[ISN] How much Damage did Mitnick Do?

Forwarded From: Erik Parker <netmask@303.org>

http://www.wired.com/news/news/email/explode-infobeat/politics/story/19488.html

How Much Damage Did Mitnick Do?
by Douglas Thomas 

3:00 a.m.  5.May.99.PDT 

LOS ANGELES -- Companies targeted by notorious cracker Kevin Mitnick claim
his illegal forays inside their networks cost them nearly US$300 million,
recently published letters revealed. 

The estimate, published in 2600: The Hacker Quarterly, represents the
combined losses of Mitnick's victims, which include NEC, Motorola, Nokia,
and Sun Microsystems. 

The figures were based on the "amount of work done to create the material" 
as well as time spent in research and development, testing, and time lost
in future development. The figures may have been used by government
attorneys to calculate wire fraud damages in Mitnick's recent plea
bargain, according to 2600, which has actively supported Mitnick. 

Sun estimated its damages at $80 million, the price it paid to acquire
Solaris -- the Unix-based operating system -- from AT&T in 1994, 2600
reported. Nokia's damages included development costs as well as $7.5
million for testing and "$120 million in lost revenue due to new
developments being delayed in reaching the market." 

But 2600 said the losses were not reported either to the IRS or to
shareholders, raising doubts about the actual impact on the companies. 

Mitnick's attorneys have petitioned to see a breakdown of corporate losses
and requested instructions from the court for interpreting the
information. 

Mitnick, who will be formally sentenced on 14 June, returns to court next
week, when the question of damages, as well as his ability to pay them,
will be considered. 

Jennifer Grannick, a Bay Area attorney who defends clients charged with
computer-related crimes, said deciding damages can be a complicated
matter. In Mitnick's case, the standard of proof is low at the sentencing
stage, assessment is in the hands of the victims, and the defendant has a
limited right to discovery. 

But Grannick says it's a mistake to treat intellectual property as an
all-or-nothing issue. In spite of the money they invested in the software,
she said, "the victim companies haven't been deprived of its use or its
value." 

Mitnick, 35, who has already spent four years behind bars, will spend an
additional year in jail, according to a plea agreement reached in March. 
He is also prohibited from using a computer upon his release and any
income he receives as the result of his conviction -- such as book sales
-- must be turned over to his victims. 

Four of the five counts to which Mitnick pleaded guilty involved
impersonating employees for several major cellular phone manufacturing
companies in order to obtain access to proprietary software. The fifth
charge, the only computer hacking offense, involved changing data on
computers at the University of Southern California, which resulted in
maintenance in excess of $1,000 to close security holes and delete files. 


-o-
Subscribe: mail majordomo@repsec.com with "subscribe isn".
Today's ISN Sponsor: Hacker News Network [www.hackernews.com]