Sven Jaschan

Background

Sven Jaschan was born on 29 April 1986 and grew up in Waffensen, a small village near Rotenburg in Lower Saxony, Germany, where he attended a local computer science-oriented school. As a teenager he developed an interest in programming and malware analysis, which led him to begin writing computer worms while still a minor.

The Netsky and Sasser Worms

Beginning in February 2004, Jaschan released a series of variants of the Netsky worm, which spread primarily as an email attachment. According to Jaschan's own account, his original intent with Netsky was to remove infections caused by the rival Mydoom and Bagle worms from victims' machines, though Netsky itself went on to spread widely and cause damage independently. On 30 April 2004, his 18th birthday, Jaschan released the Sasser worm, which was markedly more disruptive because it spread automatically over the internet by exploiting a buffer-overflow vulnerability in the Windows Local Security Authority Subsystem Service (LSASS), requiring no user action such as opening an email attachment. Sasser caused infected Windows computers to repeatedly crash and reboot, disrupting operations at organizations including Delta Air Lines, the European Commission, Deutsche Post, and various hospitals, banks, and government offices. Security firm Sophos estimated that Jaschan's worms were responsible for roughly 70 percent of malware infections reported in the first half of 2004.

Investigation and Arrest

The scale of the disruption prompted a major international investigation, and Microsoft offered a reward of up to $250,000 under its newly created Anti-Virus Reward Program for information leading to the worms' author. Following tips, including from an acquaintance of Jaschan's, German federal police (Bundeskriminalamt) arrested him at his home in Waffensen on 7 May 2004. He confessed to authorities that he had written both Netsky and Sasser.

Trial and Sentencing

Because Jaschan was 17 years old when he created Sasser, he was tried as a juvenile in a court in Verden, Germany. The four-day trial in July 2005 examined evidence from a sample of the roughly 143 plaintiffs affected by the worms, including several German city governments and a broadcaster. Jaschan confessed to the charges at the outset of the trial. On 8 July 2005, the court convicted him of computer sabotage, data manipulation, and interference with public systems, sentencing him to a 21-month suspended sentence, three years of probation, and 30 hours of community service at a hospital or care home. He was not fined.

Aftermath and Legacy

Shortly after his arrest, on 1 September 2004, Jaschan was hired as a software security consultant by the German security company Securepoint, a move that drew criticism from parts of the antivirus industry; competitor Avira publicly ended cooperation with Securepoint in response. The Sasser and Netsky episode remains one of the most-cited examples of worm outbreaks caused by a single author, and of the tension between prosecuting juvenile cybercrime and the subsequent commercial recruitment of the perpetrator as a security expert.

Timeline

• 1986-04-29Sven Jaschan is born in Germany.
• 2004-02First variants of the Netsky email worm, attributed to Jaschan, begin spreading.
• 2004-04-30The Sasser worm, exploiting a Windows LSASS vulnerability, is released and begins spreading automatically over the internet.
• 2004-05-07German police arrest Jaschan at his home near Rotenburg after he is identified as the likely author of Sasser and Netsky.
• 2004-09-01Jaschan is hired as a security consultant by German firm Securepoint.
• 2005-07Jaschan stands trial in juvenile court in Verden, Germany, and confesses to the charges.
• 2005-07-08Jaschan is convicted of computer sabotage and given a 21-month suspended sentence, probation, and community service.