Email this Document!

Creator of Melissa Computer Virus Sentenced to 20 Months in Federal Prison

 
NEWARK - The New Jersey man accused of unleashing the "Melissa" computer virus in 1999, causing millions of dollars in damage and infecting untold numbers of computers and computer networks, was sentenced today to 20 months in federal prison, U.S. Attorney Christopher J. Christie and state Attorney General David Samson announced.

David L. Smith, 34, of Aberdeen Township in Monmouth County, was ordered to serve three years of supervised release after completion of his prison sentence and was fined $5,000. U.S. District Judge Joseph A. Greenaway Jr. further ordered that, upon release, Smith not be involved with computer networks, the Internet or Internet bulletin boards unless authorized by the Court.

Finally, Judge Greenaway said Smith must serve 100 hours of community service upon release. Judge Greenaway said the supervised community service would somehow put to use Smith's technology experience.

Smith will be allowed to voluntarily surrender in the coming weeks, after the U.S. Bureau of Prisons designates a prison facility for him.

On Friday, May 3 at 9 a.m., Smith also faces sentencing before state Superior Court Judge Lawrence M. Lawson in Freehold, Monmouth County. The state sentence is to run concurrently and co-terminously to the federal sentence.

Smith pleaded guilty on Dec. 9, 1999, in state and federal court to computer-related crimes. The two prosecutions are the result of cooperative state and federal investigations of Smith, who, at his guilty pleas, admitted spreading the computer virus across North America from his home computer in Aberdeen Township.

In a cooperating federal plea agreement Smith acknowledged that the Melissa virus caused more than $80 million in damage by disrupting personal computers and computer networks in business and government.

"Virus writers seem emboldened by technology and enjoy the thrill of watching the damage they reap," Christie said. "But the case of Mr. Smith and his Melissa virus should prove to others that it's a fool's game. Law enforcement can employ technology too and track down virus writers and hackers through the electronic fingerprints they invariably leave behind."

"Computer crime is an emerging problem that can affect millions of consumers, as well as corporate America and government," said Samson. "But we will remain vigilant in our efforts to protect society and our nation's computer infrastructure from those who would criminally misuse technology."

Smith pleaded guilty in federal court to a one-count Information, charging him with knowingly spreading a computer virus with the intent to cause damage. The charge carries a maximum prison sentence of five years in prison and a $250,000 fine.

Judge Greenaway determined the actual sentence under the U.S. Sentencing Guidelines, based on a formula that takes into account the severity and characteristics of the offense and other factors, including Smith's cooperation with federal and state authorities.

Judge Greenaway determined that Smith faced a sentencing range of 46 to 57 months under the Sentencing Guidelines. Judge Greenaway accepted the Government's recommendation of a significant downward departure from that range, based on Smith's level and length of cooperation in other investigations.

Parole has been abolished in the federal system. Under Sentencing Guidelines, defendants who are given custodial terms must serve nearly all that time.

On the same day as the federal guilty plea, Smith pleaded guilty in Superior Court in Freehold to a one-count accusation, charging the second-degree offense of computer-related theft. The state has recommend a statutory maximum sentence of 10 years in prison. Smith also faces state fines of up to $150,000.

The state plea agreement provides that the federal sentencing would occur first and that, at the subsequent state sentencing, New Jersey authorities would recommend that the state sentence run co-terminously and concurrently to the federal sentence.

At his plea hearings, Smith admitted that he created the Melissa virus and disseminated it from his home computer. He said that he constructed the virus to evade anti-virus software and to infect computers using the Windows 95, Windows 98 and Windows NT operating systems and the Microsoft Word 97 and Word 2000 word processing programs.

The Melissa virus appeared on thousands of email systems on March 26, 1999, disguised as an important message from a colleague or friend. The virus was designed to send an infected email to the first 50 email addresses on the users' mailing lists. Such emails would only be sent if the computers used Microsoft Outlook for email.

Because each infected computer could infect 50 additional computers, which in turn could infect another 50 computers, the virus proliferated rapidly and exponentially, resulting in substantial interruption or impairment of public communications or services. According to reports from business and government following the spread of the virus, its rapid distribution disrupted computer networks by overloading email servers, resulting in the shutdown of networks and significant costs to repair or cleanse computer systems.

Smith described in state and federal court how, using a stolen America Online account and his own account with a local Internet service provider, he posted an infected document on the Internet newsgroup "Alt.Sex." The posting contained a message enticing readers to download and open the document with the hope of finding passcodes to adult-content websites.

Opening and downloading the message caused the Melissa virus to infect victim computers. The virus altered Microsoft word processing programs such that any document created using the programs would then be infected with the Melissa virus. The virus also lowered macro security settings in the word processing programs. The virus then proliferated via the Microsoft Outlook program, causing computers to send electronic email to the first 50 addresses in the computer user's address book.

Smith acknowledged that each new email greeted new users with an enticing message to open and, thus, spread the virus further. The message read: "Here is that document you asked for ... don't show anyone else;-)."

On April 1, 1999, members of the New Jersey State Police High Technology Crime Unit, Special Agents of the FBI and investigators from the Monmouth County Prosecutor's Office arrested Smith at his brother's house in Eatontown.

The arrest followed a tip from a representative of America Online to the head of the Computer Analysis and Technology Unit in the state Division of Criminal Justice.

The federal prosecution was handled by Assistant U.S. Attorney Elliot Turrini. Deputy State Attorneys General Mark Murtha and Denise Grugan will represent the state at Friday's sentencing.

For their roles in the investigation and prosecution, Christie and Samson credited the State Police High Technology Crime Unit, under the direction of State Police Superintendent Joseph J. Santiago, and the Division of Criminal Justice's Computer Analysis and Technology Unit; the FBI and its New Jersey component of the National Infrastructure Protection Center (INFRAGUARD), under the direction of Special Agent in Charge Phillip W. Thomas in Newark; the Justice Department's Computer Crime and Intellectual Property Section, under the direction of Chief Martha Stansell-Gamm; the Defense Criminal Investigative Service, under the direction of James Murawski, New Jersey resident agent in charge, and the Monmouth County Prosecutor's Office, under the direction of Prosecutor John Kaye.

For its cooperation, Christie and Samson thanked America Online. Christie gave special credit also to ICSA.net, of Reston, Va., for its technical assistance and its virus survey, which included an analysis of damage caused by the Melissa virus.

Statutues to which Smith pleaded guilty:
N.J.S.A. 2C:20-25(a) and 2C:20-26(a)
18 U.S.C Sections 1030(a)(5)(A) and 2

###

 

• More information on:  Defendant's Plea
• More information on:  Computer Crime Cases
• More information on: Computer Crime

Go to . . . CCIPS Home Page  ||  Justice Department Home Page