The teen creator of the “Sasser” Internet worm, which caused millions of dollars in damage worldwide, won’t be going to jail despite his conviction Friday on charges including computer sabotage.
Sven Jaschan, 19, who was fingered with the help of reward money from Microsoft Corp., instead got a 21-month suspended sentence and was ordered to do community service, court spokeswoman Katharina Kruetzfeld said.
Jaschan could have been sentenced to up to five years in prison. But, because he was a minor when arrested, prosecutors had only sought a two-year suspended sentence.
“Sven Jaschan avoided a jail sentence by the skin of his teeth because he was arrested within days of his 18th birthday,” said Graham Cluley, senior technology consultant for anti-virus vendor Sophos PLC. “In many ways, Sven Jaschan was lucky that the police caught him when they did.”
Virus writers have received sentences reduced before because of their age, though an American teenager who created a version of the 2003 “Blaster” worm was sentenced to 18 months in prison. Jeffrey Lee Parson, 19, of Hopkins, Minn., had faced a maximum penalty of 10 years in prison and a $250,000 fine.
Following the conviction Friday, Microsoft said two people who had helped identify Jaschan would share a $250,000 reward, the first bounty to be paid under its $5 million reward program.
Nancy Anderson, Microsoft’s vice president and deputy general counsel, said the company was not disappointed that Jaschan won’t go to prison. (MSNBC is a Microsoft - NBC joint venture.)
The German court, which tried Jaschan behind closed doors because of his age at the time of the offense, said in its ruling that he “acted out of a need for recognition” and not for commercial aims.
Following a four-day trial in this northwestern city, it ordered him to perform 30 hours of community service at a hospital or home for the elderly but did not order him to pay court costs.
Defense lawyer Jens Moewe said Jaschan had not profited from his actions despite being paid for an interview last year by a German magazine. Moewe said four civil suits against Jaschan involving sums of less than $6,000 each have been concluded, and proceedings are underway in a few others.
Jaschan had admitted creating the worm, confessing to authorities at the time of his arrest in May 2004 about a week after he released the worm in what he told investigators was an attempt to eradicate several malicious Internet worms.
Sasser exploited a flaw in Microsoft’s Windows 2000 and Windows XP operating systems, and though it did not cause permanent damage it prompted some computers to continually crash and reboot, apparently the result of bad programming.
Sasser snarled hundreds of thousands of computers, hitting one-third of Taiwan’s post office branches, delaying 20 British Airways flights and forcing British coast guard stations to use pen and paper for charts normally generated by computer. German prosecutors said damages ran into the millions of dollars.
Jaschan was arrested at his family’s home after Microsoft received a tip from an informant seeking a reward, though prosecutors later said the informant was among five people under investigation as possible accomplices.
Microsoft would not identify the reward recipients but said it was convinced they were not involved in any way.
Microsoft has offered similar rewards in three other attacks, “SoBig,” the original “Blaster” and version B of “MyDoom.”
Anderson said informants have provided a “significant flow of information,” but no arrests have been made so far.
Authorities who questioned Jaschan said they got the impression his motive was to gain fame as a programmer. He was arrested sitting at his computer at the house of his mother, who runs a computer store in the small northern town of Waffensen.