Ethical Look At Computer Viruses Essay, Research Paper

No Security:

A Ethical Look At Computer Viri

Nottingham i

Outline

Thesis: There is no way to stop people from writing viruses and there shouldn’t be, however penalties need to be employed for those who damage or cause harm in any way to other people and computers.

I. The Australian Taxation Office (ATO) had to close down due to a computer virus infection.

A. Australian computer vandals are believed responsible for hundreds of viruses which have caused millions of dollars in damage worldwide.

II. This background raises some questions

See IV.A-IV.H

III. There is no way to stop people from writing viruses and there shouldn’t be, however penalties need to be employed for those who damage or cause harm in any way to other people and computers.

IV. Answer questions

A. Because the writer is not the one to physically harm the computer, is he doing anything wrong?

1. Thucydides

2. Ten Commandments

3. Jesus

4. Epicurus

5. Thomas Hobbes

B. As of right now, it is not illegal to write viruses, but should it be?

1. Martin Luther King, Jr.

2. Bibical Tradition

3. Thomas Aqunias

C. Should anti-virus researchers be allowed to write viruses to learn more about them?

1. Jeremy Benthan

2. John Locke

D. Are “benevolet” viruses wrong?

1. Epictetus

Nottingham ii

2. Jeremy Bentham

E. If a virus causes a fire is the person who wrote this virus responsible?

1. Aristotle

2. Bibical Tradition

F. If a virus causes a death is the person who wrote this virus responsible?

1. Bibical Tradition

2. John Stuart Mill

G. If someone steals a virus and infects a computer should the writer be in trouble?

1. Aristotle

2. Ten Commandments

H. Should the ‘Zines be punished for giving out potentially damaging code?

1. Bible

2. Thomas Aquinas

3. Metabolis

Nottingham 1

No Security:

A Ethical Look At Computer Viri

On the 16th of February, 1995, the media across Australia was crowing the news, that the Australian Taxation Office (ATO) had to close down due to a computer virus infection. A computer virus is a malicious program which can alter, damage, or destroy files and computer memory and may attack and spread without its victim’s knowledge. There are at least 8600 known viruses worldwide and new ones are being added at the rate of 200 a month. This story received front page notice in the newspapers, and a prominent place in the television news bulletin of every station. This virus that “Harry McBungus” created when he was a high school student, shut down the ATO national network for a full day, and anti-virus experts were still working on cleaning up the problems three days later. All 26 branches of ATO had to be isolated while the virus was finally tracked down to a branch in a Melbourne suburb.

Australian computer vandals are believed responsible for hundreds of viruses which have caused millions of dollars in damage worldwide. Australia is infamous for virus groups such as Viral Labs and Distribution (VLAD), Computer Virus Research and Information Service (CRIS is not based in Australia but many of its writers are), and Revelation among others. Millions of computers around the world are hit by viruses each year, in spite of out laying billions of dollars for anti-virus protection (italicized words are defined in the glossary). It is general knowledge in the virus community that the average virus attack takes almost two and a half days to eradicate. Even then, a quarter of the companies hit by a virus can expect to be re-infected within thirty days. Viruses can be programmed to attack on contact or to sit dormant like a time bomb, set to go off on a specific date. Australian viruses with names such as Puke.393, Aussie Parasite, Dudley, and Incest have created havoc in both private enterprise and government departments.

This background raises some questions. A virus writer rarely ever actually touches a computer that he infects because viruses contaminate a computer through infected disks, BBS’s (Bulletin Board Services), on-line services, the Internet, and innocent looking programs (called “Trojans” because they are very much like the Trojan Horse that was the demise of ancient Troy) that really do something useful but later will cause damage. Because the writer is not the one to physically harm the computer, is he doing

Nottingham 2

anything wrong? As of right now, it is not illegal to write viruses, but should it be? Should anti-virus

researchers be allowed to write viruses to learn more about them? Non-harmful viruses have been written to search for and destroy other more destructive viruses. These “benevolent” viruses are helpful, but still rarely ever tell the user if they are on his computer and are hard to get rid of if do warn you they are present. Are these viruses wrong?

Architectural and engineering firms many times have very expensive monitors for showing their final work to customers. These monitors can be set to have a perfect photographic quality picture but not for very long because the screen starts to generate a lot of heat. A certain virus changes the monitor into this mode and if no one is around to turn it off the monitor will begin to melt and eventually it can start a fire. Is the person who wrote this virus responsible for the fire if one ever happens?

Another related story involves a hospital whose blood bank computer was infected with the Cookie Monster Virus. Every two weeks this virus displays a picture of Sesame Street’s Cookie Monster and asks “What do I like to eat?” If the word “cookies” is typed the virus will hibernate for two more weeks, if the answer is wrong, the contents of the computer are overwritten and all the information is lost forever. The hospital staff at the blood bank didn’t know the answer or was afraid to try it. Because they couldn’t get to the blood type records, a young man died. Should the person who created this virus be charged with killing this man?

Many times someone will write a virus and then brag to their friends about it. If the friends then take the codes and infect a computer who then should be in trouble? The writer? The friend? Both of them? Electronic magazines (known as ‘Zines or E-Zines) such as VLAD and CRIS publish the programmers codes for making the viruses they write about, which makes it possible for someone without programming knowledge to make a live, undetectable, mutating virus (otherwise known as a full-stealth, polymorphic virus). Should the ‘Zines be punished for giving out this potentially damaging code? While there are many other questions that could be asked these are some of the most important. For the answers, we will consult the Greeks, the Bible, Moral Law, and Utilitarianism.

It is the authors felling that there is no way to stop people from writing virus and there shouldn’t

be, however penalties need to be employed for those who damage or cause harm in any way to other

Nottingham 3

people and computers. With the following ethical research the greatest philosophers with be consulted for there view of this thesis.

Because the virus writer is not the one to physically harm the computer is he doing anything wrong? Not according to the Athenians who lived around 400 B.C. The historian Thucydides wrote, “…the standard of justice depends on the equality of the power to compel and that in fact the strong do what they have the power to do and the weak accept what they have to accept…” (8 [All quotes are from Ethics in America by Newton unless otherwise stated]) Quite simply; might makes right. Since these people have invisible power (might) over those who are at risk of computer infection what they do can’t be considered wrong. The Bible disagrees. The eighth of the Ten Commandments tells us that “Thou shall not steal.” (71) While the virus writer doesn’t actually take the data, he does destroy it or make it unusable and it is therefore not in the position of the rightful owner. However Jesus says, “For if you forgive men their trespasses, your heavenly Father also will forgive you; but if you do not forgive men their trespasses, neither will your Father forgive your trespasses.” (86) Once the person has indirectly (through the virus) trespassed on to the infected computer we are to forgive them, or we can not expect forgiveness from God. The Utilitarian Epicurus, wrote in The Extant Remains that “…since pleasure is the first good and natural to us, for this very reason we do not choose every pleasure, but sometimes we pass over many pleasures, when greater discomfort accrues to us as the result of them…”(157) Since the pain caused by viruses is greater than the pleasures gained by the writer then it is wrong. The Moral Lawist Thomas Hobbes would disagree with the Athenians solely because he believes that, “Nature hath made men so equal in the faculties of body and mind as that.. when all is reckoned together the difference between man and man is not so considerable as that one man can there claim to himself any benefit to which another may not pretend as well as he.”(104) He is saying that might does not make right because all men are created, for the most part, equal. Overall, the majority of the philosophers agree that it is wrong to harm the property of another, whether the harm is the result of a fist or viral codes.

So now that it is established that malicious destruction is wrong why shouldn’t we outlaw any possibility of it happening by saying that you can’t even write a virus? Martin Luther King, Jr. wrote in

his letter “A Letter From the Birmingham Jail” that “an individual who breaks a law that conscience tells

Nottingham 4

him is unjust, and who willingly accepts the penalty of imprisonment in order to arouse the conscience of the community over its injustice, is in reality expressing the highest respect for law.”(152) It is reasonable to say that he would be willing to believe the opposite for the lack of a just law. If we try to make a just law by arousing the conscience of the community we still would be “expressing the highest respect for law” and would not be committing a crime in the process. It is not possible to find a place in Biblical tradition that address’ the fact that there should be a new law because God would be admitting that he was wrong, or at least not entirely correct, so we must look to the other traditions. Thomas Aqunias in Summa Theologica wrote, “Consequently every human law has just so much of character of law as is derived from the law of nature. But if in any point it differs from the law of nature, it is no longer a law but a corruption of law.”(97) The moral law acid test of a law could be to see if it [the law] conforms to the natural law. The paragraph above shows that willful damage is wrong, so saying that it is illegal to write viruses wouldn’t be an unjust law or a law contrary to the law of nature.

One can now see that it may be a good idea to outlaw viruses altogether. But the best way for anti-virus personnel to learn how a virus works is to create one. Also, writing a virus is undisputedly one of the easiest ways to master assembly level programming which is the most powerful tool any computer user can have. To write a good (or bad depending on your view point) virus, you have to know how to trick the computer into believing that what it knows exists, the virus, really doesn’t. Computers would never have become the incredible tools they are today if LIM (Lotus, Intel, and Microsoft) had not found a way to trick them into thinking that what they knew didn’t exist, memory over 640 kilobytes, really did. Maybe viruses aren’t as bad as they first seemed.

So far we have only looked at the bad in viruses and came to the conclusion that they should be eliminated, but what if we added their potential good to the equation? Utilitarianists would weigh the help and harm of the technology and decide from that. To determine this we would use Jeremy Bentham’s formula of finding out the intensity, duration, certainty, and propinquity of the pain and pleasure among other parts of the equation.(158) It is the writers belief that if the public was more educated and virus writers didn’t distribute their “art” then the pleasure would be greater than the pain. However, this is only

one tradition. John Locke wrote in his Treatise of Government, Part II that “men may be restrained from

Nottingham 5

invading others’ rights, and from doing hurt to one another…”(110) This may seem like it is saying that viruses should be illegal but when one stops and thinks about it, if someone made it more difficult for one to learn an important skill, of if they prevented the discovery of a secret that would help all of society then they would be “invading others’ rights, and…doing hurt to one another.” What Locke meant, in this writers opinion, is that one may do whatever you wish to benefit yourself, such as learning assembly language through viral programming, as long as it doesn’t harm society by invading others rights, such as publishing a dangerous virus.

It is clear that it is wrong to publish viral code if the virus can cause damage, but what if the virus just searches out other viruses and then destroys them? Isn’t this still an invasion of property? Epictetus says in his Moral Discourses, Part I, “What then is to be done? To make best of what is our power, and take the rest as it occurs.”(93) So he would agree that the people who created the destructive viruses should do what is in their power to make the situation right or “to make best what is in our power.” Using Jeremy Bentham’s measure of pleasure and pain, a Utilitarian would take into account the short amount of time it takes to detect and delete the virus (duration), the amount of grief that the good virus can save (intensity), and the fact that the bad virus will cause harm (certainty) we can see that there is nothing unethical about a non-harmful virus even though it still invade a persons privacy.(158)

Now to change the subject slightly. If a virus caused physical harm, such as a fire because the computer’s monitor over-heated, should the virus writer be held responsible? If we were to ask Aristotle he would want to know if the virus writer meant for the monitor to over-heat and start a fire or if he was just trying to damage the monitor. Assuming that it was just meant to get the monitor hot and distort the picture then the fire could be “owing to ignorance”(44), in otherwords it was involuntary. Aristotle taught that “…virtue is concerned with passions and action, and on voluntary passions and actions praise and blame are bestowed, on those that are involuntary pardon, and sometimes also pity…”(45) Since the person that wrote the harmful code was ignorant to the possibility of a fire then pardon should be granted. If, however, the person did mean to cause a fire then blame and the proper punishment should be

administrated. Biblical Tradition says in Exodus, “you shall give life for life, eye for eye, tooth for tooth,

hand for hand, foot for foot, burn for burn, wound for wound, stripe for stripe.”(71) Providing that the

Nottingham 6

virus writer is caught, his property should be burned.

But what if the virus caused a death? Should the punishment be worse? Biblical Tradition says, “Whoever strikes a man so that he dies shall be put to death. But if he did not lie in wait for him, but God let him fall into his hand, then I [God] will appoint for you a place to which he may flee.”(71) If the virus writer didn’t mean for the virus to cause a death, as was the case with the Cookie Monster virus, then he should not be executed. The Utilitarianist, John Stuart Mill, wrote in On Liberty, “Whenever, in short, there is a definite damage, or a definite risk of damage, either to an individual or to the public, the case is taken out of the province of liberty, and placed in that of morality of law.”(182) Death is a definite damage (at least to those that have lost the loved one. Socrates said that there was no proof that death was in anyway harmful to the person that died.) So therefore the person that caused the damage has to be punished.

When a virus writer brags to his friends about a virus he has created and the friends go and infect a computer did both the writer and friend do something unethical? We have already established that the friend should be punished for willfully harming others and their property. So what about the writer? We could use Aristotle’s arguments that he didn’t voluntarily infect a computer but that it was done by someone else’s will. Just because you tell someone that you own a gun and then that person uses that gun to kill another human doesn’t mean that you had any part in the murder. Aristotle goes on to say in Politics, “For man, when perfect, is the best of animals, but, when seperated from law and justice, he is the worst of all; since armed injustice is more dangerous, and he is equipped at birth with arms, meant to be used by intelligence and virtue which he may use for the worst ends.”(61) The virus writer used his “arms” for intelligence and virtue when he programmed the virus as a programming exercise. His friend was seperated from law and justice because he used his “arms” to steal and hurt.

Viral Labs and Distribution (VLAD) and Computer Virus Research and Information Service (CRIS) publish viral code that is not compiled claiming that in that form the viruses are inactive. While that may be true, compiling the source code takes no programming knowledge and can be done by anyone that owns or has access to a computer. They are making it possible for the public to “write” their own

viruses. Is there anything unethical about his? The Bible tells us that it is wrong to “cause your brother to

Nottingham 7

stumble.”(87) Thomas Aquinas’ Summa Theologica says, “…man acts for an end by his reason and will.” (97) So if a person always acts will a reason, it would be helpful to examine VLADs reason for publishing their ‘Zine. They state:

Aims and Policies

+———————+

I guess it’s not our aim, but one of our main policies is that we don’t release and destructive code. Some people out there will argue that a virus in any shape or form is destructive.. what I’m talking about is purposeful destruction such as formatting people’s hard drives, writing random sectors, etc. The reason for this is that it makes thing bad for everyone. It helps further the theory that all virus authors are nerdy *censored*s who have nothing better to do [than] destroy a computer.

The reason we publish this magazine, is because we have something to offer that could be of use to others. We hope to educate people on how viruses work, and do this by giving examples. There are people out their that might have fun inserting their own nick in the virus and spreading it to try and be elite, but I’d say a majority of people actually get something useful out of our mag. Anti Virus research is totally legal as far as I know, and our magazine would certainly help someone who’s in this field. Or on the other hand it could be used by a beginning virus author who needs help to get their virus off the ground. Information is a free commodity, we’re just passing it along.”

If the reasons quoted here are the real reasons that VLAD publishes their magazine then the only people that are doing anything wrong are the people that compile and distribute the working virus. For example, there is nothing wrong with fertilizer. Without it farmers that provide us with fruits and vegetables and the ranchers that provide us with meats would have a much more difficult time growing the plants they need to do their job. However, sometimes people choose to misuse the fertilizer and other normally helpful chemicals for the making of devices that kill massive numbers of people at a time. Are the manufactures doing anything immoral by selling their product? Of course not. In addition anti-virus

Nottingham 8

researchers can update their own programs to look for the newly published viruses as soon as the electronic magazines come out. If Viral Labs and Distribution didn’t publish their code, then anti-virus personnel would have to first isolate the new virus and then spend months disassembling it.

In conclusion, it seems that times most respected philosophers concur with this authors thesis, that virus writing is fine as long as no one is hurt.

“Ultimately, there is no security.”

-Dr. Fred Cohen, Professor, University of Cincinnati

Nottingham 12

Bibliography

Anders, E., Atwater, D., Baker, K., Bergen, K., Duarte, B., & Goldsmith, K. (1993). The Norton Anti- Virus User’s Guide. Cupertino, California: Symantec Corp.

Booth, Stephen A. (1995, June). Doom Virus. Popular Mechanics, pp. 51-54 & 128.

Ludwig, Mark. (1991). The Little Black Book of Computer Viruses. Tucson: American Eagle Publication, Inc.

Lundell, Allan. (1989). Virus!. Chicago: Contemporary Books

Metabolis (1995, April 27). Aim & Policies [Electronic Magazine]. Viral Labs and Distribution, pp. 8-9

Newton, H. Lisa. (1989). Ethics in America. Englewood Cliffs: Prentice Hall

Symantec. (1993). The Norton Anti-Virus: Version 3 for DOS and Windows [Computer Anti-Viral program]. Cupertino, California: Symantec Corp.

Nottingham 9

Appendix A

Throughout this essay I have avoided the use of the word “hacker” when referring to virus writers. The correct way of referring to virus writers would be “cracker.”

The definition of a cracker is one who attempts to break into a system via cracking/guessing user passwords. Most of the crackers are young teenage punks who are very malicious and seek to get their kicks from destroying or altering data on a system. The media often times mistakes the cracker for the hacker. Also note that a cracker’s level of education/intelligence on the system and its inner workings ect. is very low.

The hacker on the other hand is an individual who yearns for knowledge. The hackers are very knowledgeable individuals. They often times know several programming languages, work extensively with the inwards and outwards of UNIX, have a firm understanding of all the TCP/IP implementations and protocols. They keep abreast on all security related issues involving computers. Breaking into a system for a hacker is a thrill, it is a challenge that they take on. The hacker takes much delight in exploring the system from the outside/inside searching vigorously for misconfigurations, bugs, and holes in the operating system that would allow them to break into the machine. Once in the system the challenge had been completed and they have succeeded in breaking in. It is against hacker ethics to alter any data aside from the logs that are needed to clean their tracks. They have no need or desire to destroy data as the malicious crackers. They are there to explore the system and learn more. The hacker has a constant yearning and thirst for knowledge that increases in intensity as their journey progresses.

Nottingham 10

Glossary

Anti-virus protection Usually a program that searches for known viruses and then destroys them

Assembly level programming Most difficult way to program. See CODE for example

Code Viruses are written with code like this:

push bp

mov bp, sp

les bx, [bp+4]

mov cx, [bp+8]

mov ax, 0

A working virus would have hundreds of lines like this

Compiled Compiling changes the “words” seen in CODE to the ones and zero that a computer understands

Data The information on a computer. Files, directories, ect.

Hard drive The memory [storage] of a computer

Formatting Deletion of all data

Source code Same as CODE

Writing random sectors Overwriting random spots on the hard drive to resulting in corrupt files

Nottingham 11

Virus writer Since computer viruses are programs and not natural

devices like organic viruses they must be created. The virus writer creates them.