David L. Smith and the Melissa Virus: The Email That Cost $80 Million

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On March 26, 1999, a programmer from Aberdeen Township, New Jersey, used a stolen AOL account to post a Word file called list.doc to the Usenet group alt.sex, promising passwords to paid adult websites. The file carried a macro virus named Melissa. Once opened, it lowered Word's security settings, infected the master template, and told Microsoft Outlook to mail itself to the first 50 entries in the victim's address book under the subject line Important message from, followed by a trusted name.

This episode follows the biography of that single file and of David L. Smith, the man who wrote it. Melissa deleted nothing and stole nothing, yet over one weekend it choked corporate mail servers, leaked confidential documents to random contacts, and ran up an estimated 80 million dollars in damage. The hunt that followed lasted only six days, and it ended because of a hidden feature in the very software Smith had exploited.

• Fifty emails became 2,500 and then 125,000, and the FBI later counted a million disrupted email accounts across 300 companies and government agencies.
• Microsoft suspended its own outgoing corporate email for five hours, and Intel, Lockheed Martin, Lucent Technologies, and the United States Marine Corps were all hit.
• When the minute on the clock matched the day of the month, the virus popped up a line about a 22 point Scrabble play with a triple word score, lifted from an animated sitcom.
• Researcher Richard Smith found a globally unique identifier with a MAC address buried in the document, which matched older virus files signed with the alias VicodinES.
• Arrested on April 1, 1999, at his brother's home in Eatontown, Smith pleaded guilty and in May 2002 received 20 months in federal prison, reduced from a 46 to 57 month range because he cooperated with investigators.