Activity Background

Vincent Weafer Testifies Before U.S. Sentencing Commission on Cyber Crimes

March 17, 2009 On March 17th, 2009, Vincent Weafer, senior director of Symantec Security Response, provided testimony at a hearing held by the United States Sentencing Commission (USCC) on amendments to the sentencing guidelines for the Identity Theft Enforcement and Restitution Act of 2008.

In November 2008, the Commission conducted a public hearing at which representatives from the Department of Justice (DOJ), the Federal Public Defenders, the Business Software Alliance and the Commission’s Victims Advisory Group briefed the Commission concerning their views about appropriate responses to the Act. As a result of the briefing and other staff work, the Commission developed a proposed set of sentencing guidelines to be applied after the Act has been enforced.

Symantec worked closely with the DOJ and the staff of the Senate Judiciary Committee to support the efforts of Sen. Patrick Leahy to get the Act passed. As a result, the DOJ suggested to the USCC that Symantec be invited to provide comment on the sentencing guidelines at the March hearing.

In his testimony, Mr. Weafer outlined the types of cyber attacks that posed a threat to the security of personal information online and how those threats worked. His testimony shed light on the process for how cyber thieves go about developing and executing the computer programs needed to steal personal information. The USCC was able to use Symantec’s information to provide parameters to follow when determining the level of intent needed to commit the crime of cyber theft of online information and assign appropriate sentencing for the act.

Weafer’s testimony included the following passage:

“Symantec believes that many Internet users are still unprotected and more must be done at a government level to provide deterrents and punish offenders in order to encourage more citizens and businesses to engage online. It is unconscionable that cyber crime is going unpunished to the degree that it is around the world and governments worldwide must come to grips with the escalating threats.

Governments must have a rule to protect and serve in the digital world. We need to have uniformity, not just in terms of what the laws are but what the punishments are.”