Two Missouri men who made over $4 million pitching and selling everything from electronics to teeth whiteners to students in more than 2,000 colleges and universities have been indicted by a federal grand jury on a variety of e-mail spamming and related charges.
Amir Ahmad Shah, 28, of St. Louis, and his brother, Osmaan Ahmad Shah, 25, of Columbia, Mo., were charged in a 51-count sealed indictment by a federal grand jury on April 23. Also indicted in the nationwide spamming case were Liu Guan Ming, a Chinese citizen, Paul Zucker, a 55-year-old from Wayne N.J, and I20 Inc., the company owned by the Shah brothers.
The indictment was unsealed and made public on Wednesday. All are being charged under the federal CAN-SPAM Act, and face charges that include computer hacking and fraud.
The indictments come even as spam continues to be a huge burden for businesses and consumers. A report from security vendor McAfee in March estimated that companies with 1,000 employees or more spent an average of $182,500 per year fighting spam. Storage costs are also rising because of the need for companies to stores unwanted e-mail, McAfee said.
According to the indictment papers, the spam e-mail scheme affected virtually every college and university in the country. It began around 2001 with the Shah brothers allegedly using e-mail extracting programs to harvest e-mail addresses from colleges and universities around the country which they then used to send targeted spam e-mails pitching various products.
They earned money both by sending spam e-mails on behalf of various product vendors and by purchasing products in bulk themselves and selling them directly to the students. In total the brothers are believed to have harvested more than 8 million student e-mail addresses, 37.5 million AOL e-mail IDs, 33.7 million MSN addresses, nearly 11 million Hotmail and 5 million Yahoo e-mail addresses.
In targeting students with e-mailed marketing campaigns the two brothers would make it appear that they had an association with the college or university that the student was attending in order to entice them into buying products and services. For instance, one of the campaigns involved a so-called textbook buyback program which made it appear that the institution the students were attending was participating in it.
On another occasion, the brothers allegedly set up a fictitious company called Custom Bright Inc. selling a teeth whitening product, which they portrayed as a alumni-owned business to the students they were targeting. The brothers often discussed methods on how to confuse people into subscribing or buying products from their Web sites.
In one IM exchange, a transcript of which is attached in the indictment, Osmaan talks about how 20 people signed up on one of the dozens of Web sites that the brothers typically created for each e-mail campaign. “They obviously looked at the site, and it is just funny … we conned them,” he says to his brother.
Many of the 31 spam e-mail campaigns the two brothers allegedly conducted were carried out on the networks of the University of Missouri where Osmaan Shah was a student, the indictment noted. Transcripts of chat messages between Osmaan and his brother show Osmaan apparently boasting about how he had easily gained access to the broadband networks at campus — either wirelessly or by plugging his system directly into the network via an Ethernet connection.
In one of the messages, Osmaan talks about “blasting” 2 million e-mails an hour via the school’s network. “Jease (sic) this is sick,” he tells his brother. In another exchanges, he brags about repeatedly entering an unlocked class room in a campus building and using the broadband access there to send large volumes of spam to students at other campuses. “Last night I snuck into A&S … was in a class room for like an hour and a half consuming the entire schools bandwidth … sooooooo fast,” he tells his brother.
Other exchanges between the brothers refer to complaints from system administrators from various schools about their spam e-mails and ways of dealing with the complaints. Another talks about how, a spammer who had used a hosting service provided by the brothers had been arrested in a nationwide spam crackdown by federal authorities.
Even after the Shahs learned they were under criminal investigation by federal authorities in 2005, they simply stopped sending spam to students at the University of Missouri but allegedly continued to spam students at other institutions.
Ming who is one of those named in the indictment which also includes several unnamed co-onspiratorsis alleged to have provided the Shahs with access to a network of over 40 servers in China for hosting Web sites and sending spam.
The Shah brothers also solicited customers for Ming, who provided hosting and mailing services to other spammers, the indictment alleged. Zucker meanwhile is described who partnered with the Shahs when they were leasing space on Ming’s servers in China.
Source: Computerworld.com
