Woo-Hoo! SPAMmer Sentenced to nearly 5 years

[SantaMufasa]

The original news article mistakenly headlines as "Botmaster" Gets 15 Years For Spam Attacks...the body of the article indicates the sentence is 57 months (4.75 years)...Although far less than the headlined 15 years, I'm sure that 5 years is still enough to cause other SPAMmers "pause for reflection" (perhaps enough pause that they won't do it). (BTW, because of the "broad appeal" of this news clip, I am posting it in a couple of other fora, as well.)

"Botmaster" Gets 15 (sic) Years For Spam Attacks

LOS ANGELES---Concluding the first prosecution of its kind in the United States, a well-known member of the "botmaster underground" was sentenced Tuesday to nearly five years in prison for profiting from his use of "botnets" - armies of compromised computers - that he used to launch destructive attacks, to send huge quantities of spam across the Internet and to receive surreptitious installations of adware.

Jeanson James Ancheta, 20, of Downey, California, was sentenced to 57 months in federal prison by United States District Judge R. Gary Klausner in Los Angeles. During the sentencing hearing, Judge Klausner characterized Ancheta's crimes as "extensive, serious and sophisticated." The prison term is the longest-known sentence for a defendant who spread computer viruses.

Ancheta pleaded guilty in January to conspiring to violate the Computer Fraud Abuse Act, conspiring to violate the CAN-SPAM Act, causing damage to computers used by the federal government in national defense, and accessing protected computers without authorization to commit fraud. When he pleaded guilty, Ancheta admitted using computer servers he controlled to transmit malicious code over the Internet to scan for and exploit vulnerable computers. Ancheta caused thousands of compromised computers to be directed to an Internet Relay Chat channel, where they were instructed to scan for other computers vulnerable to similar infection, and to remain "zombies" vulnerable to further unauthorized accesses.

Ancheta further admitted that, in more than 30 separate transactions, he earned approximately $3,000 by selling access to his botnets. The botnets were sold to other computer users, who used the machines to launch distributed denial of service (DDOS) attacks and to send unsolicited commercial email, or spam. Ancheta acknowledged specifically discussing with the purchasers the nature and extent of the DDOS attacks or proxy spamming they were interested in conducting. Ancheta suggested the number of bots or proxies they would need to accomplish the specified acts, tested the botnets with them to ensure that the DDOS attacks or proxy spamming were successfully carried out, and advised them on how to properly maintain, update and strengthen their purchased armies.

In relation to the computer fraud scheme, Ancheta admitted generating for himself and an unindicted co-conspirator more than $107,000 in advertising affiliate proceeds by downloading adware to more than 400,000 infected computers that he controlled. By varying the download times and rates of the adware installations, as well as by redirecting the compromised computers between various servers equipped to install different types of modified adware, Ancheta avoided detection by the advertising affiliate companies who paid him for every install. Ancheta further admitted using the advertising affiliate proceeds he earned to pay for, among other things, the multiple servers he used to conduct his illegal activity.

Following the prison term, Ancheta will serve three years on supervised release. During that time, his access to computers and the Internet will be limited, and he will be required to pay approximately $15,000 in restitution to the Weapons Division of the United States Naval Air Warfare Center in China Lake and the Defense Information Systems Agency, whose national defense networks were intentionally damaged by Ancheta's malicious code. The proceeds of Ancheta's illegal activity, including more than $60,000 in cash, a BMW automobile and computer equipment, have been forfeited to the government.

Addressing the defendant at the conclusion of the sentencing hearing, Judge Klausner said: "Your worst enemy is your own intellectual arrogance that somehow the world cannot touch you on this." 5-09-06

© 2006 North Country Gazette

Mufasa
(aka Dave of Sandy, Utah, USA)
[I can provide you with low-cost, remote Database Administration services: see our website and contact me via www.dasages.com]

 

[GwydionM]

Good news, indeed. Too late any maybe too littel, but at least the pests are being targetted.

If someone broke into a stranger's flat and plastered their walls with fly-poasting, it would have been dealt with very severely. Even doing it on the outside of someone's house would be taken seriously. But when it's a computer, the law is slow to catch up.

------------------------------
An old man who lives in the UK

 

[Spirit]

I've said it before and I'll say it again;

5 years for spamming
5 years for manslaughter

Lets keep this slight anoyance in perspective shall we.

Iain

P.S. or just hang them both!

 

[SantaMufasa]

Frankly, Spirit, if the "man" that was "slaughtered" was your father or mother, wife, son or daughter, I'll bet that "5 years" would be far, Far too short a sentence.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I can provide you with low-cost, remote Database Administration services: see our website and contact me via www.dasages.com]

 

[Spirit]

That's exactly my point!

Why does a spammer get the same as someone who commits manslaughter (avg 5 years) and more than someone that kills drunk driving (avg. 2 years plus 5 year driving ban)?

 

[lionelhill]

... if you want an answer to that rhetorical question, it's because governments and the justice system understand manslaughter and its consequences, but they don't really understand abuse of IT, or what the consequences of spamming etc. might be.

We are naturally afraid of what we don't understand. So the penalties for abusing a computer system are disproportionately high.

But explaining why something happens doesn't make it right.

 

[Diancecht]

Mainly because the sentences are not based on the damage felt by the affected people, but in the intention.

If you kill someone by accident, you'd feel a 5-year sentence way too long.

Anyway, I think 5 years is too much time for just spamming, I'd like to know what kinf of benefits he got appart from those mentioned, in the article, that are just a couple of coins compared with all the stuff we are used to read everyday.

Cheers,
Dian

 

[gbaughma]

Anyway, I think 5 years is too much time for just spamming

<soapbox>

I disagree.

Personally, I think the guy should have been charged with 400,000 counts of COMPUTER TAMPERING.

Let him plea bargain down to 100,000 counts.... with a 90 day sentence for each one...

Let's put it this way... have *YOU* had to tell someone that all their documents, family tree info, tax information, etc. was all lost because spyware killed their machine?

Have you had to spend HOURS upon HOURS of reinstalling XP, downloading all the service packs, anti-virus, spyware blocker, reinstall office, reinstall applications, printer drivers, etc. etc. etc. because of spyware or a virus?

I'll bet I've put in more than 5 years worth of time FIXING things that jerks like this CAUSED! And I wasn't even the perpetrator!

Until we crack down and have zero-tolerance for this crap; until it's a STEEP ENOUGH punishment that script-kiddies won't even THINK of doing it, because the punishment FAR outweighs the crime, we won't see an end to it.

And what about the victims? 400,000 people won't see a PENNY of retribution; the government will, because he affected a government computer system.

SOOOOO... let's put this into perspective.....

THIS GUY was driving a BMW, had $60,000 CASH on him, and made over $107,000.

If each of those 400,000 computers bought a $29 anti-virus program because of him, the Anti-virus companies got almost $12M of our money.

Oh, and our taxes will be giving this guy 3 hots and a cot for almost 5 years; it costs something like $60K a year to keep him incarcerated; so there's another $300K just to keep him in prison.

NET COST to the people he affected: $11.9M
Restitution he has to pay: $15,000
Money he made: $107,000
Money he has to pay ME to reimburse me for my time, energy, and anti-virus software licensing: $0

.... 5 years too long? I don't think so.

</soapbox>

Just my 2¢

"In order to start solving a problem, one must first identify its owner." --Me
--Greg

 

[lionelhill]

[tongue half in cheek] So perhaps all those IT administrators who are paid to fix the chaos characters like this cause, and all the people employed by McAffee should be clubbing together to buy this chap a very big bunch of flowers? Without him, a lot of people would be looking for new jobs...

 

[gbaughma]

lol.... you know, actually, I have enough to do with intranet development without having to drop everything to go fix someone's machine because it just picked up a new strain of virus.....

Makes you wonder sometimes if some of the new viruses don't come from the antivirus companies, just so you have to upgrade......



Just my 2¢

"In order to start solving a problem, one must first identify its owner." --Me
--Greg

 

[Grenage]

Makes you wonder sometimes if some of the new viruses don't come from the antivirus companies, just so you have to upgrade......

That used to be one of the virus conspiracy theories, of course in the real world the risk would far outweight the gain for the firms in question!


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[zeitghost]

Funny how none of the AV progs ever mentioned the Sony rootkit hack though...

 

[langleymass]

_SPAM_ is a Hormel product, meaning spiced pork and ham. _Spam_ is unsolicited e-mail.

 

[SantaMufasa]

Langley,

Then in that case, I hope that the perpetrator learned his lesson and is no longer making his own spiced, chopped pork/ham loaf.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I can provide you with low-cost, remote Database Administration services: see our website and contact me via www.dasages.com]