Information Management Journal: AOL Employee Charged for Stealing Screen Names

A 24-year-old America Online (AOL) software engineer was recently arrested on federal charges that he hacked into the company's computers to steal 92 million e-mail addresses that were later sold and used to bombard AOL members with spam.

Jason Smathers is accused of illegally obtaining the e-mail addresses of nearly all of AOL's customers in May 2003. Smathers allegedly sold the names for $100,000 to Sean Dunaway, who ran an Internet gambling business in Las Vegas, according to prosecutors. Dunaway then sold the list of 92 million names to unidentified spammers, who used it early this year to send millions of e-mails peddling herbal enhancement products, according to a criminal compliant filed in a New York federal court. Dunaway, who was also arrested, sold the names in 26 separate blocks, one for each letter of the alphabet, for $52,000, authorities said.

Smathers, who had worked at AOL since 1999, obtained other AOL member information as well, including telephone numbers, zip codes, and types of credit cards used by members, though not credit card numbers, according to the complaint. AOL said those numbers are stored in a separate, secure facility.

AOL discovered the scheme after it filed suit in March against another spammer. A source told the Internet provider that one of its employees was stealing screen names from the company and selling them. According to prosecutors, Smathers was not authorized to access AOL's customer database, which can be viewed by only a small number of employees and is housed in secure computers. But Smathers allegedly used the computerized employee identification code of another AOL worker to gain entry to the data and compile the lists of AOL's roughly 30 million users.

The charges against Smathers and Dunaway include conspiring to transmit stolen goods across state lines, gaining unauthorized access to computers, and sending out deceptive bulk e-mail with disguised origins. Each faces a maximum sentence of five years in prison and a fine of $250,000.