Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Botnet Crime Security IT

Mariposa Botnet Authors Unlikely To See Jail Time 163

krebsonsecurity writes "Three Spanish men were arrested last month for allegedly building an international network of more than 12 million hacked PCs that were used for everything from identity theft to spamming. But according to Spanish authorities and security experts who helped unravel the crime ring, the accused may very well never see the inside of a jail cell even if they are ultimately found guilty, due to insufficient cyber-crime legislation in Spain. 'It is almost impossible to be sent to prison for these kinds of crimes in Spain, where prison is mainly for serious crime cases,' said Captain Cesar Lorenzana, deputy head technology crime division of the Spanish Civil Guard. ... Spain is one of nearly three dozen countries that is a signatory to the Council of Europe's cybercrime treaty, but Spanish legislators have not yet ratified the treaty by passing anti-cybercrime laws that would bring its judicial system in line with the treaty's goals."
This discussion has been archived. No new comments can be posted.

Mariposa Botnet Authors Unlikely To See Jail Time

Comments Filter:
  • by cbreaker ( 561297 ) on Friday March 05, 2010 @12:09PM (#31371910) Journal
    Yes, these people should be punished. But I agree with Spain's prison/court system when they say that prison is for violent crime.

    There's other ways to punish people and have them be productive to society, instead of rotting in prison. Sure, there may be special cases, but for the most part if you're not a physical danger to people then there's no need to keep you separated from the population.
    • Eww, seriously? A criminal roaming free in the streets? They'll corrupt my children... Think of the property values...
      • Re: (Score:2, Funny)

        by MrNaz ( 730548 ) *

        Yea, imagine the exodus from the neighborhood when they know that a spammer moves into the street. You know, coz spammers only cause problems for their neighbors.

        Oh, for the days when fighting spam meant catching the asshole who persisted on ignoring your "no junk mail" sign.

        • Oh, for the days when fighting spam meant catching the asshole who persisted on ignoring your "no junk mail" sign.

          I still get more junk mail in my letterbox than I do junk email.

          Occasionally I do manage to catch the creeps. I live in a cul-de-sac street, so delivery people have to go out the way they come in. So if I do happen to see them shove paper in my mailbox, I accost them as they retrace their steps and make them take it back.
          • I'm not sure how long I've advocated (IIRC I haven't had an original thought in seven or eight years, so...) that bulk mail should be tolled at a higher rate, to subsidize the First Class postage of legitimate mail. Then we adjust the rates up until the flow is choked off, or start adding fees to the bulk rate to pay for stuff like missions to Iraq And definitely jail abusers of our USPS.

          • The problem isn't so much the teenagers/college kids actually delivering the junk - they are part of the problem yes, but the fight should be taken to the source: idiotic advertisers. Door-to-door is wasteful and inefficient.

            Around here, we have a little semi-legit print shop that distributes a take-out/delivery menu quarterly. They get a bunch of local restaurants to submit their menus and flyers, work them into a small laminated leaflet and deliver that within a 10 block radius. I find those exceptiona

    • they need to be separated from the computer poplulation!
    • by Anonymous Coward
      And what of Con men, who will happily pay the fine and go right back out and swindle more people?

      Or people whom, through callous disregard, 15,000 people in Bhopal die from a venting of tonnes of poisonous gas?

      Or somebody who steals cars without the threat of violence?

      None of those are 'violent' crime. And yet I feel that prison is a reasonable punishment for all of them. What makes a botnet different? It's showing the same sociopathic behavior as my other examples, so why should it be special?
      • Re: (Score:1, Insightful)

        by cbreaker ( 561297 )
        You assume, incorrectly, that I mean there should just be a small fine and set them free.

        There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.

        Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.

        Yea, so there's the Car thing. I think car thieves suck
        • by BitZtream ( 692029 ) on Friday March 05, 2010 @01:04PM (#31372568)

          You can strap tracking devices to them, you can restrict their movements

          Great, how does that help against spammers? They can compute from anywhere.

          you can force them to do community service,

          Unless you pile on so much community service that they can't do anything else than the punishment is far too lacking. You might as well put them in jail since you'll have to support them anyway in order to pile on enough community service to justify letting them off with only it based on their crime.

          you can enforce fines to be taken from their paychecks

          What paycheck? They are spammers, they don't work day jobs and they will just do something under the table if you garnish their wages.

          You seem to think that people should be locked up for behaving in a certain way - because that behavior is a "gateway" to other crimes? Such a tired argument..

          No, you seem to not realize that people need to be punished to deter future crime of this type. None of the things you listed would even slow a spammer down. What you propose is to slap them on the wrist and let them go to do it again.

          These people have taken advantage of millions of PCs, they have essentially burglerized millions of homes, not physically but electronically. They have cost hundreds of millions of dollars to others that they can't pay back in their life time. They've made and stuffed away in various places massive amounts of money for themselves that will never go back to who it was stolen from.

          And you want to 'fine them' ... great, lets treat spammers like we treat CEOs, brilliant fucking idea.

          • Re: (Score:3, Insightful)

            by cbreaker ( 561297 )
            And yet another person claiming prison is a deterant. It's NOT. No criminal thinks they are going to get caught. It doesn't deter anything. People still get murdered, people still sell drugs, people still steal cars - even with the MASSIVE sentances given to drug dealers and car thieves.

            It. Doesn't. Work.

            You are simplifying my argument to hold up yours and that's weak, real weak.
            • by moeinvt ( 851793 ) on Friday March 05, 2010 @02:26PM (#31373606)

              "And yet another person claiming prison is a deterant. It's NOT. No criminal thinks they are going to get caught. It doesn't deter anything."

              If a criminal is in prison, they are effectively prevented from committing further crimes, except maybe against their fellow convincts. Keeping habitual offenders away from the civilian population is a pretty good deterrant.

            • That's a total straw man. Just because some people still commit crimes when there are punishments doesn't mean that the punishments aren't deterring anyone. For some people, say those who are starving to death, or those who believe they're invincible, no amount of deterrent will keep them from committing crimes. For the average person, however, I would hypothesize that lengthy prison sentences and the stigma of a criminal record are quite effective deterrents.

              The only way to definitively settle the debate w

          • >"Great, how does that help against spammers?"

            Most of the sort of people who send spam like to go out after curfew. Take that away and they're going to be miserable.

            I think they should tattoo "spammer" on their foreheads too - so people can spit on them in the street.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          There's lots of options for punishing people without dropping them in a prison cell. You can strap tracking devices to them, you can restrict their movements, you can force them to do community service, you can enforce fines to be taken from their paychecks, etc, etc.

          And, if the activity is still profitable and possible, they will continue doing it and chalk it up as a cost of doing business.

          Seems 15,000 people dying from poison gas is pretty violent to me. No? I mean, people died.

          People also die from old age, but I wouldn't call aging 'violent'. 15,000 people died to criminal negligence. (It's the Bhopal disaster, in case you were curious where I came up with that scenario). It wasn't violence, it wasn't force, it wasn't intended... it was sheer greed and stupidity that led to dangerous corners being cut, leading to a major accident. Jail is more than justif

      • Re: (Score:2, Insightful)

        by 0racle ( 667029 )
        The summary said Spain reserved prison for 'serious crime cases.' Depending on how Spain defines 'serious crime' your examples could count and still most spammers wouldn't be eligible for jail, which is still a better situation then in the US. There are other ways to punish people, jail doesn't have to be the only one.

        It's showing the same sociopathic behavior as my other examples, so why should it be special?

        Because get rich quick is not a sociopathic behavior, no matter how you see it, so should be dealt

        • Don't interpret an internet article for the word of law.
        • Theres a difference between my geek rich quick scheme of 'The Pet Rock 2' and breaking into someones house and using their PC without permission to scam millions of other people out of money, likely stealing personal information from the infected machines along the way.

          All crimes are treated as crimes. The level of punishment is adjusted based on the effect of the crime.

          Throwing a soda can on the ground is a crime and comes with a small fine cause its very likely to do anyone any serious damage.

          Throwing 12

    • Yes, these people should be punished. But I agree with Spain's prison/court system when they say that prison is for violent crime. There's other ways to punish people and have them be productive to society, instead of rotting in prison. Sure, there may be special cases, but for the most part if you're not a physical danger to people then there's no need to keep you separated from the population.

      Any effort spent punishing them would be better put towards hardening the targets. If you're interested in the prevention of similar events in the future, that is.

    • Re: (Score:3, Insightful)

      Change that from 'no prison for non-violent criminals' to 'no prison with violent criminals for non-violent criminals' and I think you're on to something. I say lock these guys up for a good stay, even if not in the same prison they keep killers, rapists, and other physically violent criminals in.

      • Better yet, how about solitary confinement for EVERY criminal, violent or otherwise. Isolation from all society, especially peers, gives them a good chance to think about what they did.
        • by Korin43 ( 881732 )
          Yeah, making everyone who ever commits a crime completely insane through years of isolation is a great goal for our justice system..
          • Better than the criminal academy system we have now. What's your alternative?
            • by Korin43 ( 881732 )
              1. Legalize drugs and everything else that there's no reason to make illegal (get rid of 90% of the prison population, keeping largely non-violent people away from real criminals)
              2. Focus on rehabilitating prisoners rather than punishing. Also focus on getting criminals jobs. Right now it's really hard for people with a criminal background to get a job (meaning that their easiest source of income is... more crime!)

              Probably more could be done, but it's a start, and definitely better than "send everyone to priso

                1. Legalize drugs and everything else that there's no reason to make illegal (get rid of 90% of the prison population, keeping largely non-violent people away from real criminals)
                2. Focus on rehabilitating prisoners rather than punishing. Also focus on getting criminals jobs. Right now it's really hard for people with a criminal background to get a job (meaning that their easiest source of income is... more crime!)

                Probably more could be done, but it's a start, and definitely better than "send everyone to prison forever".

                I see no reason that our solutions are mutually exclusive. I agree with what you say here, but I still feel we need to isolate criminals from each other while incarcerated so that they have less opportunity to share information and do not develop a sense of comradery. A big part of our violent crime problem is that prison gangs keep close ties to their outside counterparts. A gang-banger who gets out of prison after 10 years goes right back into his old gang, usually as a hero. Imagine how different it

      • Re: (Score:3, Insightful)

        by Tim C ( 15259 )

        Prison is meant to protect society from the people being imprisoned as well as serving as punishment and deterrent.

        If there is no need to protect society (or conversely, protect them from revenge/vigilante attacks) then seeking other forms of punishment that are less costly seems to me to be a good idea. While someone is in prison not only are they not contributing to society (if only by paying taxes on the things they buy), but society is paying to house and feed them. Why not keep the non-dangerous crimin

        • I don't think that community service and prison time are mutually exclusive. I'm sure prisons can get cheap but adequate nutrition (some spiced up version of nutraloaf for instance) and keep them in a cell of some sort while during the day they can go out and work on community service projects. Guys like this, maybe they can work on something like township (or Spain's equivalent) websites or something.

          • Sure, give a person who commits the computer crime of serving up illegal schemes to the public over the internet access to state computers used for serving content to the public over the internet. There's a brain storm that's sure to have great results.

    • The point of a prison really isn't punishment per-say but a way to keep dangerous people away from the public so they don't hurt others. The Death Penalty should be only used if the person would still be a threat while they are still in prison. (which usually isn't the case even for the most horrible criminals).

      Now for the United states there is this odd rule about Cruel and Unusual Punishment. However it is kinda odd, but it is often a bad detractor for new innovations in justice. Things like castrati

      • by Gonoff ( 88518 )

        There are several points to prison. As well as punishment, there is also rehabilitation of criminals so that they are less likely to repeat their crimes.

        In violent societies, there is also the protection of the criminals from self appointed vigilantes. This is done by giving the criminals a sufficiently unpleasant time that morons feel that they don't need to do anything else.The more advanced the society, the less this is needed.

      • People doing life without parole might not fear anything but the needle almost by definition have nothing to lose by misbehaving in prison.

    • While I'd agree that non-violent crime needs some better for of punishment, the majority seems to think that having someone sit in jail for carrying a bag of pot is acceptable, so should someone that scammed people out of money, clogged inboxes and essentially broke into millions of computers be an even more acceptable jail resident? As long as no one was hurt should people found guilty of breaking and entering, grand theft, larceny and forgery be set free as well? Frankly I think that cybercrimes should

      • I'm not sure how claiming that someone shouldn't go to prison, but pay in other ways, somehow constitutes "blaming the victim."

        And again, you say "should be set free?" No. Try being a part of the discussion. I didn't say set them free. I said that I don't believe non-violent offenders need be sent to prison to rot. I think it's a waste of resource, time, and in the end rarely ever works to correct the behavior of a criminal.

        Monitoring them on the outide, forcing them to work and pay restitution, jo
    • by Jahava ( 946858 )

      Yes, these people should be punished. But I agree with Spain's prison/court system when they say that prison is for violent crime.

      Punishment aside, prison (in this sense) is a method of restricting disruptive peoples' access to society, thus eliminating their ability to disrupt society. These people are certainly disruptive to society. Your argument, therefore, must be that there is a more appropriate method to restrict their access to society besides imprisonment. I agree, in theory, since it is via electronic access, rather than physical access, that they have proven themselves a threat. If you can effectively deny their electronic

    • There's other ways to punish people and have them be productive to society, instead of rotting in prison.

      I am amazed at your thrift and foresight. Instead of rotting in prison, they can be productive to society as fertilizer, rotting outside of prison!

    • Nope no prison for them, just take them out back of the courthouse and put a bullet in each ones head. Simple, done and over with.

      Those people disrupt and financially ruin thousands of peoples lives, fuck em.

  • If Spain is anywhere near as litigious as the US, I could see them facing a rather large class-action lawsuit from the owners of infected computers. But IANAL, and certainly not a Spanish lawyer.
  • ...some extrajudicial punishment is in order.

    Maybe being tossed nakkid into the ring with several pissed off bulls.

    Force them to spend a month solid working closely (close quarters) with Nancy Pelosi.

    Fix it up so that in order to eat and drink, they have to make that browser window that keeps asking, "Are sure you want to leave?", go away by only clicking in the browser window.

    Five thousand hours of Steve Ballmer doing the monkey dance.

    Suggestions welcome.

  • by Anonymous Coward on Friday March 05, 2010 @12:11PM (#31371932)

    Not going to jail over cybercrime isn't ideal, but I'd take this any day over people being fined millions for downloading a few songs off the Internet. Ridiculous penalties for trivial acts are a lot worse than a few cybercrooks being let go with some large fines instead of jail time.

    (Note: downloading music and videos via p2p is legal in Spain)

    • So you offer to fix a horribly broken law by allowing another horribly broken law to exist? Brilliant. Two wrongs do make a right after all!

  • Serious crime? (Score:4, Insightful)

    by NewWorldDan ( 899800 ) <dan@gen-tracker.com> on Friday March 05, 2010 @12:14PM (#31371964) Homepage Journal
    'It is almost impossible to be sent to prison for these kinds of crimes in Spain, where prison is mainly for serious crime cases,'

    Do they grasp the economic impact of these botnets? There may not be any physical violence, but the spam hassels, system cleanup, and DDOS attacks create hundreads of millions of dollars in economic damages. Sure, that's distributed over millions of people, but this sort of macroscopic vandalism is, in fact, a major crime. Throw the book at 'em.
    • Comment removed (Score:4, Insightful)

      by account_deleted ( 4530225 ) on Friday March 05, 2010 @12:20PM (#31372040)
      Comment removed based on user account deletion
      • Re:Serious crime? (Score:4, Insightful)

        by JSBiff ( 87824 ) on Friday March 05, 2010 @01:00PM (#31372534) Journal

        "It's stopped now, isn't it?"

        Is it, though?

        How long will it stay 'stopped' if these guys are let out with a slap on the wrist? You don't think they'll just go right back to 'work'? What about deterrence of other 'would-be' identity thieves?

        If someone is offered a 'gamble' with two possible outcomes, one of which is gaining something, and the other of which is just remaining at the same point (that is, no net gain or loss), then it is *irrational* not to participate in the gamble. Now, of course, we have this concept in human society called 'ethics' where we say that you shouldn't do something which hurts someone else, even if it profits you, but these guys have already shown that *they have no ethics*.

        Some number of people will always ignore ethical 'rules', and for those people, you must fall back to simple, rational, economics. In this case, economics doesn't translate directly to money, but rather to the idea of incentives/disincentives.

        Of course, some of those people will still gamble - even if their is a substantial risk of loss, because with online identity theft, fraud, etc, there is always the possibility of a very large payout, just like with drug dealing - you might wind up in jail, or full of bullets, or you might wind up rich. But, at least there is enough possibility of very negative consequences to put most people off from drug dealing.

        Seems to me it's the same with cyber-fraud. Make sure there is the possibility of *very* negative consequences, to make it rational for people to avoid the gamble, even though they do have the possibility of becoming rich.

        Plus, there is plain, simple justice - even if there is no deterrent effect, most of us feel that when someone decides to throw ethics by the wayside, and hurt others, there should be some kind of price to pay.

      • Re: (Score:3, Insightful)

        by MikeBabcock ( 65886 )

        Or in the case of a murder: "She's dead now, why prosecute?"

        Nice logic.

      • Ah, so just let them go ... because they won't just do it again in a couple of weeks or anything. Or they won't just go reactivate the botnet with a new control hub or anything ...

        Are you retarded?

    • by thomst ( 1640045 )

      Do they grasp the economic impact of these botnets? There may not be any physical violence, but the spam hassels, system cleanup, and DDOS attacks create hundreads of millions of dollars in economic damages. Sure, that's distributed over millions of people, but this sort of macroscopic vandalism is, in fact, a major crime. Throw the book at 'em.

      Which part of

      "Spain is one of nearly three dozen countries that is a signatory to the Council of Europe's cybercrime treaty, but Spanish legislators have not yet ratified the treaty by passing anti-cybercrime laws that would bring its judicial system in line with the treaty's goals,"

      was unclear to you?

      They can't "throw the book at 'em", because there is no "book". What they've done is not a crime under Spanish law.

      What needs to happen is that some country that has an extradition treaty with Spain (and that has laws against computer intrusion, etc.) needs to bring charges against them and request their extradition for prosecution under those laws.

      Disclaimer: IANAL. And, most likely, neither are you.

  • Gotta admit (Score:5, Funny)

    by zapakh ( 1256518 ) on Friday March 05, 2010 @12:15PM (#31371988)
    I was expecting the Spanish Inquisition.
    • Re: (Score:2, Funny)

      by idontgno ( 624372 )

      Well there's the problem.

      No one's supposed to expect the Spanish Inquisition. That's probably the best Inquisition repellent there is: the focused expectation of Inquisition. You have to drop your guard first.

  • Every time I see this I think Marisa Bot. Which is totally possible because she was a complete bitch.

    • by EdZ ( 755139 )
      Well, it I DID steal the precious [personal identifying information].

      Yeah, I couldn't think of a way to make that joke flow properly, so I'm crowdsourcing my humor.
      • by moeinvt ( 851793 )

        "Well, it I DID steal the precious"

        Curse you! We hates you!

        • by EdZ ( 755139 )
          Darn Slashdot's lack of an edit function (additional damnations to Firefox's lack of a grammar checker, and the inability of the human brain to operate correctly with minimal sleep).
  • Aren't things such as fraud serious crimes in Spain? Or could they be extradited?

  • Pack your bags, kids, we are moving to Spain!
  • I am not a lawyer. But my best friend is. And sometimes I ask him questions about the law, how it is applied, and so on. This gives me a better understanding of how it really works, whether I agree with that or not. This should not be a problem that there are no cyber crime specific laws. There should be existing laws that cover crime and one would hope that Spain's laws aren't so weak that those don't apply. Really, are we supposed to believe that Spanish authorities are honestly going to say "Sur
    • by MozeeToby ( 1163751 ) on Friday March 05, 2010 @12:42PM (#31372332)

      You didn't really undestand the summary. Prison's in Spain are for those who are a physical danger to society. Conning someone out of their money wouldn't land you in jail either, nor would pickpocketing or unnarmed theft. They are non-violent offenders, and there are certainly punishments for those kinds of offenders, it's just that they don't generally involve prison time.

    • by Alinabi ( 464689 )
      Logic [wikipedia.org]. Read it. Live it.
    • Re: (Score:3, Informative)

      by horza ( 87255 )

      That's a poor analogy. They have laws against fraud. The article says it will take longer to gather evidence and proof of wrong-doing to put them in jail, rather than being able to short-cut and just tie them to a bunch of hacked IP addresses to put them in the slammer. If you bash somebody with an object, it's pretty easy to identify the victim and get prints off the object. The article implies that the digital forensics in this instance is hard work.

      Maybe a better analogy is gun or knife control. In the U

      • by rsborg ( 111459 )

        A botnet, ignoring abusing somebody else's resources, could in theory be used to try and find a cure for cancer. In practice it will probably be used by spammers.

        You could say the same of any organized group of resources, controlled by a small group of people (or a person). Society generally tends to be very wary of this, as they may be used for good (companies,political parties,manufacturing facilities) or evil (rogue militias,gangs,botnets)... in either case, the control mechanism is that there is auditi

  • Ok, I can understand having muddy rules where the operation of a botnet is concerned, but what I do not understand is how they can get away with launching that DDOS attack. Shouldn't that be like large scale vandalism or something? Hard to imagine them getting away scott free.
  • Extradition (Score:5, Insightful)

    by jbeaupre ( 752124 ) on Friday March 05, 2010 @12:29PM (#31372176)
    Unless all 12 million pcs were in Spain, they should qualify for extradition. Most likely another EU country, but also the US. Heck, Spain could just shop these guys around if they really want to maximize the pain to these guys.
    • Unless all 12 million pcs were in Spain, they should qualify for extradition. Most likely another EU country, but also the US

      Sure, we will sent you then as soon as you send us those CIA kidnappers that ran away from Italy under US protection.

  • by cdrguru ( 88047 ) on Friday March 05, 2010 @01:38PM (#31372974) Homepage

    The problem is that most of the world has a very simple disconnect between "stuff on computers" and "stuff that affects them". These folks did nothing to anyone that isn't using a computer. Therefore, for most of the population of the world there was zero impact. Nothing. No difference.

    Now, for a very small minority of people (a few millions out of 6 billion) these people caused trouble. In no way does this justify in the minds of the rest of the population of the world that there should be any laws against what they did.

    For example, if you go outside your house and step on some ants I am sure the ants being stepped on would like there to be a law against stepping on ants. The rest of the ant population wasn't affected and neither was the rest of the human population. So there are no laws against stepping on ants, even if to the ants being stepped on it is a huge life-ending tragedy.

    So for these guys they affected some computer users in a mysterious place outside of the real world. Good luck with convincing anyone that this is all that important.

    In the US you don't get any law enforcement attention until you cause provable damages in excess of $25,000. And if you participate in the "crime" by giving away your password through some trojan program the other person isn't going to be taking all the punishment for stealing from you.

    Face it, you live in a different world than most people. They don't understand your world and you don't understand why yours isn't important to them.

    • Also, the ants aren't actually strong enough to do a damned thing about it, since only people laws can restrain people.

      Ants are scum, they have no value to humans, so it is not illegal to torture them or even kill them. In fact, we PAY people to get rid of them. It will never be illegal to hurt them, simply because they have no apparent value to humans. This, btw, is why it usually IS illegal to hurt bigger animals, like cute puppies and cute kittens.

      There are powerful people that get away with squashing

  • There aren't privacy laws that they can nail them with?

  • "insufficient cyber-crime legislation" -- Money was obviously stoled from people's bank accounts, shouldn't that be sufficient to prosecute the thiefs?
  • Extradite them to the US and put them on trial here for crimes they've committed on US based PC's.

    After they've served their time here, send them to the next country where they've committed crime for a new trial there.

  • Unless every single one of those computer's is physically in Spain, couldn't they be extradited? Or does Spanish law make that hard/impossible?

I have hardly ever known a mathematician who was capable of reasoning. -- Plato

Working...