COLUMBIA – Two Missouri brothers, one of whom is a current MU student, were among four arrested Wednesday in connection with a nationwide e-mail spamming scheme that affected more than 2,000 colleges and universities.
Amir Ahmad Shah, 28, of St. Louis, and his brother, MU Business Administration graduate student Osmaan Ahmad Shah, 25, of Columbia, allegedly developed e-mail extracting programs to obtain more than 8 million student e-mail addresses.
They then used the MU computer network to send millions of targeted spam messages, of which at least 31 campaigns were directed toward students, according to the indictment.
The Shahs, Liu Guang Ming, a citizen of China, and Paul Zucker, 55, of Wayne, N. J., were all charged in the 51-count indictment that was unsealed Wednesday after the Shahs were arrested. The Shahs' business, I2O, Inc., was also included in the indictment.
“Nearly every college and university in the United States was impacted by this scheme,” acting U.S. Attorney for the Western District of Missouri Matt Whitworth said in a news release. “Illegal hacking and e-mail spamming wreaks havoc on computer networks. These schools spent significant funds to repair the damage and to implement costly preventive measures to defend themselves against future intrusions."
According to the indictment, the Shahs often used the MU wireless Internet service as well as Ethernet connections in MU classrooms, such as Cornell Hall and other campus buildings, to send the messages.
Sending the spam damaged MU's network and forced it to dedicate a substantial amount of money, time and resources to respond to and repair the damage, as well as to protect and defend the network against future spam e-mail campaigns, the release states.
"The University of Missouri has worked closely alongside our office throughout this investigation,” Whitworth stated in the release. “We appreciate their partnership and cooperation, which has been instrumental in bringing this case to indictment.”
The indictment alleges the brothers partnered with Ming as early as 2002 to help provide access to 40 servers in China under Ming's control to provide anonymity to the origins of the spam e-mails and to protect them from complaints sent by the recipients of the e-mails. The Shahs also allegedly acted as the middleman in soliciting more business for Ming.
The spam e-mails attempted to sell various products such as cameras, MP3 players, spring break trips, magazine subscriptions, pepper spray and teeth whitener.
“They were also soliciting subscriptions for a social networking Web site they had launched,” said Don Ledford, spokesman for the U.S. Attorney's Office.
The Shahs hired several employees, who were identified in the press release as unindicted co-conspirators, to help develop the programs designed to extract e-mails and to create Web sites to market and sell the products.
The Shahs learned of the criminal investigation against them in 2005 after search warrants were executed on their home and business, according the indictment.
The Shahs then changed their scheme because MU officials had identified them as the source of the spam e-mails. They removed the e-mail addresses of MU students from their database and stopped sending spam e-mails from the MU campus, opting instead to lease hosting and mail services from many other companies for future spam campaigns, the release states.
In addition, the Shahs also used fictitious names, claimed to be "campus representatives" and also claimed the companies they represented were "alumni-owned," according to the indictment.
The indictment states the defendants made money by charging a "referral fee" for sending spam e-mails selling the products of others and by selling products they bought in bulk themselves. The indictment states the defendants sold over $4.1 million worth of products through the operation, and concealed the proceeds in many ways, including purchasing real property and sending large amounts of the money out of the country.
Ledford said the brothers remain in federal custody and a motion will be filed asking for them to be held without bond. A detention hearing is set for Monday afternoon.