Forgot your password?
typodupeerror
Botnet Crime Security IT

Mariposa Botnet Authors Unlikely To See Jail Time 163

Posted by kdawson
from the laughing-all-the-way-to-the-bank dept.
krebsonsecurity writes "Three Spanish men were arrested last month for allegedly building an international network of more than 12 million hacked PCs that were used for everything from identity theft to spamming. But according to Spanish authorities and security experts who helped unravel the crime ring, the accused may very well never see the inside of a jail cell even if they are ultimately found guilty, due to insufficient cyber-crime legislation in Spain. 'It is almost impossible to be sent to prison for these kinds of crimes in Spain, where prison is mainly for serious crime cases,' said Captain Cesar Lorenzana, deputy head technology crime division of the Spanish Civil Guard. ... Spain is one of nearly three dozen countries that is a signatory to the Council of Europe's cybercrime treaty, but Spanish legislators have not yet ratified the treaty by passing anti-cybercrime laws that would bring its judicial system in line with the treaty's goals."
This discussion has been archived. No new comments can be posted.

Mariposa Botnet Authors Unlikely To See Jail Time

Comments Filter:
  • by cbreaker (561297) on Friday March 05, 2010 @11:09AM (#31371910) Journal
    Yes, these people should be punished. But I agree with Spain's prison/court system when they say that prison is for violent crime.

    There's other ways to punish people and have them be productive to society, instead of rotting in prison. Sure, there may be special cases, but for the most part if you're not a physical danger to people then there's no need to keep you separated from the population.
  • by Anonymous Coward on Friday March 05, 2010 @11:11AM (#31371932)

    Not going to jail over cybercrime isn't ideal, but I'd take this any day over people being fined millions for downloading a few songs off the Internet. Ridiculous penalties for trivial acts are a lot worse than a few cybercrooks being let go with some large fines instead of jail time.

    (Note: downloading music and videos via p2p is legal in Spain)

  • Serious crime? (Score:4, Insightful)

    by NewWorldDan (899800) <dan@gen-tracker.com> on Friday March 05, 2010 @11:14AM (#31371964) Homepage Journal
    'It is almost impossible to be sent to prison for these kinds of crimes in Spain, where prison is mainly for serious crime cases,'

    Do they grasp the economic impact of these botnets? There may not be any physical violence, but the spam hassels, system cleanup, and DDOS attacks create hundreads of millions of dollars in economic damages. Sure, that's distributed over millions of people, but this sort of macroscopic vandalism is, in fact, a major crime. Throw the book at 'em.
  • Re:Serious crime? (Score:4, Insightful)

    by cream wobbly (1102689) on Friday March 05, 2010 @11:20AM (#31372040)

    It's stopped now, isn't it?

    So where's the value to society in a long protracted prosecution?

  • Extradition (Score:5, Insightful)

    by jbeaupre (752124) on Friday March 05, 2010 @11:29AM (#31372176)
    Unless all 12 million pcs were in Spain, they should qualify for extradition. Most likely another EU country, but also the US. Heck, Spain could just shop these guys around if they really want to maximize the pain to these guys.
  • by ChromeAeonium (1026952) on Friday March 05, 2010 @11:34AM (#31372224)

    Change that from 'no prison for non-violent criminals' to 'no prison with violent criminals for non-violent criminals' and I think you're on to something. I say lock these guys up for a good stay, even if not in the same prison they keep killers, rapists, and other physically violent criminals in.

  • by cbreaker (561297) on Friday March 05, 2010 @11:34AM (#31372228) Journal
    You assume, incorrectly, that I mean there should just be a small fine and set them free.

    There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.

    Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.

    Yea, so there's the Car thing. I think car thieves suck, but again, it's just property. Locking someone up for decades doesn't seem to make any sense to me.

    You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..
  • by 0racle (667029) on Friday March 05, 2010 @11:40AM (#31372308)
    The summary said Spain reserved prison for 'serious crime cases.' Depending on how Spain defines 'serious crime' your examples could count and still most spammers wouldn't be eligible for jail, which is still a better situation then in the US. There are other ways to punish people, jail doesn't have to be the only one.

    It's showing the same sociopathic behavior as my other examples, so why should it be special?

    Because get rich quick is not a sociopathic behavior, no matter how you see it, so should be dealt with differently. Following your line of reasoning, every crime no matter how small or large should be treated the same, throw them in jail.

  • by Tim C (15259) on Friday March 05, 2010 @11:44AM (#31372352)

    Prison is meant to protect society from the people being imprisoned as well as serving as punishment and deterrent.

    If there is no need to protect society (or conversely, protect them from revenge/vigilante attacks) then seeking other forms of punishment that are less costly seems to me to be a good idea. While someone is in prison not only are they not contributing to society (if only by paying taxes on the things they buy), but society is paying to house and feed them. Why not keep the non-dangerous criminals in the community, and perhaps force them to work off their crimes?

  • by BrokenHalo (565198) on Friday March 05, 2010 @11:55AM (#31372454)
    Essentially what these spammers have mostly done is cause a lot of people a great deal of inconvenience. If they are guilty of phishing attacks, then that would surely come under the heading of theft or fraud, which would be punishable by jail under Spanish law.

    Otherwise, jailing the creeps only places another drain on society, when what you really want is to stop them being antisocial, and preferably discourage others from doing the same. So how about this, for a change:

    Make the guys do something actually useful for a few years. Like send them out on supervised work orders to pick up rubbish from the streets, scrub public loos and remove graffiti.
  • Re:Serious crime? (Score:4, Insightful)

    by JSBiff (87824) on Friday March 05, 2010 @12:00PM (#31372534) Journal

    "It's stopped now, isn't it?"

    Is it, though?

    How long will it stay 'stopped' if these guys are let out with a slap on the wrist? You don't think they'll just go right back to 'work'? What about deterrence of other 'would-be' identity thieves?

    If someone is offered a 'gamble' with two possible outcomes, one of which is gaining something, and the other of which is just remaining at the same point (that is, no net gain or loss), then it is *irrational* not to participate in the gamble. Now, of course, we have this concept in human society called 'ethics' where we say that you shouldn't do something which hurts someone else, even if it profits you, but these guys have already shown that *they have no ethics*.

    Some number of people will always ignore ethical 'rules', and for those people, you must fall back to simple, rational, economics. In this case, economics doesn't translate directly to money, but rather to the idea of incentives/disincentives.

    Of course, some of those people will still gamble - even if their is a substantial risk of loss, because with online identity theft, fraud, etc, there is always the possibility of a very large payout, just like with drug dealing - you might wind up in jail, or full of bullets, or you might wind up rich. But, at least there is enough possibility of very negative consequences to put most people off from drug dealing.

    Seems to me it's the same with cyber-fraud. Make sure there is the possibility of *very* negative consequences, to make it rational for people to avoid the gamble, even though they do have the possibility of becoming rich.

    Plus, there is plain, simple justice - even if there is no deterrent effect, most of us feel that when someone decides to throw ethics by the wayside, and hurt others, there should be some kind of price to pay.

  • by BitZtream (692029) on Friday March 05, 2010 @12:04PM (#31372568)

    You can strap tracking devices to them, you can restrict their movements

    Great, how does that help against spammers? They can compute from anywhere.

    you can force them to do community service,

    Unless you pile on so much community service that they can't do anything else than the punishment is far too lacking. You might as well put them in jail since you'll have to support them anyway in order to pile on enough community service to justify letting them off with only it based on their crime.

    you can enforce fines to be taken from their paychecks

    What paycheck? They are spammers, they don't work day jobs and they will just do something under the table if you garnish their wages.

    You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..

    No, you seem to not realize that people need to be punished to deter future crime of this type. None of the things you listed would even slow a spammer down. What you propose is to slap them on the wrist and let them go to do it again.

    These people have taken advantage of millions of PCs, they have essentially burglerized millions of homes, not physically but electronically. They have cost hundreds of millions of dollars to others that they can't pay back in their life time. They've made and stuffed away in various places massive amounts of money for themselves that will never go back to who it was stolen from.

    And you want to 'fine them' ... great, lets treat spammers like we treat CEOs, brilliant fucking idea.

  • by Anonymous Coward on Friday March 05, 2010 @12:23PM (#31372802)

    There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.

    And, if the activity is still profitable and possible, they will continue doing it and chalk it up as a cost of doing business.

    Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.

    People also die from old age, but I wouldn't call aging 'violent'. 15,000 people died to criminal negligence. (It's the Bhopal disaster, in case you were curious where I came up with that scenario). It wasn't violence, it wasn't force, it wasn't intended... it was sheer greed and stupidity that led to dangerous corners being cut, leading to a major accident. Jail is more than justified.

    Yea, so there's the Car thing. I think car thieves suck, but again, it's just property. Locking someone up for decades doesn't seem to make any sense to me.

    Nice straw man, there. Show me where a car thief gets 'decades' in prison, and you might have a point. The usual sentence depends on jurisdiction, but even the harsher states it is only 5-10 years, and that's a "5 years, get out in two with good behavior" scenario.

    You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..

    Nice second straw man... Where did I say that? Please, show me, I'd love to see where I even IMPLIED that. What I said is that there are non-violent crimes which deserve prison time... because the activities are detrimental towards society as a whole, and alternative punishments generally are not disincentive enough to deter somebody. I'm not advocating the death penalty, here, I'm saying that if somebody harms society through their actions, a prison sentence which will deter the activity and not simply be written off as 'cost of doing business', prison is a reasonable punishment. I then proceeded on this premise to list some examples of why I feel this way.

    If you want to argue this with straw men, however, I'm sure I can come up with some doozies.

  • Re:Serious crime? (Score:3, Insightful)

    by MikeBabcock (65886) <mtb-slashdot@mikebabcock.ca> on Friday March 05, 2010 @12:30PM (#31372866) Homepage Journal

    Or in the case of a murder: "She's dead now, why prosecute?"

    Nice logic.

  • by cdrguru (88047) on Friday March 05, 2010 @12:38PM (#31372974) Homepage

    The problem is that most of the world has a very simple disconnect between "stuff on computers" and "stuff that affects them". These folks did nothing to anyone that isn't using a computer. Therefore, for most of the population of the world there was zero impact. Nothing. No difference.

    Now, for a very small minority of people (a few millions out of 6 billion) these people caused trouble. In no way does this justify in the minds of the rest of the population of the world that there should be any laws against what they did.

    For example, if you go outside your house and step on some ants I am sure the ants being stepped on would like there to be a law against stepping on ants. The rest of the ant population wasn't affected and neither was the rest of the human population. So there are no laws against stepping on ants, even if to the ants being stepped on it is a huge life-ending tragedy.

    So for these guys they affected some computer users in a mysterious place outside of the real world. Good luck with convincing anyone that this is all that important.

    In the US you don't get any law enforcement attention until you cause provable damages in excess of $25,000. And if you participate in the "crime" by giving away your password through some trojan program the other person isn't going to be taking all the punishment for stealing from you.

    Face it, you live in a different world than most people. They don't understand your world and you don't understand why yours isn't important to them.

  • by cbreaker (561297) on Friday March 05, 2010 @12:59PM (#31373264) Journal
    And yet another person claiming prison is a deterant. It's NOT. No criminal thinks they are going to get caught. It doesn't deter anything. People still get murdered, people still sell drugs, people still steal cars - even with the MASSIVE sentances given to drug dealers and car thieves.

    It. Doesn't. Work.

    You are simplifying my argument to hold up yours and that's weak, real weak.
  • by e3m4n (947977) on Friday March 05, 2010 @01:07PM (#31373348)
    dont forget the financial cost of bandwidth. As an ISP we have OC-3 connections and we pay 95th percentile based on how much bandwidth we consume each month. I can tell you that email consumes 40% of our total bandwidth and that spam accounts for nearly 80% of all email. This means that if our bandwidth bill for the month is $11,000 then spammers directly cost us 11000 * .4 * .8 = $3520 in damages every month. If I were to cause $3000 in damages to any other facet of your property, your job, or even running up 3k in LD charges from abuse of toll-free services, you would have cause for a lawsuit against me. Why are they not liable for the costs they incur?
  • by Anonymous Coward on Friday March 05, 2010 @01:10PM (#31373400)

    Because get rich quick is not a sociopathic behavior, no matter how you see it, so should be dealt with differently. Following your line of reasoning, every crime no matter how small or large should be treated the same, throw them in jail.

    Hijacking somebody's computer, and using its resources for yourself, however IS sociopathic: You are taking something which does not belong to you, and knowing it is wrong you do it anyway. To hell with the spam, I'm talking purely about the botnet here. There are plenty of 'legal' ways to spam, there are no legal (or moral, or ethical) ways of creating a botnet of zombies. As somebody else in this thread said, "Prison is meant to protect society from the people being imprisoned as well as serving as punishment and deterrent. If there is no need to protect society (or conversely, protect them from revenge/vigilante attacks) then seeking other forms of punishment that are less costly seems to me to be a good idea.", And I agree with that completely. However, what constitutes a 'need to protect society', is what we're differing on.

  • by moeinvt (851793) on Friday March 05, 2010 @01:26PM (#31373606)

    "And yet another person claiming prison is a deterant. It's NOT. No criminal thinks they are going to get caught. It doesn't deter anything."

    If a criminal is in prison, they are effectively prevented from committing further crimes, except maybe against their fellow convincts. Keeping habitual offenders away from the civilian population is a pretty good deterrant.

He who steps on others to reach the top has good balance.

Working...