San Francisco, California - Sanford Wallace was sentenced to 30 months’ imprisonment and was ordered to pay $310,628.55 in restitution for sending millions of spam messages to Facebook users and disobeying a court order not to access Facebook announced the Office of the United States Attorney for the Northern District of California and the Federal Bureau of Investigation.
Wallace, 47, of Las Vegas, pleaded guilty on August 24, 2015 to one count of fraud and related activity in connection with electronic mail, in violation of 18 U.S.C. §§ 1037(a)(1) and (b)(2)(A); and one count of criminal contempt, in violation of 18 U.S.C. § 401(3). According to the plea agreement Wallace admitted to executing a scheme from approximately November 2008 through March 2009 to send spam messages to Facebook users that compromised approximately 500,000 legitimate Facebook accounts, and resulted in over 27 million spam messages being sent through Facebook’s servers.
Wallace illegally obtained, stored, and exploited Facebook user account information and earned money by redirecting users to other websites. Specifically, Wallace admitted he opened a fictitious Facebook account in the name of “David Frederix” to test his spam messages and created an automated process to sign into a Facebook user’s account, retrieve a list of all of the user’s friends, and then send a message to each of the user’s friends’ Facebook accounts. The message was designed to trick legitimate Facebook account holders into accessing a website listed in the message that was purportedly from a Facebook friend. Once the user entered his or her information, the user would be redirected to an affiliate website. Wallace further admitted that he earned money for directing traffic to the websites and stored users’ email addresses and passwords in order to continue sending spam messages.
In addition, Wallace admitted that during three time periods he accessed Facebook’s computer network to send spam messages to Facebook’s users. First, on or about November 5, 2008, and continuing to November 6, 2008, he accessed Facebook’s computer network in order to initiate the transmission of a program that resulted in more than 128,883 spam messages being sent to Facebook users. Second, he admitted that on December 28, 2008, he accessed Facebook’s computer network in order to initiate the transmission of a program that resulted in nearly 300,000 spam messages being sent to Facebook users. Third, he admitted that on February 17, 2009, he accessed Facebook’s computer network in order to initiate the transmission of a program that resulted in more than 126,000 spam messages being sent to Facebook users.
Facebook filed a lawsuit against him in United States District Court for the Northern District of California alleging violations of the CAN-SPAM Act of 2003, the Computer Fraud and Abuse Act, and California’s Anti-Phishing and Computer Data Access and Fraud Acts. (Facebook, Inc. v. Wallace, et al, No. C-09-00798 JF). On March 2, 2009, March 24, 2009, and September 18, 2009, U.S. District Court Judge Jeremy Fogel ordered Wallace not to access or attempt to access Facebook’s computer network in any manner whatsoever nor create or maintain a Facebook account. Wallace admitted that on April 17, 2009, he willfully disobeyed Judge Fogel’s order by logging into his Facebook account while aboard a flight from Las Vegas to New York.
Wallace was indicted by a federal grand jury on July 6, 2011. He was charged with multiple counts of fraud and related activity in connection with electronic mail, in violation of 18 U.S.C. §§1037(a)(1) and (b)(2)(A); 18 U.S.C. §§ 1037(a)(2) and (b)(2)(C); and 18 U.S.C. §§ 1037(a)(4) and (b)(2)(B). Wallace was also charged with three counts of intentional damage to a protected computer, in violation of 18 U.S.C. §§ 1030(a)(5)(A) and (c)(4)(B)(i), for accessing Facebook’s computer network and two counts of criminal contempt, in violation of 18 U.S.C. § 401(3) for disobeying Judge Fogel’s order.
The sentence was handed down by the Honorable Edward J. Davila, U.S. District Judge. Judge Davila also sentenced the defendant to a five-year period of supervised release. The defendant will begin serving the sentence on September 7, 2016.
Assistant U.S. Attorney Susan Knight is prosecuting the case with the assistance of Elise Etter. The prosecution is the result of an investigation by the Federal Bureau of Investigation.
