Nuclear lab teen hacker escapes jail

The British student who hacked a US government laboratory to hijack its bandwidth was yesterday sentenced to 200 hours community service at London's Southwark Crown Court.

Exeter student Joseph McElroy, 18, pleaded guilty to one count of unauthorised modification of the contents of a computer at Fermilab, the US government's high-energy physics research facility.

McElroy exploited a flaw in Fermilab's authentication system, and his intrusion sparked a major security alert.

He escaped a custodial sentence because he did not access classified files.

Instead, McElroy simply used the lab network's substantial bandwidth to store and share hundreds of gigabytes of copyrighted film and music files.

Judge Andrew Goymer told McElroy to "think himself lucky" that he was avoiding prison, and said it was important that the "wrong message is not sent out to anybody else who is tempted to behave in this way".

Hacking into corporate and university networks to steal bandwidth is increasingly common, and often escapes unnoticed due to a lack of manpower to review network logs and patch software on a regular basis.

McElroy pleaded guilty at a hearing in June 2002. The US Department of Energy had sought -£21,000 in compensation, but the fine was waived as McElroy was considered unable to pay.

Security experts warned that the verdict would not provide any discouragement to hackers.

"A sentence like this is not a great deterrent," said Professor Neil Barratt, technical director at Information Risk Management.

"It's the online equivalent of me breaking into your house and setting up shop there using your electricity and water."

David Williamson, director of sales at security firm Ubizen, commented: "While McElroy's stated reason for hacking into Fermilab may be regarded as relatively non-malicious, the US government was definitely right to pursue McElroy.

"However, it is very worrying that appropriate compensation or a custodial sentence has not been issued in this case.

And he added: "Hacking is still illegal. The hacker community at large will view this outcome as a green light to break the law."

By Iain Thomson and Robert Jaques