With the Sasser worm, you did not actually say, "hey, we are offering a reward for Sasser." It took someone to come forward and ask if you would you offer a reward. To what extent has that happened in the past?
It is the first time somebody came to Microsoft, specifically, and said, "I have information for you. I know about your reward program, and I want to talk to you about somebody who has done something that is malicious in nature." It is the first time that has happened. However, we have seen an increase -- and this is something law enforcement has told us -- in the number of citizens out there who are calling law enforcement and saying, "we have information on a cybercrime." The community out there using the Internet knows things about what is going on and is energised to step forward and do the right thing -- even if it is not directly connected to a reward being offered by Microsoft. That, to us, is a success in itself.
At about the same time as the Sasser arrest, there was also an arrest of a suspected writer of Agobot. Was the reward program key in that one as well?
No. The arrest actually happened at almost exactly the same time on 7 May, but the two cases resulted from two different situations and two different ways of investigating it. One was very connected to the reward being offered and somebody being aware of it and coming to us. The other was very connected to technical analyses and things that go behind that and lead to information. And then Microsoft worked with law enforcement in Germany.
What do you think the breakdown will be of crimes solved that are related to leads from technical analysis versus crimes that get leads because of an informant?
One is not exclusive of the other. There are cases where I think we will find that technical analysis is going to play a major role. At the same time, offering a reward on a particular malicious code may also have an important role in identifying the person responsible. The two can go hand in hand, but I cannot predict which one is going to take the lead.
There are reports that the informant in the Sasser case is under investigation. If that turns out to be the case, and he ended up becoming a suspect, what would be the impact on any offered reward?
If you have involvement in the virus or worm that has been launched, you are not eligible for a reward.
Talkback
It's a very expensive debugging exercise.
This all nice and good but I can`t find a contact address if I want to contact microsoft for this problem.
What about copying and selling microsoft products on internet. Is there a reward too?