German Youth Convicted for Sasser Worm

dan dan the dna man writes "The BBC is reporting that Sven Jaschan, author of the Sasser Worm, has been found guilty of computer sabotage and illegally altering data. He received a 21 month suspended sentence, as he was tried as a minor. He was 17 years old when he wrote the worm." From the article: "Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday...However, in the grand scheme of the virus world, it's the organised crime gangs, which are increasingly emerging to make stacks of money through targeted attacks, that should be dealt the harsh sentences - over and above the dumb teenagers."

Comments

Creating vs. releasing

[quentin_quayle]

I second the question - is it illegal in Germany to write a worm or virus? Or only to release it?

Same questions regarding the USA ... ?

In all the news reports and discussion of these cases, references to "writing" or "creating", and to releasing or spreading, are used interchangeably. It seems to me there is a big ethical difference and there ought to be a legal difference as well.

Consider the following series - at what point does the actor go wrong (a) ethically (b) legally?

1. Plan a worm, virus or other exploit
2. Write code
3. Compile and test it locally
4. Explain to others how to write one
5. Share source with friends or colleagues (a) for research/ POC? (b) for them to use any way they want? (c) with malicious intent?
6. Make binary available passively, others have to request it, as on a web page, with notice (not forced on anyone)
7. Someone other than the creator spreads it "in the wild"
8. Creator knowingly infects others