Spam-a-Lot! Brothers Indicted for Spamming Conspiracy Affecting 2,000 Colleges and Universities
Spam e-mail is nearly universally despised. However, recipients of spam may not fully appreciate the inventiveness and intricateness of some spammers' methods, however dubious or illegal, before considering the charges against Missouri residents Amir Ahmad Shah, age 28, and Osmaan Ahmad Shah, age 25, who operated a company I2O. As reported by IDG News Service, the brothers, along with Paul Zucker of New Jersey and Liu Guang Ming, a citizen of China, were indicted today by a federal grand jury for an e-mail spamming scheme which targeted more than 2,000 U.S. colleges and universities and sold more than $4.1 million worth of products to students. The scheme involved e-mail extracting programs which illegally harvested more than 8 million student e-mail addresses. The defendants then sent targeted spam e-mails to students in at least 31 campaign selling a variety of products and services, including digital cameras, MP3 players, teeth whiteners, pepper spray, magazine subscriptions and spring break travel offers. They developed programs to falsify header information and rotate URLs, subject lines, content, reply addresses and other information to avoid spam filters. The defendants would include false and misleading information in the e-mails suggesting an association with the college or university, using fictitious names, claiming to be "campus representatives," and that the businesses selling the products were "alumni owned." They also created dozens of identical websites for each e-mail campaign to conceal the source of the e-mails and to keep the e-mails from being blocked by spam filters, and initially set up the hosting for the websites in China. The defendants made money through referral fees for sending spam for products and services sold by others, and by buying products in bulk and reselling them. They also offered "offshore hosting" services for other spammers.
Federal investigators began investigating the Shah brothers in 2005, after University of Missouri officials identified them as the source of the spamming. The brothers proceeded to remove all Missouri students' e-mails from their lists, but continued to spam other colleges and universities. The defendants are charged in the indictment with 26 counts of aiding and abetting each other to access a protected computer without authorization and transmit commercial e-mails with the intent to deceive or mislead the recipients about the origin of the messages, and the indictment seeks $4.1 million in forfeiture and other property. Colleges and universities have spent large amounts repairing the damage from the hacking and spamming and in implementing protective measures.
Spamming is regulated by the CAN-SPAM Act of 2003, codified at 15 U.S.C. s 7704, which prohibits false, misleading or deceptive information in spam, as well as for sexually explicit spam without sufficient warnings, and carries a maximum sentence of 5 years imprisonment. Some sources estimate that spam now comprises 95% of the e-mails in the world.
