COMMENTARY--Jeffrey Lee Parson pleaded guilty last week to unleashing part of the MSBlast worm attack that wreaked havoc on the Internet a year ago. He got off easy.
Federal prosecutors predictably touted Parson's guilty plea as an example for other would-be vandals. John McKay, the U.S. Attorney for Seattle, proclaimed: "The damage to individual computer users is very real, and the penalties are also very real."
Not really. McKay neglected to mention that Parson's all-expense-paid visit to Club Fed will be surprisingly brief. Prosecutors say that the deal they cut means that Parson, who is 19 years old, will be sentenced to between 18 and 37 months.
That's mild punishment for someone who admitted to inserting nasty features into the original version of MSBlast to make it more noxious. By releasing his "MSBlast.B" variant that took advantage of a bug in Microsoft Windows, Parson intentionally harmed tens of thousands of people for his own amusement.
Parson could be serving more time if he had simply stolen a neighbor's car on a whim.
Parson could be serving more time if he had simply stolen a neighbor's car on a whim. The average federal sentence for motor vehicle theft in 2000 was 28 months, the U.S. Justice Department reports. Aggravated assault is punished with an average sentence of 33 months.
If prosecutors took real computer crimes seriously, might that deter future worm attacks? Consider that federal law says the maximum penalty for the offenses listed in Parson's arrest warrant is at least 30 years.
Few caught, fewer go to prison
Light sentences for worm and virus writers is hardly a new phenomenon. In 1988, a Cornell University graduate student named Robert T. Morris released the first Internet worm--and was eventually sentenced to three years' probation, 400 hours of community service and a $10,000 fine.
Light sentences for worm and virus writers is hardly a new phenomenon.
David L. Smith, who created the Melissa virus, which clogged the Internet in 1999, was sentenced in 2002 to 20 months in prison and a $5,000 fine. Jan de Wit, the 20-year-old living in the Netherlands who wrote the Anna Kournikova virus, received only 150 hours of community service--and no jail time.
Better deterrence is especially important because the FBI and other police agencies have such a poor record of identifying the virus and worm writers that infest the Internet's underbelly.
The FBI and its counterparts have failed to convict anyone for a slew of viruses and worms, including Code Red, Nimda, SirCam, Klez, Sobig and Nachi. Police failed to identify the author of the Slammer worm, which threw some bank ATMs offline and knocked out a PC network at a nuclear power plant in Ohio. (A $5 million reward fund created by Microsoft has had better luck, nabbing a Sasser suspect in May.)
You might expect criminals who intentionally infect tens of thousands of computers to be treated at least as harshly as environmental scofflaws. An example: In 1999, the plant manager at LCP Chemicals of Brunswick, Ga., was sentenced to six and a half years in prison for illegally releasing mercury and chlorine into a nearby creek. The chairman of LCP Chemicals' parent company received a nine-year prison sentence.
Worms and viruses pollute today's Internet and cost society far more to clean up than LCP Chemicals' toxic release. So why do their creators get off easier?
biography
Declan McCullagh is CNET News.com's Washington, D.C., correspondent. He chronicles the busy intersection between technology and politics. Before that, he worked for several years as Washington bureau chief for Wired News. He has also worked as a reporter for The Netly News, Time magazine and HotWired.
