Johannesburg, 09 May 2003
Virus writing is beginning to feel the long arm of the law in SA, in line with international trends as the first case of its kind was heard in the Johannesburg Commercial Crimes Court last month. The case involves the ex-employee of a major local retailer appearing in court for allegedly introducing a virus into the company`s computer system, resulting in losses for the company amounting to about R5 million.
The virus first appeared in May 1999 in the company`s mainframe computers and it was alleged that the employee released the virus after suffering a cut in salary due to certain IT functions at the company being outsourced.
"Cases such as this are sending a very clear message to the IT community in this country that it is not acceptable to cause malicious damage to the property of others and that the offence is punishable by the law," comments Matt Newnham, eScan product manager for local software distributor Camsoft Solutions.
"The fact that in this particular case the damage was allegedly done by a disgruntled employee who had been entrusted with the security of the computer network highlights the necessity for companies to have comprehensive security measures in place to counter such a threat," continues Newnham.
According to Reinhardt Buys of Internet and IT law firm Buys Inc (www.buys,co.za), producing malicious computer code is not a crime in SA.
"Malicious computer code is protected speech in terms of the South African Constitution. However, if the code is written or used with the purpose to violate or breach computer security, criminal action may follow in terms of section 86(4) and (5) of the Electronic Communications and Transactions Act 25 of 2002 which prohibits the creation and use of any software or device that may be used to overcome IT security measures," says Buys.
Buys adds that a company that suffered losses due to a virus infection may claim civil damages from the creator of the virus or from persons that negligently assisted in the spreading of the virus. "Company boards will be well advised to get the necessary pre-emptive measures in place to protect themselves against virus damage and liability," explained Buys.
"To date there have been no other prosecutions for virus writing and distribution in SA although there have been numerous successful convictions recently in other countries. In one of the first cases of its kind in the UK, three Cornell University students were each sentenced to several hundred hours community service for creating and disseminating a computer virus in October 1992. Then in 1995, Christopher Pile, a 26-year old who went under the name of 'Black Baron`, was jailed for 18 months for releasing into the wild two computer viruses, Pathogen and Queeg, which he named after expressions used in the British Sci-Fi comedy 'Red Dwarf`," says Newnham.
"In the US, the sentencing of virus author David L Smith just under a year ago to 20 months in a federal prison for creating and releasing the Melissa virus suggests that penalties for Internet crimes in that country may be getting tougher," adds Newnham. "Smith pleaded guilty to charges of computer theft and to distributing the Melissa worm which caused more than $90 million of damage to businesses around the world.
"In 2001, the author of the Kournikova virus, Jan de Wit, was only sentenced to community service by a Dutch court and in the same year Raphael Gray, a well-known hacker, was also sentenced to community service by a Welsh court. Courts will need to continue to hand down harsher sentences on hackers and virus writers who intentionally cause malicious damage to property if the current spate of viruses and hack attacks is to be curbed," adds Newnham.
"Interestingly, rather drastic measures reportedly taken by the Chinese government in 1994 resulted in a virus writer there paying the ultimate sacrifice for his malicious activities by being beheaded for spreading computer viruses. On the other hand, Chen Ing-Hau, the 24-year-old Taiwanese author of the CIH virus (his initials spelt backwards), has never been punished for what was one of the most destructive and costly viruses ever written."
Share