Robert Donovan
06-06-2003, 07:59 AM
Here's a lesson to learn:
TO have any chance of making easy money on the Internet, computer geek Howard Carmack knew he had to send more than a million junk e-mails every day.
And to avoid being detected by Internet companies that try to block the nuisance messages, he needed to become devious.
So to keep his annoying spam flowing across the Web and into the in-boxes of hundreds of thousands of e-mail users, the 36-year-old stole the identities of strangers and hacked into their e-mail accounts, investigators have learned - and he also betrayed members of his own family.
Carmack not only stole his uncle Joseph's identity; his mentally disabled brother, James Jr., was also a victim, according to court papers. Last week, Carmack was charged by the State Attorney General's Office with four felony counts and two misdemeanors for allegedly using false identities and stolen credit-card or bank-account information to create 343 e-mail accounts through which he sent about 825 million spam messages.
The spam offered products for sale from herbal sexual stimulants, to bulk e-mail lists, to get-rich-quick schemes - and even spam-blocking devices - prosecutors said.
The complaint, filed in Buffalo City Court, alleges that on the day of his arrest, Carmack possessed computer software designed for e-mail forgery and other software programs for sending spam e-mails with forged return addresses to millions of consumers.
If convicted of the most serious charges, he could spend up to seven years in prison.
His arrest Tuesday was the first under New York's new identity-theft statute enacted last October.
The state's charges against Carmack came after a relentless pursuit of a mystery spammer by Internet company EarthLink after the service provider detected a huge amount of spam e-mails originating from the Buffalo, N.Y., area.
In an action separate from the state charges, EarthLink sued Carmack for damages. Last week, as he was being arrested by New York authorities, a judge in Atlanta awarded the Georgia-based EarthLink a $16.4 million judgment against Carmack.
Dave Baker, an EarthLink vice president, conceded the money will probably never be collected, but the company was content that one of its most troublesome spammers had been disabled.
Howard Carmack lived with his widowed mother, Judith, and his brother in a two-story home on Parkridge Ave. in Buffalo. His grandmother lived across the street.
When investigators from EarthLink began their probe into the source of the Buffalo spam, they traced hundreds of e-mail accounts to the two Parkridge Ave. homes.
According to EarthLink attorney Paul Wellborn, the company's investigators said Carmack was neither the most prolific, nor the most successful spammer they had uncovered. But they rated him as one of the most brazen they had tracked.
Carmack was a spammer who did not shy away from soiling the family nest, Wellborn said.
"This was especially devious given the egregious act of stealing the identity of his mentally handicapped brother," said Wellborn.
The attorney added that when investigators first confronted Carmack, he tried to pass himself off as his uncle, Joseph.
In fact, Joseph Carmack, as well as Howard's brother Jimmy, along with a "John Doe," had been named in a complaint filed by EarthLink last year.
In a sworn statement to investigators, Joseph Carmack said he contacted Howard after he learned he was being sued by Earthlink for sending spam. He said his nephew told him "it is nothing to worry about."
"Upon Howard's advice, [we] ignored the lawsuit," Joseph said in his statement.
The 6-foot, 260-pound Carmack looks nothing like the stereotype nerdy computer geeks often associated with online crimes.
HE is "very muscular," according to relatives, and was a high school football player.
His love of sports was reflected in e-mail account passwords he frequently chose - including football and baseball. Buffalo and 12345 were others he used for his fraudulently obtained accounts, according EarthLink investigators.
Carmack's mixture of brawn and cleverness came in handy for avoiding EarthLink's attempts to serve him with legal documents.
"He assaulted prior investigators who came to him to discuss the matter," said Peter M. Vito, a private investigator hired by EarthLink to serve papers on Carmack.
"He'd dodged service for a number of months, if not a year. He would do a counter surveillance of the neighborhood before coming home to make sure there were no vehicles he was unfamiliar with - and no one he was unfamiliar with inside those [cars] that he knew."
Based upon his surveillance, Vito said, Carmack appeared to have no outside employment during the time he was tracking him.
Mary Youngblood, who led the EarthLink investigation that identified Carmack, said his undoing was a result of his refusal to lay low. Even as investigators closed in, Carmack continued to send millions of e-mails each day, she said.
Youngblood, whose evidence helped bolster the state charges against Carmack, said her investigation began in March 2002.
She said a person EarthLink dubbed "The Buffalo Spammer" regularly purchased dial-up accounts using fraudulent and/or stolen credit-card numbers, false bank-account numbers and fake identities.
As each illegal account was detected and terminated by Earthlink, "The Buffalo Spammer" would open another.
Youngblood said that to evade EarthLink's spam-stopping filters and prolong the life of his accounts, Carmack often used sophisticated "spoofing" identity falsification techniques including changing addresses, headers and subject lines.
Each account tended to last 2.5 days and was used to send a million spams per day, she said.
The rewards for Carmack, however, appear to have been relatively small.
Angelo Tirico, a Florida-based Web site advertiser, said in a declaration in the EarthLink lawsuit that he paid Carmack $10 per sale of products such as nonprescription alternatives to Viagra.
He said Carmack's more than 10 million spams over a three-month period generated a mere 36 sales - $360 in commissions for efforts.
Wellborn said "The Buffalo Spammer" may have played his hand too strongly.
Many of Carmack's spam e-mails gave his mother's address as a contact address for buyers to get products, Wellborn said.
And when Wellborn telephoned Carmack in October 2002 to imply EarthLink might take legal action against him, Carmack boasted he could never be held responsible because "nothing is in my name."
Retired North Dakota school teacher Wallace Olson was among the victims whose names and social security (news - web sites) numbers were allegedly stolen by Carmack from information he found online.
"I don't think it's cost me anything, but you still wonder if your next credit card bill will have charges you're not familiar with," Olson said.
"It makes you wonder if he'll have your number after he comes out [of prison] again. And they got the guy, but does he have friends? I don't use my credit card that much, but I now take a good look at [the statement] when I get it each month."
TO have any chance of making easy money on the Internet, computer geek Howard Carmack knew he had to send more than a million junk e-mails every day.
And to avoid being detected by Internet companies that try to block the nuisance messages, he needed to become devious.
So to keep his annoying spam flowing across the Web and into the in-boxes of hundreds of thousands of e-mail users, the 36-year-old stole the identities of strangers and hacked into their e-mail accounts, investigators have learned - and he also betrayed members of his own family.
Carmack not only stole his uncle Joseph's identity; his mentally disabled brother, James Jr., was also a victim, according to court papers. Last week, Carmack was charged by the State Attorney General's Office with four felony counts and two misdemeanors for allegedly using false identities and stolen credit-card or bank-account information to create 343 e-mail accounts through which he sent about 825 million spam messages.
The spam offered products for sale from herbal sexual stimulants, to bulk e-mail lists, to get-rich-quick schemes - and even spam-blocking devices - prosecutors said.
The complaint, filed in Buffalo City Court, alleges that on the day of his arrest, Carmack possessed computer software designed for e-mail forgery and other software programs for sending spam e-mails with forged return addresses to millions of consumers.
If convicted of the most serious charges, he could spend up to seven years in prison.
His arrest Tuesday was the first under New York's new identity-theft statute enacted last October.
The state's charges against Carmack came after a relentless pursuit of a mystery spammer by Internet company EarthLink after the service provider detected a huge amount of spam e-mails originating from the Buffalo, N.Y., area.
In an action separate from the state charges, EarthLink sued Carmack for damages. Last week, as he was being arrested by New York authorities, a judge in Atlanta awarded the Georgia-based EarthLink a $16.4 million judgment against Carmack.
Dave Baker, an EarthLink vice president, conceded the money will probably never be collected, but the company was content that one of its most troublesome spammers had been disabled.
Howard Carmack lived with his widowed mother, Judith, and his brother in a two-story home on Parkridge Ave. in Buffalo. His grandmother lived across the street.
When investigators from EarthLink began their probe into the source of the Buffalo spam, they traced hundreds of e-mail accounts to the two Parkridge Ave. homes.
According to EarthLink attorney Paul Wellborn, the company's investigators said Carmack was neither the most prolific, nor the most successful spammer they had uncovered. But they rated him as one of the most brazen they had tracked.
Carmack was a spammer who did not shy away from soiling the family nest, Wellborn said.
"This was especially devious given the egregious act of stealing the identity of his mentally handicapped brother," said Wellborn.
The attorney added that when investigators first confronted Carmack, he tried to pass himself off as his uncle, Joseph.
In fact, Joseph Carmack, as well as Howard's brother Jimmy, along with a "John Doe," had been named in a complaint filed by EarthLink last year.
In a sworn statement to investigators, Joseph Carmack said he contacted Howard after he learned he was being sued by Earthlink for sending spam. He said his nephew told him "it is nothing to worry about."
"Upon Howard's advice, [we] ignored the lawsuit," Joseph said in his statement.
The 6-foot, 260-pound Carmack looks nothing like the stereotype nerdy computer geeks often associated with online crimes.
HE is "very muscular," according to relatives, and was a high school football player.
His love of sports was reflected in e-mail account passwords he frequently chose - including football and baseball. Buffalo and 12345 were others he used for his fraudulently obtained accounts, according EarthLink investigators.
Carmack's mixture of brawn and cleverness came in handy for avoiding EarthLink's attempts to serve him with legal documents.
"He assaulted prior investigators who came to him to discuss the matter," said Peter M. Vito, a private investigator hired by EarthLink to serve papers on Carmack.
"He'd dodged service for a number of months, if not a year. He would do a counter surveillance of the neighborhood before coming home to make sure there were no vehicles he was unfamiliar with - and no one he was unfamiliar with inside those [cars] that he knew."
Based upon his surveillance, Vito said, Carmack appeared to have no outside employment during the time he was tracking him.
Mary Youngblood, who led the EarthLink investigation that identified Carmack, said his undoing was a result of his refusal to lay low. Even as investigators closed in, Carmack continued to send millions of e-mails each day, she said.
Youngblood, whose evidence helped bolster the state charges against Carmack, said her investigation began in March 2002.
She said a person EarthLink dubbed "The Buffalo Spammer" regularly purchased dial-up accounts using fraudulent and/or stolen credit-card numbers, false bank-account numbers and fake identities.
As each illegal account was detected and terminated by Earthlink, "The Buffalo Spammer" would open another.
Youngblood said that to evade EarthLink's spam-stopping filters and prolong the life of his accounts, Carmack often used sophisticated "spoofing" identity falsification techniques including changing addresses, headers and subject lines.
Each account tended to last 2.5 days and was used to send a million spams per day, she said.
The rewards for Carmack, however, appear to have been relatively small.
Angelo Tirico, a Florida-based Web site advertiser, said in a declaration in the EarthLink lawsuit that he paid Carmack $10 per sale of products such as nonprescription alternatives to Viagra.
He said Carmack's more than 10 million spams over a three-month period generated a mere 36 sales - $360 in commissions for efforts.
Wellborn said "The Buffalo Spammer" may have played his hand too strongly.
Many of Carmack's spam e-mails gave his mother's address as a contact address for buyers to get products, Wellborn said.
And when Wellborn telephoned Carmack in October 2002 to imply EarthLink might take legal action against him, Carmack boasted he could never be held responsible because "nothing is in my name."
Retired North Dakota school teacher Wallace Olson was among the victims whose names and social security (news - web sites) numbers were allegedly stolen by Carmack from information he found online.
"I don't think it's cost me anything, but you still wonder if your next credit card bill will have charges you're not familiar with," Olson said.
"It makes you wonder if he'll have your number after he comes out [of prison] again. And they got the guy, but does he have friends? I don't use my credit card that much, but I now take a good look at [the statement] when I get it each month."