Jason Smathers, 24, of Harpers Ferry, W.Va., entered his guilty plea in New York federal court to charges of stealing an AOL list with 92 million subscriber screen names. He said he sold the list for $28,000 to another man, who then sold it to spammers who used it to send billions of e-mails.
The case, one of the first of its kind, was brought under a 1-year-old law banning unsolicited and deceptive e-mails. Federal sentencing guidelines suggest that Smathers will serve as much as 24 months in prison. He'll be sentenced in May.
"He stole it explicitly for the purpose of using it for spam," Assistant U.S. Attorney David Siegal said in court. The theft led to "waves and waves of billions of spam."
Smathers pleaded guilty to New York and Virginia charges of conspiracy and interstate transportation of stolen property. He also admitted his guilt under the anti-spam law.
U.S. District Judge Alvin Hellerstein accepted the plea after he said in December that he wasn't sure the new law applied to Smathers's case.
Siegal said AOL, a unit of Time Warner Inc., the world's biggest media company, has "sophisticated spam-filter software" that intercepts e-mails sent from thousands of blacklisted computers. He said spammers, employing their own programs, seek to convince AOL computers that the e-mails they send come from names on the stolen list.
"So the deception is to lull AOL into a false sense of security, not knowing there is a spam message sent," Hellerstein said.
Prosecutors say Sean Dunaway, who purchased the list from Smathers in May 2003, used it to promote his own Internet gambling operation. Dunaway, who has pleaded innocent, sold it to other spammers for $52,000, they say.
When Smathers was charged last year, U.S. Attorney David Kelley said one of the spammers who bought the AOL list from Dunaway used it to send e-mails marketing herbal penile enlargement pills.
Smathers, who worked in AOL's Dulles, Va., office, wasn't authorized to access the information on the list, prosecutors say. Using the identification code of another employee, he gained access to AOL's database and began assembling the list.
"You were aware the theft would lead to deception of AOL and its customers?" Hellerstein asked.
"Yes, sir," Smathers replied.
AOL said previously that it learned of the 2003 theft by Smathers during a civil lawsuit against "a major spammer." AOL alerted authorities and fired Smathers. The list didn't include credit card numbers.