Melissa Virus' Author Owns Up

A New Jersey man admitted Thursday he created and distributed the Melissa computer virus and acknowledged it caused millions of dollars of damage that disrupted e-mail systems worldwide.

David L. Smith pleaded guilty to a state charge of computer theft Thursday morning. He also was expected to enter a plea in federal court in Newark Thursday afternoon.

The virus wreaked havoc at the end of March. It was initially believed to be named for a topless dancer Smith knew when he lived in Florida, but authorities said they had no confirmation of that.

"I did not expect or anticipate the amount of damage that took place," Smith read from a statement after answering a series of questions from his lawyer, Edward F. Borden Jr. Smith added that he thought any damage would be minor and thought he had built in features that would minimize any damage.

Smith, 31, is believed to be among the first people ever prosecuted for creating a computer virus.

State Attorney General John Farmer said he did not believe Smith's statement that he did not intend to cause any harm.

"He claims he intended it as a prank," Farmer said following Smith's plea in Superior Court in Freehold. "I think he intended to do exactly what was accomplished, a total disruption of worldwide communication."

The computer programmer was arrested April 1 at his brother's home in nearby Eatontown in Monmouth County, and freed on $100,000 bail the next day.

Smith said he created the virus on computers in his Aberdeen apartment and used a stolen screen name "Skyroket" and password to get into America Online. In the Internet's alt.sex newsgroup, he posted a file called "list.zip," a listing of adult web sites and passwords, which contained the virus.

Asked by his lawyer if that was designed to entice people to download the file, Smith said "Yes."

Melissa was designed to lower security settings on computers with Microsoft Word 97 and Microsoft Word 2000, making them vulnerable to other viruses so that any document created would be infected. It also was design to send infected mail to the first 50 names in a computer user's address book through the Microsoft Outlook e-mail program.

Asked by his lawyer if it spread quickly to tens of thousands computers worldwide, Smith said, "That is correct."

Under his plea bargain, Smith could face five to 10 years on the state charge, and up to five years in prison on a federal charge. Sentencing for the state charge was tentatively set for Feb. 18, but Superior Court Judge John A. Ricciardi said he would wait to impose a sentenced until after Smith had been sentenced in federal court.

Authorities said the terms would likely be served at the same time.

Smith is the only person charged regarding the virus. Those charges came from state authorities. No federal charges had been brought, meaning Smith is to waive his right to indictmet in both courts.

The state charge to which Smith pleaded is among the charges originally brought by the state attorney general's office.

The other charges, including theft of computer service and wrongful access to computer systems, are to be dropped. All the state charges carried the potential of up to 40 years in prison and a $480,000 fine.

The federal charge is "transmitting any program, code, document or other item with the purpose of damaging a computer program or data," a person familiar with the case said, speaking on condition of anonymity.

Melissa struck thousands of e-mail systems on March 26, disguised as an "important message" from a friend or colleague, and spread around the world like an electronic chain letter.

It caused affected computers to fire off 50 infected messages, slowing e-mail systems at government agencies, companies and thousands of other institutions.

Supervising Deputy Attorney General Christopher Bubb said Melissa affected tens of thousands of e-mail systems and cost tens of millions of dollars.

"The quantification is massive and is still ongoing," he said.

Farmer said that among the e-mail systems affected was the NATO headquarters in Brussels, Belgium. State Police Lt. George Joo, supervisor of the state police high-tech crime unit, said that led NATO to wonder whether it was under a computer terrorist attack.

America Online, the Internet provider, contacted state authorities after their investigators found evidence that pointed to New Jersey, and law officers were able to trace the virus to Smith's phone number in days, authorities have said.

Before his arrest, Smith was a subcontractor for CGS Computer Associates of Iselin, and had recently completed a project at AT&T Labs in Florham Park, his lawyer has said.

A legal brief filed this summer by state prosecutors said Smith admitted creating the computer bug and destroyed the computers that launched it.

"Smith admitted, among other things, to writing the Melissa macro virus, illegally accessing America Online for the purpose of posting the virus onto cyberspace, and destroying the personal computers he used to post Melissa," Bubb wrote.