Sasser worm writer walks free from court, Sophos comments on conviction of Sven Jaschan

July 08, 2005 Sophos Press Release

Teenager, Sven Jaschan, who admitted responsibility for the Sasser and Netsky computer worms which struck hard around the world, has today received a sentence of one year and nine months on probation and 30 hours community service - meaning he will walk free. The four-day trial in Verden, North Germany looked into one of the biggest internet attacks of its kind.

The verdict is unlikely to be welcomed by many IT administrators who defend business networks from computer attacks. Last month, a Sophos survey of almost 1,000 people found 66% believed that a jail sentence was the most appropriate punishment for writing a virus.

The Sasser internet worm, created by Jaschan, attacked millions of PCs around the world, while versions of his Netsky email virus continue to spread - accounting for over 25% of all virus reports in the first six months of 2005. The Netsky-P worm, which can pose as a Harry Potter computer game, is the second most widespread virus of the year to date.

The Sasser and Netsky worms have caused millions of pounds worth of damage and disruption to businesses and home users around the globe.

"Even a year after his arrest, it is more likely that you will be infected by a worm written by Sven Jaschan than any other virus author," said Graham Cluley, senior technology consultant for Sophos. "However, in the grand scheme of the virus world, it's the organised crime gangs, which are increasingly emerging to make stacks of money through targeted attacks, that should be dealt the harsh sentences - over and above the dumb teenagers."

Jaschan avoided a custodial sentence because he released all of his worms before his 18th birthday and has been tried as a junior. Sophos experts state that if the authorities had arrested Jaschan a few months later, and he had continued to release his army of malicious worms, he would have been tried as an adult and faced a much stiffer punishment.

"Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday," continued Cluley. "In many ways, Sven Jaschan was lucky that the police caught him when they did. Nevertheless, his name will always be associated with some of the biggest viruses in the history of the internet."

"It's a sad story of how a young man with potential can make the wrong choices and end up disrupting millions of business and home computer users around the world," said Cluley. "It's a shame that someone with such IT skills should turn to writing computer viruses to increase his self esteem, rather than doing something positive like developing computer games or an innovative website. Other young people considering writing malware should learn from Sven Jaschan's case and realise that the authorities are getting better than ever at catching virus writers."

Prosecutors charged Jaschan with computer sabotage in September 2004. He pleaded guilty to data manipulation, computer sabotage and interfering with public corporations.