Mariposa Botnet Authors Unlikely To See Jail Time 163
krebsonsecurity writes "Three Spanish men were arrested last month for allegedly building an international network of more than 12 million hacked PCs that were used for everything from identity theft to spamming. But according to Spanish authorities and security experts who helped unravel the crime ring, the accused may very well never see the inside of a jail cell even if they are ultimately found guilty, due to insufficient cyber-crime legislation in Spain. 'It is almost impossible to be sent to prison for these kinds of crimes in Spain, where prison is mainly for serious crime cases,' said Captain Cesar Lorenzana, deputy head technology crime division of the Spanish Civil Guard. ... Spain is one of nearly three dozen countries that is a signatory to the Council of Europe's cybercrime treaty, but Spanish legislators have not yet ratified the treaty by passing anti-cybercrime laws that would bring its judicial system in line with the treaty's goals."
And prison SHOULDN'T be used for non-violent crime (Score:3, Insightful)
There's other ways to punish people and have them be productive to society, instead of rotting in prison. Sure, there may be special cases, but for the most part if you're not a physical danger to people then there's no need to keep you separated from the population.
Beats the RIAA lawsuits (Score:5, Insightful)
Not going to jail over cybercrime isn't ideal, but I'd take this any day over people being fined millions for downloading a few songs off the Internet. Ridiculous penalties for trivial acts are a lot worse than a few cybercrooks being let go with some large fines instead of jail time.
(Note: downloading music and videos via p2p is legal in Spain)
Serious crime? (Score:4, Insightful)
Do they grasp the economic impact of these botnets? There may not be any physical violence, but the spam hassels, system cleanup, and DDOS attacks create hundreads of millions of dollars in economic damages. Sure, that's distributed over millions of people, but this sort of macroscopic vandalism is, in fact, a major crime. Throw the book at 'em.
Comment removed (Score:4, Insightful)
Extradition (Score:5, Insightful)
Re:And prison SHOULDN'T be used for non-violent cr (Score:3, Insightful)
Change that from 'no prison for non-violent criminals' to 'no prison with violent criminals for non-violent criminals' and I think you're on to something. I say lock these guys up for a good stay, even if not in the same prison they keep killers, rapists, and other physically violent criminals in.
Re:And prison SHOULDN'T be used for non-violent cr (Score:1, Insightful)
There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.
Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.
Yea, so there's the Car thing. I think car thieves suck, but again, it's just property. Locking someone up for decades doesn't seem to make any sense to me.
You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..
Re:And prison SHOULDN'T be used for non-violent cr (Score:2, Insightful)
Because get rich quick is not a sociopathic behavior, no matter how you see it, so should be dealt with differently. Following your line of reasoning, every crime no matter how small or large should be treated the same, throw them in jail.
Re:And prison SHOULDN'T be used for non-violent cr (Score:3, Insightful)
Prison is meant to protect society from the people being imprisoned as well as serving as punishment and deterrent.
If there is no need to protect society (or conversely, protect them from revenge/vigilante attacks) then seeking other forms of punishment that are less costly seems to me to be a good idea. While someone is in prison not only are they not contributing to society (if only by paying taxes on the things they buy), but society is paying to house and feed them. Why not keep the non-dangerous criminals in the community, and perhaps force them to work off their crimes?
Make punishment fit the crime... (Score:2, Insightful)
Otherwise, jailing the creeps only places another drain on society, when what you really want is to stop them being antisocial, and preferably discourage others from doing the same. So how about this, for a change:
Make the guys do something actually useful for a few years. Like send them out on supervised work orders to pick up rubbish from the streets, scrub public loos and remove graffiti.
Re:Serious crime? (Score:4, Insightful)
"It's stopped now, isn't it?"
Is it, though?
How long will it stay 'stopped' if these guys are let out with a slap on the wrist? You don't think they'll just go right back to 'work'? What about deterrence of other 'would-be' identity thieves?
If someone is offered a 'gamble' with two possible outcomes, one of which is gaining something, and the other of which is just remaining at the same point (that is, no net gain or loss), then it is *irrational* not to participate in the gamble. Now, of course, we have this concept in human society called 'ethics' where we say that you shouldn't do something which hurts someone else, even if it profits you, but these guys have already shown that *they have no ethics*.
Some number of people will always ignore ethical 'rules', and for those people, you must fall back to simple, rational, economics. In this case, economics doesn't translate directly to money, but rather to the idea of incentives/disincentives.
Of course, some of those people will still gamble - even if their is a substantial risk of loss, because with online identity theft, fraud, etc, there is always the possibility of a very large payout, just like with drug dealing - you might wind up in jail, or full of bullets, or you might wind up rich. But, at least there is enough possibility of very negative consequences to put most people off from drug dealing.
Seems to me it's the same with cyber-fraud. Make sure there is the possibility of *very* negative consequences, to make it rational for people to avoid the gamble, even though they do have the possibility of becoming rich.
Plus, there is plain, simple justice - even if there is no deterrent effect, most of us feel that when someone decides to throw ethics by the wayside, and hurt others, there should be some kind of price to pay.
Re:And prison SHOULDN'T be used for non-violent cr (Score:5, Insightful)
Great, how does that help against spammers? They can compute from anywhere.
Unless you pile on so much community service that they can't do anything else than the punishment is far too lacking. You might as well put them in jail since you'll have to support them anyway in order to pile on enough community service to justify letting them off with only it based on their crime.
What paycheck? They are spammers, they don't work day jobs and they will just do something under the table if you garnish their wages.
No, you seem to not realize that people need to be punished to deter future crime of this type. None of the things you listed would even slow a spammer down. What you propose is to slap them on the wrist and let them go to do it again.
These people have taken advantage of millions of PCs, they have essentially burglerized millions of homes, not physically but electronically. They have cost hundreds of millions of dollars to others that they can't pay back in their life time. They've made and stuffed away in various places massive amounts of money for themselves that will never go back to who it was stolen from.
And you want to 'fine them' ... great, lets treat spammers like we treat CEOs, brilliant fucking idea.
Re:And prison SHOULDN'T be used for non-violent cr (Score:2, Insightful)
There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.
And, if the activity is still profitable and possible, they will continue doing it and chalk it up as a cost of doing business.
Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.
People also die from old age, but I wouldn't call aging 'violent'. 15,000 people died to criminal negligence. (It's the Bhopal disaster, in case you were curious where I came up with that scenario). It wasn't violence, it wasn't force, it wasn't intended... it was sheer greed and stupidity that led to dangerous corners being cut, leading to a major accident. Jail is more than justified.
Yea, so there's the Car thing. I think car thieves suck, but again, it's just property. Locking someone up for decades doesn't seem to make any sense to me.
Nice straw man, there. Show me where a car thief gets 'decades' in prison, and you might have a point. The usual sentence depends on jurisdiction, but even the harsher states it is only 5-10 years, and that's a "5 years, get out in two with good behavior" scenario.
You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..
Nice second straw man... Where did I say that? Please, show me, I'd love to see where I even IMPLIED that. What I said is that there are non-violent crimes which deserve prison time... because the activities are detrimental towards society as a whole, and alternative punishments generally are not disincentive enough to deter somebody. I'm not advocating the death penalty, here, I'm saying that if somebody harms society through their actions, a prison sentence which will deter the activity and not simply be written off as 'cost of doing business', prison is a reasonable punishment. I then proceeded on this premise to list some examples of why I feel this way.
If you want to argue this with straw men, however, I'm sure I can come up with some doozies.
Re:Serious crime? (Score:3, Insightful)
Or in the case of a murder: "She's dead now, why prosecute?"
Nice logic.
Not getting it, are we? (Score:4, Insightful)
The problem is that most of the world has a very simple disconnect between "stuff on computers" and "stuff that affects them". These folks did nothing to anyone that isn't using a computer. Therefore, for most of the population of the world there was zero impact. Nothing. No difference.
Now, for a very small minority of people (a few millions out of 6 billion) these people caused trouble. In no way does this justify in the minds of the rest of the population of the world that there should be any laws against what they did.
For example, if you go outside your house and step on some ants I am sure the ants being stepped on would like there to be a law against stepping on ants. The rest of the ant population wasn't affected and neither was the rest of the human population. So there are no laws against stepping on ants, even if to the ants being stepped on it is a huge life-ending tragedy.
So for these guys they affected some computer users in a mysterious place outside of the real world. Good luck with convincing anyone that this is all that important.
In the US you don't get any law enforcement attention until you cause provable damages in excess of $25,000. And if you participate in the "crime" by giving away your password through some trojan program the other person isn't going to be taking all the punishment for stealing from you.
Face it, you live in a different world than most people. They don't understand your world and you don't understand why yours isn't important to them.
Re:And prison SHOULDN'T be used for non-violent cr (Score:3, Insightful)
It. Doesn't. Work.
You are simplifying my argument to hold up yours and that's weak, real weak.
Re:Not a menace to society? (Score:2, Insightful)
Re:And prison SHOULDN'T be used for non-violent cr (Score:1, Insightful)
Because get rich quick is not a sociopathic behavior, no matter how you see it, so should be dealt with differently. Following your line of reasoning, every crime no matter how small or large should be treated the same, throw them in jail.
Hijacking somebody's computer, and using its resources for yourself, however IS sociopathic: You are taking something which does not belong to you, and knowing it is wrong you do it anyway. To hell with the spam, I'm talking purely about the botnet here. There are plenty of 'legal' ways to spam, there are no legal (or moral, or ethical) ways of creating a botnet of zombies. As somebody else in this thread said, "Prison is meant to protect society from the people being imprisoned as well as serving as punishment and deterrent. If there is no need to protect society (or conversely, protect them from revenge/vigilante attacks) then seeking other forms of punishment that are less costly seems to me to be a good idea.", And I agree with that completely. However, what constitutes a 'need to protect society', is what we're differing on.
Re:And prison SHOULDN'T be used for non-violent cr (Score:5, Insightful)
"And yet another person claiming prison is a deterant. It's NOT. No criminal thinks they are going to get caught. It doesn't deter anything."
If a criminal is in prison, they are effectively prevented from committing further crimes, except maybe against their fellow convincts. Keeping habitual offenders away from the civilian population is a pretty good deterrant.