Why the punishment doesn't fit the high-tech crime

The nine-year jail sentence today for the IT expert who masterminded a £2m credit card fraud from passengers who bought tickets for London's Heathrow Express rail link contrasts sharply with recent sentences seen for virus writers and software piracy.

The disparity between the two-year sentence for the web designer in Wales who infected 27,000 computers worldwide with mass-mailing worms and the 15-month term for the software pirate turning over £300,000 a year selling counterfeit Adobe, Macromedia and Microsoft products highlights the problem of how to punish high-tech and, usually, white-collar crime.

While no one is protesting the innocence of 26-year-old Sunil Mahtani, who downloaded almost 9,000 credit card details while working for a company that processed transactions for the Heathrow Express, is a nine-year sentence – comparable to getting sent down for murder and probably longer than many rape convictions – really the appropriate punishment?

And is seven years really the difference between the credit card fraud and the virus writer who infects thousands of computers and causes, albeit less quantifiably, millions of pounds more damage in clean-up costs for IT managers and lost productivity for businesses whose networks are hit? Yes a deterrent effect is necessary but is locking someone up and throwing away the key for this type of crime really the answer?

Ultimately Mahtani got his heavy sentence because he was prosecuted under conspiracy to defraud charges, whereas the virus writer is subject only to the archaic and outdated computer misuse laws of this country.

It's far from a black and white issue, which was highlighted by the responses from silicon.com readers when we asked how the MSBlast virus writer should be punished. The answers ranged from the, quite frankly, obscene and offensive to jail sentences, to compensation, to those who say we should learn and use the misguided expertise of these offenders.

The problem with punishing virus writers in the first place however is the issue of tracing them and then prosecuting them if they are resident in an overseas country with less strict or non-existent cyber crime laws. The only thing that is certain is that there certainly needs to be more consistency in dealing with high-tech crime and there needs to be a global effort to tackle a global and costly problem.