Netherlands

[NL] Prosecution of Author of “Kournikova” Virus

IRIS 2001-10:1/29

Rik Lambers

Institute for Information Law (IViR), University of Amsterdam

On 27 September 2001, the author of the infamous "Kournikova" virus was given an unconditional sentence of 150 hours of community service by a police court in Leeuwarden in the Netherlands. The fact that he was a first-time offender and that the damage caused seemed to have been limited, influenced the length and nature of the sentence.

The virus, which has been labelled the second-largest ever to be released, infected hundreds of thousands of computers worldwide from 12 February of this year. It was called the "Kournikova" virus, as it was hidden in an e-mail with a picture of tennis star Anna Kournikova attached to it. Double-clicking on this Visual Basic virus will cause it to forward itself to all the e-mail addresses in a victim's address book. Browsers infected by this socalled "worm" will also be redirected to a website in the Netherlands on 26 January each year.

Although it spread very quickly, the "Kournikova" virus caused little damage compared to the earlier "Love Bug" or "Melissa" viruses. This may be one of the reasons why the State Prosecutor asked for a relatively light sentence (240 hours of community service) at the trial of the author of the virus, a twenty year-old man from Sneek in the Netherlands.

The man was charged with spreading data through a computer network, with the intent to cause damage (Article 350a part 3 of the Dutch Criminal Code). The maximum sentence for the violation of this article is four years' imprisonment or a fine of NLG 100,000. As the case was heard in a police court, the writer could not be sentenced to more than six months' imprisonment.

This is the first time that somebody has been prosecuted in the Netherlands for spreading a computer virus. In other countries, the authors of computer viruses are also rarely prosecuted. The author of the "Kournikova" virus turned himself in after realising the damage his creation had caused. He claimed that he had never intended to do any harm, but that he merely wanted to demonstrate the naivety of computer users. He created the virus with a simple worm-making toolkit, software freely available to anyone on the Internet.

The police court found him guilty of a violation of article 350a part 3 of the Dutch Criminal Code, which protects, inter alia, the interests of private individuals, institutions and companies in the adequate functioning of the Internet. The author put these interests at risk and violated the privacy of those whose computers were infected by the virus.