Court documents released yesterday reveal that David L Smith, the author of the Melissa virus, assisted computer crime authorities in the investigation and prosecution of other virus writers.
Within weeks of Smith's arrest by the FBI in 1999, he was using a fake identity to communicate with and track virus writers around the world.
The court documents released yesterday reveal that New Jersey attorney Christopher J Christie wrote to Judge Joseph Greenaway, who sentenced Smith to 20 months in prison in 2002, claiming that "Smith provided timely, substantial assistance to the United States in the investigation and prosecution of others."
According to the court documents, Smith gave the FBI the name, home address, email address of Jan de Wit (also known as "OnTheFly"), the Netherlands-based author of the Anna Kournikova virus. The FBI passed the information on to authorities in the Europe, who arrested de Wit, who was later sentenced to 150 hours community service.
In 2001 David L Smith is claimed to have assisted in another investigation into a virus writer - having recorded online discussions with part-time DJ Simon Vallor, the author of three viruses. The FBI shared the information with British detectives, who arrested Vallor in February 2002. Vallor subsequently pleaded guilty and was sentenced to two years imprisonment.
"Both Jan de Wit and Simon Vallor showed extraordinary levels of stupidity, helping the authorities track them down," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "Jan de Wit's Kournikova virus contained his nickname "OnTheFly". Unfortunately he also had a website with that name, complete with downloadable images of the tennis pinup. You wouldn't have had to have been Sherlock Holmes to solve that riddle."
"Vallor, meanwhile, appears to have done himself no favours by writing viruses which included messages to his mates, and bragging about his achievements online. Hollywood's depiction of virus writers as geniuses could hardly be further from the truth," continued Cluley.
Simon Vallor was released from prison in early September 2003, but is being electronically tagged. Until January 2004 he must adhere to a curfew which bans him from leaving his Welsh home after 7.15pm.
In return for his services, the FBI paid for David L Smith's rent, insurance and utilities, totalling over $12,000. Smith continues to serve his sentence in federal prison at Fort Dix, New Jersey.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.