Scumbag AOL employee caught selling E-mail lists

[Darth Wong]

From CNN:

AOL worker arrested in spam scheme

NEW YORK (CNN/Money) - A software engineer at America Online was arrested Wednesday and charged with stealing AOL's subscriber list and selling it to someone sending spam e-mail, federal prosecutors in New York said.

According to the criminal complaint, Jason Smathers of Harpers Ferry, W. Va., used his inside knowledge of AOL's computer system to steal a list of 92 million AOL customer account "screen names," and then sold them to Sean Dunaway, who is not an AOL employee.

Dunaway, of Las Vegas, NV., was accused of using the list to promote his own Internet gambling business and also sold the list to other spammers for $52,000, according to David Kelley, the U.S. attorney for the Southern District of New York.

The complaint further charges that Dunaway later paid Smathers $100,000 for an updated version of AOL's customer list.

Megan Gaffney, a spokeswoman with the U.S. Attorney's Office, Southern District of New York, confirmed that both men appeared in court Wednesday.

Dunaway, 21, attended federal court in Las Vegas, and Smathers, 24, made his initial federal court appearance in Virginia. Smathers will be detained overnight until a detention hearing tomorrow, Gaffney said.

Defense lawyers could not be reached for comment.

The two men each face a maximum sentence of five years in prison and a fine of $250,000, according to prosecutors.

An AOL spokesman said Smathers has been fired from the company.

"We deeply regret what has taken place and are thoroughly reviewing and strengthening our internal procedures as a result of this investigation and arrest," AOL said in a statement.

According to the complaint, Smathers used another employee's ID in April and May 2003 to assemble a complete list of AOL's customer account screen names, zip codes, telephone numbers and credit card types.

"(But) AOL has uncovered no information indicating that this theft involved member credit card or password information stored by AOL," said the statement from AOL.

AOL, the world's biggest Internet service provider, is owned by Time Warner Inc., as is CNN/Money.

May he be raped in prison.

[Tatterdemalion]

As someone who until a few months ago had the unfortunate experience of having an AOL account, I hope they find the bastard swinging from the lighting fixture.

[HemlockGrey]

Five years? What's the usual sentence for, say, breaking and entering?

[Evil Sadistic Bastard]

Five years? What's the usual sentence for, say, breaking and entering?

Append to that the charges of "Criminal breach of trust", "Grand larceny", "Theft of identity", etc. etc, then scale it up to accommodate the crime. That's what he could be charged for.

However, it is true that he did not physically harm anyone - that he at most inconvenienced them. Still, he deserves the minimum of 5 years, because he's a selfish bastard who'd fuck up people's lives for his own gain.

[Admiral Valdemar]

At least we know the anti-spam laws that are coming in are working somewhat. Tbe problem is a global one now and these arseholes aren't helping.

[General Zod]

I don't think you could apply grand larceny, given that he didn't actually steal any money, nor identity theft, since all he was taking was user names rather than real life information (least from what i saw in the article), although corporate espionage might be applicable in some sense.

[Darth Wong]

Theft of something worth more than $50k is serious business. That's a decent haul for a typical bank robbery.

[General Zod]

Theft of something worth more than $50k is serious business. That's a decent haul for a typical bank robbery.

true, though it's not as though the names themselves had any actual value, he was just being paid for them by someone else. Which is why i wouldn't consider it grand larceny, but maybe corporate espionage.

[Thinkmarble]

true, though it's not as though the names themselves had any actual value, he was just being paid for them by someone else. Which is why i wouldn't consider it grand larceny, but maybe corporate espionage.

How do you define actual value ?
And if these names themselves did not have any value then why did he get paid as much ?

[General Zod]

true, though it's not as though the names themselves had any actual value, he was just being paid for them by someone else. Which is why i wouldn't consider it grand larceny, but maybe corporate espionage.

How do you define actual value ?
And if these names themselves did not have any value then why did he get paid as much ?

isn't whether something is determined grand larceny set by the price of the object that was stolen? the names themselves were neither for sale nor had a preset price the last i checked. It's effectively the equivalent to selling a list of business contacts or business plans from a company for lots of cash. The list has no real vlaue and isnt' for sale, but nevertheless someone is willing to set a high price for the information. Hence why corporate espionage would be more appropriate than grand larceny.

[neoolong]

You should be able to up the punishment based on the number of people affected.

[General Zod]

You should be able to up the punishment based on the number of people affected.

well, if the individual users on the list decided to file lawsuits against the theft of their personal names, it might be possible to really fuck the guy over. course i'm not too familiar with what can and can't be sued over, so. . .*shrug*

[RedImperator]

Wow, five years, that's serious time. That a whole year more than you can get in New Jersey for committing misdemeanor simple possession and then violating your probation.

[Darth Wong]

isn't whether something is determined grand larceny set by the price of the object that was stolen? the names themselves were neither for sale nor had a preset price the last i checked.

So? The Mona Lisa doesn't have a price tag on it, and it's not for sale, but they'd throw the book at you if you stole the fucking thing. You don't need to have a price tag on something for it to have value for the purpose of determining the magnitude of the crime of stealing it.

[Admiral Valdemar]

Wow, five years, that's serious time. That a whole year more than you can get in New Jersey for committing misdemeanor simple possession and then violating your probation.

Well, if anything, this guy needs to be made an example of if there are any others out there who seriously think they can pull off this shit without consequences.

[General Zod]

isn't whether something is determined grand larceny set by the price of the object that was stolen? the names themselves were neither for sale nor had a preset price the last i checked.

So? The Mona Lisa doesn't have a price tag on it, and it's not for sale, but they'd throw the book at you if you stole the fucking thing. You don't need to have a price tag on something for it to have value for the purpose of determining the magnitude of the crime of stealing it.

point. though the mona lisa is a physical object while the username list was information that can be copied with a simple push of a button. I'm simply not so sure that grand larceny would be an appropriate charge given what was taken, though other charges would probably be just as suitable.

[Keevan_Colton]

At the rate things are going charging him with copyright infringment would probably result in the harshest sentence

[Admiral Valdemar]

isn't whether something is determined grand larceny set by the price of the object that was stolen? the names themselves were neither for sale nor had a preset price the last i checked.

So? The Mona Lisa doesn't have a price tag on it, and it's not for sale, but they'd throw the book at you if you stole the fucking thing. You don't need to have a price tag on something for it to have value for the purpose of determining the magnitude of the crime of stealing it.

point. though the mona lisa is a physical object while the username list was information that can be copied with a simple push of a button. I'm simply not so sure that grand larceny would be an appropriate charge given what was taken, though other charges would probably be just as suitable.

In this age of digital information, at the "push of a button" I could swipe credit card details or data from a company product that could be worth millions. It's best we don't fall for any false ideas that something so easily available or copied is worthless.

[Alyrium Denryle]

true, though it's not as though the names themselves had any actual value, he was just being paid for them by someone else. Which is why i wouldn't consider it grand larceny, but maybe corporate espionage.

How do you define actual value ?
And if these names themselves did not have any value then why did he get paid as much ?

isn't whether something is determined grand larceny set by the price of the object that was stolen? the names themselves were neither for sale nor had a preset price the last i checked. It's effectively the equivalent to selling a list of business contacts or business plans from a company for lots of cash. The list has no real vlaue and isnt' for sale, but nevertheless someone is willing to set a high price for the information. Hence why corporate espionage would be more appropriate than grand larceny.

Basic llaws of supply and demand. The two people reached an agreement on what the names were worth, that is a price, an equilibrium point on a nice little damand curve and supply curve.

[mauldooku]

That bastard! Doesn't AOL keep its names secure to protect against this kind of stuff?

[General Zod]

That bastard! Doesn't AOL keep its names secure to protect against this kind of stuff?

It does. The one that stole it was an AOL employee who had access to that information, however. So however secure it was against outside theft didn't help a whit against inside theft.