Large scale spammer Robert Soloway, whose criminal trial was scheduled to start in a week and a half pled guilty to most of the charges against him.

The indictment (actually the third indictment, since each time Soloway asked for a postponement, the government got to refile with more charges) made three categories of charges. Counts 1-10 were mail fraud, due to Soloway delivering his spamware through the mail, and the product egregiously failing to be what he said it was, notably including 30 million addresses purported to be opt-in. Counts 11-17 seven were wire fraud, sending spam making false claims about the product, support, guarantee, etc. Count 18 was CAN SPAM fraud, forged mail headers. Counts 19-25 were identity theft, sending spam forging other people’s return addresses. Counts 26-27 were for failure to file income taxes, and 28-40 were money laundering, using his ill gotten income (see counts 1-17) to pay for further lawbreaking, e.g., server hosting and rent for his activitites. All in all, it was quite a comprehensive indictment, most of which was not depending on CAN SPAM.

I have not yet seen the plea bargain, but according to news reports he pled guilty to wire fraud, CAN SPAM fraud, and tax evasion, but not identity theft which was dismissed. This is a thorough victory for the government, although it’s a shame to lose the identity theft charges. Spammers routinely forge return addresses in spam, often picking addresses at random from their spam lists. This causes problems indirectly for the forgery victims, when recipients assume the From: address in the spam is the guilty party, and directly because a lot of spam is sent to invalid addresses which cause non-delivery reports to be sent back to the forged address. We call this blowback, and it is not an insignificant problem. I run a service called abuse.net which some eastern European spammers often use in forged return addresses, and I have gotten up to 400,000 bounces per day from forged spam, even though abuse.net rarely sends out more than a few hundred real messages per day. A precedent confirming that this misuse of innocents’ addresses would have been a useful tool for future cases.

Sentencing on the charges to which Soloway confessed is scheduled for June, and he could get 20 years or more.

Claimer: Had the case gone to trial, I would have testified for the prosecution as a technical expert.