Minnesota teen first arrested in 'Blaster' attack

ST. PAUL, Minn. -- A Minnesota teenager known online as "teekid" was arrested and placed on electronic monitoring Friday for allegedly unleashing a version of the "Blaster" computer worm that infected thousands of computers.

U.S. Magistrate Judge Susan Richard Nelson told Jeffrey Lee Parson not to access the Internet or any other network connection as a condition of his release. He did not enter a plea during his initial court appearance.

Parson, 18, admitted during an interview with the FBI and Secret Service agents that he had modified the original "Blaster" infection and created a version known by a variety of different names, including "Blaster.B.," court papers said. At least 7,000 computers were affected by Parson's worm, prosecutor Paul Luehr said Friday.

Collectively, different versions of the virus-like worm, alternately called "LovSan" or "Blaster," snarled corporate networks worldwide, inundating more than 500,000 computers, according to Symantec Corp., a leading antivirus vendor. Experts consider it one of the worst outbreaks this year.

First arrest

Parson is the first person arrested in connection with the attack. Investigators would not comment on whether any other arrests were imminent.

His next hearing was scheduled for Sept. 17 in Seattle, where the case was being investigated.

He faces one federal count of intentionally causing damage to a protected computer. If convicted, he could face up to 10 years in prison and a fine of up to $250,000.

Tom Heffelfinger, the U.S. attorney for Minnesota, said the case will be turned over to a grand jury to decide whether more charges will be filed.

"This kind of prosecution should be a warning shot across the bow of hackers," Heffelfinger said. "We're serious about it, and we're coming after you."

In court, the high school senior wore a T-shirt that read "Big Daddy" on the front and "Big and Bad" with a grizzly bear on the back. He sported a metal stud under his lip and his hair was dyed blond on top and shaved close around the sides and back.

Parson's public defender for the hearing, Lionel Norris, argued for putting his client on home monitoring. Parson was told he would be assigned a permanent public defender after telling the judge he had no income, no assets and only $3 in a savings account.

His mother, Rita Parson, seated in the back row of the courtroom, sighed heavily and wiped tears from her face before the hearing. Neither she nor Parson's father, Robert, would comment afterward.

Parson left the courtroom escorted by federal marshals after Nelson said threats had been made against him. He is allowed to leave his home only for doctor visits and school.

He later left the courthouse with his parents. None of the three responded to questions shouted by reporters as they arrived home.

Luehr told the judge the Blaster variants caused $5 million to $10 million worth of damage to Microsoft alone.

FBI and Secret Service agents searched Parson's home in the Minneapolis suburb of Hopkins on Aug. 19 and seized seven computers, which are still being analyzed. One remaining computer will also be removed.

Parson told the FBI he built into his version a method for reconnecting to victim computers later. Investigators said the worm allowed him to access individual computers and people's personal communications and finances. It wasn't immediately clear how he might have used that information.

Parson apparently took few steps to disguise his identity. As a byproduct of each infection, every victim's computer sent signals back to the "t33kid.com" Web site that Parson had registered in his own name, listing his home address. The computer bug also included an infecting file called "teekids.exe" that experts quickly associated with Parson's Web site: Hackers routinely substitute "3" for the letter "e" in their online aliases.

By midday Friday, hours after Parson's arrest, professional virus-hunters across the Internet were slapping their foreheads in frustration that nobody figured out the clues earlier.

"It's kind of embarrassingly simple," said Nick Fitzgerald of New Zealand, a widely recognized expert and contributing editor to the Virus Bulletin newsletter. "I guess we should praise the Lord for stupid people, right?"

Parson's Web site, which was operated from computers physically in San Diego, appeared not to have any content on it Friday but previously contained software code for at least one virus and a listing of the most-damaging viruses circulating on the Internet.

In Washington state, U.S. Attorney John McKay praised the work of federal agents and Microsoft Corp., based in Redmond, saying their collaboration helped quickly track the source of the worm.

McKay would not elaborate on the case beyond the allegations outlined in the charges against Parson, but said, "Is he dangerous? Yes, he's dangerous. ... There is serious harm to individuals, businesses, Microsoft Corp. being only one of them."

Parson's case was being handled from Seattle because the infection affected software sold by Microsoft.