Washingtonpost.com: AOL Orders the Spam Special

Byline: Cynthia L. Webb

America Online has amply demonstrated its acumen in attacking spam, but the latest news on the junk e-mail front has left the company reeling.

Authorities yesterday arrested 24-year-old AOL software engineer Jason Smathers , who is accused of lifting 92 million AOL subscribers' e-mail addresses and selling them to 21-year-old Internet gambling entrepreneur Sean Dunaway for $100,000. Authorities allege Dunaway, who was also arrested, sold the addresses to spammers and used it to hawk gambling ads. Both men were charged with conspiracy and, if convicted, could spend up to five years in prison and be forced to pay a $250,000 fine. That punishment, however, might not even come close to making up for the potential damage to customer confidence in AOL's internal security.

The Los Angles Times reported that the "case underscores the difficulties that Internet service providers face as they fight to keep their networks free of spam. AOL, the country's biggest ISP, with more than 30 million customers, has sued dozens of spammers and blocked billions of their messages. But the actions of a single rogue employee may have delivered AOL's entire member list into the hands of online marketers. 'It's a black eye,' said Rob Sanderson , an analyst with American Technology Research ." * Los Angeles Times: Insider Arrested In Spam Scheme

"The theft, the first at AOL, is one of the largest of its kind. It underscores what spammers will do to reach consumers. They usually buy e-mail addresses from people who comb the Internet for them," USA Today reported. Independent tech researcher Michael Osterman told the paper that "If it can happen to AOL, it can happen to anyone." * USA Today: AOL Says Worker Sold Screen Names

The case is one of the first that relies on the six-month-old national anti-spam law, as The Wall Street Journal reported. "The CAN-SPAM act , which took effect Jan. 1, regulates commercial e-mail by requiring, for example, an existing business relationship between the sender and the recipient. The law requires that commercial e-mail contain a valid U.S. postal address as well as a way for recipients to refuse future mailings from the sender. The law also makes it harder for senders to disguise their identity. ... Smathers and Dunaway couldn't be reached to comment," the paper said. The Financial Times said the charges "highlight the dangers facing internet service providers from spammers who are willing to go to ever-greater lengths to ensure e-mails reach users' inboxes." * The Wall Street Journal: AOL Employee Faces Charges In Spam Probe (Subscription required) * Financial Times: AOL Man Charged With Spam Offences

The Washington Post detailed how authorities think the heist occurred: "Smathers, who became an AOL employee in 1999, obtained other AOL member information as well, including telephone numbers, Zip codes and types of credit cards used by members, though not credit card numbers, according to the complaint. The company said those numbers are stored in a separate, secure facility... According to prosecutors, Smathers was not authorized to access AOL's customer database, which can be viewed by only a small number of employees and is 'housed' in secure computers. But in May 2003, Smathers used the computerized employee identification code of another AOL worker to gain entry to the data and compile the lists of AOL's roughly 30 million users, many of whom maintain more than one screen name. 'I think I found the member database,' Smathers wrote in an instant message to an unidentified person who used the handle The Brews. 'There are going to be millions of them so, will take time to extract. I will do them a chunk at a time.'"

The Associated Press said Dunaway eventually "offered the list to spammers, charging them $2,000 for lists containing names beginning with a single letter of the alphabet or $52,000 for the entire list, the complaint said. At least one spammer used the list to send advertising for herbal penile enhancement pills, prosecutors said."

And more from the Post: "The revelations come as AOL and other Internet providers have ramped up their efforts to track down the purveyors of spam, which has grown into a maddening scourge that costs consumers and businesses billions of dollars a year." Not to understate the case, but the news left AOL management in a pretty bad mood. "I am very, very angry about this," AOL chief executive Jonathan F. Miller , wrote in an e-mail to employees yesterday, according to the Post. "We will absolutely not tolerate wrongdoing by employees. . . . We will do everything we can to uncover abuse and assist law enforcement in prosecuting it." * The Washington Post: AOL Employee Charged In Theft of Screen Names (Registration required) * Associated Press via The Washington Post: Two Men Arrested In AOL Spam Scheme (Registration required)

The New York Times provided more details on how the case was cracked: "In the process of discovery for that lawsuit, AOL interviewed someone who said he bought addresses of its members from an insider and used it to send spam for penis enlargement pills, according to the complaint. AOL passed that information to the Secret Service . The pill vendor told the Secret Service that he purchased a list of names from Mr. Dunaway, who had told him they came from an employee of AOL.

America Online, a unit of Time Warner , was able to determine the identity of the insider by looking at the dates from a copy of the stolen list provided by the pill vendor, according to the complaint. Once it determined the date that the list was stolen, it looked at its log of users and determined that the computer of Mr. Smathers was involved in looking up e-mail addresses on that date," the article said. "America Online searched the laptop computer of Mr. Smathers, who was fired yesterday, and discovered e-mail discussions about the profits that can be earned from sending spam as well as evidence that he had broken into AOL's database, the complaint said." * The New York Times: Two Arrested and Charged In E-mail Theft (Registration required)

The New York Post plastered the story on its front page , with a huge headline reading "Spam Scam." The paper provided an update of the two arrested men. "Dunaway appeared in a Las Vegas court and was given 30 days to appear before a judge in New York. Smathers was ordered held by an Alexandria, Va., court until a hearing scheduled for today in Manhattan." * New York Post: AOL Worker, Steal, Sells, Names: Feds

Time Warner released a statement yesterday about the arrests. "Earlier this year, AOL began litigation against a major spammer, and in the process of which, discovered that an AOL employee had stolen member screennames in 2003, which AOL believes were used to send junk email. AOL has uncovered no information indicating that this theft involved member credit card or password information stored by AOL. AOL rapidly brought this information to the attention of federal law enforcement, and this morning the AOL employee was arrested and charged with criminal activity relating to the theft of these screennames," the company said. "We deeply regret what has taken place and are thoroughly reviewing and strengthening our internal procedures as a result of this investigation and arrest. We take this very seriously, and we will continue to hold spammers fully accountable for their activities, through our own ongoing civil litigation, as well as further cooperation with authorities in criminal spam prosecutions."

$435 Million Later

Maybe a multimillion-dollar consolation prize will make AOL feel better. The company said today it is scooping up Advertising.com in a $435 million cash deal. "The companies said in announcing the deal Thursday that the combination would provide advertisers with an opportunity to reach more than 140 million Internet users. ... Baltimore-based Advertising.com said in a statement it works with more than 800 advertisers and over 1,500 online publishers on delivering and measuring the results of online marketing campaigns," the Associated Press reported. "Advertising.com, which earlier this year filed to go public, had income from operations of $12.1 million and revenue of $132 million, up 80%, for the year ended Dec. 31," The Wall Street Journal said in its coverage of the deal. * Associated Press via The Washington Post: AOL Buying Advertising.com (Registration required) * The Wall Street Journal: America Online To Acquire Advertising.com For $435 Million (Subscription required)

Party's Over, Dude

MediaLive International yesterday pulled the plug on this year's Comdex show, saying in a company announcement that the expo, always a hot Las Vegas mega-fest, has been "postponed." "We feel that while we could run Comdex profitably this year, it really wouldn't serve the interests of the broader IT industry," Eric Faurot , vice president of MediaLive International, told CNET's News.com, which was the first to report the news yesterday. In another article, the news site wrote: "Although organizers announced Wednesday that Comdex 2004 has been canceled, for tech executives like P.G. Bartlett the show died long ago. Bartlett, vice president of marketing for specialty software maker Arbortext , said his company gave up on Comdex in the late 1990s, as the show's broad audience made connecting with potential customers a hit-and-miss proposition. 'A lot of the people who come to the Comdex booths are trick-or-treaters rather than serious buyers,' he said. 'If the density of potential buyers is low...it's just not worth it.'" * CNET's News.com: Organizer Cancels Comdex 2004 * CNET's News.com: Comdex Cancellation Packs Little Surprise

The Seattle Times wrote: " Microsoft , for years Comdex's largest presence, wants organizers to resume the show in 2005, but several observers said it's a stumbling dinosaur that needs an extreme makeover if it's going to survive. Started in 1979 as the Computer Dealers Exposition , Comdex blossomed as the industry surged in the 1990s. It became an event where you could see the next big thing in technology on the crowded exhibition floor, meet the inventor at a garish party and place an order with the company president the next day in his hotel suite. But the show lost its way after peaking with 200,000 attendees in 2000. Technology spending fell, crowds thinned and last year the company running Comdex went bankrupt." * The Seattle Times: Comdex Event Canceled For '04

Mike Langberg of the San Jose Mercury News isn't shedding any tears. "Silicon Valley and the technology industry have grown too big for a single all-encompassing trade show. What was once a village is now a metropolis. Smaller, more focused trade shows have picked up the Comdex slack. One example is the annual Consumer Electronics Show , held in Las Vegas in early January, which has kept growing through the tech recession. CES in 2004 drew a record 133,000 attendees, with 2,500 exhibitors filling 1.4 million square feet. I didn't see any big stars at CES this year, unless you count Bill Gates of Microsoft, but I did gather a lot of useful information without standing in any long lines. I won't miss Comdex." * San Jose Mercury News: Tech Show Won't Go On (Registration required)

The San Francisco Chronicle said "tech heavyweights IBM , Intel and Dell pulled out of the show in 1997, although Dell returned last year. Meanwhile, January's Consumer Electronics Show had become the hot ticket, drawing 120,000 people to Las Vegas in January." The Los Angeles Times and The Wall Street Journal also picked up the news. * San Francisco Chronicle: Comdex Cancels '04 Convention * Los Angeles Times: Comdex Goes Dark For the First Time (Registration required) * The Wall Street Journal: Comdex Organizers Cancel This Year's Show In Las Vegas (Subscription required)

Busting Piracy

Congressional lawmakers are starting to look at new ways to get rid of digital piracy, this time looking at who's posting the content online, not just who's downloading it.

"Top Senate leaders from both parties launched an assault on online music and video file-sharing services yesterday, introducing legislation that makes anyone who 'induces' illegal copying just as liable for breaking copyright law as someone who makes the copies. The proposed law, backed by Majority Leader Sen. Bill Frist (R-Tenn.) and Minority Leader Sen. Thomas A. Daschle (D-S.D.), is intended to crack down on the free file-sharing services that the recording and movie industries claim are costing them millions of dollars in lost sales," The Washington Post reported. "But some legal experts argue that the bill is worded so broadly that it threatens numerous electronic devices and software products that enable copying of digital entertainment. And opponents worry that the bill is being hustled through the Senate without sufficient hearings and debate."

More from The New York Times on how the new bill draws a line in the sand: "[Critics] say that the bill's language is overly broad, and that it amounts to a fundamental unraveling of a 1984 Supreme Court decision that has protected companies developing otherwise legal technologies that could be abused by users. 'It's a very powerful blunt instrument that can be used to threaten and intimidate industries that copyright owners disagree with,' said Sarah Deutsch , associate general counsel for Verizon Communications . Echoing the concerns of other critics, Ms. Deutsch added that the Senate Judiciary Committee appeared intent on passing along the bill to the full Senate without holding hearings first. 'What's disturbing is that this is a dramatic sea change to copyright law, but there have been no discussions or hearings,' Ms. Deutsch said. Sponsors of the bill, however, insisted that such concerns were overblown." * The Washington Post: Expanded Copyright Law Proposed (Registration required) * The New York Times: Bill To Curb Online Piracy Is Challenged As Too Broad (Registration required)

Filter is designed for hard-core techies, news junkies and technology professionals alike. Have suggestions, cool links or interesting tales to share? Send your tips and feedback to cindyDOTwebbATwashingtonpost.com . (Yes, those spammers have been having a lot of fun with my e-mail address lately.)