Script kiddies beware: The long arm of U.S. jurisdiction to prescribe

Washington and Lee Law Review, Fall 2002 by Eisinger, John

I. Introduction

On Friday, March 26, 1999, a computer virus shut down computer networks across the United States and around the world.1 The virus, dubbed "W97M.Melissa.A" by the anti-virus industry and "Melissa" by the media, came in the form of an E-mail attachment written in Visual Basic Script (VBS).2 When opened, the virus executed a string of commands and E-mailed itself to the first 50 people in the user's Microsoft Outlook address book.3 The virus set off a chain reaction that flooded the E-mail systems of many large companies and forced them to shut down their Internet gateways and mail systems.4 Not since university student Robert Morris released the "Internet Worm" in 19885 had the Internet been so paralyzed by a program gone awry.6 Within a week, nearly two dozen copycat versions of Melissa infected computers on the Internet.7

On Thursday, May 4, 2000, a computer virus shut down computer networks across the United States and around the world.8 The virus, dubbed "VBS.Love Letter" by the anti-virus industry and the "iloveyou" virus by the media, typically came in the form of an E-mail attachment written in VBS.9 When opened, the virus executed a string of commands that deleted files, infected Internet Relay Chat (IRC), attempted to steal passwords, and E-mailed a copy of the virus to everyone in the user's Microsoft Outlook address book.10 The virus set off a chain reaction that flooded the E-mail systems of many large companies and forced them to shut down their Internet gateways and mail systems.11 Within a year, over eighty variants of the iloveyou virus existed.12

Although these two virus outbreaks seem quite similar, the legal consequences for the two men who authored and distributed the viruses were very different.13 Authorities arrested New Jersey resident David Smith, the creator and distributor of Melissa, within a week of Melissa's release and charged him with interruption of public communications, conspiracy, theft of computer service, and wrongful access to computer systems.14 He faced forty years in prison and $480,000 in fines.15 Smith pleaded guilty to a violation of the computer fraud statute and admitted causing damages in excess of $80 million.16

The Philippine government could not directly charge Manila, Philippines resident Onel de Guzman for his role in creating and distributing the iloveyou virus because the Philippines criminal code did not prohibit computer crimes.17 Instead, the government charged de Guzman with the traditional crimes of theft and credit card fraud in connection with the virus.18 However, in August 2000, the Philippine government dropped all charges due to a lack of evidence of a non-computer crime.19 The virus caused worldwide damages estimated at $10 billion.20

The primary federal computer crime statute, the Computer Abuse Amendments Act of 199421 (1994 Act), makes it illegal to damage data on a computer,22 defraud others,23 or steal information electronically.24 However, Smith's virus did very little real damage to files; Melissa only infected documents and occasionally added some text to infected documents.25 In addition, the Melissa virus did not attempt to defraud people or steal information.26 Moreover, Smith attempted to limit the spread of Melissa by only sending E-mail to "the first 50 entries out of the address books . . . [and by] only running once per system boot."27

Unlike Smith, de Guzman intentionally caused damage and destroyed files.28 He used his virus in an attempt to defraud people and steal passwords.29 While Smith evinced surprise at the rapid spread of Melissa,30 de Guzman used the same method for spreading his virus and therefore cannot claim ignorance of the potential worldwide distribution of iloveyou.31

Why did Smith face forty years in prison while de Guzman was not even charged with a crime in the United States? It appears that de Guzman went out of his way to create a virus that could rapidly propagate itself around the world and that would damage, defraud, and steal.32 Why did de Guzman get away without charges in the United States, whereas Smith was charged and convicted for a much less damaging virus? The answer to this question lies in international law concepts that restrict the jurisdiction of states based on the nationality and residence of the person who commits the crime.33

This Note examines how the United States can use its jurisdiction to prescribe laws in order to prohibit foreign nationals from releasing viruses that affect domestic computers, even if their actions occur on foreign soil. Part II of this Note outlines the basic tenets of international law, including the sources from which international law derives.34 Part III discusses various methods by which the United States can exert jurisdiction to prescribe its laws extraterritorially.35 Those methods include the effects principle,36 the protective principle,37 passive personality,38 and universal jurisdiction.39 Part IV examines the reasonableness of exerting jurisdiction in computer virus cases40 and whether or not Congress meant the 1994 Act to apply extraterritorially.41