'Melissa' computer virus creator sentenced to 20 months

NEWARK, N.J. -- The creator of the "Melissa" computer virus was sentenced Wednesday to 20 months in federal prison for causing millions of dollars of damage by disrupting e-mail systems worldwide in 1999.

David L. Smith, 33, pleaded guilty in December 1999 to a state charge of computer theft and to a federal charge of sending a damaging computer program. In the federal plea, both sides agreed the damage was greater than $80 million.

Smith is believed to be among the first people ever prosecuted for creating a computer virus. In court Wednesday, he called the act a "colossal mistake."

The Melissa virus, which struck in March 1999, was disguised as an e-mail marked "important message" from a friend or colleague. It automatically spread like a chain letter by causing each infected computer to send 50 additional infected messages.

Melissa was relatively benign compared with viruses that delete computer files or do other damage. But the volume of e-mail it generated clogged e-mail systems, causing some to crash and slowing others to a crawl.

Smith could have faced up to five years in prison, but prosecutors suggested a term of about two years, saying he had given authorities extensive assistance in thwarting other virus creators. He was also fined $5,000 by U.S. District Judge Joseph A. Greenaway Jr.

He is expected to get a similar prison term Friday when sentenced on a guilty plea to a state charge of computer theft.

Smith has said he created the virus on computers in his Aberdeen apartment and used a stolen screen name and password to get into America Online.

Smith was arrested April 1, 1999, after investigators for America Online provided authorities with evidence that helped trace the virus to Smith's phone number.

"My curiosity got the better of me, as I soon began to write the 'Melissa Virus,"' he wrote in a letter to Greenaway. "It didn't take me too long as I borrowed a lot of the code from other viruses that I found on the Internet."

While admitting his actions were "immoral," Smith wrote that the virus did not delete or corrupt anyone's files or data, or harm any machines.

"It did result in clogged mail servers, which admittedly caused headaches and aggravation to many," he acknowledged.