Canadian Teen Hacker 'Mafiaboy' Pleads Guilty

The teenage computer hacker known as Mafiaboy has pleaded guilty to 55 of 66 counts of mischief in connection with last year's denial-of-service attacks that crippled several major Web sites.

Authorities arrested the 16-year-old Montreal youth last April and charged him with two counts of "mischief to data" for a distributed denial-of-service attack (DDOS) that brought down the Internet sites of CNN.com, Yahoo, Amazon.com, EBay, Dell, and others last February.

Soon after the court convened on Thursday, prosecutor Louis Miville-Deschenes announced the youth had pleaded guilty to the charges. The youth, who can't be identified under Canadian law, will be freed pending sentencing. He had previously pleaded not guilty to all charges.

Some experts last year had concluded that Mafiaboy is an amateur copycat and that the real culprits may never be found. But Mark Rasch, vice president for cyberlaw at Predictive Systems and the former head of the Computer Crime Unit at the U.S. Department of Justice, said it's unlikely the authorities have the wrong person.

"He's caving," Rasch says. "I will grant you that he's an amateur, but he's pleading guilty because he is guilty. It would be extraordinary if he is not the person primarily responsible."

In addition to a two-year prison term and a fine of $1000 (about $650 in U.S. funds) the youth could face a wide range of conditions restricting his activities after his release. Although Canadian law grants the court broad discretion in cases that involve minors, the teenager could be forced to forfeit his PC or be banned from using the Internet for a specified amount of time.

Hacker Punishments Vary

Last year, a U.S. court slapped convicted computer hacker Kevin Mitnick with a 46-month prison term and ordered him to pay $4125 in restitution to more than a dozen companies and organizations. Federal authorities arrested Mitnick in 1995 for cracking corporate and university systems and for illegally downloading proprietary software. He pleaded guilty to seven counts of computer and wire fraud charges.

The court also barred Mitnick from accessing computer hardware and software and any form of wireless communications. He's also banned from working at a company that has computers, and he can't possess passwords, cellular phone codes, or data encryption devices without permission.

Although it's possible that the Canadian teenager may face restrictions similar to those imposed upon Mitnick, Rasch says the court likely will consider the threat he may pose in the future before making such determinations. "You have to weigh the character of the defendant as well as the nature of the offense," he says.

Threats Change, Continue

Despite the capture of Mafiaboy, U.S. security experts say they remain concerned about the growing threat of more sophisticated DDOS attacks against the U.S. private sector infrastructure. Experts caution that thousands of other individuals still active in the hacker community pose a much greater threat.

In fact, the prosecution of Mafiaboy could signal the end to 15199 DDOS attacks as we now know them, says Jeff Ambrose, technical marketing engineer at Top Layer Networks. The next generation of malicious hackers are learning from his sloppiness, he says. "This was the tip of the iceberg."

Meanwhile, the teenager also faces the possibility of extradition to the United States.

Eric Friedberg, a former computer and telecommunications crime coordinator at the U.S. Attorney's Office in New York and now a computer crime consultant at Stroz and Associates in New York, says it is unlikely a juvenile will be extradited to the United States, where the punishment would be more severe.

"The charges here would be much more serious, particularly in the amount of jail time," Friedberg says. "In the U.S. it's a function of the financial loss that was caused. When you have a DDoS attack, the loss figures can be staggering."