By Brian Krebs washingtonpost.com Staff Writer
Thursday, October 2, 2003; 4:24 PM
Convicted hackers and virus writers soon will face significantly harsher penalties under new guidelines that dictate how the government punishes computer crimes.
Starting in November, federal judges will begin handing out the expanded penalties, which were developed by the U.S. Sentencing Commission. Congress ordered the changes last year, saying that sentences for convicted computer criminals should reflect the seriousness of their crimes.
"The increases in penalties are a reflection of the fact that these offenses are not just fun and games, that there are real world consequences for potentially devastating computer hacking and virus cases," said John G. Malcolm, deputy assistant attorney general and head of the U.S. Justice Department's computer crimes section. "Thus far, the penalties have not been commensurate with the harm that these hacking cases have caused to real victims."
There are multiple factors that a judge depends on to determine whether to send someone to prison and for how long, but most maximum prison sentences handed down for computer crime range from one year to 10 years. Hackers whose exploits result in injury or death -- if they disable emergency response networks or destroy electronic medical records, for example -- face 20 years to life in prison.
Hackers will face up to a 25 percent increase in their sentences if they hijack e-mail accounts or steal personal data -- including financial and medical records and digital photographs. Convicted virus and worm authors face a 50 percent increase.
Sentences also will increase by 50 percent for hackers who share stolen personal data with anyone. The sentences will double if the information is posted on the Internet. More than half of the sentences handed out under federal computer crime laws would be lengthened by this change alone, according to a Sentencing Commission report released in April.
Jail time also will double for hackers who break into government and military computers or networks tied to the power grid or telecommunications network.
Hackers who electronically break into bank accounts can be sentenced based on how much money is in the account, even if they don't take any of it. Under the new guidelines, however, judges can tack on a 50 percent increase to the sentence if the hacker did steal money.
Prosecutors traditionally had to show that computer criminals caused at least $5,000 in actual losses to win a conviction. The new guidelines let victims tally financial loss based on the costs of restoring data, fixing security holes, conducting damage assessments and lost revenue.
"Some computer crimes are more serious than others, and these new guidelines reflect that critical infrastructures need to be protected and that invasions of privacy need to be treated as seriously as invasions of our pocketbooks," said Mark Rasch, former director of the Justice Department's computer crimes division and chief security counsel for Solutionary Inc., an Internet security company in Tysons Corner, Va.
