Interview with Vesselin Bontchev
(Alive Magazine)

Many people know the name Vesselin Bontchev from discussions on Virus-L/ comp.virus. His formal biography says:

In 1988 Mr Bontchev became interested in computer viruses and soon afterwards his freeware anti-virus programs were the most popular in Bulgaria. In 1990 he became the director of the Laboratory of Computer Virology at the Bulgarian Academy of Sciences - a laboratory, created mainly due to his efforts. Since 1991 he is working on his Ph.D. thesis in the Virus Test Center at the University of Hamburg, Germany.

Since 1990 Mr Bontchev is the Bulgarian representative in IFIP's TC-11 (Computer Security). He is also a founding member of CARO (the Computer Anti-virus Researchers' Organization), a founding member of VSI (the Virus Security Institute), and a member of EICAR (the European Institute for Computer Anti-virus research).

Mr Bontchev's main fields of interest include computer viruses, computer security, integrity and data protection, encryption, number theory....etc.

Leaving formalities for a moment, Vesselin Bontchev speaks for "Alive" exclusively:

Why did you get interested in computer viruses?

Initially - because they are interesting, of course. I mean, they are challenging; doing something that is unusual and clever. Later I discovered that my knowledge in this field can help many other people and this motivated me additionally.

When did you start to deal with computer viruses and could you describe shortly your work?

It all began in the Spring of 1988. At that time I was working on a voluntary basis as a consultant for the only Bulgarian computer-related magazine - "Komputar za vas" ("Computer for You"). I was asked to provide some help in translating a German article (from the German magazine "CHIP", I believe) about computer viruses. I didn't know German at all, but I knew a lot about computers. The article was initially translated by a professional translator, who knew German perfectly, but knew nothing about computers and the special jargon used in this area. There was a lot of funny stuff in the draft translation... But I digress.

In short, the article was about computer viruses. I read it, and the subject captivated me at once. Knowing from personal experience that the quality of the information obtained from such sources as popular magazines tends to be rather low, I used the information system of the Bulgarian Central Institute for Scientific and Technical Information to do a library search by keywords and then to read all available serious journals that had some articles on this subject. The most valuable source of information proved to be "Computers & Security", and in particular the papers from Dr. Fred Cohen and Prof. Harold Highland - two of the very few people that seemed to know what they were talking about.

After reading all that was available to me at that time (not that much; there weren't so many articles published on this subject at that time), I decided that while an interesting mental exercise, computer viruses couldn't be that dangerous, because every moderately competent computer techie should be able to spot them at once. Also, it was obvious that all the hype in the popular media was caused mostly by people who knew near to nothing on the subject. Even the viruses that existed at that time didn't seem anything particularly clever - I remember that when I read the description of Brain, I spent long time wondering what the *other* part of the code could do, because it was clear to me that anybody with some experience in assembly language programming could fit the described functionality into less than one kilobyte of code - so what were the other 2 Kb of the virus *doing*?

In short, I wrote an article for "Komputar za vas", explaining my view that computer viruses can't be a real threat. What I have overlooked was that by far not all computer users are technical experts who know by heart the internals of their machines... Just a couple of days after my article was published, two guys came at the editor's office of the magazine and proudly announced that they have found a virus! It was what we are calling now Vienna.648.Reboot.A, but nobody knew it at that time. The two guys had already dealt with the infection in the company they were working for (they were system programmers, after all) and demonstrated us how well their custom-made disinfector works... disinfecting the only copy of the virus left in their disposition. Of course, I wanted to examine "the beast" and to understand how exactly it works and why. The problem was, it was already gone! I visited the office in their company, and after a long and fruitless search for an infected file, we finally found a piece of paper in the trash bin, that contained the hex dump of an infected file... I got that piece of paper and entered the code with DEBUG byte-by-byte. Then I disassembled it, understood it, wrote my own disinfector (and even a vaccine) for it... This is how it all began for me. My second case was Cascade, then Ping_Pong, then the Bulgarian viruses began to appear (Old_Yankee, Yankee_Doodle), and then came the Dark Avenger...

My work now? Well, I am working in the Virus Test Center at the University of Hamburg, under the leadership of Prof. Klaus Brunnstein. I am in charge of maintaining our virus collection. I am also analysing viruses, helping people who are asking virus-related questions from all parts of the world, writing my Ph.D. thesis, testing anti-virus products, and many other less exciting things.

Why did you leave Bulgarian anti-virus scene and moved to Germany?

Because I was proposed the wonderful opportunity to live and work under excellent working conditions in place with a very high reputation in the computer anti-virus field - and also to get a Ph.D. there.

Are you familiar with present virus/anti-virus situation in Bulgaria?

It depends on your definition of "familiar". I have a pretty clear idea of what is happening there, although I am not as much familiar with the virus/anti-virus scene there as I used to be.

It is known that certain animosity existed between you and Bulgarian virus writer known as Dark Avenger some time ago.

That is put very mildly, yes.

What do you think about him today?

The same bad things I've been always thinking about him. Sorry, but my education does not allow me to list them here.

What is your general opinion about virus writers?

Most of them are just irresponsible juvenile people (I am tempted to say - kids), who want to "establish" themselves and to impress their peers, by doing things that they perfectly know are regarded as "bad" by the society, but for which, as they also know very well, this same society is unlikely to be able to punish them. They like so much to brag about their "exploits" and "civil liberties", but it is actually the same old graffiti writing, only in a more modern, electronical form. In short - vandals.

What do you think about beneficial viruses and artificial life? Why are people willing to reject the concept of beneficial viruses and artificial life in general?

I don't feel competent to comment about artificial life, because I am not expert in this area. I don't believe that computer viruses are a form of artificial life, however.

People don't like to even hear about the so-called "beneficial viruses" mostly because the term "computer virus" is already loaded with negative meaning in the public opinion - maybe incorrectly, just like the term "hacker", but that's it how it is. I would suggest to anybody who is doing serious and responsible research in the field of self-replicating code, to use some other term, if they don't want to be misunderstood by the general public. After all, what Dr. Cohen is understanding under the term "beneficial virus" is *very* different from those nasty little programs that the general public is acquainted with.

Do you think that is unethical to claim that computer viruses can be beneficial and why?

Now, that's a difficult question... Well, it depends. It depends on what are the motives of the person making the claim. Is he a legitimate scientist who is trying to use an interesting phenomenon for something useful for the humanity? Or is he just an irresponsible person who is looking for an excuse for his asocial acts and is trying to masquerade them under the scientifically-looking term "research"?

However, I think that even the legitimate researcher ought to emphasize that he is talking about something completely different from the real computer viruses known to the general public - in order not to be misunderstood. Also, I think that he should clearly (and loudly) distinguish himself from the virus writing crowd. Research - yes, but seriously done, in clear and strictly controlled environment, by people who have the knowledge and experience to conduct it. Just like the kind of research into biological experiments.

You often mention "real viruses". What are they and how are they related to the concept of "beneficial viruses" ?

I am convinced that what most people understand under the term "computer virus" cannot be beneficial. When the average user hears the term "computer virus", he almost certainly does not have a valid definition for it, but just as certainly he has a pretty clear view of what the term is about. I call this a "real computer virus". Real computer viruses are always bad.

My professional understanding of "real virus" is this:

"Something has entered my computer without my authorization and is replicating there, potentially doing damage."

The accents are on (a) entered without authorization, (b) replicating - i.e. modifying executable objects and wasting time and disk space, and (c) maybe it is doing damage, maybe it is intentionally, maybe not intentionally.

The average user's understanding of "real virus" is probably:

"Something is here, I didn't allow it to be here. I've been told it can spread like living being and that it can destroy my data/programs. I don't like it."

Two years ago I asked the net to send me the arguments why they think a "good" virus is a bad idea. I have collected dozen reasons. I do not claim that computer viruses cannot be beneficial, but any virus that pretends to have this property must not violate any of the 12 conditions.