Interview with Robert Slade
(Alive Magazine)

Rob Slade, the author of previous article and guest of Alive in this issue, is a data communications and security specialist from Vancouver, British Columbia, Canada. His first love was teaching, and he got into computers because of an interest in what they could do in improving the education process in the public school system. He still has links with the education system in British Columbia with both grade school and the college system, and writes and speaks for the computer educators in the province. He has a B.Sc. from the University of British Columbia, a M.S. from the University of Oregon (in Computer and Information Science Education) and a Diploma of Christian Studies from Regent College in Vancouver. He is the founder of the DECUS (Digital Equipment Computer Users' Society), Canada Education and Training SIG (Special Interest Group). He is also the founder of the DECUS Canada Communications SIG and DECUS Canada Security SIG.

Rob Slade has both formal training in data communications and exploration with the BBS and network community, and has done communications training for a number of the international commercial seminar firms. His technical jobs have involved everything from support of terminal emulation programs to satellite communications. He considers communications technology to be the most interesting of the various computer fields.

His research into computer viral programs started when they first appeared as a major problem "in the wild". Acting initially as the unofficial archivist for the budding research community, he has since become known for "Mr. Slade's lists" of antiviral software vendors, antiviral reviews, antiviral BBSes and virus books. One of the working group for the VIRUS-L FAQ [Frequently Asked Questions], he is best known for a series of review and tutorial articles which have recently been published as "Robert Slade's Guide to Computer Viruses".

He is more widely known for his series of daily technical book reviews which appear on appropriate newsgroups and mailing lists, including alt.books.reviews, rec.arts.books.reviews, the *.books.technical groups and topics related to the individual titles...etc...

However, it is the time to let Mr Slade to say something himself...

Why did you get interested in computer viruses and could you describe shortly your work?

My first exposure was the flurry of messages surrounding the Lehigh virus and then the Jerusalem (Israeli, as it was then known) virus in the fall of 1987. I started collecting postings related to viral reports, as I was interested in what it had to say about the operating systems and functions. For a time I was the unofficial "archivist" for this material, before VIRUS-L started up.

I kept on archiving the virus material. In 1990, I noticed an increasing call for assessments of antiviral software, and started doing reviews. The list I had to collect in order to find out who made AV [Anti Virus] software became the CONTACTS.LST, the first of what Fred Cohen called "Mr. Slade's lists". It was followed by the quick reference list of antiviral software reviews. In 1991, just before work got started on the FAQ [Virus-L Frequently Asked Questions], I started writing a tutorial column on viral programs. My involvement with Fidonet, when I started to post the columns to the VIRUS and VIRUS_INFO echoes, became the basis of the AVBBS list. Ironically enough, when I went to turn all of this into "Robert Slade's Guide to Computer Viruses" (and that title was *not* my idea, blame Springer-Verlag), the work I had to do on the book meant I had to *stop* doing active virus research. I hope to be able to get some more done this year, but my financial situation is not hopeful.

What did you write in your book?

I tried to write a practical book for the average user or manager who wants to know what is happening, and to get some protection. As far as possible, it is written in "plain language", and tries to define the terms clearly so that people don't have to be experts to begin with. In fact, I stated outright in the Preface that the one group it is *not* intended for is the virus research community.

I included reviews of all the virus related books I could find (plus a couple of general security ones and some fiction). There are also a large number of software reviews of MS-DOS antivirals, Atari antivirals and MS-DOS general security. I am, in fact, trying to get materials together for an updated version, and have just sent out a general call for review copies.

What are the aims of your call for discussion about viral morality?

1) To clear the air about the confusion regarding virus exchange as opposed to legitimate research into artificial life and "good" virii.
2) To promote discussion between vx and AV people.
3) To promote discussion of computer ethics overall.

Let's make some clarifications of the terms used in your article first. What do you mean by "normal computer environment"?

Mostly I mean a normal working environment, as opposed to a research lab or other specialized situation. Fred Cohen also refers to a "viral computing environment", and sometimes I am opposing normal (Von Neumann) architecture to the VCE.

What are "normal computer functions" ?

Copying (Input/Output), storing, decisions based on accessible data and predetermined programming, calculations, the basics.

You say - "Operating system upgrades could not guarantee universal coverage." What is "universal coverage"?

I use "universal coverage" here to refer to the fact that everyone who wants the upgrade should be able to have access to it. This does not address any concerns about copyright or payment. Since a viral program does not have centralized distribution and control, then those who had *not* received the upgrade could not request it from a central location. If there was centralized control, then there is no significant difference between this and "normal", non-viral, distribution.

Why do you think that the concept of reproduction is dangerous?

Reproduction is only really dangerous in terms of filling up memory and disk space on a given machine, so I suppose it is reproduction *and spread* that holds the inherent danger. A program which continues to make copies of itself, and to spread to other machines, is going to have an unknown effect on subsequent machines/programs/systems, and that effect is much more likely to be damaging than to be helpful. Playing with viral programs is most akin to playing with genetic research: if it gets away from you, you have no idea where it is going to end up or what it will do. In fact, viral programs have a *greater* risk of running wild than do biological organisms, since the computer "ecosystem" is much simpler. Having computers "get sick" and crash is much less severe than having people get sick and die, but it is demonstrably simpler to create a computer virus than to create a viable biological organism. Logically, therefore, every virus is potentially dangerous.

With the exception of "system" and companion viral programs (and I only except them because I haven't thoroughly studied them), every known viral program "in the wild" creates some kind of problem for the normal, average, everyday computer environment. Historically and statistically, therefore, every virus released into the wild has been actually dangerous.

These considerations are only necessary in the "normal" computing environment. Research on computer viral programs is not a problem if the research area is isolated from the "real world" to avoid release. Indeed, Fred Cohen's idea of a viral computing environment is a very exciting one, and I'd love to do some work on it. It is likely, however, that programs from the current computing environment would not run in a VCE, and programs meant for a VCE would not run under current architectures. That kind of VCE *would* be inherently safe, but it isn't the type of work that seems to be going on right now.

Are the polemics about "good" vs "bad" viruses possibly arising because of lack of good and unique definition of computer virus?

Got it in one. I think this is the heart of many disagreements about whether a "good" virus is possible or not. Fred Cohen, for example, defines the terms in a way which allows a lot of theory to be developed and looked at with the tools of logic and number theory. It does not, however,translate well into the "real world".

What do you mean by "real world"?

The world inhabited by real computers and the average "Joe (or Jane) User", who doesn't really care about Turing machines, but *does* care about getting this report done by five o'clock.

How do you define computer virus?

My definition, which is not accepted by everyone, is that a computer virus is a program which is written (intended) to copy and spread itself (to other systems) without the knowing (informed) assistance of the user.

How do you define worm and what relation do you see between the two?

I accept the definition of a worm as a reproductive/parasitic program which spreads without specifically attaching or associating itself with a given program, particularly over networks and/or mail links. However, I see this as a distinction without a difference. By my definition, a worm is a specialized type of virus.

What do you think are the basic "technical" reasons against virus writing?

In brief:
a) virus writing is a simplistic task that does not contribute to learning about computers *or* artificial life,
b) the overwhelming majority of current viral programs are malign, either by design or stupidity. The second reason applies only to writing and release: if you write a virus and keep it under control only the pointlessness reason applies.

Do you think that is possible to obtain absolute controllability of anything?

No. But I'm not a fatalist.

Assuming that major population of computer viruses is PC/DOS population, do you think that this fact says possibly something about inherent (technical) weaknesses of such a configuration?

Actually, while I agree that PCs have weak security, viral programs can spread on *any* platform: they don't use any special functions. Fred Cohen did work on several platforms. Also, David Chess [ from IBM Watson Research Center ] has an interesting take on this: he says that the PC platform is *very* secure - you have to convince the owner/user to run a program of yours or a subsequent generation, and that tactic has worked very well. In addition, I think the number of viral programs has more to do with the number of machines available, rather than any inherent strength or weakness of the platform.

Are worms (or breaking techniques) pointing to the vulnerabilities in today distributed systems?

Generally, no. Everyone in data security knows that the *major* weaknesses are bad passwords and social engineering. Again, I don't think that viral programs have anything additional to point out here.

What is your idea of a good testing of anti-virus software?

I test every package of antiviral software as a whole, and as it would appear to the naive (novice and uninformed) user. This is because, while most computer users have heard of a computer virus, the majority do *not* have a realistic idea of what a virus is or how it works. Almost every article on viral programs which I have seen in the news media has presented an inaccurate and warped view, so it is important to assess not only how many viral variants an antiviral product can identify, but in what the documentation says, and how well the installation procedure protects against a possible pre-existing infection.

What is your opinion about exchange/sale of ("malicious" PC/DOS) virus collections to legitimate evaluators/evaluating centers/producers of antiviral products or researchers?

I am interpreting your question as referring to virus writing and exchange (vx) groups and individuals offering their viral programs for sale, or for trade in exchange for other code which they don't have, to av developers, researchers or evaluators. As a reviewer, I would not buy such code or make such trades. I am providing a service, at my own expense and to my own cost, and I simply could not afford to pay money for the garbage that most such offers are made on. I would not provide virus code to anyone who I was not absolutely certain would keep it to themselves, or to other like minded AV researchers. Those who produce the best antiviral software hold similar opinions, and the argument that they "benefit" from the activities of vx groups is utter nonsense. There are a number of companies who do "buy" or "give rewards for" antiviral code. I find their activities to be shameful, their products to be mediocre at best, and I would not provide them with any viral code from my own collection, pitiful as it is.

I am speaking of the situation as it currently exists. The discussion of the possibility of "good" viral programs or artificial life is not at issue here since current vx groups have not, to date, produced anything which benefits either objective.

Why people are willing to reject the concept of beneficial viruses or artificial life in general?

For those who are actively involved in antiviral research and development, the issue is not so much one of professional bias, as some vxers argue, as the daily realization that the current situation has almost nothing to do with artificial life or "good" virii. Artificial life and artificial intelligence have been studied for years, and, while we can now get some use out of expert systems and certain graphical algorithms, it will be a long and arduous task to create anything like real life or intelligence. Those who are working in the virus field are simply too busy to have time to spend in this pursuit. (Maybe if vxers would stop releasing virii, AV people would have the time to look into it.)

Regarding ethical reasons against virus writing do you think that is possible to suggest unique ethical model for human behavior?

It certainly wouldn't be easy. People in this century are not used to thinking of ethics or morality as anything other than an academic and philosophical discussion.

Isn't it easier to concentrate to legal aspects, e.g. to establish appropriate laws in existent legislative system(s)?

Easy answers to difficult problems are almost always wrong. In general, laws are safeguards against minor breakdowns of social morality. When the network of social ethics does not exist, laws are useless. In any case, the law in Canada makes virus "release" illegal - but that hasn't eliminated the problem.

Isn't the question of morality of virus writing somewhat exaggerated? After all there are more important problems in the world - poverty, hunger, wars, drugs abuse, etc. Isn't that just another way to avoid discussions about real (more important) problems?

There are lots of real and important problems in the world. I have addressed only one, because it is an area in which I have specialized knowledge. It also touches on other problems such as that of ignorance, confused thinking, and lack of ethical considerations in technical topics. I am not ignoring other problems, but, as Edmound Burke said, the only thing necessary for the triumph of evil is for good men to do nothing. Or to put it in religious terms (which seems to make many people so violently upset that they lose all rationality):

"Mortal man," [God] said, "tell your people what happens when I bring war to a land. The people of that country choose one of their number to be a watchman. When he sees the enemy approaching, he sounds the alarm to warn everyone. If someone hears it but pays no attention and the enemy comes and kills him, then he is to blame for his own death. His death is his own fault, because he paid no attention to the warning. If he had paid attention, he could have escaped. If, however, the watchman sees the enemy coming and does not sound the alarm, the enemy will come and kill those sinners, but I will hold the watchman responsible for their death."

Ezekiel 33: 2-6