A federal grand jury in Kansas City has indicted four people, including two Missouri brothers, in a nationwide email spamming case that involved the illegal harvesting of eight million student email addresses from more than 2,000 colleges.
Amir Ahmad Shah, 28, of St. Louis; his brother, Osmaan Ahmad Shah, 25, of Columbia, Mo., Liu Guang Ming of China, and Paul Zucker, 55, of Wayne, N.J., were charged in a 51-count indictment unsealed last week, federal prosecutors said.
"Nearly every college and university in the United States was impacted by this scheme," Matt Whitworth, acting U.S. attorney for the Western District of Missouri, said in a statement. "These schools spent significant funds to repair the damage and to implement costly preventive measures to defend themselves against future intrusions."
The four are accused of using the database they built to send targeted spam emails as part of at least 31 marketing campaigns in which they sold $4.1 million worth of products and services, such as digital cameras, MP3 players, magazine subscriptions, pepper spray and teeth whiteners.
According to the indictment, the Shah brothers initially set up hosting on a botnet in China, which provided anonymity. They also falsified email header information to avoid spam filters, a violation of the federal CAN-SPAM Act.
The law bans false or misleading header information, prohibits deceptive subject lines, and requires the sender to include a valid physical postal address.
The defendants face up to 10 years in prison, in addition to the forfeiture of more than $4 million and their cars and homes.