From: escheire@sunlab.cit.cornell.edu (Eric Scheirer)
Subject: Cornell Virus Case Results
Originator: daemon@eff.org
Organization: EFF mail-news gateway
Date: Tue, 8 Sep 1992 18:35:30 GMT


Retyped without permission from the Cornell Daily Sun of 8 Sept 1992.
Typographical errors are my fault.

----
FORMER C.U. STUDENTS PLEAD GUILTY
Virus Defendants Avoid Prison With Plea Bargain Agreement
by Rhonda Stewart

Last Friday in Tompkins County Court, three former Cornell students,
David S. Blumenthal '94, Mark A. Pilgrim '94 and Randall A.
Swanson'94, pleaded guilty to releasing the "MBDF-A" computer virus.

In separate plea bargain agreements, all felony charges, fines and
possibiliies for jail sentences were eliminated.

The former students had faced 40 charges, including 16 felony counts,
for releasing a computer virus from a campus computer laboratory last
semester.

Since they have no prior records, DA George M. Dentes J.D. '76 [ie,
his JD was from Cornell in 1976] accepted guilty pleas instead of seeking
felony convictions in a common plea bargain agreement.

In lieu of administering fines or time in prison, Judge Betty D.
Friedlander ordered each defendant to pay restitution in the amount of
$2476 to three victims, including the University.  Blumenthal and
Pilgrim were also ordered to forfeit their personal computer equipment,
which was used to create the virus.

In addition, Friedlander reserved the right to impose probation and
community service as alternatives to incarceration when she sentences
the three defendants on Oct 5.

The defendants are not currently registered with the University this
semester, according to Cornell officials.  The officials would not say,
however, if the the three have been expelled from the University.

Pligrim and Swanson would not say Friday if they had been expelled or
if they chose to leave voluntarily.  Blumenthal said he does not plan
to return to the University.  He said he will continue his studies at
another institution and "wants to get on with his life".

The virus was developed by Blumenthal and Pilgrim, who were employees
at Cornell Information Technologies (CIT), and on Feb. 14, they sent
computer games containing the virus from Upson Lab via the VAX5 network
[a common Cornell link to the Internet] to Stanford public archives.
Although the virus spread worldwide, reaching as far as Japan, it
caused no serious permanent damage for users.

Dentes called Swanson "a lesser player in the offense," because he
only assisted in launching the virus.

Blumenthal and Pilgrim pleaded guilty Friday to computer tampering in
the second degree, a misdemeanor, while Swanson pleaded guilty to
disorderly conduct, a violation.

"This kind of thing is likely to recur considering the technological
age we live in and the tendency of students to be creative", Dentes
said.

In February, Blumenthal was charged with nine misdemeanors and eight
felonies.  The most serious was a Class D felony, punishable by seven
years in state prison and a fine up to $5000.  

Pilgrim and Swanson were each charged with nine misdemeanors and four
felonies.  The most serious was a Class E felony, punishable by four
years in prison and a fine up to $2500.

Raymond M. Schlather, attorney for Blumenthal, called the case, "a
time consuming and expensive learning process for all of us."

Of the three attorneys working on the case, Schlather was the most
vocal in expressing his views on the state statute under which the
defendants were charged.  The two other attorney, Paul D. Bennett and
Robert J. Holdsworth, Jr J.D. '81 declined to comment on the case.

In court on Friday, Schlather argued that the statue was too vague and
did not cover his client's individual actions.

Dentes said the case opened up certain complicated legal programs.

"In order to be considered a felony, damage must exceed $1000.  For
example, does this mean market value or the cost to rectify the
situation?" Dentes asked. "There's some uncertainty as to what the
statue means in terms of the creators mental state, whether there
need to be malicious intent or not," he added.

"There is a proposal before the legislature to change the law.  In
light of my experience with this case I will suggest further changes,"
Dentes said.

[Cornell University] President Frank H. T. Rhodes issued a statement
last Friday condemning this and any future computer tampering.

"We took these case very seriously.  The University will continue to
inform all members of the campus community of the seriousness of
coputer tampering.  These proceedings will send a message to all
concerned," Rhodes said in a prepared statement.

After the plea hearing last Friday, Blumental expressed his opinion
on University's computer policy, calling the virus "an experiment."

"I was very upset and dismayed when I realized it was causing damage.
Cornell's attitudes and policies are the exact opposite of what should
be done to prevent tampering.  They rule their computers with an iron
fist.  That's dictatorship," he said.

When asked if he will continue to work with computers in the future,
Blumenthal replied, "Of course."

M. Stuart Lynn, vice president of information technologies, said
Saturday that the University's policies were appropriate.

"Justice is being served.  The University has completed what it
intends to do," Lynn said.  "The fact that they pleaded guilty shows
the seriousness of what they did.  If Mr. Blumenthal thinks it's okay
to unleash a virus on the world's computers, then he really doesn't
understand what he did.  He hasn't gotten the message."

This was the second compuer virus released by Cornell students in the
last six years.

In 1986, Robert T. Morris, Jr. launched a virus [the "Internet worm"]
that spread nationwide and affected computers at NASA.

Morris was indicted under a felony section of the 1986 Computer Fraud
and Abuse Act.


----
Eric Scheirer -- Cornell U. -- (607) 277-1899 -- HORJ@vax5.cit.cornell.edu

"Small change can often be found under sofa cushions" -- Lazarus Long
Newsgroups: alt.comp.acad-freedom.talk