http://msnbc.msn.com/ID/5279826/

Hacks, Viruses, Scams & Spam

AOL customer list stolen, sold to
spammer

Former employee charged with stealing subscriber list

By Bob Sullivan

Technology correspondent

MSNBC

Updated: 6:19 p.m. ET
June 24, 2004

A former AOL employee was charged Wednesday with stealing
the Internet provider's entire subscriber list -- over 30 million consumers,
and their 90 million screen names -- and selling it to a spammer.

The employee, a 24-year-old software engineer named Jason
Smathers, was arrested Wednesday at his residence in Harpers Ferry, W.Va., according
to the U.S. Attorney's Office in the Southern District of New York.

According to a complaint filed before Judge Andrew J. Peck,
Smathers accessed AOL's subscriber list in May 2003, then sold the list to
21-year-old Las Vegas resident Sean Dunaway for an unknown sum. Dunaway was
also arrested Wednesday.

Authorities allege Dunaway used the list to promote his
Internet gambling business, and then resold it to another spammer for $52,000.
That spammer, who isn't named in the complaint, eventually agreed to cooperate
with authorities and fingered Dunaway to U.S. Secret Service Agent Peter
Cavicchia, hoping for leniency from government prosecutors.

The unnamed spammer admitted to using the AOL e-mail
addresses to send e-mail marketing herbal penile enlargement pills. The spammer
also told authorities than Dunaway claimed to be making $10,000 to $20,000 per
day from his Internet gambling business.

AOL said no users will be forced to change their e-mail
address because of the theft. Instead, the company will simply continue to
attempt to block spam before it hits users.

"What we are doing for consumers is cooperating with
law enforcement," said Nicholas Graham, AOL spokesman. "AOL members
can rely on us to tighten our filters, get them more tools to fight spam, and
file lawsuits against spammers. Our anti-spam efforts are still hitting on all
cylinders."

Other personal
data also stolen

According to the complaint, information on AOL's 30 million subscribers is
maintained in the company's "Data Warehouse," and access is limited
to a small number of employees. Smathers, who worked at the firm's Dulles
office, didn't have access to the data, but he impersonated another employee to
reach it, the complaint says.

Smathers, who had worked at AOL since 1999, got more than
screen names, according to the complaint. He also allegedly stole related zip
codes, credit card types and telephone numbers. But he did not get credit card
numbers, the complaint says, because they are stored separately by the company.

A search of Smather's employee computer last month revealed
electronic conversations he had with Dunaway describing the heist, according to
the government. After stealing the entire screen name database in May 2003,
Smathers went back and got an update in March 2004, taking another 18 million
screen names. Dunaway paid $100,000 to Smathers for the updated list, and later
sold it to the unnamed spammer for $32,000.

During their investigation, AOL technicians discovered a
telling file on Smathers' computer, which included a conversation between
Smathers and a correspondent named "The Brews." Initially, the
correspondent complains that most spam lists include many fake and invalid AOL
addresses.

"Well . . . it would be different if you mailed
current AOL members. But the lists I use, and others have used, are just
collected lists where people have to enter their emails and all there is
thousands and thousands of fake emails. If you have a database of REAL emails,
that were fresh, the ratio of sign ups would be sooo much greater. If you have
any ideas on bulk mailing with AOL lol let me know and I can get you a program
set up in a heart beat. heh.”

To that, Smathers replied: "Well I’ll check it
out ... It isn’t going to be easy. I think I found the member database
... Just need to figure out how to get the SNs [screen names] it is spread over
like 30 computers ... You can’t talk about this."

But later, he added, "OK, I got it figured out ...
there are going to be millions of them so, will take time to extract I will do
them a chunk at a time ... because 37 million accounts have up to 7 screen
names per account I’d expect there to be around 100 million active screen
names4 maybe more."

Both face up to five years in prison, the complaint says.

© 2004 MSNBC
Interactive