You get years in prison for possession, but community service for spreading a virus. 9/30 ReleVents hed: Hacking sentences must change dek: You get years in prison for possession, but community service for spreading a virus. by James Mathewson
A news item on our site over the weekend was a real jaw-dropper. Jan de Wit, the man convicted of writing and spreading the Anna Kournikova virus, received just 150 hours of community service for the act, which caused millions of dollars in damage around the world. I’m with security experts on this one: This is the wrong message to send to hackers.
In the wake of the terrorist attacks, we should examine how justice is meted out for acts other than murder. Certainly victimless crimes, such as marijuana possession, should not consume as many resources as they do today. I’ve read reports that one-third of U.S. police and corrections resources are spent on detecting, capturing, convicting, and detaining criminals for possessing marijuana. Some of those resources could come in handy in fighting crimes that do more harm to American citizens, such as computer crime. While I’m not advocating legalizing marijuana, I do think our justice system is messed up when we devote so much attention to illicit drugs and so little attention to crimes against humanity.
Several factors conspired against a heavier sentence for de Wit, and they deserve a closer look. Perhaps in identifying the things that went wrong in this case, laws can be adjusted to deter computer criminals in the future. The first problem is one that I’ve talked about before in ReleVents: The FBI’s computer crime division is woefully understaffed. Because of this, the Bureau did not gather enough claims of harm here. As a result, it could only present a case that the virus did $160,000 in damage, which experts say is only a small fraction of the actual damage. The second problem–that the case was outside FBI jurisdiction–also lightened the sentence.
The biggest problem is that hacking is a global crime and there is not a global body like Interpol that can assess damage and frame international punishment to fit the crime. Until such a body exists, computer crime will be underprosecuted. Considering how easy it is to create and spread VB script worms (de Wit used the free VBS Worm Generator 1.5 to craft and spread Anna K.), worms will increase exponentially until proper criminal deterrence is in place. Yes, we are all responsible for the security of our systems–especially Microsoft servers with Outlook/Exchange–but it would help if law enforcement did its part to keep us safe from computer crime.
James Mathewson is editor of ComputerUser magazine and ComputerUser.com.