FC: Israeli teens reportedly indicted for Goner worm

[Declan McCullagh <declan () well com>]

Previous Politech message:
http://www.politechbot.com/p-03728.html

---

From: =?windows-1255?Q?=E2=EC_=EE=E5=F8?= <GAL-MO () y-i co il>
To: "'declan () well com'" <declan () well com>
Subject: Goner worm suspects indicted in Israel
Date: Mon, 5 Aug 2002 18:20:34 +0200

Hi Declan,
Thought you might be interested.
The following article was published in Ynet, Israel’s news portal
http://www.ynet.co.il/articles/0,7340,L-2041436,00.html


Goner worm suspects indicted in Israel

By Gal Mor, Ynet

The State Attorney’s Office in the Northern District of Israeli has 
indicted 5 Israeli teenagers for creating and distributing the Goner Virus 
late last year. The five partners live in the city of Naharia, located in 
northern Israel. All of them are under 18, and therefore this case is 
heading to Juvenile Court.

According to the indictment, one of the teens created Goner, based on the 
Melissa virus, on December 2001. He asked four of his friends to distribute 
the virus in Israeli web sites. The four partners published copies of the 
virus as attachments to postings on discussion groups. Many unsuspecting 
users who thought the virus was an innocent screen saver downloaded it and 
helped, unintentionally, to distribute Goner.

Three of the partners tried to eliminate evidence from their computers 
after they learned that Goner has wide spread all over the Internet.

The five partners are charged primary by violating chapter 6 of the Israeli 
computer law:

“6. A computer virus
A person who writes a software program in such a manner that it is capable 
of causing damage or disruption to an unspecified computer or computer 
material in order to cause unlawful damage or disruption to a computer or 
computer material, specified or unspecified, is liable to imprisonment for 
a period of three years.
(b) A person who conveys to another, or who infiltrates another's computer 
with, a software program that is capable of causing damage or disruption as 
stipulated in Subsection (a), in order to cause unlawful damage or 
disruption as aforesaid, is liable to imprisonment for a period of five years.”



Regards,

Gal Mor

Computers and Internet correspondent

Ynet

www.ynet.co.il

Tel: 056-400-405

---

Date: Tue, 06 Aug 2002 04:49:52 +0200
From: "BoazGuttmanAdv." <bg10 () bezeqint net>
Organization: B.GRG Ltd.
To: Declan <declan () well com>
Subject: Goner Virus Indictment Formal Release

Hi Declan
Goner Virus Indictment Release
I had to wait till today to the formal release.Now the Indictment is ready 
to download here in pdf.1.2 MB.The reason - I did not reach the Prosecutor 
of the case Yehiel Lifshiz Adv. today,Maby he is tired from the long flight 
from US...I asked him for a word version.In any case page by page English 
Translation will be soon in our site in the same place.He is also in this 
mailing list.What I must to note that 10 persons in the witness list from 
1-10 are all the Israeli National Cyber Crime Section.The 11th Investigator 
Koby Forlighter - Interpol Training Graduate was on holiday in the day of 
operation.Part of you can find in this list part of Investigators you know 
abroad.Like Ohad Genis FBI graduate.Eyal Sharon the Intelligence Cyber 
Crime Officer that got the information during our meeting in Comdex to his 
cell from somebody in a Chat.Witness no.17is from the American Company 
mentioned in the Charge Shett.Thats Dennis Woolbert,Chief Executive Officer 
of Phoenix Consultants Group in NJ.As I said before nothing to do with FBI 
assistance or request in this case.From the begining till the 
end...Israelis made...All the partialy past publictions in US media concern 
FBI or trace from US needless to say without basis at all.We say here - 
"every body was on Altelena..."(every body was on the Menahem Begins Arms 
Ship in 1948....).
Goner Virus Indictment Hebrew Download from my urls here :
http://www.bgrg.co.il/348.pdf
http://www.4law.co.il/348.pdf
http://www.ruppin.ac.il/upload/1068/GonerIshum.pdf
The news today afternoon in Israeli Biggest Portal(Hebrew):
http://news.walla.co.il/ts.cgi?tsscript=item&path=&amp;id=264331
They made a direct link to our cyber crimes page in the end of the news 
this one:
http://www.bgrg.co.il/6.html
The Hebrew Haaretz:
http://www.haaretz.co.il/hasite/pages/ShArt.jhtml?itemNo=194433+
The English Haaretz this morning:
http://www.haaretzdaily.com/hasen/pages/ShArt.jhtml?itemNo=194489&contrassID=2&amp;subContrassID=1&amp;sbSubContrassID=0&amp;listSrc=Y 

Summary of the Charge sheet for English readers:5 juvenile.4 from Naharia.1 
from a small village near Haifa.Years of birth.85,86,88.
In Nov. 01 Juvenile 1 edited the virus.He improved the virus.In the second 
part of Nov. he edited the virus from Malissa Virus.He called it GONE.The 
virus was planed so that "she will read" the mailing list in the 
OUTLOOK.Also to enter the ICQ and MIRC.Moreover " in her attributes" the 
virus was planed and made crash of Anti Virus software like Norton,Macfee. 
crash and shut down also Firewall(page 2 section 6 of the charge sheet 
-  b.g.).After that Juvenile 1 edited the GONE he asked his friends 
2,3,4,5, to publish it in various forums in the Internet, so that the 
reciever will think that he gets a screen saver.It was between the end of 
November to the begining of December.the other partners knew that this is a 
virus and juvenile 2,3,4, tried it before.Juvenile 2,published in forum in 
Rotter.net that the GONE is a screen saver and he knew that this is a 
lie.Juvenile 3 in the begining of December 2001 uploaded the virus to the 
Internet address:
http://www.graphics-forum.net/uploads/gone.scr  and published it as a 
screen saver,he also presented a link in the website of FRESH in order that 
others will download it.Juvenile 4 in the begining of December published 
the GONE virus in NANA`s Computer`s forum.Published the link and presented 
himself as a girl while doing this.Juvenile 5(from the village - 
b.g.)published news in Walla & Nana forums that this software is a screen 
saver.He knew its a lie.In steps of their activities damage was made to 
companies and organizations that have computers and networks.So for 
instance  the virus damaged the computers of the consultancy company 
Phoenix Consultants Group,Inc from New Jersy in US lost of time and much 
money.the virus made damage to the computers of Radvision from 
Israel,Saydor from israel,The Herzelia Academic Center,as well as made 
damage to many computers of private users around the globe.In companies and 
organizations like NASA in US and others unknown.After that juvenile 1,4,5, 
knew from publishing in the media and the Internet the amount of the damage 
that  the virus made,they deleted various files from their computers as 
they knew that these files can be used as an evidence in ajudicial trial in 
order to prevent the use of these files as evidence.(page 4 sec.15 - b.g)
The sections they were cahrged:section 6 of the Computer Law here 
(English): http://www.bgrg.co.il/252.pdf
http://www.4law.co.il/252.pdf
destruction of eviedence (section 242 of the penal code ) and obtaining by 
fraud ( section 415 of the penal code ) plus section 29 of the penal code- 
performers together .
PPT (English)of their arrest with evidence were presented in the Magistrate 
Court on December 2001http://www.bgrg.co.il/203.ppt
http://www.4law.co.il/203.ppt
Virus In Israeli Courts till today explanation:
• Generating a computer virus
A person who writes a software program in such a manner that it is capable 
of causing damage or disruption to an unspecified computer or computer 
material in order to cause unlawful damage or disruption to a computer or 
computer material, specified or unspecified, may be imprisoned for three 
years.A person who conveys to another, or who infiltrates another’s 
computer with, a software program that is capable of causing damage or 
disruption as described in the above paragraph, in order to cause unlawful 
damage or disruption as aforesaid, may be imprisoned for five years.This 
offense is deemed to be committed at the preparation stage, even if no harm 
results. Therefore, it is sufficient to show that the perpetrator had an 
intent to damage by the creation of the virus itself, rather than that he 
was successful in causing damage.  Transmitting a computer virus makes this 
offense more serious thereby deserving a more severe penalty.
*Verdicts
The first trial in Israel for the offense of writing or spreading of a 
computer virus resulted in a  Haifa  Magistrate court approved plea 
bargain. The defendant(Gil Paz an RAFAEL Engineer - b.g.) inserted a 
malicious software in a computer of his former employer, REFAEL, Israel’s 
national defense lab. The software was designed to remove different 
computer files and cause a lasting damage to REFAEL’s projects and systems. 
The software also included a command designed to eliminate its own traces 
so that it would be impossible to find it.  Before the software started its 
operation it was discovered by the person who replaced the defendant in the 
computer department, who promptly canceled the command designed to start 
the application of the malicious software.In its 1998 decision, the Haifa 
Magistrate Court confirmed the plea bargain mainly because this was the 
first conviction in Israel for an offense under section 6 of the Law. 
Nevertheless, the Court gave a detailed decision stating that it was 
designed to send a clear and direct message to whomever maliciously uses a 
computer. The Court interpreted section 6 of the Law, titled “A computer 
virus,” as being applicable to different types of “malicious software” 
including “worms,” “logic Bombs,” “Trojan horses,” “viruses,” and “stealth 
viruses.” The Court held that the damage that can result from such software 
programs may cause serious harm since they may destroy computer files that 
contain important information, the retrieval of which may be difficult or 
impossible. This is the reason for the harsh punishment imposed by the law 
on a person who conveys such software to a computer of another. The Court 
held “It is therefore necessary to make it clear to whoever wishes to write 
“malicious software,” to convey it to another computer or to commit another 
malicious use in a computer, that the court will not be lenient with him 
when he is caught...whoever maliciously uses his computer will find himself 
in a place where other people who committed malicious acts are found, 
distanced from his computer and prevented from repeating his malicious 
actions, at least for a specific time.”  Despite of the harsh words, the 
defendant was sentenced to eighteen months incarceration, twelve of which 
are on probation and the rest may be served by public works.
A 2000 decision of the Tel Aviv magistrate court illustrates a stricter 
enforcement of the law which prohibits generating and conveying of computer 
viruses. In the circumstances of that case the defendant(Demitry Grinberg - 
b.g.) had generated a virus which was later conveyed by his soldier 
girlfriend(Tania Birman - b.g.) to fifteen computers in a military base(The 
main signal corps IDF`S base). As a consequence, the computers were 
subjected to a sizeable damage which affected the functioning of the base 
for a period of one month. The girlfriend was sentenced by the military 
court to nine months of actual imprisonment. The defendant, a civilian, was 
sentenced to seven months actual imprisonment and thirteen months 
probation. In its decision the court (Judge Zeharia Caspi,later in the 
Analyzer verdict - b.g.)relied on public interest and the need for 
deterrence as well as punishment for the offense. The court noted that the 
more reliant on computers a society is, the larger the harm done to its 
data when it is deliberately corrupted. The fact that the infected computer 
in this case was a military one, and that the action of creating the virus 
required a deliberate and rational act indicates that the crime was planned 
with real malice. Actual imprisonment was therefore deemed a suitable 
punishment.
The cases referred to above illustrate a trend to impose harsher penalties 
on convicted offenders in the future.
The IDF virus in the base case slide & verdict - English is in this ppt of 
the Intelligence Commanders training of the Police HQ: 
http://www.4law.co.il/304.ppt
http://www.bgrg.co.il/304.ppt
note:
There are another case under pending with a virus case also in Tel Aviv 
Magistrate Court will start in October 2002 the State v. Toni Asadi.In this 
case the man sent false statements in the net concern blast and bombings 
and by the way sent virus to private users.Not so huge damage like this 
case will be open in the Haifa  Juvenile Magistrate Court.The boys just got 
the charge sheet last week by mail.There is another person that was working 
in the security forces network as a contractor that sent trojans to private 
computers he finished his job on the day the police found him.I dont know 
whats going with his case.His file was sent before a long time to the 
District Attorney`s Office.
I think you have now clear picture concern virus etc. concern open courts....
NOTE: for our readers in US:Our website http://www.4Law.co.il was moved 
today to a US server from this evening.The http://www.bgrg.co.il is still 
at Israel.I hope US readers can now better download from the Mirror - 
American server.I think it will help also to visitors from Arab units that 
asked me for ppt`s "with hotmail"...to download free without fear that they 
will hang them as suspect spy ...
Regards
Boaz Guttman Adv.
http://www.4law.co.il
http://www.bgrg.co.il 




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
Declan McCullagh's photographs are at http://www.mccullagh.org/
-------------------------------------------------------------------------
Like Politech? Make a donation here: http://www.politechbot.com/donate/
-------------------------------------------------------------------------