Email this Document!

Creator of "Melissa" Computer Virus Pleads Guilty to State and Federal Charges

 
NEWARK - The New Jersey man accused in April of unleashing the "Melissa" computer virus pleaded guilty today to both state and federal charges, admitting that he created and spread the virus that caused millions of dollars in damage, U.S. Attorney Robert J. Cleary and State Attorney General John Farmer Jr. announced.

David L. Smith, 31, of Aberdeen Township in Monmouth County, appeared in state Superior Court and later in U.S. District Court to enter his pleas. Smith admitted spreading the Melissa virus, which infected more than one million personal computers in North America and disrupted computer networks in business and government.

Smith acknowledged in his federal plea agreement that the Melissa virus caused more than $80 million in damage.

Smith, who was arrested by New Jersey authorities on April 1, 1999, pleaded guilty before state Superior Court Judge John A. Ricciardi in Freehold to a one-count accusation charging the second-degree offense of computer-related theft. The state will recommend a sentence of 10 years, which is the maximum sentence provided by law. He also faces fines of up to $150,000. Sentencing date was set for Feb. 18.

Smith pleaded guilty in U.S. District Court in Newark to a one-count Information, charging him with knowingly spreading a computer virus with the intent to cause damage. Smith faces a maximum prison sentence of five years and a $250,000 fine on the federal charge. U.S. District Judge Joseph Greenaway Jr. set sentencing for May 15.

Smith remains free on bail pending sentencing.

The guilty pleas are the result of a joint state and federal investigation, ending in separate but coordinated prosecutions. The state plea agreement provides that the federal sentencing will occur first and that, at the subsequent state sentencing, New Jersey authorities will recommend that the state sentence run coterminously and concurrently to the federal sentence.  The coordinated investigations and prosecutions by the state and federal governments represent an unprecedented approach in New Jersey to dealing with computer crime.

"The Melissa virus demonstrated the danger that business, government and personal computer users everywhere face in our technological society," said Cleary. "Far from being a mere nuisance, Melissa infected computers and disabled computer networks throughout North America.

"There is a segment in society that views the unleashing of computer viruses as a challenge, a game. Far from it; it is a serious crime. The penalties Mr. Smith faces - including potentially five years in a federal prison - are no game, and others should heed his example."

"Computer criminals may think that they operate in a new frontier without boundaries, where they won't be caught. Obviously, that's not true," said Farmer. "We've responded by breaking down traditional borders among federal, state, county and local law enforcement. In this case, it helped us to make an arrest in less than a week."

And said Attorney General Janet Reno: "This plea is a significant marker in the Justice Department's efforts to stop computer crime. In light of society's increasing dependence on computers, the Department will vigorously investigate and prosecute computer crimes that threaten our computer infrastructure."

The guilty pleas were handled today by Supervising Deputy Attorney General Christopher Bubb in Freehold and by Assistant U.S. Attorney Elliot Turrini in Newark.

Smith admitted in state and federal court that he created the Melissa virus and disseminated it from his home computer. He said that he constructed the virus to evade anti-virus software and to infect computers using the Windows 95, Windows 98 and Windows NT operating systems and the Microsoft Word 97 and Word 2000 word processing programs.

According to Paul Zoubek, Director of the state Division of Criminal Justice, the Melissa virus appeared on thousands of email systems on March 26, 1999, disguised as an important message from a colleague or friend. The virus was designed to send an infected email to the first 50 email addresses on the users' mailing lists. Such emails would only be sent if the computers used Microsoft Outlook for email.

Because each infected computer could infect 50 additional computers, which in turn could infect another 50 computers, the virus proliferated rapidly and exponentially, resulting in substantial interruption or impairment of public communications or services. According to reports from business and government following the spread of the virus, its rapid distribution disrupted computer networks by overloading email servers, resulting in the shutdown of networks and significant costs to repair or cleanse computer systems.

Smith described in state and federal court how, using a stolen America Online account and his own account with a local Internet service provider, he posted an infected document on the Internet newsgroup "Alt.Sex." The posting contained a message enticing readers to download and open the document with the hope of finding passcodes to adult-content websites.

Opening and downloading the message caused the Melissa virus to infect victim computers. The virus altered Microsoft word processing programs such that any document created using the programs would then be infected with the Melissa virus. The virus also lowered macro security settings in the word processing programs. The virus then proliferated via the Microsoft Outlook program, causing computers to send electronic email to the first 50 addresses in the computer user's address book.

Smith acknowledged that each new email greeted new users with an enticing message to open and, thus, spread the virus further. The message read: "Here is that document you asked for ... don't show anyone else;-)."

On April 1, members of the New Jersey State Police High Technology Crime Unit, Special Agents of the FBI and investigators from the Monmouth County Prosecutor's Office arrested Smith at his brother's house in Eatontown.  The arrest followed a tip from a representative of America Online to Deputy State Attorney General Christopher Bubb, head of the state's Computer Analysis and Technology Unit.

Following Smith's guilty plea, Superior Court Judge Ricciardi allowed Smith to remain free on $100,000 bail, pending sentencing. District Judge Greenaway allowed Smith to remain free on a $50,000 personal recognizance bond.

For their roles in the investigation and prosecution, Cleary and Farmer credited the State Police High Technology Crime Unit, under the direction of State Police Superintendent Carson Dunbar, and the Division of Criminal Justice's Computer Analysis and Technology Unit; the FBI and its New Jersey component of the National Infrastructure Protection Center (INFRAGUARD), under the direction locally of Acting Special Agent in Charge Garey S. Chin in Newark; the Justice Department's Computer Crime and Intellectual Property Section, under the direction of Chief Martha Stansell-Gamm; the Defense Criminal Investigative Service, under the direction of James Murawski, New Jersey resident agent in charge, and the Monmouth County Prosecutor's Office, under the direction of Prosecutor John Kaye.

For its cooperation, Farmer and Cleary thanked America Online. Cleary gave special credit also to ICSA.net, of Reston, Va., for its technical assistance and its virus survey, which included an analysis of damage caused by the Melissa virus.

Statutes to which Smith pleaded guilty (copies attached):
N.J.S.A. 2C:20-25(a) and 2C:20-26(a)
18 U.S.C Sections 1030(a)(5)(A) and 2

 

###  

• More information on: Defendant's Sentence
• More information on:  Computer Crime Cases
• More information on: Computer Crime

Go to . . . CCIPS Home Page  ||  Justice Department Home Page