Imagine for a minute that you were a consultant and wrote code for a large corporation that has significant security flaws. Later your security flaws cost the corporation money as well as lawsuits from their customers due to personal information being stolen and abused.

Who do you think that the corporation would hold responsible?

I see the reward program for virus writers as sheer genius, for these reasons:

1. These virus authors are almost always part of a peer group. They get accolades from their peers by getting their creation mentioned in the news, for how many machines it took down, etc. Part of the payoff comes from the acknowledgement of their peers. Without this, their is much less reason to do it. I doubt that any of them operate in total anonymity.

2. Because they don''t operate in total anonymity, someone always knows who wrote such-and-such virus. And some of these people like money. Honor among thieves? I don''t think so.

For some reason, this hasn''t been working in the case of Osama bin Laden ($25,000,000 US), but maybe people in this category are more afraid of the judgement of Allah (according to their twisted system of ethics) than they are enamored of a deluge of cash. It certainly worked in the case of Saddam Hussein.

Sorry, that was supposed to be "Dave, [nod] to worrying..."

Dave, to worrying that these guys are the ones keeping Microsoft up-to-date. Although I doubt we have to really worry: as long as Microsoft is so huge, they might not have competitors, but they''ll sure be the biggest, ripest target out there.

Marco, you can''t "make an example" of people. It might be effective, but it''s hardly justice.

Dan and Marco''s comments are sophomoric. Are you guys saying you are experts in sociological behavior and social justice? I just want to point out the lynch mob mentality you are expressing. Should people who drive beyond the speed limit be punished severely because they endanger all those around them? And I am sure you guys speed. What if they cause a traffic jam and it slows everyone else down and wastes their gas. What if an ambulance with someone in it that is on life or death status gets stuck in this jam and that individual dies. It seems that the costs can add up, but we never punish those individuals for that behavior that is commensurate with the amount of inconvenience it causes.

And what does the author mean by perverse? Nice spin, jerk.

I have always wondered why Microsoft is never held accountable for their software throttling down the Internet and the World, just to get market share and captivate dumb monkies that require widgets for their attention. This amounts to negligence in my mind. Why is it they insist that the OS be built around accessories and not the other way around. Fix Microsoft culture and hold them accountable, their software could not be used to effect the rest of the World. But they assume they shouldn''t be held accountable for their reckless abuse of a public entity. It is out of their hands, in their minds. Microsofts attitude is like the attitude of rednecks that believe that they have the freedom to take their motorized recreational vehicles where ever and when ever they want with out considering the damage to the environment. Shoot, shouldn''t they be entitled to think of only themselves? Microsoft''s business model does not feel beholden to the environment they operate in. They are just a redneck company. Seems like the World needs to create some control to hold those that are thoughtless responsible.

In a perverse sort of way, individuals such as he provide a valuable service. One could argue that we owe thanks to these guys for holding Microsoft accountable for creating more secure software. Flush out these guys and there will be no one but Al Queda types attacking our systems - with none of the "teenagers" to have revealed the existing vulnerabilities beforehand.

I agree with Marco that consequences are necessary, but in a world with billions of people there will always be someone who thinks they won''t get caught. We cannot trust the security of our information systems to the hope that all potential criminals will be deterred by the consequences. What we need is an interface to the Internet that does not allow unauthorized activity on a computer, and an operating system that does not expect an end-user to figure out what is malicious.

Hmm, I do not think Microsoft, FBI, Secret Service or any authority will be capable of stopping theese people.

Most of them are teenagers, if not they are socially disturbed in one way or another. In both cases, it is an expression of power, that is experienced by trying to control a piece of something: an email system, a network box, or whatever.

Control is their driving force and so is everyone''s else. The more control the happier we are. Of course, "socially well behaved" individuals pursue control in some other more legitimate ways (not neccessarily less destructive ways: look at Bush for example), but the core is still there control.

So given all of the above, the only effective way to deal with theese people is to be prepared. So go and vote against Bush, turn on your firewall, patch your system, stop believing everything CNN brodcasts, etc., etc.

The only way to stop these people is to punish them as harshly as possible so it serves as a deterrant to others with similar clever ideas. If this individual gets something silly like 100 hours community service and then becomes a millionare by writing a book about it, IT community will never win the war.