Virus Writing Serves No Educational Purpose

Few days ago, AVIEN members published their thoughts on the computer viruses class, that was announced by University of Calgary. Soon the University responded with a news release defending the virus writing classes, so Robert Vibert sent us another AVIEN commentary, acting as a follow-up to this release.

Members of AVIEN and AVIEWS expressed their disappointment with the announcement of the University of Calgary to advance with a course which will include the writing of viruses as part of the curriculum.

We strongly believe that this course sends the wrong message to students and to current authors of malicious code, by providing a legitimizing factor.

We also disagree with several statements made in the University’s press release of May 29th.

While the University claims to be “developing the next generation of computer professional who will be proactive in stopping computer viruses” preventing viruses has nothing to do with writing viruses or other malware.

We agree that “It is na??ve and dangerous to think that virus writers can be stopped without a better understanding of how they operate.” but that this understanding does not involve the writing of malicious code, which merely reflects rudimentary programming ability.

If one wants to understand viruses, one need only examine one or more of the 70,000+ viruses that already exist, not write new ones!

AVIEN and AVIEWS have never claimed “that teaching students about viruses is “wrong” or “dangerous” because this kind of software is bad.” From the start, we have said that we encourage the spread of information, but recognize the fundamental disconnect between learning how to produce a virus and the entire gamut of information about how viruses work.

We disagree with the position that “a critical element of being able to stop these viruses is to have sufficient knowledge about them to be able to write them. That will come as no surprise to IT professionals who understand that to solve a computer problem it helps to understand what caused the problem.”

The main problem of computer viruses is not the fact that they exist, but that new ones appear constantly, which results in expensive upgrades to defence systems. Encouraging people to not write viruses has the desired effect of reducing the inflow.

We find the statement “It is clear that anyone who claims they understand computer viruses well enough to stop them also understands them well enough to write them” particularly perplexing as our membership includes the largest group of individuals who deal with the virus problem on a daily basis, and have done so for as long as viruses have been around. AVIEN and AVIEWS have not found it necessary to write viruses to defend against them.

This concept that writing viruses is a skill needed to understand them has been proven wrong numerous times over the past 10 years in academic circles and at professional conferences, and, perhaps most important, in the combined years of experience accumulated by our membership.

The claims that “A necessary step in stopping viruses is that the computer professional could also write one so we are using the “writing” of computer viruses as a teaching method.” is one often used by the computer underground to legitimize their creation of malware. We find it lamentable that the same argument is now being used by a publicly-funded educational institution.

The claim that “Anyone who claims they can fight a virus but could not write one is either uninformed or trying to mislead for other reasons.” ignores the reality that the hundreds of security professionals who make up AVIEN and AVIEWS membership do not need nor use this supposed “skill”. These professionals, many of whom work in Fortune 500 level companies, educational institutions and government, have no agenda other than trying to reduce the influx of new viruses.

As AVIEN and AVIEWS represent the largest groups of professionals, both in the user community and the Anti-Virus vendor community, respectively, we question who the University has been in contact with when they make the claim: “Most of this community accepts the argument that stopping viruses requires sufficient knowledge to also write a virus so they are willing to work with us.” A public letter categorically rejecting this assertion has been posted at the AVIEN web site and is signed by an ever-growing number of people involved in anti-virus work.

AVIEN and AVIEWS continue to state their willingness to assist the University with the development of a course on malware which does not include the writing of viruses. We also re-affirm our disagreement with the concept that writing viruses is an activity worthy of legitimization by a University.