Spitzer’s office said in a statement that Carmack, referred to by EarthLink as the Buffalo Spammer, was charged with four felonies and two misdemeanors based on allegations that he stole the identities of two Buffalo residents to open fraudulent email accounts.

EarthLink sued Carmack for spamming, claiming he sent 825 million unsolicited commercial emails to its users, and won a $16.4m judgment last week. But Spitzer’s charges relate to opening allegedly fraudulent email accounts, rather than spamming.

It was not a spamming question, he was opening false accounts and stealing people’s credit card details, a spokesperson for Spitzer told ComputerWire. The state of New York does not have a spam law.

Carmack faces charges of forgery relating to the spoofing of email headers, falsifying EarthLink’s business records, and identify theft. He pleaded not guilty on all counts and was released on bail. The maximum penalty is three and a half to seven years in prison.

Spitzer’s office said in a statement that the state managed to shut down another alleged spammer, MonsterHut Inc, in January. In that case, the charges related to allegations of fraudulently representing email marketing as opt-in or permission-based.

EarthLink had sued Carmack based on the Computer Fraud and Abuse Act, which makes a criminal offense of trespassing on the networks or computers of others without their consent. The law also allows civil suits to be filed.

EarthLink’s VP of law and policy Dave Baker said in a statement yesterday: Howard Carmack’s arrest demonstrates that spamming has both civil and criminal consequences. Simply put, spammers who brazenly disregard the law will wind up in jail.

The position of EarthLink’s outside attorney who prosecuted the Carmack case is that existing laws are adequate to pursue suspected spammers, and that a federal anti-spam law would need real teeth to work.

There is currently a bill before Congress, referred to by the acronym CAN-SPAM, which aims to make shutting down spammers easier. A rival bill, reportedly utterly toothless, is also said to be introduced shortly.

In the European Union, member states have until October to implement an EU Directive on privacy protection that contains significant anti-spam measures. In the UK, the government recently said it expects to meet this deadline.

Source: Computerwire