You say: 'But he IS abetting the crimminal who wrote the worm/virus. I suggest that he either "knew or should have known" what was his system was doing. He should not be considered completely blameless, especially if the activity has been going on "for months at a time".'

this is the area of civil liability, unless the supervisor knowingly refused to take action. if the supervisor knowingly did nothing, that would fall under criminal negligence. however, unless you can definitively prove that the supervisor of the machine knew what was happening, there is no way to hold him/her criminally liable.

your suggestion that the admin "should know" belongs to tort law. you could sue the supervisor of the offending box for negligence. that might stand up in court, especially since the evidence need not be as robust in a criminal suit.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/98/15928#15928