Sasser Author Arrested

[hobbes]

JBR,

I doubt our 18 internet thug is very streetwise and this is probably his first run-in with the law. When the men in black came to his house and got in his face and promised him a life in prison where his ass would see more traffic than an ashtray at a Pall Mall convention if they didn't get his full and immediate cooperation, he probably caved.

"You hold out, we'll throw the book at you. But if you talk, maybe we can cut a deal." Rather standard police practice to intimidate, pretend to know more than they do and embellish the penalties.

I caught onto this trick after my 15th arrest.



Clocker,

I know this guy who is spending a tremendous amount of time and energy to optimize his computer. He wants to improve its efficiency and test its limits. Why, because he enjoys the learning and the challenge, and that is it. Minesweeper and Solitaire don't require that much tweeking to run effectively.

I look at hackers the same way, trying to test limits and simply see if they can accomplish something. Particularly if all the worm does is shut down the computer.

So I see the intent as being far different than a single minded effort to kill. We really shouldn't make light of attacks which have killed people. We cannot offend the dead, but we can re-open the emotional wounds of their surviving heirs. I would definately be angry if someone equated a virus which turn off computers to 9/11.

You are totally correct that the crime is greivous and harsh punishment should be dealt. After all, this is not a matter of a few minutes work, but a premeditated and dedicated attempt to corrupt an essential societal utility.

I imagine the young man would have been devastated if people had died, but he must be accountable for any consequences of his action. Ignorance of the potential consquences is not an excuse.

An example needs to made so that those future social outcast hackers can see that the punishment far outweighs their 15 minutes of infamy.

The truth is that if you can create a computer virus which has the means to spread itself and targets the right function, you can cause such disruption of the internet, that many people could potentially die. This would be an act of terrorism.

I don't think that the penalty for attempting such acts would disuade any real "terrorist", but stiff penalties for doing what this kid did, might seriously scare off the thrill seeking hackers.

[leftism]

Originally posted by clocker+--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (clocker)</td></tr><tr><td id='QUOTE'>Lefty,

1). The people killed in the subway attack in Japan are currently dead. As such, they are incapable of being offended.[/b]

The families of those who died, whatever, ... the point remains. It is offensive to compare this to mass murder.

Originally posted by clocker@

2). You have no idea of the life-threating ( or indeed, life-ending) consequences of disrupting computers worldwide. As pervasive and essential to modern life as computers are, it takes little imagination to see just how lethal a computer attack can be.

How many worms have there been since 1986? A hell of a lot. How many deaths caused by these worms? None that I know of, and I&#39;m sure the media would tell us all about it if it happened.

If the release of a computer worm was as dangerous as your making out (on the same level as sarin gas or anthrax) we would have had tens of thousands of deaths over the last 20 years. If you wanted to keep it purely recent for the sake of comparison to todays networked world we should have seen a few thousand in the last 3-5 years alone.

The point is that we do know the consequences of disrupting computers worldwide. Its been happening on a fairly regular basis for 2 decades.

<!--QuoteBegin-clocker
3). Whether or not computer administrators also share responsibility for any harm is completely irrelevant to the question of this kid&#39;s guilt or the severity of his punishment. If I was wounded by a stray bullet, your argument lays the blame at my feet since I wasn&#39;t wearing a Kevlar vest, a "reasonable precaution" in the neighborhood, perhaps. The two issues are not at all linked.
Punish the kid first and then look to others later.
[/quote]

1st.. That analogy is completely inappropriate.

Securing a networked computer that is responsible for safety is in no way the same as wearing a kevlar vest in a bad neighbouthood. Securing a networked computer is the same as locking your car or your front door. It&#39;s common sense and moreover, if you are an administrator of an important computer system its the most basic of duties and your getting paid good money to do it.

2nd. I know the incompetence of administrators is irrelevant to the question of his guilt or punishment. I&#39;m not talking about that. I&#39;m talking about the damage done to important systems. That is the responsibility of the administrators. As I said, this worm should have been nothing to these Gvt systems, zip, zero, nada, nothing. Only the complete stupidity of certain overpaid individuals allowed it to be a problem. I cannot emphasise this enough.. there is no explanation asides from gross negligence of the worst kind that can explain how these safety critical systems were affected.

What happens time and time again in these cases, is that we "punish the kid", have a hysterical outburst for a little while, and then get back to the same state of affairs we had before. These idiot administrators stay in their jobs making the same mistakes in preparation for the next inevitable worm, and it is inevitable until some clever spark comes up with a solution to completely solve the issue of criminality.....

After 20 years of internet worms its time we got real and realised hysteria about terrorists and the end of the world does not help, it hinders by drawing attention away from an important issue that&#39;s been overlooked for far too long.

[clocker]

I know this guy who is spending a tremendous amount of time and energy to optimize his computer. He wants to improve its efficiency and test its limits. Why, because he enjoys the learning and the challenge, and that is it. Minesweeper and Solitaire don&#39;t require that much tweeking to run effectively.

I look at hackers the same way, trying to test limits and simply see if they can accomplish something. Particularly if all the worm does is shut down the computer.

So I see the intent as being far different than a single minded effort to kill. We really shouldn&#39;t make light of attacks which have killed people. We cannot offend the dead, but we can re-open the emotional wounds of their surviving heirs. I would definately be angry if someone equated a virus which turn off computers to 9/11.

Hobbes,
I think I&#39;d enjoy meeting this "guy" that you know, he sounds like a kindred spirit.

Isn&#39;t it possible to test the limits of one&#39;s skills in a controlled environment?
Is it really necessary to release your pet program worldwide and then hope that nothing bad happens?

I certainly did not mean to make light of attacks which have killed people in the past, I meant to point up the fact that a virus/worm which "just shuts down computers" willy-nilly can be equally as deadly in our modern world as Sarin or anthrax.

Had the Sasser worm shut down my PC ( it didn&#39;t), I would have been irritated and inconvenienced.
My Minesweeper and Solitaire scores would have suffered.
No biggie.
But what if my computer monitored my insulin level or heart rate?
What if I was an eighty year old shutin who&#39;s primary contact with the outside world was my PC?
You are a man of considerable imagination
hobbes...these scenarios and more I&#39;m sure, have crossed your mind.

How pissed off would the author of this worm have been if HIS PC was suddenly removed from his conrol and then randomly shut down?
You think he didn&#39;t think about that as he went about his work?

[hobbes]

Originally posted by clocker@9 May 2004 - 05:01
What if I was an eighty year old shutin who&#39;s primary contact with the outside world was my PC?
You are a man of considerable imagination
hobbes...these scenarios and more I&#39;m sure, have crossed your mind.

Yes, I admitted that it could be a very lethal thing to do. It is all about intent.

I was more discussing how a "decent " person could do a "bad "thing" as a result of an attempt to test limits, rather than a maniac hoping to kill as many as possible.

Laws should be set up to really punish these people so the weekend hacker is strongly disuaded from testing the limits.

Stay out of my computer and fuck with your own is my motto.

BTW, this guy I was talking about, well he comes off gay.

[leftism]

Originally posted by clocker
But what if my computer monitored my insulin level or heart rate?

Such a system has no business being connected to the whole internet. This system would and should only be available to the systems it needs to &#39;speak&#39; to.

If someone allowed this system to be reachable from the entire net, they should be prosecuted in the same way that a train company that fails to meet safety regulations is.

[j2k4]

A couple of things spring to mind:

1. As I remember, internet news was from Nuremburg, so I think we can rule him out.

2. Clocker-I have made the acquaintance of Hobbes&#39;s friend; he&#39;s quite a piece of work, but I don&#39;t think he&#39;s gay.

Actually, he&#39;s a rather sober individual who loves to drink.

3. While I must say I agree for the most part with Clocker&#39;s opinion of this individual and wishes for his future prospects, I am compelled to also note that many people would/could equate the necessity of an unsullied WWW with that of the free flow of oil at a fair market price.

4. Those who complain of the impropriety of rash comparisons between internet shenanigans and Sarin attacks might think twice before comparing George Bush to Adolph Hitler.

Just my opinions, of course.

[hobbes]

Originally posted by j2k4@9 May 2004 - 05:43
4. Those who complain of the impropriety of rash comparisons between internet shenanigans and Sarin attacks might think twice before comparing George Bush to Adolph Hitler.

That one may just be a classic.

Just remember, it was Clocker who did such.

[leftism]

Originally posted by j2k4
Those who complain of the impropriety of rash comparisons between internet shenanigans and Sarin attacks might think twice before comparing George Bush to Adolph Hitler.

I wasn&#39;t aware that anyone complaining about the "impropriety" of "comparisons between internet shenanigans and Sarin attacks" had compared Bush to Hitler.

The search facility doesn&#39;t show me or Hobbes comparing Bush to Hitler and we&#39;re the only ones complaining about the sarin/internet worm comparison. You&#39;ve obviously made an innocent mistake.

[hobbes]

Perhaps I should clarify.

Clocker compared the internet attacks to the Sarin attacks. I think this is an overstatement, with all due respect.

The reason I thought J2K4&#39;s post to be a classic is that many individuals like to make equally inappropriate comparisons between Bush and Hitler, and feel themselves fully justified.

[clocker]

The families of those who died, whatever, ... the point remains. It is offensive to compare this to mass murder.

Sorry, but I disagree.

I know the incompetence of administrators is irrelevant to the question of his guilt or punishment. I&#39;m not talking about that. I&#39;m talking about the damage done to important systems. That is the responsibility of the administrators.

Secondarily, yes. The primary responsibility still lies with the author of the worm/virus.

What happens time and time again in these cases, is that we "punish the kid", have a hysterical outburst for a little while, and then get back to the same state of affairs we had before.

Hmmm, since punishment hasn&#39;t worked in the past, I suppose we just let the little geek go.
After all, what&#39;s the point.
BTW, punishment for murder doesn&#39;t seem to be terribly effective either, so....

Leftism, I have no problem with your dislike of incompetent computer security experts...we actually agree on this one ( despite my lack of knowlege of the field...).
That still does not shift responsibility from the malicious authors of the code attacks, and, despite a lack of direct casualities, the very real threat that they pose.
If not the Sasser worm, then the next.... or the next...inevitably, a worm-to-come will be intentionally malicious-let&#39;s shut down the powergrid or launch an attack on a nuclear power plant- and the defense is what, "It&#39;s the fault of the computer admins"?