Punishment fails to fit the cybercrime

Declan McCullagh CNET News

Published: 19 Aug 2004 10:35 BST

David L. Smith, who created the Melissa virus, which clogged the Internet in 1999, was sentenced in 2002 to 20 months in prison and a $5,000 fine. Jan de Wit, the 20-year-old living in the Netherlands who wrote the Anna Kournikova virus, received only 150 hours of community service -- and no jail time.

Better deterrence is especially important because the FBI and other police agencies have such a poor record of identifying the virus and worm writers that infest the Internet's underbelly.

The FBI and its counterparts have failed to convict anyone for a slew of viruses and worms, including Code Red, Nimda, SirCam, Klez, Sobig and Nachi. Police failed to identify the author of the Slammer worm, which threw some bank ATMs offline and knocked out a PC network at a nuclear power plant in Ohio. (A $5m reward fund created by Microsoft has had better luck, nabbing a Sasser suspect in May.)

You might expect criminals who intentionally infect tens of thousands of computers to be treated at least as harshly as environmental scofflaws. An example: In 1999, the plant manager at LCP Chemicals of Brunswick, Georgia, was sentenced to six and a half years in prison for illegally releasing mercury and chlorine into a nearby creek. The chairman of LCP Chemicals' parent company received a nine-year prison sentence.

Worms and viruses pollute today's Internet and cost society far more to clean up than LCP Chemicals' toxic release. So why do their creators get off easier?