Buffalo Spammer' Arraigned On

State Attorney General Spitzer today announced the arrest of a notorious email marketer known as the "Buffalo Spammer." The charges, four felony and two misdemeanor counts, stem from a scheme used by the defendant to send hundreds of millions of forged spam emails through accounts opened using stolen identities.

Howard Carmack, 36, of Buffalo was charged with stealing the identity of two Buffalo-area residents to open Internet access accounts with EarthLink, an Internet Service Provider (ISP), thereby falsifying the business records of EarthLink, forging the headers of email sent from the EarthLink accounts, and possessing a software program designed to create the forged emails.

The prosecution is the first by the Attorney General under New York's recently enacted identity theft statute. The arrest is a result of an ongoing investigation by the New York State Attorney General's Office, the New York State Police and the FBI's Buffalo Cyber Task Force.

"This defendant stole the identities of innocent New Yorkers to spam millions of consumers throughout New York and the nations," Spitzer said. Prosecutions like this are designed to teach spammers that cyber-crime does not pay."

According to court papers filed by EarthLink in civil litigation in Atlanta, Carmack used 343 stolen identities to sign up for email accounts through which he sent about 825 million spam emails offering for sale spamming software, herbal sexual stimulants and bulk email lists. Carmack is alleged to have taken a share of the sales.

According to the criminal complaint, Carmack repeatedly opened numerous email accounts with EarthLink using personal information from Buffalo-area residents. Using software designed to mask the identity of the account from which the email was sent, Carmack would remove the EarthLink email address and replace it with another person's email address. Carmack would then send his spam with the forged email address attached.

Forging email headers so that the message appears to have originated from someone other than the actual source is referred to as "email spoofing". The consequence of email spoofing is that all of the undeliverable email, which can in some cases number in the thousands, and all of the replies, including complaints, are sent to the unwitting person whose email address was stolen by the spammer. Additionally, because ISPs and spam filters identify the "spoofed" email address as the source of the spam they block all email, including legitimate email from the spoofed email address from being delivered.
Carmack is facing numerous charges, including Forgery in the Second Degree, a class D felony, Criminal Possession of a Forgery Device, a class D felony, two counts of Falsifying Business Records in the First Degree, a class E felony, and two counts of Identity Theft in the Third Degree, a class A misdemeanor. If convicted on the top Forgery charge, Carmack faces a maximum of 3½ to 7 years in prison. The defendant entered not guilty pleas before Buffalo City Court Judge Diane Devlin. Bail was set at $20,000. The next court date is May 19.

Attorney General Spitzer acknowledged and thanked the partners in the law enforcement agencies who assisted in the investigation, including New York State Police Investigator Tom Spulecki, Supervising Special Agent Holly Hubert and Special Agent Brian Haynes of the FBI's Buffalo Cyber Task Force and Assistant U.S. Attorney Martin Littlefield.

Earlier this year, the Attorney General successfully shut down another spammer. In January, Manhattan Supreme Court Justice Lottie E. Wilkins permanently enjoined MonsterHut, Inc., of Niagara Falls, its Chief Executive Officer Todd Pelow, and its Chief Technical Officer Gary Hartl, from "further engaging in any of the fraudulent, deceptive and illegal acts and practices pertaining to representations of ‘opt-in', ‘opt-out' or the ‘permission-based' nature of their protocols or the collection and use of their email data."

The Attorney General's Internet Bureau receives more complaints about spam than any other Internet-related issue.

The charges in the case are mere accusations and the defendants are presumed innocent unless and until proven otherwise in a court of law.

The case is being handled by Assistant Attorneys General Stephen Kline of the Internet Bureau, and Paul McCarthy of the Criminal Prosecutions Bureau, and Investigators James Domres and Vanessa Ip. The case is being supervised by Janet Cohn, Chief of the Criminal Prosecutions Bureau and Kenneth Dreifach, Chief of the Internet Bureau.