Interview with a Virus Hunter

Lee Altschuler tells all about viruses, bombs, and hackers.
[from: ZDTV]

In the wake of the Explore worm, law enforcement is looking ever more vigilantly for the virus writer-- or writers-- behind the program. Here's an inside look at the process.

Lee Altschuler is the former chief assistant US attorney in charge of computer crime prosecutions in San Jose. He spoke with Luke Reiter in July of 1998 to outline laws relating to computer and Internet crimes. He reviewed how law enforcement treats a variety of crimes, from posting viruses to hacking, to what a "protected" PC means.

CyberCrime Are there any laws against writing programs that are designed to damage computers?

Altschuler Laws have been on the books, in various forms, since about 1981 concerning computer hacking and computer fraud and abuse. And over time they've gotten much more tailored to the problems that we face on a day-to-day basis.

CC So if you write a program that is designed to do damage to somebody's computer, is there a law that makes that illegal?

Altschuler Federal prosecutors are very interested in cases where someone causes a code or command to be transmitted to somebody else's computer. And that's the kind of case that can be prosecuted under law as it currently stands.

CC So if you write a program and post it on the Internet, and the program is a utility that enables you to get unauthorized access to somebody's program, but you don't actually run that program yourself, how does the law view you then?

Altschuler The law views you [as] little different from the irresponsible person who posts bomb-making instructions on the Internet. Right now, that's not illegal.

When Virus-writing Becomes Illegal

CC It's not illegal to post bomb instructions, or to post virus programs on the Internet, provided that you don't run those programs yourself?

There's certainly not a safe harbor for doing this sort of socially irresponsible activity. -Lee Altschuler

Altschuler Well, in the investigation, if it develops that the person had knowledge of what was going to happen when those instructions were posted, it could be a very uncomfortable position for the writer as well as the user of the program.

CC In that situation, you would attempt to charge the virus writer, say, as an accessory to the ultimate crime?

Altschuler Accessory or a co-conspirator, or aiding and abetting the violation. There's certainly not a safe harbor for doing this sort of socially irresponsible activity.

CC Are you familiar with cases that have been made against people who have written programs like that?

Altschuler Cases have been made all over the country, from Guam all the way to New York on these kind of issues.

CC And have there been people who have written the code, but not run them who have also been held accountable?

Altschuler Well, it's hard to find a case where one but not the other happens. They're really inseparable, based on experience so far.

Snooping Around: Trojan Horses

CC Let's focus on what happens if you are the person responsible for using one of these utilities. What are the laws that apply to using computers to gain unauthorized access?

Altschuler Gaining unauthorized access, or exceeding authorized access, in connection with a computer used in interstate commerce or a government computer, is a very serious criminal violation. The FBI has specially trained agents who investigate these kinds of matters, and US attorney's offices across the country have specially trained prosecutors to bring these cases in court. The penalties range from five to 10 years for a first offense, and as long as 20 years for a repeat offender.

CC Some groups, like the Cult of the Dead Cow, say that they're developing these tools and utilities as a form of social protest - to reveal the inadequacy of current security measures by companies like Microsoft. Do you see this as a form of civil disobedience? Is this a form of social protest?

Altschuler Writing the program is different from running it. Running the program, or making it available to people who run it, is akin to providing maps on how to break into another person's home, and it's not a very nice thing to do.

CC Aside from not being a nice thing to do, do you think there are larger social implications to this? Could this be seen as the cyberspace equivalent of a sit-in by a civil rights organization?

Altschuler I think it's the cyberspace equivalent of peering in another person's bedroom window late at night. And I think there is little redeeming value to it.

CC So you would suggest that these groups find other ways to demonstrate their unhappiness with current security measures?

Altschuler There are a whole host of ways that one can work constructively in order to address defects in current security measures. And that's the way that one lives under the rule of law.

Unauthorized Access: When is Hacking Illegal?

CC There's a difference in some people's minds between those who simply access computers without authorization, and those who do damage once they get inside. Does the law make that distinction?

In fact, it's hard to find a case where [people] can snoop in a computer and be assured that they're not committing a crime. -Lee Altschuler

Altschuler Accessing another's computer without authorization is a high risk proposition. If one does that without permission, the law holds the trespassing individual strictly liable for any damage, whether intended or not. It's little different from attempting to rob a bank and causing a customer to suffer a heart attack. Bank robbers are well advised to be careful when they rob banks. And computer hackers stand in essentially the same position.

CC In the event that no damage does occur, whether intentionally or inadvertently, but someone is simply interested in getting access to your information-– in reading your email, in reading your hard drive-– are there laws that prevent them from simply being in there in the first place?

Altschuler The federal law reaches very broadly right now. It protects not only government computers, financial institution computers, computers that are used to send messages between different states. In fact, it's hard to find a case where one can snoop in a computer and be assured that they're not committing a crime.

'Protected' PCs: Penalties for Hacking

CC There is a law, Section 1030, the Computer Fraud and Abuse Act it's often called, which makes it a crime to knowingly cause the transmission of a program, information, code, or command, and as a result of such conduct, intentionally cause damage without authorization to a protected computer. Is that the law that you're speaking of?

Altschuler Yes.

There are few places where a hacker is completely safe from the long arm of the law.

CC When it says "protected computer," there's a broad understanding of what that means?

Altschuler "Protected computer" covers a lot of real estate in cyberspace. Financial institutions, U.S. government, private businesses doing work for the government, or computers used to send messages between states, are all protected computers.

CC As a prosecutor, could you make a case that somebody who puts a program up that has the ability to cause damage to somebody else's computer-– or to many computers-– is knowingly transmitting a program with the intent that it ultimately cause damage to a protected computer?

Altschuler That's a very interesting question. And it's hard to answer it in the abstract.

CC So you would need to go on a case by case basis?

Altschuler Right.

CC You say that law enforcement agencies are trying to track down the people who are running these programs. Is it practical, or even possible, to find these people?

Altschuler It's very possible. It's very practical. The FBI runs computer intrusion squads all over the United States, as close to us as San Francisco, and as far away as Washington, D.C., and many places in between.

CC For example, the CIH virus that has been widely reported in the last week or so, was reportedly written by someone in Taiwan.

[Editor's Note: The author of the CIH virus was a university student from Taiwan.]

If that program were to be run on computers in the United States by an individual in a country like Taiwan, do we really have the mechanisms here to find that person and get some justice?

Altschuler Intergovernmental cooperation is increasing every day. Prosecutors in most developed countries have working relationships with U.S. prosecutors. Treaty arrangements are steadily broadening to reach computer crime.

There are few places where a hacker is completely safe from the long arm of the law. And there are indeed cases now where FBI agents have traveled overseas to interview hackers, and the hackers are then prosecuted either by their home government or by the U.S. government.