Who writes viruses?

"Minor aggravation?"
The total number of viruses unleashed upon the Internet in its relatively short history is about 63,000. The total cost of these acts is estimated at $65bn (£39.24bn). Some, of course, have been very destructive, while many have been weak and harmless. Still, in any other field, an act of premeditated vandalism that results in a million bucks worth of damage (intended or unintended) usually carries a seriously stiff penalty. Over the Web it seems not to. Consider this: Robert Tappan Morris: Created and let loose a worm that infected 6,000 systems for $15m worth of damage. He was placed on three years' probation and fined $10,000, plus 400 hours of community service. Christopher Pile: Wrote and sent out two viruses. Sentenced to 18 months. Chen Ing-hau: Responsible for the Chernobyl virus, which caused hundreds of millions of dollars damage and repair costs worldwide. Released upon first arrest because "no one had filed a complaint." A year later, someone did. The most he could serve in prison is three years. Onel de Guzman: Sent out the 'Iloveyou' virus, which cost $7bn. Arrested and then released for lack of an existing Philippine law to prosecute him. Jan De Wit: Received 150 hours of community service for authoring the Anna Kournikova virus. David Smith: Received 20 months in prison and paid $5,000 in fines for the Melissa virus. Small price to pay for an estimated $80m in damages, huh? Simon Vallor: Wrote and distributed three separate viruses, and received a two-year sentence.

There are problems to overcome in order for the prosecuting authorities to act, at least in the US There must be demonstrable evidence of intent to damage, and that damage must be over $5,000 for the US Feds to pick it up at all. That's assuming they even know who to investigate. The writer(s) of many of the more infamous viruses, such as Code Red, Slammer, Nimda, and SirCam, are still unidentified. Laws and legal attitudes are changing, but slowly. These folks are still seen as popular antiheroes by many. Rage against The Establishment and the Military-Industrial Complex, you know.

So then, why?
So why do these people write and spread viruses and other malware? Because they CAN -- and that can be reason enough. In the large majority of cases, the authors are not caught. When caught, they go relatively unpunished. So the deal is, "hey, let's do something cool and be on the news and watch everybody freak out." All that fun and very low risk. Do it right and you won't get caught. If you are, make some "bad childhood, your Honour!" snivelling excuse at trial, and it won't be much worse on you than if you got caught breaking schoolhouse windows.