VX Heavens

What kind of person would create a computer virus and set it loose in the world - an evil genius or a deranged technopath? Sarah Gordon has spent years trying to answer that question and her research has turned up some surprising results. Milly Jenkins reports.

Sarah Gordon didn't know much about computers, let alone computer viruses, when she bought a second-hand PC in the early 1990s and found herself "the proud owner of not only the PC but of the Ping-Pong virus as well". Like a bad bout of winter flu, she couldn't shake it, nor could anyone else she showed it to. As a last resort, she looked up a news group for virus writers and immediately found someone who knew exactly how to get the Ping-Pong out of a PC.

Seven years on, she is now a leading authority on computer viruses and works for IBM's virus lab in New York, anticipating new viral threats and developing products for their detection. But she is best known for her work on ethical computing and as a pioneering anthropologist of the virus-writing underground. She has made it her mission to find out who writes viruses and why.

The Ping-Pong incident intrigued her. A "typical" virus writer, she had assumed, was an "evil, depraved... technopathic, genius gone mad, a sociopath". But the ones she came across in the news groups seemed like a nice, normal lot. Virus writing may not be illegal, but it is certainly anti-social. So what was the attraction? She wanted to find out what ethics motivated them to write viruses.

What she found was that, apart from writing viruses, there was nothing very "unethical" about them at all. In one study she interviewed a sample of 60 virus writers and compared them with a model of ethical development formulated by the psychologist Lawrence Kohlberg. They were mostly "within the ethical norms for their ages". There was no such thing, she also discovered, as a typical virus writer, although they did fall into categories - the adolescent, the student and the professional adult. They were almost exclusively male.

They tended to be young, from middle-class homes and with a keen sense of "right" and "wrong". They were respectful of authority - not the angry, antisocial teenagers you might expect.

"Justifications vary from 'we can do this because we can', to 'we do this because someone said we were not capable of doing it'," says Gordon. Most said it was something they just did and that they had never considered why.

"The impact of their actions is often seen, at least by them, as impacting machines, not other human beings." This shouldn't come as a surprise, she says. The impersonal, dehumanised world of "electronic communities" is bound to make some people behave differently. Anonymity, it has been shown, often prompts people to behave in ways they wouldn't in the "physical world".

Adult virus writers tended to be more immature for their "ethical development" age groups, and more likely to have chips on their shoulders. They spoke of their hatred of hypocrisy and politicians, and saw themselves as fighting an "enemy", mostly defined as "Society". Some saw virus writing as a right - a form of free speech.

Most of them said they were battling against the "AV people" - anti-virus experts, like Gordon. Fame was a common motive - getting a virus discussed in news groups or written about in the press was a major coup. The highest accolade was for a virus to become so widespread that a scanning product to detect it was put on the market.

One of Gordon's aims in doing this research, which she continues to update, is to demystify people's perceptions about virus writing. "The 'art' of writing viruses is vastly overrated by the virus writers," she says. "It is pretty simple to write a virus, and real talent could be better shown by making useful software." There are only 300 viruses currently circulating, although over 17,000 have been identified in the past.

Some viruses are serious. But even these tend to get over-hyped, not least by the press, which loves a good virus scare story. When the Michelangelo virus surfaced five years ago, it prompted mass panic. Like the Friday 13th virus before it, it activated on a certain date (6 March, the artist's birthday) and people predicted it would wipe millions of hard drives clean in days. But in the end only a few thousand computers were affected.

Gordon has interviewed some of the more sophisticated virus writers - underworld celebrities spoken of in hushed, admiring tones by their younger counterparts. When she published an interview with one, an aggressive Bulgarian known as "Dark Avenger", she was dubbed the Clarice Starling of the virus world. He was Hannibal Lecter, and the interview does indeed read like something from The Silence of the Lambs: after she made her first attempt to contact him, via a bulletin board, his spooky response was to dedicate his latest virus to her. "Why didn't you contact me directly?" he asks in the interview. "I was afraid of you," she replies. "You should see a doctor," he says. "Normal women don't spend their time talking about computer viruses."

So why did he start writing viruses? "I think the idea of making a program that would travel on its own, and go to places its creator could never go, was the most interesting thing for me," he replies. "The American government can stop me from going to the US, but they can't stop my viruses."

Gordon believes that winning the battle against the virus writers means taking a "multi-disciplined approach". Governments and courts can do little to help. But new technology will, and IBM, like others, is currently developing "an immune system for cyberspace" designed to automatically destroy all viruses including new, previously undetected ones.

She would also like to see schools and universities teaching ethics as part of their computer science curriculum. Her research has found that, like young criminals, virus writers mostly grow out of their habit. The trouble is, there is always a new generation to take their place, which is why education could help: "We can't sit idly by and expect our children to figure out for themselves what is right and wrong."

Above all, she believes in the power of persuasion. She spends a lot of time talking to virus writers, online or at hackers' conventions, trying to challenge their views. "Getting people who write viruses to become 'ex' writers is, after all, a purpose of my research," she says.

Reasoned debate, she admits, doesn't always work: "I tell them why what they are doing is not always responsible behaviour, and they tell me how what they do is not bad. We go round and round a few times and usually part knowing that we just don't agree." But it's still early days, she says. New technologies have accelerated at such a breathtaking rate, it is hardly surprising that the ethical debate has been left lagging behind.