it isn't a spammer that took control of your account. Anyway... even if AOL is just for noobs, I'd rather most peopl be using AOL for Broadband, rather then Comcast and degrading the quality of the net.
Regards,
Steve

Lucky guy

[igny]

He has got just 1 second of jail per 175 emails.

Re:Lucky guy

[ScentCone]

He has got just 1 second of jail per 175 emails

That assumes that the people he sold the names to (and whoever else might have received them downstream) only used them once. I'm going to bet that's not the case. Some hunk of that last has probably made rounds to multiple mail whores for a little merge/purge processing against their other lists. That's not nearly enough time - he should get out when people holding those addresses haven't seen any spam for at least 6 months.

Re:Lucky guy

[Frogbert]

I think its kind of harsh that he was sent to prison, personally I think that prisons should be reserverd for people who present a physical threat to other people.

In a case such as this, while he may have caused damage and made some money off it, a significant fine would be ample. I mean its not like he is a danger to society if he doesn't get locked away.

define irony

[Fox_1]

Obligatory Family Guy joke: "Remember last week when you asked me to define irony and I said - urarghhh!" AOL personally kept me supplied with floppy disks during my school dayz, and many a cd coaster when I started working IT. These guys are the king of snail mail spam (virus(AOL8) laden cd's anyone :) and here this guy goes and follows their lead online, further screwing over the poor AOL customers. I love it.

Hypothetical Prison Conversation

[Anonymous Coward]

The setting: Prison cafeteria.

Prisoner #1: So what're you in for?
Prisoner #2: Aggravated assault. You?
Prisoner #1: Armed robbery. How 'bout you?
AOL Engineer: I stole 92 million screen names and e-mail addresses and sold them to spammers who sent out up to 7 billion unsolicited e-mail messages.
Prisoners #1 and 2 inch away from AOL Engineer at the lunch table

Re:Hypothetical Prison Conversation

[mhearne]

If I had to go to jail for a cybercrime, I would at least want the other inmates to understand the charge.

15 months really isn't that bad, he'll probably do a third of that with good time (5 months). But he'll have to be on probation for years, and nobody worth working for is going to want to let him do anything more than stuff resistors in circuit boards.

The trouble that comes after prison is often worse than doing the time itself.

Michael

Further details / This looks strangely familiar

[securitas]

AOL E-mail Data Thief Gets 15 Months in Prison

AP's Larry Neumeister reports that the AOL employee who sold 92 million stolen e-mail addresses and screen names to spammers has been sentenced to one year and three months in prison. Jason Smathers sold the list to spammers for $28,000, who then proceeded to send as many as 7 billion spam messages. The prosecutor in the case estimated 'AOL suffered a loss of 10 cents for every 1,000 spam e-mails sent to subscribers.' The judge suggested that Smathers pay $84,000 in restitution but will decide on the final figure after AOL files details of financial losses due to increased staff, hardware and software costs. An interesting note: Judge Alvin Hellerstein said in December that he canceled his AOL subscription because he received too much spam.

2005-08-17 21:42:32 AOL E-mail Data Thief Gets 15 Months in Prison (Index,Spam) (rejected)

So...

[Lally Singh]

How many years are AOL's management getting for... well, managing AOL.

Re:So...

[nmb3000]

Which probably attract 1 customer out of 100 free CDs.

1 in 100? I have to think the return on those discs is way lower than 1 in 100. I'd put it at more like 5,000 discs in return for a single year-long contract.

*Maybe* 1 in 100 will put the disc in the drive, perhaps 1 in 500 will begin the trial. However, once the 10 million hours of free* Internet access expire, I expect very few will pony up the $21.95 or whatever the hell they're charging for "special" Internet today.

*10 million hours of free slower-than-hell dialup access expire 10 days after activation. Social security number, date of birth, full name, and valid credit card with a minimum of $20,000 credit limit required. AOL reserves the right to do whatever the hell we want, anytime, anywhere. By agreeing to these terms, you acknowledge you are a complete dumbass.

Why jail?

[Eightyford]

I've never understood why non-violent criminals are even put into jail. Instead of us taxpayers paying about 25 grand a year for this guy(a number I pulled directly out of my ass, by the way); he should be forced to repay the damage that he has done. And, if it takes the rest of his life, then so be it; just don't let the guy declare bankruptcy (another thing I've never really understood).

Anyways, save jail for the murderers, rapists, and child molesters of the world. Make people like this guy, Martha Stewart, and Bernie Ebbers repay they're debt in other more productive ways.

Re:Why jail?

[YrWrstNtmr]

Repayment is only a deterrent if the perp has been less than successful. A millionaire spammer (Richter?) could consider that just the cost of business, and be on his merry way.

Re:Why jail?

[value_added]

just don't let the guy declare bankruptcy (another thing I've never really understood)

Such debts can't be discharged in bankruptcy court.

Re:Why jail?

[dal20402]

I agree with you that, in general, too many people are in jail.

But in cases of very costly (to the rest of us) and profitable (to the perp) white-collar crime, there is very little else that can serve as a deterrent. White-collar criminals tend to have a different attitude from low-level drug offenders: they aren't desperate or sick, and don't even recognize that what they're doing is wrong. Instead, they feel no guilt about gaming the system in any way possible (speaking in generalities, of course).

If you fine them, they'll hide their money (as another poster said). If you try to leverage their knowledge, they'll fail to cooperate. As long as you let them have their freedom, they'll find a way to beat you. The way to make them think twice is to take away their freedom.

If we put one white-collar perp in jail for every five low-level drug offenders we let out and put into intensive treatment programs, we'd make the market a more honest place and solve a lot of social problems at the same time.

Re:Why jail?

[Andy_R]

He should have his own designated bit of highway, so the rest of us know where to throw out our junkmailed AOL cds.

That's quite a feat.

[Rocky1138]

I wonder how he stole them? And how long did it take for him to give them back? Did they ever find them?

The truth of the matter is...

[jhfry]

of those 92 million, only about 2 million actually use aol mail... the rest are people who used up thier free trial and moved on.

I mean seriously, you expect me to believe that AOL has 92 million paying customers?

Honestly if I were a spammer, I'd only pay half price for AOL addresses, the odds of someone reading your email (especially after filtering) is nearly zero.

Re:The truth of the matter is...

[Paradise Pete]

I mean seriously, you expect me to believe that AOL has 92 million paying customers?

Not if you'd RTFA, and noticed where it said "The stolen list of 92 million AOL addresses included multiple addresses used by each of AOL's estimated 30 million customers."

a quote from Heavy Metal popped into my head

[zephc]

"He's nothing but a low-down, double-dealing, backstabbing, larcenous perverted worm! Hanging's too good for him. Burning's too good for him! He should be torn into little bitsy pieces and buried alive!"

Indeed.

Lemme get this straight

[DSP_Geek]

Kevin Mitnick prowls around some machines, steals nothing, damages nothing, yet spends four years in jail waiting for his trial, gets a five year sentence, and has to stay away from computers for another few years, while this fucknuts steals a subscriber list for spammers and gets a slap on the wrist? Doesn't even have to stay away from other people's mail servers? Riiight.

Re:Lemme get this straight

[firewrought]

Mitnick didn't steal anything? Mitnick allegedly copied and removed....software valued at $2,100,000.00.

I hate to take Kevin's side on this because his actions were illegal and immoral. However, it's very important to accurately appraise the costs (financial, emotional, cultural, etc.) of a crime. If the costs are exaggerated then justice is miscarried, tax money is misspent, the public is misserved, and third parties--such as policy makers, security analysts, and insurance companies--are misinformed.

The $2.1 billion number represents the cost to make the software. If Mitnick merely made an unauthorized copy, burned it to CD, and shoved it in a drawer somewhere, what part of that $2.1 billion did the companies lose? None. Nada. Business would continue uninterrupted.

Alternatively, suppose that Mitnick managed to destroy every copy of the software that the company owned. That would make the $2.1 billion a much more accurate assessment. The business could go bankrupt.

And then there's the middle ground... what about leaking secrets to competitors or providing binaries to black-market distributors? These are things that chip away at that $2.1 billion, but it's unlikely they erode it completely.

Of course, we haven't discussed administrative costs associated with mopping up and responding to the Mitnick incidents. We haven't factored in the intangible losses to privacy or even the hidden gains that might have come from the crime (e.g., if benign criminals attack you early and force you to beef up your security before the truly malignant ones arrive, haven't you inadvertly made money?)

A true valuation is perhaps impossible, but we can be more accurate than to assume that the unauthorized copying of private/proprietary information is directly equivalent to the theft of physical goods.

What's his cellmate's name and address?

[www.sorehands.com]

I think we all should send his cellmate bottles of penis enlargment pills, viagra, cialis, cialis soft tabs, Jackrabbit vibrators, and everything else we get from spam.

All in the name of poetic justice.

Re:What's his cellmate's name and address?

[Eightyford]

There's no way in hell that I'm sending him the money I'm getting from my new Nigerian friend!

It should be here any day now...

Just curious

[hackstraw]

Does anybody actually know the charge he was convicted of? I looked at the article and it mentioned pleas and taking "stolen property" across state lines, and CAN-SPAM, but none of these were clear as to what he was actually convicted of.

Anybody?

Everyone All At Once Now...

[jpiggot]

"You've Got Jail !"

Camp Cupcake

[__aamcgs2220]

He better pray for solitary confinement. Bubba and his posse are all fiercely loyal AOL users and they don't NEED no \/i@GR@ or Ci@li5.

bfd

[ErichTheWebGuy]

From what I understand, there are several robot programs that go through AOL chat rooms and suck down screen names for use in spam operations. I would suspect that that technique is:

- more effective, since all of the addresses you gather are known good
- cheaper, since you can get millions of addresses a week then cancel your free trial
- less risky

A spammer that pays that kind of money for such a seemingly worthless list of stolen addresses should look for another line of work.

Time for Master Card Ad:

[Comatose51]

Cost in dolars delete spam from your AOL account: $5
Cost to have CompUSSR repair your PC from spyware: $150
The look on the spammer's face as he see "Bubba" get a penis enlargement spam: Priceless

There are some things money can't buy, for everything else there's KARMA!

He got 15 months?

[craXORjack]

The most I've ever got from AOL was 1 month free.

Read TFA

[Alomex]

If you read TFA you'll see that the AOLer got off easy because he pleaded guilty very early on. In contrast this Kevin Mitnick nitwit is even now trying to play the victim and not really sounding contrite about it.

Re:Read TFA

[Alomex]

Wrong. Mitnick originally pleaded guilty and was sentenced accordingly to "a year in a low-security prison and three years of probation" [CNN]. Furthermore, the judge ordered that that he serve his sentence in a halfway house. He violated the terms of his probation and became a fugitive. The second time he was caught he had to continue serving the original sentence, hence no rush to go to trial with the second set of charges. Eventually Mitnick pleaded guilty to the second set of charges. The judge in this case did not have much choice in the length of the sentence since Mitnick was now a repeat offender and fell under the federal sentencing guidelines for those.

Mitnick was charged for crimes spanning 15 years and four different trials starting in the early eighties and finishing in the late 90s. That he generates so much undeserved sympathy has to be the ultimate meme.

Next

[TRRosen]

what I want to know is when we can expect to hear about the conviction of the spammers he sold to. Obviously due to the size of the database (every AOL member ever apparently) they knew it was stolen. So we should see several spammers charged with 92,000,000 counts of recieving stolen merchandise right???

OK - no chance of the government being that smart... but it would be nice.

Re:Ahh....

[Mahtar]

Yeah, hilarious. He desereved to be gang raped and/or forced to perform sexual favors for his crime that physicall harmed no one.

Also I guess I missed where the judge included "rape" in the 15 month jail sentence.

Internet tough guys, huh?

Welcome

[dirtsurfer]

You've got jail!

Re:Please don't call him an "engineer"

[Detritus]

Are you a P.E.? If not, you aren't legally a "real engineer" in many places.

Don't stow thrones in grass houses.

I think they'd understand it very well

[Moraelin]

" If I had to go to jail for a cybercrime, I would at least want the other inmates to understand the charge."

The public at large may not be experts in some of the more sophisticated crimes, nor in the finer points of intellectual property (e.g., as applied to those database records), but stuff like spam is something you don't need a Ph.D. in CS to understand. If someone doesn't understand, someone else will explain it to them.

Spammer: "I sold 92 million AOL email addresses to spammers."
Bubba: "Uh, wot's a spammer"
Billy Joe: "Bubba, you know those 'enlarge your penis' and 'horny teens waiting for you' messages you told me your little daughter was getting on AOL? This guy told them where to send those."

Which way it goes from there, I wouldn't know. But from there Bubba understands exactly what the cybercrime was.

Re:Jason Smathers

[Frogbert]

Press enter please

:-) I hope you too get assraped :~P

[Vicsun]

I've been sentenced for a D.U.I. offense. My 3rd one. When I first came to prison, I had no idea what to expect. Certainly none of this. I'm a tall white male, who unfortunately has a small amount of feminine characteristics. And very shy. These characteristics have got me raped so many times I have no more feelings physically. I have been raped by up to 5 black men and two white men at a time. I've had knifes at my head and throat. I had fought and been beat so hard that I didn't ever think I'd see straight again. One time when I refused to enter a cell, I was brutally attacked by staff and taken to segragation though I had only wanted to prevent the same and worse by not locking up with my cell mate. There is no supervision after lockdown. I was given a conduct report. I explained to the hearing officer what the issue was. He told me that off the record, He suggests I find a man I would/could willingly have sex with to prevent these things from happening. I've requested protective custody only to be denied. It is not available here. He also said there was no where to run to, and it would be best for me to accept things . . . . I probably have AIDS now. I have great difficulty raising food to my mouth from shaking after nightmares or thinking to hard on all this . . . . I've laid down without physical fight to be sodomized. To prevent so much damage in struggles, ripping and tearing. Though in not fighting, it caused my heart and spirit to be raped as well. Something I don't know if I'll ever forgive myself for.
-A letter to Human Rights Watch

Prison rape is funny again, guys!

Re::-) I hope you too get assraped :~P

[Adnuo]

I actually registered to reply to this. I'm really glad that someone finally stopped the "ZOMG i hope j00 get t3h raped in teh assz0r LOLOLOL spammar!" comments and brought a real light to the situation. Sorry, sodomy isn't a joke. Just glad someone said it :)

He *did* represent a physical threat

[Solandri]

7 billion spams. Say 99% of them were caught by spam filters or went to bogus addresses. That leaves 70 million spams people had to deal with by hand. If it took one second to delete each of those spams, that means he cost everyone an aggregate 2.2 years of life. If someone imprisoned you in front of a computer hitting delete over and over for 2.2 years, wouldn't you consider him to be a physical threat to you and others?

Why is it that people think a distributed crime is any less of a crime? Do you think it'd be OK if he stole $130,000 from a bank? Then why do you think it's OK that he stole $0.0019 each (1 second's wages at $6.75/hr) from 70 million people? They work out to the same amount of money.

Re:Well, see, that's just the point

[mnoel2]

I know everyone loves that Steve Jobs quote about decreasing boot time*, and I know a distributed crime is still a crime, and I figure that white-collar criminals are probably the group of lawbreakers most likely to be swayed by 'examples' of horribly disproportionate punishments for crimes --

but to claim that being violently raped, repeatedly, is an acceptable repayment to society for any crime, is a sign that some people here need to unplug a bit. If you get more bent out of shape over spam than large scale violence against fellow people, no matter what laws or social boundaries they've crossed, then I sincerely hope I am never on the recieving end of your decision-making process. It's just junk mail. Yeah, it sucks; but if someone gave a nation the choice between everyone receiving junk mail every day, or having a specific individual gang raped, I should hope the nation would be enlightened enough to deal with the stupid colored pamphlets.

For the love of all that's right, end prison rape.

* It goes something like "It's my moral responsiblity to decrease the Mac's boot time, because if I shave ten seconds off, and have 5 million users, and they each use their Macs for so many years, I'll have saved fifty lives". Uncle Google is failing me right now...

Re:Please don't call him an "engineer"

[callipygian-showsyst]

Are you a P.E.? If not, you aren't legally a "real engineer" in many places.

Yes I am.