German Youth Convicted for Sasser Worm

dan dan the dna man writes "The BBC is reporting that Sven Jaschan, author of the Sasser Worm, has been found guilty of computer sabotage and illegally altering data. He received a 21 month suspended sentence, as he was tried as a minor. He was 17 years old when he wrote the worm." From the article: "Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday...However, in the grand scheme of the virus world, it's the organised crime gangs, which are increasingly emerging to make stacks of money through targeted attacks, that should be dealt the harsh sentences - over and above the dumb teenagers."

Comments

Dumb Kid, Sure

[DanielMarkham]

But his "prank" costs tens, if not hundreds of millions of dollars. FTA,

...allegedly wrecked Delta Airlines' systems in Atlanta for seven hours, leading to the cancellation of 40 flights. Around the world, the Australian Railcorp trains stopped running because computer problems caused by Sasser made it impossible for drivers to talk to signalmen. In Taiwan, more than 400 branches of the post office were forced to use pen and paper because Sasser crashed desktop computers...

In the USA, we're already seeing a big push to try juveniles as adults in violent crime cases. The damage caused by this worm was serious business -- its not too hard to extrapolate people one day losing their lives because of worms like this.
Being a dumb teenager is one thing. Causing world disruption is something else entirely (Yes. I know. The victims bear some responsibility)
People take the computer too lightly, like it was a TV set or something. It's more like a small nuclear bomb in each home, great for powering the house, but not so much something you want the kids mucking around with unsupervised. If you are one of those who think gun control stops gun crime, wait 20 years or so until people start advocating "computer control" to stop cyber crime. You'll have a blast with that one.

WTF? How About CSS Implementation?

Re:Dumb Kid, Sure

[dasunt]

We don't (usually) try kids as adults because we understand that children tend to have a more limited judgement than adults. Admittedly, there is a lot of problems with this.

However, arguing that the punishment should be increased due to the severity of the crime is somewhat faulty logic. If a child runs into the interstate and ends up causing an accident that kills 20 people, we don't charge the child with 20 cases of manslaughter.

That's the problem with having limited judgement: You don't really grasp the consequences of your actions.

(Now if you want to argue that the kid's understanding of the crime was about the same as an adult's understanding of the crime, and thus he should be tried as an adult, that could be a valid argument.)

Re:Dumb Kid, Sure

[Ingolfke]

A better analogy would be when people start talking about kitchen knife control or baseball bat control. Do you see that happening

Knives and bats are inanimate objects. They are controlled by people who make choices with thier minds... therefore we need to get to the root of the problem and start talking about mind control.

Re:Dumb Kid, Sure

[ScentCone]

Yeah, cause look at all the hand gun crimes in England...

The UK is chasing its tail on that one. No easily owned guns, so of course there's an epidemic of stabbings, instead. And of course now there are calls there to ban long kitchen knives because those are too dangerous for the public to own, too. All of this is politcally correct claptrap, designed to keep everyone looking busy doing something about problems while ignoring the real problem: poorly raised, intellectually stunted people with no sense of accountability. As long as people don't give a damn about the consequences of their actions, and as long as societies feel bad about holding the accountable, the only option is to pursue pointless little media-friendly exercises like taking tools away from people.

And, of course, people who don't care about the law anyway are going to ignore those laws, too, leaving only the criminals with guns, knives, and eventually anything heavy, pointy, or flammable. Australia took away everyone's guns, too, and have seen violent crime of all sorts skyrocket as a result.

Re:Dumb Kid, Sure

[lseltzer]

>>If a child runs into the interstate and ends up causing an accident that kills 20 people, we don't charge the child with 20 cases of manslaughter.

I think what we have here is a kid throwing nails on the interstate and causing an accident. Sure, he's responsible for all the damage and substantially for damage from worm variants that he didn't create.

And if he was smart enough to create such worms at age 17 he was smart enough to comprehend the damage they could cause. He did it for the notoriety, so he would want the biggest impact he could get.

Re:Dumb Kid, Sure

[Anonymous Coward]

The kid did something stupid, but he wasn't the only one. Everyone knows that there are systems that are prone and fragile, and ones that are well archetected, well made, and not affected by stupid pranks like this. Any IT manager (lets not ignore CIO's too) who advocated poor systems that were affected by this stupid kids prank, needs to be fired. They put their companies' profits and revenue generation in jeopardy. Any system that can fall down because of a stupid prank done by a kid 3000 miles away, is not a system I want to rely on. Managers who promoted or accepted the sales pitch of people selling this kind of junk, deserve (and need) to be fired! My system was unaffected by this virus. As a matter of fact, I haven't seen a virus in more than 10 years, and I've been on the internet for all that time (including running a web server 24/7 for over three years). No viruses, no crashes, no reboots, no problems. The systems that this virus was affected by, are affected by all the other punk crap floating out there. Grown-ups know better, they don't use systems that can be kicked over by a stupid punk from 3000 miles away. If they don't know any better or have been affected by stupid punks before, then they don't know any better (and seriously need to be fired for their own stupidity). No one with half a brain uses fragile, easily-broken systems for mission-critical tasks. If anyone were to die because the manager who picked the technology picked stupidly, the manager who picked the fragile technology deserves jail for wreckless endangerment, incompetence, and blatant stupidity.

Justice

[Malicious]

Create a Worm, cripple thousands of businesses, get convicted, no monitary fine, get a 2 year Jail sentence and 30 Hours of Community service, do not pass go. Do not collect $200.
Steal a Movie, get fined Thousands of dollars, go to Jail for dozens of years, never expect to use a computer or have any rights or freedoms again.

Amazing.

Re:Example?

[TripMaster Monkey]

But he was a child when he committed the offense...and he was a child when he was arrested...doesn't matter how old he is now.

Re:Example?

[delta_avi_delta]

The fact that he's over 18 now should be irrelevant - he was a minor when the crime was commited, he should be tried as a minor.

I wouldn't worry

[Moth7]

Most "leet hackers" under 18 couldn't hack their way out of a wet paper bag. If they start young enough to have a good level of programming ability by 17, then they've generally matured enough to handle that responsibility by then. This guy is the exception, not the rule.

Robbery

[Anonymous Coward]

What kind of punishment would he have gotten if he had been convicted of shoplifting on several occasions? He wrote several worms, each causing some degree of economic damage, and he should have known after the first one got press coverage that it shouldn't be done.

What if he did damage to someone's car so they couldn't use it (like slashing the tires)? What would the penalty be then?

I see it as he got off too lightly. Just because someone is 17, doesn't mean they don't know something is wrong and shouldn't be punished for it. Maybe some people should get him drunk and get him into a fight so he violates his probation, and doesn't have his record cleared.

He essentially got what he wanted - fame and no penalty.

Re:Others should face liability also

[TripMaster Monkey]

I was waiting for this argument...

From TFA:

Although Microsoft had released a patch for this loophole on 13 and 28 April 2004, many companies had not applied this protection before Sasser struck.

It looks like M$ is not the one to blame here (although we do so love to blame them).

Re:Organized Crime Gangs.

[KD5YPT]

What they meant were the group of organized crime gangs that bascially ask protection fees from web oriented company by threatening them with DDoS attacks by zombie machines.

Re:Sounds like he made out on the deal...

[Ihlosi]

If I ran a multinational company that was hit bad by this, I'd be in civil court suing the hell out of him right now. He deserves to be in jail, not reaping rewards for his behavior.

Sorry, but that's most likely the dumbass way to handle things.

1. Sue him. That puts the name of your company out in the open. Hello, we're the ones who give a shit about network security ... your data's absolutely safe with us.

2. Sue him. Pay your lawyers big bucks. Win the case (maybe). Be awarded millions in damages. Will you ever see one cent ? Nope. Can't get water from a rock.

The least damaging way to handle things for the company is: Keep a low profile and do some major reorganization in your IT department.

Re:Example?

[PHP Addict]

Most hackers/crackers/ass-clowns-like-this posess a maturity level (though in this case not the moral sense) well beyond their age in years. He knew what he was doing, well knew the consequences, and should have been tried as an adult.

Re:propose this penalty!

[g0bshiTe]

LMFAO, he should.
Though he will probably go on to write his first bio at 21, on his ordeal with the authorities after he released the code.
It will be picked up and made into a mini series where he will be portrayed as fighting for some type of political change.
At 25 he will go on to create his own Security firm.
One year after he starts his firm it makes the Fortune 500 top 5.

Re:Dumb teenagers/ organized crime

[thomasweber]

> I think his punishment should fit the crime, but then again I wouldn't want this kid anywhere near my systems unsupervised. So what would a suitable punishment be, not only is it for his crime, but also as a detterent to others.

The basic idea of German law with regards to youth is education, not punishment.
The importance of deterent can be seen quite clearly in the United States, where the death penalty exists in most states and still there are much more murders than in Germany.

Re:Sounds like he made out on the deal...

[patio11]

Whats the point of suing him as a multinational corporation? You'll never collect from him and will end up being portrayed in the media as a bully persecuting a teenager for a youthful indiscretion. He'll say he's very, very sorry and why are you tryring to ruin his life for just one little mistake, etc. And people will buy it because people are, on average, dumb.

Re:Example?

[Trigun]

Most hackers/crackers/ass-clowns-like-this posess a maturity level (though in this case not the moral sense) well beyond their age in years.

As noted by the pr3v4l3nc3 0f 1337 sp34k, 4w3s0m3 k0d1ng style, and liberal use of the word fag. They are only outmatched in their maturity by the aimbotting n00bs that keep appearing on Enemy Territory and Counterstrike.

I say try them as two adults, they're that mature!

Before you're 18

[Hachey]

I don't know about you guys, but I did some dumb things before I was 18. There are different punishments for minors for a reason, and saying "it was only a few days before he was 18" doesn't change the fact that he wasn't 18 when he wrote it. Bluring lines in the law makes a weak system.


(I'm an ESTJ, if you didn't already know)
--
Check out the Uncyclopedia.org :
The only wiki source for politically incorrect non-information about things like Kitten Huffing and Pong! the Movie !

Dumb or not ...

[bizitch]

I still say we string this little piggy up by his balls! - That little douchebag gave me headaches for
fucking weeks ...

I'll agree when...

[absurdist]

... we also correspondingly lower the age of consent to, say, 12 or so. I think it's interesting that most of the people who scream about wanting to impose harsh penalties up to and including the death penalty on juveniles are also the first in line to want to murder pedophiles because "they're just kids, they can't give informed consent."

You can't have it both ways. Either they're considered responsible and mature at a younger age and granted all the rights, responsibilities, and privileges of adults, or they're immature kids and are treated accordingly.

Please mod down racist parent

[Anonymous Coward]

Is it funny that he uses traditional Italian names to perpetuate the sterotype that all organized crime "goons" are Italian?

Would it be funny if he talked about "Leroy" and "Tyrone" playing basketball? Or "Shlomo" and "Mordecai" working in a bank? Or "Sanjay" and "Srini" taking my IT job?

Re:Please mod down racist parent

[suitepotato]

Is it funny that he uses traditional Italian names to perpetuate the sterotype that all organized crime "goons" are Italian?

To those of us with Italian family members who try to live up to the stereotype, it is farking hilarious.

Lighten up. Humans have a peculiarity for going out of their way to live up to the stereotypes of their groups in that self-fulfilling prophecy way. And stereotypes come about because of small goofy differences that others notice about our group and we then often in subconscious spite end up redoubling our efforts to be exactly that.

My ethnicity is all over the map and I got some really embarassing fellow countrymen as it were. I laugh it all off because I don't knee-jerk assume that everyone is dumb enough to confuse stereotypes with the reality of individual people.

Responsibility?

[jondt]

We're pleased that the author of the Sasser worm has admitted responsibility for the damage he caused and is being held accountable - Nancy Anderson, Microsoft

That's nice, but how about taking some responsibility yourself? Sure, virus writers are guilty, but the users and the vendors should also take some responsibility- that means Microsoft, Oracle, Redhat and anyone else that distributes software.

You Forget...

[gillbates]

That quite a few businesses cannot patch their systems because:

1. Testing the patches takes time, and:
2. Downtime is expensive, consequently, they may have to wait a month or more for a "downtime window" to install the patch, and
3. Sometimes patches break key software - in which case the business can't install them at all until they find a workaround.

I'm sick of this "blame the users" attitude - yes, it may be appropriate for a home user, but to a business which depends on its computers for day to day operations, patching is a big deal, and it can't always be done at the pace we'd like. It isn't the fault of the business that Microsoft didn't do it right the first time.

a crime is still a crime

[DirtyFly]

Im getting tired of listening to all that 'you dont patch is your fault' , 'you use microsoft is your fault the system is attacked'.
c'mon, if i leave my mobile in the car and it gets stolen, that is my fault ? NO IT IS NOT, i was dumb to leave it there because of the lack of security in the streets but I AM NOT the criminal neither is the car company that makes glasses that can be broken, either way you put it the burgler is the criminal here.
the kid is a criminal and should be dealt with acordingly, it is true that microsoft has bugs and flaws but the attack was mallicious, lets put it other therms, an old man walks with a cane and can not run , a juvenile kicks his ass and steals his wallet , is the old mans fault that he got burglered ? This is the same situation in many companies, they have a deficiency (unsecure OS) but they must live with it and must be left alone living with it.
Make no mistake the kid is no robin wood he did the worm just for spite , people should be hold accountable for what they do no matter what

Jorge Canelhas

http://www.retroreview.com/ - Retro Computing for all

Re:Punishment Does Not Fit The Crime

[Shawndeisi]

I have to respectfully disagree.

When you make it a habit to place a great permanent burden upon an individual in the form of punishment, bad things will happen. If you ruin someone's life and they feel trapped and unable to make an honest living, they will make a dishonest living.

If this kid got smacked with $5mil in fines or something similarly ridiculous that he couldn't get out of because of a judgement slip as a minor, he would likely turn to crime for life. This is why I hate how we treat felons in the states. Let's make it to where they can't get a real job, can't vote, and in general are sub-citizens for stupid shit. -That- won't make them commit more crime to survive... Work minimum wage forever, or sling drugs. Program for 60 hours a week to pay off a huge fine, or write malicious viruses and commit computer fraud and disappear. I wonder which pays better and offers more hope.

I know that I've made some really dumb mistakes as a minor, and if they still haunted me now in the form that you are advocating, I really doubt that I would be a productive member of society. I would be willing to wager that most of us could say the same.

Re:more appropriate punishment

[Doctor O]

It's not "human dignity can't be taken away", it's

The dignity of men is unimpeachable.

Makes quite a difference to me as a German.