Perspective: Why cyberscofflaws get off easy

Jeffrey Lee Parson pleaded guilty last week to unleashing part of the MSBlast worm attack that wreaked havoc on the Internet a year ago. He got off easy.

Federal prosecutors predictably touted Parson's guilty plea as an example for other would-be vandals. John McKay, the U.S. Attorney for Seattle, proclaimed: "The damage to individual computer users is very real, and the penalties are also very real."

Not really. McKay neglected to mention that Parson's all-expense-paid visit to Club Fed will be surprisingly brief. Prosecutors say that the deal they cut means that Parson, who is 19 years old, will be sentenced to between 18 and 37 months.

That's mild punishment for someone who admitted to inserting nasty features into the original version of MSBlast to make it more noxious. By releasing his "MSBlast.B" variant that took advantage of a bug in Microsoft Windows, Parson intentionally harmed tens of thousands of people for his own amusement.

Parson could be serving more time if he had simply stolen a neighbor's car on a whim.

Compare Parson's sentence with the far stiffer penalties that the government metes out to marijuana "criminals," who harm nobody and cause no property damage. For the 2001 fiscal year, the average sentence for a marijuana offense was 38 months in prison, according to the Office of National Drug Control Policy.

Parson could be serving more time if he had simply stolen a neighbor's car on a whim. The average federal sentence for motor vehicle theft in 2000 was 28 months, the U.S. Justice Department reports. Aggravated assault is punished with an average sentence of 33 months.

If prosecutors took real computer crimes seriously, might that deter future worm attacks? Consider that federal law says the maximum penalty for the offenses listed in Parson's arrest warrant is at least 30 years.

Few caught, fewer go to prison
Light sentences for worm and virus writers is hardly a new phenomenon. In 1988, a Cornell University graduate student named Robert T. Morris released the first Internet worm--and was eventually sentenced to three years' probation, 400 hours of community service and a $10,000 fine.

Light sentences for worm and virus writers is hardly a new phenomenon.

Morris probably didn't deserve a harsher sentence. He never meant for his worm to spread so quickly that it became a worldwide menace (a programming error, not malice, made that happen). Today's generation of so-called script kiddies have no excuse: Their handiwork is carefully crafted to be both disruptive and destructive.

David L. Smith, who created the Melissa virus, which clogged the Internet in 1999, was sentenced in 2002 to 20 months in prison and a $5,000 fine. Jan de Wit, the 20-year-old living in the Netherlands who wrote the Anna Kournikova virus, received only 150 hours of community service--and no jail time.

Better deterrence is especially important because the FBI and other police agencies have such a poor record of identifying the virus and worm writers that infest the Internet's underbelly.

The FBI and its counterparts have failed to convict anyone for a slew of viruses and worms, including Code Red, Nimda, SirCam, Klez, Sobig and Nachi. Police failed to identify the author of the Slammer worm, which threw some bank ATMs offline and knocked out a PC network at a nuclear power plant in Ohio. (A $5 million reward fund created by Microsoft has had better luck, nabbing a Sasser suspect in May.)

You might expect criminals who intentionally infect tens of thousands of computers to be treated at least as harshly as environmental scofflaws. An example: In 1999, the plant manager at LCP Chemicals of Brunswick, Ga., was sentenced to six and a half years in prison for illegally releasing mercury and chlorine into a nearby creek. The chairman of LCP Chemicals' parent company received a nine-year prison sentence.

Worms and viruses pollute today's Internet and cost society far more to clean up than LCP Chemicals' toxic release. So why do their creators get off easier?

Biography
Declan McCullagh is CNET News.com's chief political correspondent. He spent more than a decade in Washington, D.C., chronicling the busy intersection between technology and politics. Previously, he was the Washington bureau chief for Wired News, and a reporter for Time.com, Time magazine and HotWired. McCullagh has taught journalism at American University and been an adjunct professor at Case Western University.

More Perspectives

[aaronabend]

True but what's the solution?

On the one hand, I agree that the penalty does not match the severity of the damage done (I was a victim, even if only because I had to take time out of my schedule to put in the patch to prevent the virus). Still, what benefit to a jail sentence? Putting him in jail does little to stop virus writers in other countries, and the really dangerous people are not being caught in my opinion.

Is there any way we can sentence this guy to some national community service fixing computers damaged by bugs like this? Or tracking down the really dangerous people?

We do need a stronger punishment that fits the crime, but one that provides some restitution to the community harmed would be even better.

[swwg69]

Remove civil rights

If you shoot someone, you are not allowed to
own a gun. If you commit a crime with a computer
you should not be allowed to own a computer.
We should be able to start class action lawsuits
against these teeny boppers. If they walked into
your office and spray painted your files,
you would sue them and thier parents.
Just because a crime was commited in:
OOHHH CYBERSPACE does not make it magic.
These are cowardly scum, they do not have the
balls to actually walk into an office with
a spray can. Sue em, ban em.
I liked the old west, where you could leave your
doors unlocked and criminals were hung.