Profile of the Defense

CyberCrime Legal Analyst Alex Wellen gets the inside story on the Melissa trial from Ed Borden, lawyer for alleged virus writer David L. Smith.
[April 1999]
[from: ZDTV]

CyberCrime Analyst Alex Wellen spoke to Ed Borden on April 8, the day Borden's client, David L. Smith, appeared in court in Aberdeen, New Jersey. State authorities have charged Smith with interruption of public communications, conspiracy to commit the offense, attempt to commit the offense, and third-degree theft of computer service. All together, the charges carry a maximum penalty of 40 years in prison and a $480,000 fine.

Smith was not required to answer the charges during his court appearance and has not given any interviews since then.

CyberCrime Have you ever had a computer-crime related client before?

Borden Well sure, I mean given the nature of our practice, I've represented a number of people who are alleged to have perpetrated various crimes using computers and computer equipment. Certainly I've never represented a virus writer and I think that the number of prosecutions of virus writers are so small that I doubt there are many other people who have either.

CC So, has David Smith ever written a virus before-- do you know?

Borden Well the allegation is that he is a virus writer. What the state can prove remains to be seen.

CC I'm not aware of a law anywhere in the world that makes it illegal to simply create a virus. Do you know any?

Borden I'm aware of no federal or state statute that does that. The way that the statues are written, they address themselves to claims that there's been damage to equipment or improper access to files, improper access to various compilations of data, that sort of thing.

Cybercrime When did you become David Smith's attorney?

Borden Over this past weekend.

CC How did that happen?

Borden That's a private matter between David and his lawyers.

CC Wasn't it public that the family asked that you represent him?

Borden David and his family asked that we become involved and so, to that extent, sure.

CC I think one thing that surprised people was your demeanor today. The Melissa virus, which Smith has been accused of writing, disrupted or affected a lot of people. It was very public. Do you think the case is overstated?

Borden Well I do. Certainly there have been some level of problems caused by the Melissa virus-- whoever wrote it. And certainly there's been a slowdown in email systems and that sort of thing, but I really think that it's necessary to take a step back and ask whether all of the hype is actually justified.

Let's talk specifically about what the Melissa virus does. [It] takes a relatively innocuous short message and passes it on to 50 other computer users-- if and only if the person who receives it overrides several protections in the interim.

It deletes no files. It corrupts no files. It reformats no drives. It removes no files from any system. Doesn't change anything on a system. I certainly think there were some problems caused by the virus, some slowdowns, but it's important [to keep] some perspective on this. I think the significance of the Melissa virus was how prolific it was and how fast it reproduced itself.

CyberCrime The virus moved quickly, but so did the FBI and the state. They came forward one week later with a name; what do you think about their speed?

Borden Well the question I have, is whether the law-enforcement authorities are as aggressive about pursuing viruses that actually do some specific harm. Some of the permutations of the Melissa virus [such as] the Papa and Mad Cow [viruses]-- as I understand from what I've read-- actually do harm to systems. And I just hope that they are pursuing those with a vigor that they used to pursue David Smith.

CC They say their investigation is still ongoing. Moving on, how interested was Smith in computers?

Borden Well David's a very bright young guy. He's been interested in computers for a number of years, that's part of the work he does. And as everybody seems to know, he was working for a consulting company, doing some work for AT&T on a programming contract, and had been with that company for a relatively short period of time. But David had an active interest in computers and had some facility with that.

CC Do you know whether he's designed his own programs-- not specifically viruses?

Borden No, I understand. I wouldn't want to go into the details of that. Frankly, that's not a specific subject that we've gotten into yet.

CC All the charges against Smith are New Jersey laws-- no federal laws. What do you think about the laws he's been charged under?

Borden Well if you look at the New Jersey statutes they seem to me to be focused on a couple of areas of concern. Number one is activities by hackers and the like to invade systems and get access to private or secure data, law enforcement files, national security files, and the like.

And number two [is] to prevent people from using computers to commit theft. Seems to me those are the two [types of] activities that these files are directed toward preventing and punishing. Neither of those occurred here, even if you credit what the law enforcement authorities have leaked as being true. None of that occurred here.

CC What do you mean by leak?

Borden Well from what I've read on the Net and newspaper articles and the like, it would appear that the law enforcement authorities suggest that the Melissa virus had certain effects. None of those are proscribed by these statutes it seems to me.

CC The laws themselves may not fit what actually happened-- independent from whether the activity was committed or not. Is that your position?

Borden That's right. Putting aside the question of how specific they are and whether they meet the constitutional test to avoid challenges for vagueness.

[Furthermore,] we're beginning to take a look at First Amendment issues in this country. Certainly if the type of conduct here charged was of a politically expressive nature, then, there would be little doubt that it's constitutionally protected conduct that you can't prosecute someone for.

I think that within the Melissa virus, whoever the author is, that there may well be some element of expressive conduct that would entitle it to First Amendment protection. That doesn't mean it's inherently unprosecutable, but I think it's a very serious issue that we're gonna have to look at.

CC What do you mean by First Amendment? Are you talking about the content of the virus itself? Are you talking about what's being expressed? Are you talking about the GUID information?

Borden There are a lot of off shoots and I think we have to look at what the expressive conduct is. The, as you know, the message that the virus sends itself is a pretty inocuous thing. It would as a message certainly be protected. The bigger issue is whether the activity of the virus itself is in some sense expressive. Let me ask you what it says for instance about the platforms on which it operates and whether there is some element of expression in that, whether it sends a message about those platforms.

CC They say they only want to identify vulnerabilites that exist in platforms with the intent of improving the products for everyone. Is that what you're getting at?

Borden Exactly, and whoever wrote Melissa wrote a virus, which in and of itself does nothing except forward on an inocuous message, but it does point out certain specific things about the platforms on which it operates, it seems to me.

CC Do you have a message for Microsoft?

Borden No, I'm not attempting to convey a message to Microsoft. I'm just saying that there are certainly issues that we're gonna be looking at in this case as to whether or not there is at some level expressive conduct here that should be protected.

CC One of the most talked-about issues in this case is whether in fact David is VicodinES. I can give you very good reasons why the two of them seem like the same person, but what's your take?

Borden I'm familiar with that debate having seen it on the Net myself, and that's certainly not an issue that we're prepared to go into now, one way or another.

CC You can't speak to, whether they're the same person? How do you feel about VicodinES as a person?

Borden In the same sense that we are not talking about the evidence concerning the Melissa virus, we're not prepared to respond to charges made by the attorney general's office when we don't even know what their claimed evidence is. We're certainly not gonna talk about matters that even they haven't firmed up enough to even charge.

CC And that answer doesn't necessarily answer the question whether you know or don't. It's a broad answer saying, "whether I know or not, I can't respond to that." Is that how I understand it?

Borden Well my answer is that we've only begun to represent David. We've not gone into a lot of these allegations in any detail at all, so it's much too early to address those issues.

CC And what about the possibility that David is part falsely accused, and only responsible for posting the virus. Maybe he knew it, and someone else wrote it.

Borden Well as you know in any kind of criminal proceeding there's certain very basic stages. First, the prosecutors have to tell you what you're charged with. They haven't told us that yet. We don't even know what the state claims David did. We don't even have an affidavit of probable cause. So until we at least know what it is that the prosecutors claim, we're certainly not going to respond to an ephemeral sense of what other people think the prosecutors are charging.

CC Could you have asked for a probable cause hearing, and shouldn't have already have a probable cause affidavit?

Borden Well, the entirety of what we have from the state now is two pages of legalese, which list the charges, has David's name, home address, date of birth, and the amount of his bail. That's what we know about the state's charges as of now. We don't know the probable cause affidavit. We don't have any specification of what their supposed evidence is. I've learned far more from a number of hours on the Net and the suppositions of various other people about what the state's evidence might be then I learned today in court or have learned in several days in contact with the attorney general's office. It is part of the nature of the process that they're not obliged to disclose that evidence at this point, but here we have some[one] who's subject to immense public scrutiny. His life is simply torn apart. He's lost his job. His family's had to post a $100,000 bail bond to keep him out of jail, the state, [and] the attorney general's office have not come forward with the slightest scintilla of evidence.

CC You say they have that discretion, but in your opinion they haven't shown maybe the level of decency that might accompany such a big case?

Borden It's certainly not an uncommon tack for them to take. And you must understand that there are certain types of criminal investigations where they would want to withhold evidence for good and proper reasons. I'm not sure that this is such a case. That's a question only they can answer.

CC So when do you find out anything?

Borden They are not obliged to give us anything until after the case is indicted. The determination when to indict it, if at all, is entirely up to the attorney general's office.

CC So then they can indict him a year from now?

Borden They can indict him four years and 11 1/2 months from now.

CC Why's that?

Borden Statute of limitations is five years.

CC Is that the rule in all states, or is it unique in New Jersey?

Borden It's essentially the federal rule as well. I mean in federal court the difference is that before someone can be held on bail, they're entitled to a probable cause hearing. Now that's a very low standard in federal court and can be sustained with a lawyer giving some sort [of] specification of what the evidence is, but at least you have that. We don't even have that here.

CC Can you ask for a probable cause hearing?

Borden Sure, in New Jersey as elsewhere, defendants [are] constitutionally entitled to a probable cause hearing at some point. There is case law in New Jersey that kind of goes back and forth about when a defendant is entitled to that. Certainly not terribly quickly, and I would expect if we filed such a motion now it would be deferred and a probable cause hearing would be deferred in order to give the state sufficient time to indict if they chose to do so.

CC So you sit and wait right now?

Borden That's right. Well we obviously prepare our case. We ruminate about what the charges may be and we do a lot of hard work to get ready.

CC And how's David doing?

Borden He's doing OK. Today was our day. It was really a substantial crush of media out there, but David's OK. And I think he's gonna stay strong through this and I think we're gonna be all right.

CC You thought this was going to be a two-day thing, do you still feel that way?

Borden Well, I thought it would be a two-day story. I certainly didn't think it would be a two-day prosecution. There are no such things.

CC It was crazy out there. Did you expect that?

Borden Well, we had certainly done some checking, and the level of media attention certainly led me to believe that it was gonna be substantial.

CC Is there anything that you would add that I didn't hit upon?

Borden Well, the one thing that I would add is that it's really a fascinating case with a great deal at stake. I mean a young man's life and future are at stake here. Obviously not his life physically, but his future is. He had a very promising future until a few days ago, and our job will [be to] see that he gets that future back.