Back in the early 90s, we were certain that they were depraved young men with chips the size of Manhattan on their shoulders. They wrote viruses to destroy the world, make societal protests, and take the place of the girlfriends they could never have, all while listening to heavy metal in their darkened rooms. These kids were not to be trusted. We all knew that.

Fortunately, after six years of researching the methods and motivations of the vX world, we have found that the once common perceptions of virus writers are for the most part inaccurate. Why is this fortunate? Sociopathic behaviors are not something which we can reduce or eliminate via education or peer pressure.

The generic virus writer

On the other hand, when people who are pretty much ethically normal express themselves in undesirable ways, they eventually grow out of these destructive behaviors. Research into the motivations and backgrounds of virus writers has shown that the early virus writers were not evil incarnate, but rather adolescents who were basically just like the kids next door. In fact, their ethical development was right on target with that of normal young people, according to the developmental scale developed by Lawrence Kohlberg during his long-term study of ethical development. This meant that most of the kids who were writing viruses would age out, or stop, and that peer pressure from these ex-virus writers could have a positive influence on those who were contemplating this new hobby. The predictions made inThe Generic Virus Writer have come to pass. [2] The virus writers did age out and stop. Peer pressure seemed to be pretty effective. The battle was won, right? Wrong.

As of late 1996, there are new virus writers taking their places. But, it is even worse than that. Yes, we have new youngsters filling the empty shoes of those who have aged out, but we also have new types of virus writers. The new types, whom I call "The New Age Virus Writers" in The Generic Virus Writer II [3], are somewhat different than the ethically normal kids we found the first time around.

First, there seem to be two newly emergent types. The first seems obsessed with the technical aspects of writing more clever viruses. Unlike many of the early virus writers, this new type does not seem too interested in fame. The other type may surprise you, but we will get to him in a moment.

Why are these types new? Well, it's pretty simple really. Just about anytime a society tacitly condones questionable activities, it lends the activities some degree of credibility. It makes them seem less bad. That means that people don't need to age out of the activity. This means that what constitutes ethical behavior changes! On the Internet today, virus writing is undergoing this sort of tacit approval. We find all sorts of viruses available for public consumption. People routinely tell me they get viruses from some of the vX sites for testing. Never mind that this makes for a pretty unscientific test, since you don't really know if you are getting real viruses. Making use of these sites lends them credibility, and gives some validity to the frequently cited argument: "We perform a service." We can even read in some popular cyber-culture magazines that virus writers are heroes, fashioning out a sort of electronic graffiti or "walking the lonely intellectual wilderness which is home to he who practices science on the fringe." It's just not popular to say writing viruses is bad.

Writing viruses is bad. There, I've said it.

Virus writers at your company?

Before, there was reason to believe that the kids simply did not realize the impact of their action on others. It is well documented that the Internet, and computers in general, have helped us to become desensitized to the effects of many of our actions toward others. But, the excuse "I didn't know it would hurt anyone," cannot be used relative to writing computer viruses now. People know that writing, modifying, and distributing viruses is bad. Well, sort of. It gets more complicated. In some universities, virus writing can be part of an approved curriculum. Combined with all the mixed messages from media and Internet culture, we can now factor in the functionality and ease of use of Visual Basic and Visual Basic for Applications, the languages of choice for the new crop of macro viruses. What does this mean? It means basically (no pun intended!) that the other new type of virus writer may work for you!

Many people in the workplace now feel it is not only their right, but their duty to play around with viruses. And now, it's easy to do. No more complicated interrupt vector tables. Now, it's as simple as typing in a few macros. Given this new mandate, I think the recent macro virus explosion should come as no surprise to any of us. Many times a month I get the message, "I've played around with this virus a bit, and I found that..." Of course, this sort of playing around puts companies at terrible risk and liability as the viruses could inadvertently escape. Is this virus writing? Yes. It may wear a different hat, but it still puts the company at risk, forces the anti-virus product developers to update products, and causes major problems within corporations. It doesn't matter if the virus writer meant to harm you or was only trying to help. The end result can be the same no matter who is writing the virus.

What can you do about all of this? There have been several suggestions. Some people have suggested that if you don't like viruses being allowed as free trade on your ISP, let the ISP know. If virus writing is part of a curriculum of a college in your part of the world, and if this annoys you, let them know. These suggestions are only part of what could constitute a long-term solution which computing professionals and educators have to deal with. However, there is one thing you can do that can have an immediate effect. It may not help decrease the virus writing and intentional or accidental distribution done by people you will never meet, but it can help place your company at lower risk. One extremely important aspect of anti-virus protection in the workplace is to establish policies for handling virus incidents. This would include a policy that prohibits all types of experimentation with viruses in any situation that could place your company at increased risk or liability.