An Oregon man has plead guilty to launching a distributed denial-of-service attack against the E-commerce giant eBay. According to the Department of Justice press release, the man admitted to launching the attack in July and August 2003 with an army of infected computers he had amassed by using a worm program.

The guilty plea under 18 U.S.C. §1030(a)(5)(A)(i), (a)(5)(B)(i), (c)(4)(A) and 2 carries a maximum statutory penalty of ten years imprisonment and a $250,000 fine. According to the guilty plea,

Mr. Clark and his accomplices accumulated approximately 20,000 "bots" by using a worm program that took advantage of a computer vulnerability in the Windows Operating System – the "Remote Procedure Call for Distributed Component Object Model," or RPC-DCOM vulnerability. The "bots" were then directed to a password-protected Internet Relay Chat (IRC) server, where they connected, logged in, and waited for instructions. When instructed to do so by Mr. Clark and his accomplices, the "bots" launched DDOS attacks at computers or computer networks connected to the Internet. Mr. Clark personally commanded the "bots" to launch DDOS attacks on the nameserver for eBay.com. As a result of these commands, Mr. Clark intentionally impaired the infected computers and eBay.com.

Damages

Although court documents estimate total damages of the DDoS attack at "at least $5,000" over a one-year period, not a major damages case, the amount is set at $5,000 or more intentionally by the prosecution to satisfy 18 U.S.C. 1030 requirements for at least $5,000 in damages. Real damages in computer crime cases are hard to estimate and often the amount of damages can make or break a prosecutor’s case. For example, in a case of computer hacking, often the only litigable issue is whether the cost to recover from the hack and to put protective measures exceeds $5,000. Lost time and  productivity are often calculated, although it is unclear whether IT employees’ time should or should not be counted against these damages.

In short, one of the critical factors of a computer crime prosecution becomes the determination of damages. Although $5,000 is not a high amount to meet, in many hacking cases, this amount may not be reached due to poor response, inability to calculate intangible damages, etc.