Adam Guerbuez and Atlantis Blue Capital were ordered to pay Facebook the damages by U.S. District Court Judge Jeremey Fogel in San Jose, Calif. And Guerbuez can no longer access Facebook. The ruling came after four months of court arguments.

Guerbuez and Atlantis were ordered to pay $436.6 million in statutory damages and $436.6 in aggravated statutory damages, according to court documents posted on Justia.com. The award is the largest judgment awarded under the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003).

"This judgment is the result of the tireless effort of our security experts, legal team, and other significant resources we've devoted to finding, exposing and prosecuting the sources of spam attacks," wrote Max Kelly, Facebook's director of security, on his blog.

Four Million Messages

Guerbuez runs the crazypricks.com Web site, according to Neil Schwartzman, executive director of the Coalition Against Unsolicited Commercial Email (CAUCE), a consumer-advocacy group formed to fight for antispam laws which now works to defend Internet users. "He is a Nazi skinhead who was videotaping homeless people beating each other up," Schwartzman said.

The court found Guerbuez illegally accessed Facebook's user-profile data to launch his spamming activities. He sent Facebook users four million messages and conned some into providing their log-in details. Each violation under CAN-SPAM can be punished by a $11,000 fine.

CAN-SPAM covers e-mail that is advertising or promoting a commercial product or service . The Federal Trade Commission is the enforcer and the Department of Justice handles criminal violations.

Other federal and state agencies can enforce the law against organizations under their jurisdiction, and companies that provide Internet access may sue violators, as Facebook did, according to the FTC. Under CAN-SPAM, the FTC has brought nearly 30 actions against offenders.

Flawed But Good

"So as much as CAN-SPAM is flawed, I've got to say it is being used for good by countless people like MySpace, Facebook and, of course, Microsoft and Yahoo," Schwartzman said. He added that it is much better than in Canada, where the coalition has reported botnet operators and phishing schemes to law enforcement.

Facebook doesn't expect to receive $873 million, according to Kelly, who wrote that it's unlikely Guerbuez and Atlantis could honor the judgment. But Facebook plans to collect every penny it can, he said.

"This again is a victory. We should all accept there are several ways to skin this cat," said Jart Armin, whose group, HostExploit, recently took down McOlo, a spamming company.