Members of AVIEN and AVIEWS expressed their disappointment with the
announcement
of the University of Calgary to advance with a course
which
will include the writing of viruses as part of the curriculum.
We strongly believe that this course sends the wrong message to students
and
to current authors of malicious code, by providing a legitimizing factor.
We also disagree with several statements made in the University's
press
release of May 29th.
While the University claims to be "developing the next generation
of
computer professional who will be proactive in stopping computer viruses"
preventing viruses has nothing to do with writing viruses or other
malware.
We agree that "It is naïve and dangerous to think that virus
writers can be
stopped without a better understanding of how they operate." but
that this
understanding does not involve the writing of malicious code, which
merely
reflects rudimentary programming ability.
If one wants to understand viruses, one need only examine one or more
of the
70,000+ viruses that already exist, not write new ones!
AVIEN and AVIEWS
have never claimed "that teaching students about
viruses is
"
wrong" or "dangerous" because this kind of software
is bad." From the
start, we have said that we encourage the spread of information, but
recognize the fundamental disconnect between learning how to produce
a virus
and the entire gamut of information about how viruses work.
We disagree with the position that "a critical element of being
able to stop
these viruses is to have sufficient knowledge about them to be able
to write
them. That will come as no surprise to IT professionals who understand
that
to solve a computer problem it helps to understand what caused the
problem."
The main problem of computer viruses is not the fact that they exist,
but
that new ones appear constantly, which results in expensive upgrades
to
defence systems. Encouraging people to not write viruses has the desired
effect of reducing the inflow.
We find the statement "It is clear that anyone who claims they
understand
computer viruses well enough to stop them also understands them well
enough
to write them" particularly perplexing as our membership includes
the
largest group of individuals who deal with the virus problem on a daily
basis, and have done so for as long as viruses have been around. AVIEN
and
AVIEWS have not found it necessary to write viruses to defend against
them.
This concept that writing viruses is a skill needed to understand
them has
been proven wrong numerous times over the past 10 years in academic
circles
and at professional conferences, and, perhaps most important, in the
combined years of experience accumulated by our membership.
The claims that "A necessary step in stopping viruses is that
the computer
professional could also write one so we are using the "writing" of
computer
viruses as a teaching method." is one often used by the computer
underground
to legitimize their creation of malware. We find it lamentable that
the same
argument is now being used by a publicly-funded educational institution.
The claim that "Anyone who claims they can fight a virus but
could not write
one is either uninformed or trying to mislead for other reasons." ignores
the reality that the hundreds of security professionals who make up
AVIEN
and AVIEWS membership do not need nor use this supposed "skill".
These
professionals, many of whom work in Fortune 500 level companies, educational
institutions and government, have no agenda other than trying to reduce
the
influx of new viruses.
As AVIEN and AVIEWS represent the largest groups of professionals,
both in
the user community and the Anti-Virus vendor community, respectively,
we
question who the University has been in contact with when they make
the
claim: "Most of this community accepts the argument that stopping
viruses
requires sufficient knowledge to also write a virus so they are willing
to
work with us." A public letter categorically rejecting this assertion
has
been posted at the AVIEN web site and is signed by an ever-growing
number of
people involved in anti-virus work.
AVIEN and AVIEWS continue to state their willingness to assist the
University with the development of a course on malware which does not
include the writing of viruses. We also re-affirm our disagreement
with the
concept that writing viruses is an activity worthy of legitimization
by a
University.
