THE TEEN-AGED COMPUTER hacker known as Mafiaboy pleaded guilty Thursday to 55 of 66 counts of mischief in connection with last year's denial-of-service attacks that crippled several major Web sites.

   ADVERTISEMENT
  

Free IT resource

Virtualization Insights from Top Experts - Learn how virtualization gets real!

Sponsored by Dell

Free IT resource

TechNet: More ways to know it, share it, and keep it running.

Sponsored by Microsoft

RELATED LINKS
»  IE 7 bug reopens debate over patch responsibilities
»  Woman ordered to pay for file-sharing will appeal
»  McAfee to buy SafeBoot for $350M
»  Security RSS feed 

IDG ENTERPRISE NETWORK
• Research Reports  (CIO)
• Ask the Expert  (CIO)

TOP NEWS 


IT SOLUTION SEARCH
Authorities arrested the 16-year-old Montreal youth last April and charged him with two counts of "mischief to data" for a distributed denial-of-service attack (DDOS) that brought down the Internet sites of CNN.com, Yahoo, Amazon.com, eBay, Dell Computer, and others between Feb. 8 and Feb. 14.

Soon after the court had convened, prosecutor Louis Miville-Deschenes announced that the youth had pleaded guilty to the charges. The youth, who can't be identified under Canadian law, will be freed pending sentencing. He had previously pleaded not guilty to all charges.

Although some experts last year had concluded that Mafiaboy was an amateur copycat and that the real culprits may never be found, Mark Rasch, vice president for cyberlaw at Predictive Systems, in Reston, Va., and the former head of the Computer Crime Unit at the U.S. Department of Justice, said it's unlikely the authorities have the wrong person.

"He's caving," said Rasch. "I will grant you that he's an amateur, but he's pleading guilty because he is guilty. It would be extraordinary if he is not the person primarily responsible."

In addition to a two-year prison term and a fine of $1,000 Canadian dollars (about $650 U.S.), the youth could face a wide range of conditions restricting his activities after his release. Although Canadian law grants the court broad discretion in cases that involve minors, the teen-ager could be forced to forfeit his PC or be banned from using the Internet for a specified amount of time.

Last year, a U.S. court slapped convicted computer hacker Kevin Mitnick with a 46-month prison term and ordered him to pay $4,125 in restitution to more than a dozen companies and organizations. Federal authorities arrested Mitnick in 1995 for cracking corporate and university systems and for illegally downloading proprietary software. He pleaded guilty to seven counts of computer and wire fraud charges.

The court also barred Mitnick from accessing computer hardware and software and any form of wireless communications. He's also banned from working at a company that has computers, and he can't possess passwords, cellular phone codes, or data encryption devices without permission.

Although it's possible that the Canadian teen-ager may face restrictions similar to those imposed upon Mitnick, Rasch said the court likely would consider the threat he may pose in the future before making such determinations. "You have to weigh the character of the defendant as well as the nature of the offense," he said.

Despite the capture of Mafiaboy, U.S. security experts said they remain concerned about the growing threat of more sophisticated DDOS attacks against the U.S. private sector infrastructure. Experts cautioned that there are thousands of other individuals still active in the hacker community who pose a much greater threat.

In fact, the prosecution of Mafiaboy could signal the end to DDOS attacks as we now know them, said Jeff Ambrose, technical marketing engineer at Top Layer Networks in Westboro, Mass. The next generation of malicious hackers are learning from his sloppiness, he said. "This was the tip of the iceberg."

Meanwhile, the teenager also faces the possibility of extradition to the United States.

Eric Friedberg, a former computer and telecommunications crime coordinator at the U.S. Attorney's Office in New York and now a computer crime consultant at Stroz and Associates in New York, said it is unlikely that a juvenile would be extradited to the United States, where the punishment would be more severe.

"The charges here would be much more serious, particularly in the amount of jail time," said Friedberg. "In the United States, it's a function of the financial loss that was caused. When you have a DDOS attack, the loss figures can be staggering."