Hacker sentencing

[David Farber <farber () central cis upenn edu>]

The following appeared on Newsbytes, a commerical copyrighted
international news service on July 29th. It is reposted here with the
express consent of the author (This notice must accompany any subsequent
re-postings which I am authorizing here)

========================================================================
(EDITORIAL) (GOVERN) (NYC)
Reflections On Hacker Sentencing 07/29/93
NEW YORK, NEW YORK, U.S.A.(NB) 072993 --  I sat in federal court 
this week and watched two young men be sentenced to prison. It was not a 
pleasant experience.

The young men, Ellias Ladopoulos, known in the hacker world as "Acid 
Phreak", and Paul Stira, a/k/a "Scorpion", were each sentenced to six 
months imprisonment, six months home detention, seven hundred fifty 
hours of community service, and $50 assessment charge for conspiracy to 
commit computer crimes. Both had pled guilty on March 17th on this 
charge so there was not a question of guilt or innocence.

The six months imprisonment also does not seem draconian -- six months 
doesn't seem very long unless you happen to be the one serving it. Time is 
extremely relative as I found out when I spent five years at Fort Sill, 
Oklahoma between January 1963 and April 1963. It is safe to say that these 
young men will find the six months loss of freedom to be a very long 
period.

The penalty, however, may be reasonable. It is certainly well within the 
sentencing guidelines for the infraction (The maximum sentence quoted for 
the crime pled to is five years in prison and a $250,000 fine).

If I think that the sentencing may be just, or at least defensible, then
what is the problem? Well, first, I have known the young men for over
three years and like them both. I would have preferred that they not go to
prison. I also personally feel that Stira never should have been a part of
the indictment; a view shared by some law enforcement folks that I have
spoken to (he is only mentioned in the papers twice and any illegal
activities seeming stopped in January 1990; the activities enumerated
involved possesion a "trap door" program and a list of user passwords to
systems). 

I recognize that is a personal feeling and that all people want their
friends not to bear hardship. Some place Ted Bundy probably had a friend
who wanted him loose and running around. 

Another problem relates to the procedures that got the defendants to the
sentence. Stira and Ladopoulos (along with Mark Abene a/k/a "Phiber Optik")
 were the subjects of a search and seizure by Secret Service agents in
January 1990. Stira and Ladopoulos' fate then languished until July 1992
when they were indicted along with Abene and two new players, John Lee
a/k/a "Corrupt" and Julio Fernandez a/k/a "Outlaw", on conspiracy to
commit computer crimes. 

During the over three years that have gone by, Stira and Ladopoulos have 
undergone changes. They are both college students -- Stira would have 
graduated had his college not pulled his computer account when he pled 
guilty; an action which prevented him from completing his last course 
requirement.

Both have performed community service through contacts provided by 
Robert Ambrose, a director of the New York Amateur Computer Club 
(NYACC). Ladopoulos is employed by a major New York broadcasting 
company and has impressed his employer to the extent that the employer 
wrote a letter to the judge, asking for leniency, and came to the sentencing.

Ladopoulos' attorney, Scott Tulman, speaking at the hearing, said "He goes 
to school, works and donates time to working with the handicapped, 
teaching them to use computers. He acknowledges his culpability and has 
been attempting to atone for it. His probation officer noted his sincere 
efforts to rehabilitate himself. The stupid young person, 'Acid Phreak', 
who was involved with other person's computers no longer exists. It is 
Elias Ladopoulos who will be sentenced and that will cause a hardship to 
his family."

There are those who may say "It doesn't matter how long ago they did
something wrong. They did it and they have to pay the piper." They may
well be right in some cases but these are not past serial killers; they
are two young men who have been under tremendous pressure for a
substantial part of their lives (3 years out of 21 is significant) since
the indictment.  Perhaps that should have been considered sufficient
punishment. 

There is, further, an overriding problem. From day 1 of the case, the
judge, Richard Owen, showed a complete lack of understanding of the
technology related to the case. At the initial scheduling meeting, then-
Assistant US Attorney Steve Fishbein pointed out that the discovery
process might take a long time as the government had intercepted over "50
megabytes" of electronic evidence. The judge asked what a megabyte was
and, when told it was a million characters, seemed to look rather panicked
when he said "You're not going to show all that to a jury are you?"
Fishbein assured him that he would not. 

It seemed obvious to those of us in attendance that Judge Owen had visions 
of 50 million pieces of paper being delivered to a jury. He was 
understandably concerned.

That was only day one and a federal judge may not be computer literate at
the start of such a case. That would certainly be a lot to expect. One
might expect, however, that, a year later, at the conclusion of the case,
knowledge would have been acquired. Sadly, that did not seem to be the
case. 

One of the charges made against Stira and Ladopoulos (and Abene) was 
that they both pulled a prank and caused damage to a computer system 
belong to WNET, the PBS television channel in New York. While Stira and 
Ladopoulos admitted being on the system, both deny causing any damage 
(it is a common belief that another hacker, known for malicious actions, 
left unindicted by the federal government because of his age, knowingly 
committed the damage). A major part of the sentencing dialogue between 
Ladopoulos and Judge Owen had to do with this incident. Newsbytes 
reported it this way:

"In response to questions from Judge Owen concerning his involvement with
the damage to the WNET system, Ladopoulous said 'Another hacker whose name
I have already provided to the government was the one who took the system
down. When I saw the problem, I called the station and left my own phone
number and offered to help. If I had caused the damage, I would not have
done that. The person who caused the damage is a very deranged person.'

"Owen said that he could not believe that it was merely a coincidence that 
the damage was done to the WNET system in the same time frame that 
Ladopoulous was on the system. Ladopoulous replied by saying that the 
system log showed that he was off the system when the damage occurred. A 
discussion followed on the entire incident."

The discussion actually had knowledgeable persons in the court room
shaking their heads. The judge didn't understand. He said that there was
too much work for this mysterious hacker to have done to copy messages
from Ladopoulous, add destructive material to it and shut down the system
all on the same day -- just too much typing. Ladopoulous tried to explain
about capture routines, editors, etc. and then, seeming to realize the
futility of it, just gave up. 

Speaking later to Newsbytes about the experience, Ladopoulous said "It was 
terribly frustrating. The judge just didn't understand about WNET. I tried 
to explain that I did not damage the system but he didn't understand."

Now it certainly is not clear that the judge based his sentencing on the 
WNET episode. He may not have -- at John Lee's sentencing, the same 
judge mentioned that evidence showed that Lee had insulted someone's 
mother on the net. One suspects and hopes that this social transgression 
played no part in Lee's year-and-a-day sentence; there were, after all, 
substantive charges against Lee.

We will never know whether or how much this misunderstanding influenced
the sentence -- and it is a light sentence under the guidelines. So,
perhaps, no harm was done. 

No harm? Not quite! At a minimum, the dialogue shook the confidence of
everyone in the room about the sentence. Perhaps the prosecution was
satisfied because the defendants were being punished for their illegal
acts -- perhaps the defense took it in stride because of the relative
lightness of the sentence -- perhaps it was a good sentence. However, any
one with an understanding of computers and telecommunications had to feel
that the judge had no grasp of these issues. 

So what happens next? Organizations like the Electronic Frontier
Foundation (EFF), the Society for Electronic Access (SEA), and Computer
Professionals for Social Responsibility (CPSR) are trying to close the
knowledge gap between public officials and technologists. Congress is
holding hearings on technology issues. There is recognition at the
national level on the importance of understanding the changes that the
telecommunications revolution has brought. 

Progress may be made. I hope so. Can you imagine if it were your case -- 
or that of a member of your family being sentencing? Scary, isn't it?

John F. McMullen/19930729)


John F. McMullen           mcmullen () mindvox phantom com    Consultant,
knxd@maristb.bitnet        mcmullen () well sf ca us            Writer,
70210.172 () compuserve com   mcmullen () panix com                 Student,
GEnie - nb.nyc             mcmullen () eff org                     Teacher