# How should "Mafiaboy" be punished? **URL:** \ **Category:** Great Debates\ **Created:** [April 21, 2000, 9:38pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046 "2000-04-21T21:38:00Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![system](https://global.discourse-cdn.com/straightdope/original/2X/e/e489c3b7d8fce19c4b355dd4fc3f88cc39c34b87.png) [@system](https://boards.straightdope.com/u/system)\ **Post date:** [April 21, 2000, 9:38pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/1 "2000-04-21T21:38:00Z")
Evidently they’ve caught the hacker responsible for the DoS attacks in February. My question is, “Is he being punished enough? And if not, what should his punishment be?” This is from the Chicago _Tribune._ > [@](#): > > {bolding mine} > TEENAGE HACKER CHARGED > EXPERTS SAY ATTACK ON EBAY, AMAZON `VERY, VERY SIMPLE’ > By Jon Van and James Coates, Tribune Staff Writers. The Associated Press contributed to this report. > April 20, 2000 > The hacker who shut down CNN, Yahoo, Ebay, Amazon and other big-name Internet sites earlier this year was evidently a 15-year-old Canadian boy with big ambitions but moderate skills, authorities said Wednesday. > The boy **has been charged with two counts of mischief** for his part in the February attacks that crippled some of the world’s most popular Web sites with a barrage of bogus messages. > Inspector Yves Roussel of the Royal Canadian Mounted Police said in Montreal that police got a warrant over the weekend and searched the home of the 15-year-old, who calls himself “Mafiaboy.” > Authorities apparently found the suspect with the help of adult hackers who were unhappy with Mafiaboy. > The suspect’s alias was mentioned last month in an article that appeared in Maclean’s Online magazine on the Web that quoted a veteran hacker, Rachelle Magliolo, as saying the boy had bombarded her Web site using the same tactics he employed against Yahoo and the others. > “I’ve known Mafiaboy on-line for a couple of years,” said Magliolo, 34, the mother of a teenage son. “He’s a malicious little kid.” > Among the hacker elite, Magliolo told Maclean’s, the boy isn’t taken seriously as a hacker but is thought of “more like a vandal.” > She added: “Anybody could have made those attacks. With the right software tools, it’s very, very simple.” > When police raided Mafiaboy’s home, they confiscated computers and software equipment, Roussel said. \*\*The boy has appeared in a Canadian youth court and was released on an undisclosed bail. > The court ordered that the boy use a computer only for schoolwork while under close supervision and mandated that he not visit any store dealing in computer equipment, Roussel said. \*\* > The joint investigation by Canadian authorities and the U.S. Department of Justice and Federal Bureau of Investigation is continuing, Roussel said, and more arrests may be made. > “Wherever they are,” Roussel said, “hackers will be investigated and arrested.” > The hacking attack, called denial of service, involves enlisting lots of outside computers to bombard target sites with messages and queries. When computer servers get so much traffic at once, they overload and crash so that legitimate visitors are unable to use the Web sites. > Dozens and perhaps hundreds of computers were enlisted in the attacks without the knowledge of their owners, authorities said. > Denial of service attacks are fairly popular with Internet vandals, with dozens of free software programs to launch them available on-line. > The main thing about the February attacks was that they targeted several high-profile Web sites at the same time and that they attracted enough attention to be reported in mainstream media. > That law-enforcement agencies required help from hackers to find Mafiaboy is not unusual, said a computer security expert. > “Nine out of 10 times these people are caught using information from hacker informants,” said Stuart McClure, co-author of the book “Hacking Exposed.” > If Mafiaboy eventually is tried, convicted and sentenced to a significant punishment, it may deter some others from future attacks on Web sites, McClure said, but law enforcement alone will not solve the problem. “Companies on the Internet have to get serious about security.” > Authorities said they have identified some of the computers enlisted as “middlemen” in the February attacks. A computer at the University of California in Santa Barbara, a router at Stanford University and a home business computer in Portland, Ore., have been implicated as unwitting accomplices in the February attacks. > Another Canadian police officer, Sgt. Jean-Pierre Roy, said Mafiaboy’s apparent use of some California computers in his attacks helped track his home location. > While declining to provide details, Roy said law-enforcement officials were not impressed with the young man’s computer skills. > “It is our estimation that Mafiaboy wasn’t that good,” Roy said. “He wasn’t what we would call a genius.” So, whaddaya think? Is a slap on the wrist enough? Personally, I don’t think so. Should we let him off easier because he’s “only a kid”? I don’t think so. But I don’t know what to do with him, either. What should be done with this kid? * * * “Why, sometimes I’ve believed as many as six impossible things before breakfast!” - the White Queen ---
**Author:** ![Joe\_x](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Joe\_x](https://boards.straightdope.com/u/Joe_x)\ **Post date:** [April 21, 2000, 9:44pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/2 "2000-04-21T21:44:00Z")
Criminally not much can be done to him. What is the Canadian law say when it comes to parental accountability and civil actions. I know that here in the States generally if a kid commits an act of vandalism often times the parents can be sued in civil court for the cost of the damage. That actually sounds pretty ok. ---
**Author:** ![sixseatport](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@sixseatport](https://boards.straightdope.com/u/sixseatport)\ **Post date:** [April 21, 2000, 9:55pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/3 "2000-04-21T21:55:00Z")
I think they oughta do the same thing they’ve done with Mitnick: Keep him away from all technology more advanced than a toaster for 8 or 10 years. (N.B. I think that was too much punishment for Mitnick, whose situation was different from this. But this kid sounds like a snotnosed spoiled little hacker-wannabe…I have no sympathy for him. “mafiaboy,” Indeed! _snort_ ) ---
**Author:** ![Arnold\_Winkelried](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Arnold\_Winkelried](https://boards.straightdope.com/u/Arnold_Winkelried)\ **Post date:** [April 21, 2000, 10:10pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/4 "2000-04-21T22:10:00Z")
Additional information: This canadian boy might not be responsible for **all** the attacks. [Computerworld: Update: Mafiaboy a copycat; attacks could have been stopped](http://www.computerworld.com/home/print.nsf/CWFlash/000420D73A) > [@](#): > > The 15-year-old Montreal boy was arrested on April 15 and charged with two counts of “mischief to data” for a distributed denial-of-service attack that brought down the Atlanta-based CNN Web site and 1,200 CNN-hosted sites on Feb. 8. Despite the hoopla surrounding his arrest, Mafiaboy is likely not responsible for three denial of service attacks launched earlier against Yahoo Inc., eBay Inc. and [Amazon.com](http://Amazon.com) Inc… The entire spate of attacks took place between Feb. 7 and 14. > > “He’s a ‘me-too guy,’ just responsible for the CNN denial of service that came after the first major hit of Yahoo,” said Chris Davis, CEO of Hexedit Network Security Inc. in Ottawa. “The people who instigated it are a bigger threat; they are some of the best in the world, and these are the people I fear daily.” He should be punished like any other vandal is punished. What is the punishment for a kid that TPs someone house, or does a “doughnut” on someone’s lawn, or plays mailbox baseball? Of course, the financial loss to the companies is much greater. ---
**Author:** ![tracer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tracer/32/20578_2.png) [@tracer](https://boards.straightdope.com/u/tracer)\ **Post date:** [April 21, 2000, 10:53pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/5 "2000-04-21T22:53:00Z")
> [@](#): > > “The people who instigated it are a bigger threat; they are some of the best in the world, and these are the people I fear daily.” Which is amazing, because a Denial-of-Service attack is _painfully_ simple to instigate. Sounds to me like the real fault is with Yahoo!, Amazon, etc., for having such poor security. ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [April 22, 2000, 4:43am UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/6 "2000-04-22T04:43:00Z")
mafiaboy likely faces a maximum custodial sentence of two years, no more. He may be liable to pay compensation or restitution. I’m going from the press reports, which suggest that mafiaboy is charged under section 430 of the _Criminal Code_ of Canada: > [@](#): > > **430** (1.1) Every one commits mischief who wilfully > > (a) destroys or alters data; > > (b) renders data meaningless, useless or ineffective; > > © obstructs, interrupts or interferes with the lawful use of data; or > > (d) obstructs, interrupts or interferes with any person in the lawful use of data or denies access to data to any person who is entitled to access thereto. The normal punishment for this offence is set out later in the section: > [@](#): > > **430** (5) Every one who commits mischief in relation to data > > (a) is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years; or > > (b) is guilty of an offence punishable on summary conviction [i.e. - a maximum of six months, if the Crown proceeds summarily rather than by indictment]. However, mafiaboy is under 18, so he would be a young offender, prosecuted under the _Young Offenders Act_ of Canada. The substantive offence is the same, but the punishment is different. Under section 20 of the _YOA_, if the court convicts mafiaboy, it has a range of sentencing options. It can order him to pay a fine of not more than $1000 (section 20(1)(b)), or restitution or compensation to a person whose property was affected (section 20(1)© or (d). The court can also impose a custodial sentence, under section 20(1)(k): > [@](#): > > (k) subject to sections 24 to 24.5, commit the young person to custody, to be served continuously or intermittently, for a specified period not exceeding > > (_i_) two years from the date of committal, or > > (_ii_) where the young person is found guilty of an offence for which the punishment provided by the Criminal Code or any other Act of Parliament is imprisonment for life, three years from the date of committal. Since the base penalty in the _Criminal Code_ is 5 years, as a young offender the maximum would be 2 years. (Note that there is no guarantee that if convicted, he would face the maximum, or any custodial sentece. The judge could use one of the range of non-custodial options available under section 20.) The Crown could apply to transfer a youth to adult court, where the adult sentences would apply, but the courts normally only grant those applications in cases like murder . I suppose there may also be a question of extradition to the United States. If he were sued civilly in Quebec, the lawsuit would be under the _Civil Code of Quebec_. It’s been a while since I looked at the _Civil Code_, but I don’t recall any express provisions for parental civil liability. It may be implicit in the section dealing with fault, however. * * * Thanks for doing your bit to advance the cause of human knowledge.     – Cecil Adams ---
**Author:** ![system](https://global.discourse-cdn.com/straightdope/original/2X/e/e489c3b7d8fce19c4b355dd4fc3f88cc39c34b87.png) [@system](https://boards.straightdope.com/u/system)\ **Post date:** [April 22, 2000, 1:07pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/7 "2000-04-22T13:07:00Z")
> [@](#): > > Originally posted by Arnold Winkelried: > **He should be punished like any other vandal is punished. What is the punishment for a kid that TPs someone house, or does a “doughnut” on someone’s lawn, or plays mailbox baseball? Of course, the financial loss to the companies is much greater.** Yeah, but then there’s the psychological thing. Screwing up e-Bay or Yahoo has literally world-wide consequences. People get scared–even the SDMB got real nervous about jokes about spamming the SDMB, witness the recent OgreFade/Urge thing. I have to wonder, if this kind of thing keeps up, are the Powers That Be going to get nervous enough so that they start regulating the Internet? “Well, we can’t have this sort of thing, we’ll have to have licensing…” etc. Like when somebody abuses the privilege at the library by razoring things out of magazines, so the librarian puts all the magazines behind the counter, so you have to ask for them. Shouldn’t something more drastic be done to Mafiaboy and all the others, something that sinks in to the hacker community? Is there anything that COULD have a cautionary effect on all the frustrated adolescent hackers and crackers out there? I’m reminded of the saying, “Justice must not only be done, it must be seen to be done.” If you TP somebody’s lawn, and you get caught, usually they make you clean it up yourself, or else you have to do “community service” like pick up trash along the highway for a Saturday afternoon. Is there anything comparable for kids like Mafiaboy? Would that keep them from doing it again? I also think that saying it’s Yahoo’s fault for having such lax security is kind of like blaming the guy whose mailbox got stolen for “keeping it right out there where kids could get at it.” Will the ultimate result of Yahoo & Co.'s tightening up security be that the Internet becomes licensed, with websites being like TV stations? When people get frightened, they start passing laws to fix what frightens them. * * * “Why, sometimes I’ve believed as many as six impossible things before breakfast!” - the White Queen ---
**Author:** ![WillGolfForFood](https://avatars.discourse-cdn.com/v4/letter/w/82dd89/32.png) [@WillGolfForFood](https://boards.straightdope.com/u/WillGolfForFood)\ **Post date:** [April 22, 2000, 6:43pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/8 "2000-04-22T18:43:00Z")
What is he, fifteen years old? Make him do community service - say, doing some computer programming for a local charity or something. If you’re really mad at him, make him do a **lot** of community service. Then, when he’s done, wipe his record clean. That gives him something useful to do, may well turn him in a better direction than he was heading before, and doesn’t mark him forever. ---
**Author:** ![Klaatu](https://avatars.discourse-cdn.com/v4/letter/k/e0b2c6/32.png) [@Klaatu](https://boards.straightdope.com/u/Klaatu)\ **Post date:** [April 22, 2000, 8:54pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/9 "2000-04-22T20:54:00Z")
I think he should be forced to download, and write out in longhand on the blackboard, one year of CERT advisories using a 1200 baud modem. ---
**Author:** ![meara](https://avatars.discourse-cdn.com/v4/letter/m/df705f/32.png) [@meara](https://boards.straightdope.com/u/meara)\ **Post date:** [April 22, 2000, 9:15pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/10 "2000-04-22T21:15:00Z")
There’s some interesting commentary at: [http://www.2600.com/news/2000/0420.html](http://www.2600.com/news/2000/0420.html) expressing skepticism that “mafiaboy” is anything more than a random scapegoat. ---
**Author:** ![red\_dragon60](https://avatars.discourse-cdn.com/v4/letter/r/ce73a5/32.png) [@red\_dragon60](https://boards.straightdope.com/u/red_dragon60)\ **Post date:** [April 22, 2000, 11:01pm UTC](https://boards.straightdope.com/t/how-should-mafiaboy-be-punished/18046/11 "2000-04-22T23:01:00Z")
Well, criminal as the act, he did do a vital service. Why, you ask? He showed the back door to the companies. Sure, he should punished, but not to the extent of being someone named Butch’s “special friend” in the state pen. Companies pay hackers to get into their websites and systems to make them more stable when a fault is detected. Think about what would happen if someone with a real agenda found out how to take down Ebay and Yahoo. Still, anyone who chooses the stupid name of “mafiaboy” with no regard if they’re even Italian, much less of Canadian residency, should be picking up cans on I-90 for the next five years. Strange justice? Hey, it works. * * * “I know you’ve come to kill me. Shoot, coward, you’re only going to kill a man.”  -Che Guevara, Oct 9, 1967.