Smith pleads guilty to Melissa virus
Melissa infected hundreds of thousands of computers -- now its creator faces 10 years in prison and a $150,000 fine.

By Robert Lemos, ZDNet News
UPDATED December 9, 1999 12:40 PM PT

David L. Smith, who was arrested for creating and releasing the Melissa virus in April, plead guilty on Thursday to a second-degree charge of computer theft.

The Melissa macro computer virus hit companies on March 26 after being released to a Usenet newsgroup as part of a list of porn sites contained in a Word document infected with the virus.

The virus, which mailed itself out to the first 50 addresses listed in the address book of Microsoft's Outlook e-mail client, caused a massive spike in e-mail traffic, flooding corporate e-mail servers. Companies such as Microsoft Corp. (Nasdaq: MSFT), Intel Corp. (Nasdaq:INTC), Lockheed Martin Corp. (NYSE: LMT), and Lucent Technologies Inc. (NYSE:LU) shut down their gateways to the Internet in the face of the threat.

After Judge John Riccardi outlined the events, a nervous Smith read the following statement:

"Yes, I admit those events occurred as a result of the spread of the Melissa virus. But I did not expect or anticipate the amount of damage that took place. When I posted the virus, I expected that any financial injury would be minor and incidental. In fact, I included features designed to prevent substantial damage. I had no idea there would be such profound consequences to others."

'I certainly agree'

When the judge again asked if Smith agreed that it caused significant damage to computer systems nationwide, Smith replied, "I certainly agree. It did result in those consequences, without question."

The crime -- which covers intercepting computer communications and damages to computer systems or data -- is punishable by 5 to 10 years in jail and up to a $150,000 fine. As part of the plea agreement, Smith has agreed to the maximum penalty for the crime, but the presiding judge could ignore the recommendation.

Smith appeared in Monmouth County, N.J., Superior Court at 10 a.m. ET. He has another appearance scheduled in the U.S. District Court in Newark later today to answer to federal charges in the case.

According to law enforcement sources close to the case, Smith will enter a guilty plea in federal court as well. Edward Borden, Smith's attorney in the case, could not be reached for comment.

Court papers filed in August stated that Smith confessed to writing the virus. Smith had admitted his guilt at the time of the arrest, said Paul Loriquet, a spokesman for the New Jersey Attorney General's office, in a ZDTV interview.

"There was a statement made at the time of the arrest from Mr. Smith to our investigator... that, in fact, at the time of the arrest, he had admitted to creating the virus and had said that he had destroyed the personal computers that he had used to post it on the Internet," Loriquet said in the report.

Melissa conviction to stop virus writers?

Computer security specialists say the stiff penalty meted out to the Melissa creator -- years in prison and a $150,000 fine -- will cause other virus writers to think thrice before unleashing their wares.

By Robert Lemos, ZDNet News
December 9, 1999 5:25 PM PT

Law enforcement officials and computer security specialists say that David L. Smith's conviction in the Melissa virus case -- the first successful prosecution of a virus writer in the United States -- will have a strong chilling effect on other authors of malicious code.

"We are hoping that the sentence has a significant deterrent impact," said Robert J. Cleary, the U.S. attorney for the District of New Jersey, who led the federal prosecution. "I think this will have the effect we want. Those predisposed to white-collar crimes really do balance risk versus reward."

Smith, 31, pleaded guilty in both state and federal courts on Thursday, agreeing that the virus he wrote and released -- named "Melissa" after a Florida stripper -- caused $80 million in damages (the minimum monetary amount needed in order to trigger stiffer federal sentencing guidelines).

Smith is expected to receive anywhere between a four- and five-year sentence in the federal case and up to a 10-year sentence in the state case, accompanied by total fines of up to $400,000. As part of the plea agreement, state prosecutors have recommended that the sentences run concurrently.

"The sentencing guidelines attempt to minimize disparity. If that works here, then anyone else that sends a virus out that does $80 million in damage should expect a similar sentence," said Cleary.

Melissa's March madness

The Melissa macro computer virus hit companies on Friday, March 26 after being released to a Usenet newsgroup as part of a list of porn sites contained in a Word document infected with the virus.

The virus, which mailed itself out to the first 50 addresses listed in the address book of Microsoft's Outlook e-mail client, caused a massive spike in e-mail traffic, flooding corporate e-mail servers. Companies such as Microsoft Corp. (Nasdaq:MSFT), Intel Corp. (Nasdaq:INTC), Lockheed Martin Corp. (NYSE:LMT) and Lucent Technologies Inc. (NYSE:LU) shut down their gateways to the Internet in the face of the threat.

Smith -- then a resident of Aberdeen, N.J. -- was arrested on April 1 by New Jersey authorities.

"This becomes a landmark case, because it's the first time the (U.S.) federal government has successfully prosecuted a computer virus writer," said Dr. Peter Tippett, chief technologist at computer security firm ICSA.net, which helped the U.S. prosecutors estimate the damages caused by Melissa.

'I think this will have the effect we want. Those predisposed to white-collar crimes really do balance risk versus reward.' -- Robert J. Cleary, U.S. attorney

Deterrent effect

Tippett and others point to a virus case in England as potential proof that such a deterrent could work.

In November 1995, the UK courts sentenced Chris Pile -- known underground as the Black Baron -- to 18 months in jail. The 26-year-old, self-taught programmer admitted to five counts of unauthorized access to computers to facilitate crime and five unauthorized modifications of computer software over a two-year period.

Since that time, no major viruses have come out of the UK, said Tippett.

Smith appeared in Monmouth County, N.J., Superior Court at 10 a.m. ET on Thursday, followed by his appearance at the U.S. District Court in Newark at 1:30 p.m. ET to answer to federal charges in the case. In both courtrooms, Smith admitted his guilt and agreed with the damages.

When the judge in the Monmouth County court case asked if Smith agreed that it caused $80 million in damage to computer systems nationwide, Smith replied, "I certainly agree. It did result in those consequences -- without question."

Edward Borden, Smith's attorney in the case, could not be reached for comment.

'Tis the season for computer viruses
New computer viruses are cropping up weekly, leaving anti-virus firms to play catch-up. Virus writers 'unconcerned' by Smith case, expert says.
By Robert Lemos, ZDNet News
December 10, 1999 4:31 PM PT

Despite an expected four- to five-year sentence for admitted Melissa virus writer David L. Smith, the number of new viruses appearing on the Internet appears to be accelerating as the end of the millennium draws near, anti-virus firms said Friday.

"We had an unprecedented deluge of viruses over the past two weeks and we see no sign of it stopping," said Dan Schrader, vice president of new technology for anti-virus firm Trend Micro Inc.

On Friday, Trend and computer support firm Computer Associates Inc. (NYSE: CA) warned of a new virus that could potentially spread quickly among users of the ICQ messaging service. The virus had hit one of Trend's largest corporate customers, according to Schrader.

Just the latest, not the last

While the new virus, called TROJ_ICQGREETING by Trend, has a damaging payload, an error in the program prevents it from activating. However, the virus's method of spreading could potentially have a cascading effect similar to Melissa and cause mass e-mailings, said a brief written by Trend.

TROJ_ICQGREETING is the latest in a host of network-aware viruses that have hit the Internet in the past month. However, none of the viruses have spread to the extent of Melissa.

Still, the fact that the new viruses use the Internet to multiply means that more people are aware of them, said Sarah Ford, a well-known expert on virus writers and the psychology of virus writing.

"We have predicted an upswing in network-aware viruses, due to the growth of the Internet and related technologies," she said. "I suspect, if it seems like there are 'more' viruses, it's probably closer to the truth to say ... that the viruses that are out there have had wider effect -- this makes it seem like a lot of 'activity.'"

'Unconcerned' about Smith case

Ford also believes that the Smith case has had little effect on the virus community. "Most of the virus writers that I have spoken with recently seem to be unconcerned about this particular case," she said. "I don't see this type of thing having any huge effect on virus creation per se, in the short term."

Smith plead guilty in both state and federal courts on Thursday agreeing to a maximum sentence in state court of 10 years in prison and up to $150,000 fine, and a sentence in federal court of 5 to 10 years in prison and up to a $250,000 fine. Prosecutors recommended that the sentences run concurrently, though the judge could decide not to adopt any or all of the recommendatons.

Smith was arrested by law enforcement officials on April 1, 1999, after a six-day manhunt for the writer of the Melissa virus. The Word macro virus, which struck on Friday, March 26, affected hundreds of thousands of computers when it flooded e-mail gateways.

While the resolution of the case may not have curtailed the virus community's activities, the initial arrest did have some effect, said Richard Smith, an independent security consultant (and no relation to the Melissa virus writer).

"Right after (David L. Smith) was arrested, lots of folks retired as active virus writers," he said. "The stiff penalties are going to be pretty scary for folks for awhile."