German Youth Convicted for Sasser Worm

dan dan the dna man writes "The BBC is reporting that Sven Jaschan, author of the Sasser Worm, has been found guilty of computer sabotage and illegally altering data. He received a 21 month suspended sentence, as he was tried as a minor. He was 17 years old when he wrote the worm." From the article: "Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday...However, in the grand scheme of the virus world, it's the organised crime gangs, which are increasingly emerging to make stacks of money through targeted attacks, that should be dealt the harsh sentences - over and above the dumb teenagers."

Comments

more appropriate punishment

[Anonymous Coward]

Don't lock him up, don't curtail his computer usage.

Just force him to use AOL for the next 5 years.

Re:more appropriate punishment

[TripMaster Monkey]

You call that 'appropriate'???

I call that 'cruel and unusual'.

Re:more appropriate punishment

[mog007]

He's a German citizen, they don't have an Eighth Amendmentment.

Re:more appropriate punishment

[eosp]

Hopefully he'll virus it for us :)

Re:more appropriate punishment

[Bananenrepublik]

No, but we have a far-wider reaching first paragraph in our constitution: "Die Würde des Menschen ist unantastbar." -- A faithful translation is out of reach for me, it's something like "Human dignity can't be taken away." (I wouldn't have responded if your post had received the more appropriate "Funny" moderation, I couldn't resist smiling at what I took for your parody of American ignorance.)

Re:more appropriate punishment

[Doctor O]

It's not "human dignity can't be taken away", it's

The dignity of men is unimpeachable.

Makes quite a difference to me as a German.

Dumb Kid, Sure

[DanielMarkham]

But his "prank" costs tens, if not hundreds of millions of dollars. FTA,

...allegedly wrecked Delta Airlines' systems in Atlanta for seven hours, leading to the cancellation of 40 flights. Around the world, the Australian Railcorp trains stopped running because computer problems caused by Sasser made it impossible for drivers to talk to signalmen. In Taiwan, more than 400 branches of the post office were forced to use pen and paper because Sasser crashed desktop computers...

In the USA, we're already seeing a big push to try juveniles as adults in violent crime cases. The damage caused by this worm was serious business -- its not too hard to extrapolate people one day losing their lives because of worms like this.
Being a dumb teenager is one thing. Causing world disruption is something else entirely (Yes. I know. The victims bear some responsibility)
People take the computer too lightly, like it was a TV set or something. It's more like a small nuclear bomb in each home, great for powering the house, but not so much something you want the kids mucking around with unsupervised. If you are one of those who think gun control stops gun crime, wait 20 years or so until people start advocating "computer control" to stop cyber crime. You'll have a blast with that one.

WTF? How About CSS Implementation?

Re:Dumb Kid, Sure

[InfiniteWisdom]

people start advocating "computer control" to stop cyber crime
A better analogy would be when people start talking about kitchen knife control or baseball bat control. Do you see that happening?

Re:Dumb Kid, Sure

[99BottlesOfBeerInMyF]

A better analogy would be when people start talking about kitchen knife control or baseball bat control. Do you see that happening?

There have been several proposals in the UK to require registration of all knives, including kitchen knives. I also know someone who was arrested and convicted of the crime "carrying a concealed weapon" for having a baseball bat in the back seat of his car and he was wearing a softball uniform at the time of his arrest. You may think the concept is absurd, but it is just absurd enough to be true.

Re:Dumb Kid, Sure

[dasunt]

We don't (usually) try kids as adults because we understand that children tend to have a more limited judgement than adults. Admittedly, there is a lot of problems with this.

However, arguing that the punishment should be increased due to the severity of the crime is somewhat faulty logic. If a child runs into the interstate and ends up causing an accident that kills 20 people, we don't charge the child with 20 cases of manslaughter.

That's the problem with having limited judgement: You don't really grasp the consequences of your actions.

(Now if you want to argue that the kid's understanding of the crime was about the same as an adult's understanding of the crime, and thus he should be tried as an adult, that could be a valid argument.)

Re:Dumb Kid, Sure

[Ingolfke]

A better analogy would be when people start talking about kitchen knife control or baseball bat control. Do you see that happening

Knives and bats are inanimate objects. They are controlled by people who make choices with thier minds... therefore we need to get to the root of the problem and start talking about mind control.

Re:Dumb Kid, Sure

[phorm]

in the grand scheme of the virus world, it's the organised crime gangs ...that should be dealt the harsh sentences

This is, however, a very good point. Being a retard and letting something loose beyond your control is one thing, deliberately making a bid to own/disrupt as many machines online you can for purposes of blackmail/theft/etc is another.

We can't overlook the impact of these dumb kids, and certainly should such abuse become more prevalent they should be dealt with in increasing harshness to act as a deterrent...

However, the biggest problems I've seen are not dumb kids that let loose something bigger than they expect.

Dumb kids tend to take out unpatched, insecure, or non-fault-tolerant systems.

Those same systems are the target of focussed criminals who will bring them down to collect a ransom, take over them for illegal uses, or attempt to steal from them every last piece of your personal info.

In short, dumb teenagers like this create viruses which are definately an annoyance and a potentially huge disruption, but the organized crime gangs are the ones that are killing the internet by making it a dangerous businessplace.

Re:Dumb Kid, Sure

[ScentCone]

There have been several proposals in the UK to require registration of all knives, including kitchen knives

Actually, the UK proposals include the banning of "long" kitchen knives from ownership by "the public." Presumably chefs and household gourmands are not "the public." Of course, this is completely ridiculous. People should be locked up when they do bad things, not when they own equipment (like cars, or gasoline, or kitchen knives, or computers) with which they can do bad things.

Re:Dumb Kid, Sure

[ScentCone]

Yeah, cause look at all the hand gun crimes in England...

The UK is chasing its tail on that one. No easily owned guns, so of course there's an epidemic of stabbings, instead. And of course now there are calls there to ban long kitchen knives because those are too dangerous for the public to own, too. All of this is politcally correct claptrap, designed to keep everyone looking busy doing something about problems while ignoring the real problem: poorly raised, intellectually stunted people with no sense of accountability. As long as people don't give a damn about the consequences of their actions, and as long as societies feel bad about holding the accountable, the only option is to pursue pointless little media-friendly exercises like taking tools away from people.

And, of course, people who don't care about the law anyway are going to ignore those laws, too, leaving only the criminals with guns, knives, and eventually anything heavy, pointy, or flammable. Australia took away everyone's guns, too, and have seen violent crime of all sorts skyrocket as a result.

Re:Dumb Kid, Sure

[slavemowgli]

Unlike in the USA, minors *cannot* be tried as adults in Germany under any circumstances. In fact, the opposite is true: a young person can be tried as a minor instead of an adult if they're behind in their development, for example, even if they're over 18.

And that's the way it should be.

Re:Dumb Kid, Sure

[Draigon]

!= is modern english. =! is from the shakespeare++ language.

Re:Dumb Kid, Sure

[lseltzer]

>>If a child runs into the interstate and ends up causing an accident that kills 20 people, we don't charge the child with 20 cases of manslaughter.

I think what we have here is a kid throwing nails on the interstate and causing an accident. Sure, he's responsible for all the damage and substantially for damage from worm variants that he didn't create.

And if he was smart enough to create such worms at age 17 he was smart enough to comprehend the damage they could cause. He did it for the notoriety, so he would want the biggest impact he could get.

Re:Dumb Kid, Sure

[Jugalator]

It's more like a small nuclear bomb in each home, great for powering the house, but not so much something you want the kids mucking around with unsupervised.

rofl...

Re:Dumb Kid, Sure

[Kojiro Ganryu Sasaki]

"Those assclown companies should of secured their networks."

Should HAVE secured their networks.

Re:Dumb Kid, Sure

[Anonymous Coward]

The kid did something stupid, but he wasn't the only one. Everyone knows that there are systems that are prone and fragile, and ones that are well archetected, well made, and not affected by stupid pranks like this. Any IT manager (lets not ignore CIO's too) who advocated poor systems that were affected by this stupid kids prank, needs to be fired. They put their companies' profits and revenue generation in jeopardy. Any system that can fall down because of a stupid prank done by a kid 3000 miles away, is not a system I want to rely on. Managers who promoted or accepted the sales pitch of people selling this kind of junk, deserve (and need) to be fired! My system was unaffected by this virus. As a matter of fact, I haven't seen a virus in more than 10 years, and I've been on the internet for all that time (including running a web server 24/7 for over three years). No viruses, no crashes, no reboots, no problems. The systems that this virus was affected by, are affected by all the other punk crap floating out there. Grown-ups know better, they don't use systems that can be kicked over by a stupid punk from 3000 miles away. If they don't know any better or have been affected by stupid punks before, then they don't know any better (and seriously need to be fired for their own stupidity). No one with half a brain uses fragile, easily-broken systems for mission-critical tasks. If anyone were to die because the manager who picked the technology picked stupidly, the manager who picked the fragile technology deserves jail for wreckless endangerment, incompetence, and blatant stupidity.

Re:Dumb Kid, Sure

[Tim C]

of course there's an epidemic of stabbings

Not that I've noticed. Yes, there have been headlines about rising violent crime, but I don't recall any talking of "an epidemic of stabbings".

All of this is politcally correct claptrap, designed to keep everyone looking busy doing something about problems while ignoring the real problem: poorly raised, intellectually stunted people with no sense of accountability.

Now there I agree with you 100%. It's not just the fault of the politicians, though - most of the tabloids go on crusades on some subject or another (eg crime, immigration, etc) and whip up their readership to the point that the politicians almost *have* to be seen to be doing something, or face the wrath of the papers. (Not that they don't anyway...)

Australia took away everyone's guns, too, and have seen violent crime of all sorts skyrocket as a result.

"As a result"? Do you have any proof that violent crime has increased *because* of the ban on guns, rather that *despite* it?

No editors at the BBC anymore..?

[rsd1s1g]

From the article: The two individuals who helped identify the Sasser creator will share the reward no Jaschan has been convicted, said Microsoft.

Pretty sure they meant "once Jaschan has been convicted..."

Parent is wrong

[Anonymous Coward]

The virus was released ON his 18th birthday (April 29, 2004). He was tried as a minor because the german courts determined that he created the virus before he was 18. He wasn't arrested days before his 18th birthday as the parent says.

Re:Parent is wrong

[TripMaster Monkey]

Interesting...especially since the german courts seem to think that it's the creation of the virus that is the crime, not the release of it into the wild.

Do you have any references for this?

Re:Parent is wrong

[Tante]

From the Parent:

The virus was released ON his 18th birthday (April 29, 2004). He was tried as a minor because the german courts determined that he created the virus before he was 18. He wasn't arrested days before his 18th birthday as the parent says.

From the Article:

"Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday,"

So he was arrested before he released the virus? When did Germany get their pre-crime division up and running?

Sounds like he made out on the deal...

[cavtroop]

Ok, so he causes untold millions in damages (yes, real damages) worldwide, get a 21 month probation slap on the wrist, which clears off his record after 3 years if he keeps his nose clean. AND he gets a job in the antivirus industry. Sounds more like a reward than a punishment. If I ran a multinational company that was hit bad by this, I'd be in civil court suing the hell out of him right now. He deserves to be in jail, not reaping rewards for his behavior.

Re:Sounds like he made out on the deal...

[Ihlosi]

If I ran a multinational company that was hit bad by this, I'd be in civil court suing the hell out of him right now. He deserves to be in jail, not reaping rewards for his behavior.

Sorry, but that's most likely the dumbass way to handle things.

1. Sue him. That puts the name of your company out in the open. Hello, we're the ones who give a shit about network security ... your data's absolutely safe with us.

2. Sue him. Pay your lawyers big bucks. Win the case (maybe). Be awarded millions in damages. Will you ever see one cent ? Nope. Can't get water from a rock.

The least damaging way to handle things for the company is: Keep a low profile and do some major reorganization in your IT department.

Re:Sounds like he made out on the deal...

[patio11]

Whats the point of suing him as a multinational corporation? You'll never collect from him and will end up being portrayed in the media as a bully persecuting a teenager for a youthful indiscretion. He'll say he's very, very sorry and why are you tryring to ruin his life for just one little mistake, etc. And people will buy it because people are, on average, dumb.

Skin of his teeth

[Hank Chinaski]

It wasnt even this close, because in Germany the youth criminal law is applicable to persons up to the age of 21, depending on how "adult" they behave and live. E.g. Living in your own apartement and having a job will probably get you treated as an adult. For his case the social projections are quite good, because he now lives a stable life with a regular job and a girlfriend.

Justice

[Malicious]

Create a Worm, cripple thousands of businesses, get convicted, no monitary fine, get a 2 year Jail sentence and 30 Hours of Community service, do not pass go. Do not collect $200.
Steal a Movie, get fined Thousands of dollars, go to Jail for dozens of years, never expect to use a computer or have any rights or freedoms again.

Amazing.

Re:Example?

[TripMaster Monkey]

But he was a child when he committed the offense...and he was a child when he was arrested...doesn't matter how old he is now.

Re:Example?

[delta_avi_delta]

The fact that he's over 18 now should be irrelevant - he was a minor when the crime was commited, he should be tried as a minor.

*ducks*

[jZnat]

I guess he wasn't able to worm his way out of this one.

I think I speech for the Slashdot community...

[Krankheit]

I think I speech for the Slashdot community when I say that I am going to miss these interesting programs. With Jaschan being convicted, and Claria being bought out by Microsoft, how am I going to have an excuse to go out to an extended lunch, or take the rest of the day off? My company only gives me one hour to eat lunch, which is not nearly enough to go to Wal-Mart and get my four litres of Mountain Dew, my two coffees at Dunkin' Donuts, with my two dozen donuts, and then make my way over to Burger King. I hope someone replaces Jaschan soon in the name of giving me extended lunches and days off to code. Does anyone else feel this way?

I wouldn't worry

[Moth7]

Most "leet hackers" under 18 couldn't hack their way out of a wet paper bag. If they start young enough to have a good level of programming ability by 17, then they've generally matured enough to handle that responsibility by then. This guy is the exception, not the rule.

Robbery

[Anonymous Coward]

What kind of punishment would he have gotten if he had been convicted of shoplifting on several occasions? He wrote several worms, each causing some degree of economic damage, and he should have known after the first one got press coverage that it shouldn't be done.

What if he did damage to someone's car so they couldn't use it (like slashing the tires)? What would the penalty be then?

I see it as he got off too lightly. Just because someone is 17, doesn't mean they don't know something is wrong and shouldn't be punished for it. Maybe some people should get him drunk and get him into a fight so he violates his probation, and doesn't have his record cleared.

He essentially got what he wanted - fame and no penalty.

Re:Others should face liability also

[TripMaster Monkey]

I was waiting for this argument...

From TFA:

Although Microsoft had released a patch for this loophole on 13 and 28 April 2004, many companies had not applied this protection before Sasser struck.

It looks like M$ is not the one to blame here (although we do so love to blame them).

The Guido Proposition

[1967mustangman]

My brother in-law has what he calls the Guido proposition. That is that everyone in the country should pitch in 1 or two dollars a year to a fund which hires big guys named Guido and Luigi to fly around the world find these virus writers and spammers and well..............I think you get the picture. That would be so much better than jail time.

Re:The Guido Proposition

[Reverend528]

now I have an image stuck in my head of Guido van Rossum breaking someone's legs with a baseball bat.

Re:The Guido Proposition

[hyfe]

That is that everyone in the country should pitch in 1 or two dollars a year to a fund which hires big guys named Guido and Luigi to fly around the world find these virus writers and spammers and well..............I think you get the picture. That would be so much better than jail time.

And teach them Python?

Re:Inevitable...

[TripMaster Monkey]

That's OK...your previous post applies to just about any discusion on Slashdot... ^_^

Re:Organized Crime Gangs.

[KD5YPT]

What they meant were the group of organized crime gangs that bascially ask protection fees from web oriented company by threatening them with DDoS attacks by zombie machines.

Creating vs. releasing

[quentin_quayle]

I second the question - is it illegal in Germany to write a worm or virus? Or only to release it?

Same questions regarding the USA ... ?

In all the news reports and discussion of these cases, references to "writing" or "creating", and to releasing or spreading, are used interchangeably. It seems to me there is a big ethical difference and there ought to be a legal difference as well.

Consider the following series - at what point does the actor go wrong (a) ethically (b) legally?

1. Plan a worm, virus or other exploit
2. Write code
3. Compile and test it locally
4. Explain to others how to write one
5. Share source with friends or colleagues (a) for research/ POC? (b) for them to use any way they want? (c) with malicious intent?
6. Make binary available passively, others have to request it, as on a web page, with notice (not forced on anyone)
7. Someone other than the creator spreads it "in the wild"
8. Creator knowingly infects others

Re:Creating vs. releasing

[dknj]

simple, just release your virus with an EULA. if you use it, the creator assumes no responsibility. if the creator goes to jail, it means EULA's fail and thus hell will freeze over, the earth will start spinning backwards, and mass anarchy will take over the world.

Re:Example?

[PHP Addict]

Most hackers/crackers/ass-clowns-like-this posess a maturity level (though in this case not the moral sense) well beyond their age in years. He knew what he was doing, well knew the consequences, and should have been tried as an adult.

Re:propose this penalty!

[g0bshiTe]

LMFAO, he should.
Though he will probably go on to write his first bio at 21, on his ordeal with the authorities after he released the code.
It will be picked up and made into a mini series where he will be portrayed as fighting for some type of political change.
At 25 he will go on to create his own Security firm.
One year after he starts his firm it makes the Fortune 500 top 5.

Re:Dumb teenagers/ organized crime

[thomasweber]

> I think his punishment should fit the crime, but then again I wouldn't want this kid anywhere near my systems unsupervised. So what would a suitable punishment be, not only is it for his crime, but also as a detterent to others.

The basic idea of German law with regards to youth is education, not punishment.
The importance of deterent can be seen quite clearly in the United States, where the death penalty exists in most states and still there are much more murders than in Germany.

Re:Example?

[Trigun]

Most hackers/crackers/ass-clowns-like-this posess a maturity level (though in this case not the moral sense) well beyond their age in years.

As noted by the pr3v4l3nc3 0f 1337 sp34k, 4w3s0m3 k0d1ng style, and liberal use of the word fag. They are only outmatched in their maturity by the aimbotting n00bs that keep appearing on Enemy Territory and Counterstrike.

I say try them as two adults, they're that mature!

Before you're 18

[Hachey]

I don't know about you guys, but I did some dumb things before I was 18. There are different punishments for minors for a reason, and saying "it was only a few days before he was 18" doesn't change the fact that he wasn't 18 when he wrote it. Bluring lines in the law makes a weak system.


(I'm an ESTJ, if you didn't already know)
--
Check out the Uncyclopedia.org :
The only wiki source for politically incorrect non-information about things like Kitten Huffing and Pong! the Movie !

Dumb or not ...

[bizitch]

I still say we string this little piggy up by his balls! - That little douchebag gave me headaches for
fucking weeks ...

Re:Dumb or not ...

[Paul Jakma]

I'd say that's your tough luck for:

a) running windows
b) not applying the patches which your vendor had already made available

I'll agree when...

[absurdist]

... we also correspondingly lower the age of consent to, say, 12 or so. I think it's interesting that most of the people who scream about wanting to impose harsh penalties up to and including the death penalty on juveniles are also the first in line to want to murder pedophiles because "they're just kids, they can't give informed consent."

You can't have it both ways. Either they're considered responsible and mature at a younger age and granted all the rights, responsibilities, and privileges of adults, or they're immature kids and are treated accordingly.

Please mod down racist parent

[Anonymous Coward]

Is it funny that he uses traditional Italian names to perpetuate the sterotype that all organized crime "goons" are Italian?

Would it be funny if he talked about "Leroy" and "Tyrone" playing basketball? Or "Shlomo" and "Mordecai" working in a bank? Or "Sanjay" and "Srini" taking my IT job?

Re:Please mod down racist parent

[suitepotato]

Is it funny that he uses traditional Italian names to perpetuate the sterotype that all organized crime "goons" are Italian?

To those of us with Italian family members who try to live up to the stereotype, it is farking hilarious.

Lighten up. Humans have a peculiarity for going out of their way to live up to the stereotypes of their groups in that self-fulfilling prophecy way. And stereotypes come about because of small goofy differences that others notice about our group and we then often in subconscious spite end up redoubling our efforts to be exactly that.

My ethnicity is all over the map and I got some really embarassing fellow countrymen as it were. I laugh it all off because I don't knee-jerk assume that everyone is dumb enough to confuse stereotypes with the reality of individual people.

Punishment Does Not Fit The Crime

[Evil W1zard]

The simple fact here is that the punishment he is receiving does not fit the crime in scale and it sends out a really bad message to others in his community that they have a Get Out of Jail Free Card if they are under 18... I'm sorry but teenagers today are in many cases much smarter than adults. If the excuse is whether they are mature enough to distinguish between right and wrong then I question that argument because I think people learn that at around age 10... and if they can't comprehend the difference by age 14 then I would guess there is an issue psychologically. This kid caused millions in damages and should face not only time in prison but also some hefty monetary fines as well.

Re:Punishment Does Not Fit The Crime

[Shawndeisi]

I have to respectfully disagree.

When you make it a habit to place a great permanent burden upon an individual in the form of punishment, bad things will happen. If you ruin someone's life and they feel trapped and unable to make an honest living, they will make a dishonest living.

If this kid got smacked with $5mil in fines or something similarly ridiculous that he couldn't get out of because of a judgement slip as a minor, he would likely turn to crime for life. This is why I hate how we treat felons in the states. Let's make it to where they can't get a real job, can't vote, and in general are sub-citizens for stupid shit. -That- won't make them commit more crime to survive... Work minimum wage forever, or sling drugs. Program for 60 hours a week to pay off a huge fine, or write malicious viruses and commit computer fraud and disappear. I wonder which pays better and offers more hope.

I know that I've made some really dumb mistakes as a minor, and if they still haunted me now in the form that you are advocating, I really doubt that I would be a productive member of society. I would be willing to wager that most of us could say the same.

Unfortunately

[thisisauniqueid]

Unfortunately it's the "organised crime gangs, which are increasingly emerging to make stacks of money through targeted attacks," that ARE the "dumb teenagers"...

Responsibility?

[jondt]

We're pleased that the author of the Sasser worm has admitted responsibility for the damage he caused and is being held accountable - Nancy Anderson, Microsoft

That's nice, but how about taking some responsibility yourself? Sure, virus writers are guilty, but the users and the vendors should also take some responsibility- that means Microsoft, Oracle, Redhat and anyone else that distributes software.

Re:Dumb Kid, Sure (But Delta Sucks)

[Ranger]

...allegedly wrecked Delta Airlines' systems in Atlanta for seven hours, leading to the cancellation of 40 flights. Around the world,

How is this any different than a normal day on Delta Airlines? They probably figured they could blame their low industry rankings on Sasser.

You Forget...

[gillbates]

That quite a few businesses cannot patch their systems because:

1. Testing the patches takes time, and:
2. Downtime is expensive, consequently, they may have to wait a month or more for a "downtime window" to install the patch, and
3. Sometimes patches break key software - in which case the business can't install them at all until they find a workaround.

I'm sick of this "blame the users" attitude - yes, it may be appropriate for a home user, but to a business which depends on its computers for day to day operations, patching is a big deal, and it can't always be done at the pace we'd like. It isn't the fault of the business that Microsoft didn't do it right the first time.

a crime is still a crime

[DirtyFly]

Im getting tired of listening to all that 'you dont patch is your fault' , 'you use microsoft is your fault the system is attacked'.
c'mon, if i leave my mobile in the car and it gets stolen, that is my fault ? NO IT IS NOT, i was dumb to leave it there because of the lack of security in the streets but I AM NOT the criminal neither is the car company that makes glasses that can be broken, either way you put it the burgler is the criminal here.
the kid is a criminal and should be dealt with acordingly, it is true that microsoft has bugs and flaws but the attack was mallicious, lets put it other therms, an old man walks with a cane and can not run , a juvenile kicks his ass and steals his wallet , is the old mans fault that he got burglered ? This is the same situation in many companies, they have a deficiency (unsecure OS) but they must live with it and must be left alone living with it.
Make no mistake the kid is no robin wood he did the worm just for spite , people should be hold accountable for what they do no matter what

Jorge Canelhas

http://www.retroreview.com/ - Retro Computing for all

Re:a crime is still a crime

[fred fleenblat]

There is a legal theory that fits the situation: computer viruses could be declared a public nuisance (which is essentially what they are at this point) and then it IS the responsibility of the victim to protect himself.

Re:Others should face liability also

[99BottlesOfBeerInMyF]

It looks like M$ is not the one to blame here (although we do so love to blame them).

Don't worry. We can still blame them. They only released the patch a month before Sasser started hitting machines in the wild. That is hardly enough time to test and apply a patch across a large enterprise, especially given MS's terrible track record for patches. Like many other patches, this one conflicted with a variety of other software packages that customers had to stop using if they wanted to be protected. The worm runs on and propagates to other machines on Windows 98, 98SE, and ME operating systems (although it's other functions fail). MS has still released no patch for any of these systems and has no plan to.

Aside from the above concerns, many versions of Windows are just not easy to update, especially across a great many machines and updates often break functionality or need to be applied in a specific order. Updates are often dependent upon other updates, which may also break something important. MS is the one who wrote an OS without concern for security and we are all still paying for it. Writing the worm was like intentionally tossing a match in an open window. Designing Windows was like deciding to sell all buildings with floors made of extremely flammable material. There is plenty of blame to go around.