Melissa virus creator pleads guilty

A computer programmer admitted on Thursday that he created and distributed the "Melissa" virus which caused millions of dollars' worth of damage and disrupted email systems worldwide.

In two separate hearings, David Smith pleaded guilty to charges of computer theft by the State of New Jersey, and later to a US Federal charge of sending out a damaging computer program. In the Federal plea, both sides agreed that the damage amounted to more than $80 million.

Smith, who is one of the first people to be prosecuted for creating a computer virus, read the following statement in court: "I did not expect or anticipate the amount of damage that took place...I had no idea there would be such profound consequences to others."

But John Farmer, the New Jersey Attorney General, said: "These crimes are not victimless crimes. This is not a joke."

The court tentatively set the date of 18 February next year for sentencing under the state charge, and 15 May for the federal one. Smith faces a maximum of five years in prison and a $250,000 fine in federal court, while a state conviction carries a maximum sentence of 10 years in prison and a possible $150,000 fine.

Melissa was considered a particularly serious virus due to the speed at which it spread, mailing itself to the first 50 email addresses listed in users' address books held on infected systems. This lead to a mass emailing of the virus round the world.

Graham Cluley, senior technology consultant for Sophos Antivirus, said: "It was one of the biggest events in the computer business," adding that the International Computer Security Association (ICSA) estimated Melissa caused more than $385 million worth of damage to businesses in North America.

"A number of companies, including Microsoft, shut down their email servers because of the email storm or hurricane," he added.

Cluley said that while most virus writers were teenagers, Smith was a 31 year old programmer so could not use the excuse that he did not understand what he was doing. But, he added, a strong message needed to go out to the industry because the work of a virus was never undone.

"It still continues and you can never put the genie back in the bottle. Most of these people have not thought through the ethics of what they've done. This will be a landmark case," he said.