The New York Times | June 23, 2004
By David Stout

A software engineer for America Online stole the Internet provider's customer list — some 92 million names — and sold it to an on-line marketer, setting off a torrent of unsolicited commercial e-mail commonly known as spam, federal authorities said today.

The engineer, Jason Smathers, 24, of Harpers Ferry, W. Va., and the on-line marketer, Sean Dunaway, 21, of Las Vegas, Nev., were charged with conspiracy and face prison terms of up to five years and fines of up to $250,000 if convicted, said David N. Kelley, the United States attorney for the Southern District of New York.

Mr. Smathers, who has since been fired, used his computer skills and his inside knowledge of AOL to gain access to the customer list in the spring of 2003, then sold it to Mr. Dunaway, the United States attorney said. Mr. Dunaway used the list to promote his own gambling enterprise, then sold the list in turn to other spammers, Mr. Kelley said.

AOL issued a statement expressing regret over the episode. Prosecutors emphasized that there is no evidence that anyone gained access to or stole customers' credit card account numbers, which AOL stores in a separate secure location apart from the data warehouse that Mr. Smathers gained access to in Dulles, Va.

Mr. Kelley said the case is one of the first in the nation prosecuted under the recently enacted federal anti-spam law that is supposed to shut off the spigots on unwanted Internet solicitations.

Prosecutors said Mr. Smathers worked at AOL's offices in Dulles but was not authorized to handle the customer information in the secure data warehouse. But by using the computerized identification code of another employee, prosecutors said, he was able to assemble a list of customer account screen names, ZIP codes, phone numbers and credit card types — but no credit card numbers.

The prosecutors did not go into great detail on how suspicion first attached to the defendants, although a statement from Mr. Kelley's office said that a "confidential source" bought the list from Mr. Dunaway in the spring of 2003, then bought an updated list from him last March.

Mr. Kelley's office said Mr. Dunaway paid Mr. Smathers $100,000 at one point, and then sold a copy of the list to the confidential source for $52,000, or $2,000 for each letter of the alphabet. In a later transaction, the source paid Mr. Dunaway $32,000 for an updated list, prosecutors said.

The confidential source was not named, nor was there any mention of charges against him or her — suggesting that he or she may be cooperating with the authorities.