# COMPUTER VIRUSES:

## Making The Time Fit The Crime

By
Joseph N. Froehlich, Edward M. Pinter, and John J. Witmeyer III

The computer virus may just be the modern plague that afflicts the upcoming millennium. The "infection" numbers are staggering. The annual damage cost associated with viruses was estimated at over $1 billion for last year and is expected to rise to $2 to $3 billion in the upcoming year. One survey found that 98 percent of North American businesses have been infected by the over 6,000 types of viruses that are currently cataloged. One virus, Concept, is believed to have infected nearly one half of all companies nationwide within one year.

While once seen as pranks or the products of misdirected creativity, viruses now comprise business pathogens with destructive powers. In light of the tremendous and growing costs of computer crime, which spiral upward as more businesses link to the Internet thus accelerating the rate at which contagion can spread, the FBI's Computer Crime Squad in late January mounted a nationwide series of raids targeting the seizure of evidence of various computer crimes, including the spreading of viruses.

The eight city search culminated an eight month investigation dubbed Operation Cyber Strike. While the FBI has decided to hold off arresting any suspects until after it analyzes the confiscated materials, the strike itself invites us to ponder the potential fate of these "masterminds" who create destructive computer viruses.

Today, in the U.S., the most likely avenue of prosecution is the Federal Computer Abuse Act of 1994 (18 U.S.C. Sec. 1030). Amending the earlier 1986 Computer Fraud and Abuse Act, the new Act is much clearer and more encompassing than the older act.

Seeking to avoid hypertechnical arguments about what is and is not a "virus" -- or a "worm" or a "Trojan horse," etc. and whether they differ from "viruses" -- the new Act outlaws the "transmission of a program, information, code, or command" that "cause[s] damage to a computer, computer system, network, information, data or program." 18 U.S.C. Sec. 1030(a)(5)(A). As intended, this language should encompass both existing viruses and any future virus-like creations. The earlier law, which focused on the unauthorized access to a computer system, proved to be ineffectual at times because it focused merely on the crossing of a system-level boundary and also became outdated as technology advanced. The new law is an improvement because it's directed against the act of transmitting the virus. Prosecutors are no longer strained to argue that the viral release constitutes an unauthorized entry, instead the deliberate transmission of a viral release is a crime unto itself.

The 1994 Computer Abuse Act tries to deal differently with those who foolhaeartedly launch viral attacks and those who do so intending to wreak havoc. To do this, the the Act defines two levels of prosecution for those who create viruses.

For those who intentionally cause damage by transmitting a virus, the punishment can amount to ten years in federal prison, plus a fine.

For those who transmit a virus with only "reckless disregard" to the damage it will cause, the maximum punishment stops at a fine and a year in prison.

By differentiating along the lines of the intent to damage, the new law efficiently accounts for the two typical "strains" of viral creators. The first "strain", which is becoming increasingly more common, is the intelligent, disgruntled employee or contractor or sociopath who intentionally infects someone's computer system so as to destroy data and files. Recent cases of this type have appeared in New York, Texas, Illinois, and Wisconsin. Under the new federal law, these individuals would be classified at the "intentional" level and thus could face up to ten years in prison.

The second classification deals with what we more would commonly perceive as the stereotypical viral creator -- typically, a young computer wiz who is both curious and eager to show off his or her expertise by pointing out the flaws in the "system" or in the computer safeguards erected by others. The case of the 1988 "Internet Worm," that Robert Morris, Jr. incubated and released, typifies this kind of criminal defendant. According to Morris, he launched his "worm" to point out the security flaws of other computer networks. However, his worm program replicated much faster than Morris expected and caused over a billion dollars in damage by overloading systems and causing them to crash or slow to the point that they became non-functional.

The U.S. Justice Department prosecuted Morris under the 1986 Act, an awkwardly worded piece of legislation arguably unclear as to the necessity that the prosecutors prove Morris had the specific intent to cause damage. Morris argued that the damage he caused was unintentional and, thus, his action not illegal under the old act. The case went to the United States Court of Appeals for the Second Circuit, which upheld Morris' conviction and held that there was no intent-to-cause-damages requirement. United States v. Morris, 928 F.2d 504, 509 (2d Cir.), cert. denied, 502 U.S. 817 (1991). However, in our federal legal system, the decisions of the Second Circuit technically do not "bind" the numerous federal district courts sitting in other circuits, the possibility existed that other appellate courts might rule differently, and the "intent" issue might pose a potential "defense" for others who launched viral attacks until the U.S. Supreme Court decided the question. While Morris' conviction and sentence to three years' probation and a $10,000 fine made national headlines and were upheld, the case highlighted the difficulty of prosecuting a viral creator who does not necessarily intend the disasterous consequences wrought by the infectious spread of his creation.

Congress' response of creating a standard of "reckless disregard" makes it both easier to prosecute cases like Morris and easier for prosecutors to determine if the act of creating a virus is chargeable. The 1994 Act makes clear that the creator of a virus cannot hide behind the cloak that he did not really mean to hurt anyone, or that he really only wanted to send a message or, as in Morris' case, point out a flaw. While the courts may need to evaluate what qualifies as "damage" to a computer or computer system, as the new Act uses those terms, it seems that any interruption in service, which in turn causes a disruption in business, will likely fulfill the requisite damage component.

Under the new Act, a software genius who foolheartedly creates a "benign" virus that does not actually cause a computer to crash can still be prosecuted (if the damage is at least $1,000 in the aggregate), although the maximum punishment is less than that to be levied upon the maker of a "malignant" virus who intentionally aims at destroying files or data. The new law constitutes a much more responsible approach to the growing problem of computer viruses. By specifically not defining a virus, and rather describing the act, the drafters have left it open to cover the next wave of technological attacks on information systems, whatever form that may take. In differentiating the levels of offense, the new law lines up more closely with the commonly held beliefs of what is criminal. Clearly society would see fit to more severely punish someone who attacks another's computer based on a grudge or the sheer delight in creating havoc than someone who causes the destruction of computer services due to a failure to recognize the consequences of an attempt to "show off" one's expertise. Although some degree of variation for the punishments seem fitting, it hardly seems likely that even the less culpable miscreant in these examples should get off without any punishment in light of the extreme costs that such behavior can cause.

While some have continued to debate whether the penalties are too severe or too mild, the reality of the situation is that it will take some time for judges, prosecutors and society to find a comfortable level of punishment. Yet as the costs of such behavior rise, society may find itself willing to provide harsher punishment. One example comes from England where after the judge sentenced that nation's first convicted virus creator to 18 months imprisonment, the judge stated, "Those who seek to reap mindless havoc on one of the vital tools of our age cannot expect lenient treatment." Undoubtedly, business, which faces most of these costs first-hand, will be in the forefront of any effort to increase the penalties in order to provide some degree of deterrence to such a costly activity.

Copyright © Ford Marrin Esposito Witmeyer & Gleser, L.L.P., 1997.

Last Updated March, 1997

http://www.fmew.com/archive/virus/