What Goes on Inside a Virus Writer
ANNOUNCER: Today on "CNNdot</s>COM": Bitten by the love bug? Mauled by Melissa? If you've been victimized by a computer virus, you might be surprised to learn that writing these destructive programs is not illegal.</s>UNIDENTIFIED FEMALE: I think it's nice that I am one of the good guys.</s>ANNOUNCER: Meet a woman who dissected thousands of viruses and shows us what goes on inside the head of a virus writer. If the summer heat has you singing the energy bill blues, have we got some tools for you!</s>NATALIE PAWELSKI, CNN CORRESPONDENT: So this is going to give me my big answers?</s>MARY BARRETTA, HOST, "THE MONEY PIT": Yes.</s>ANNOUNCER: Find out how to save energy over the Internet. And parents are starting to get a clue about their kids' use of the Internet.</s>UNIDENTIFIED FEMALE: Anything you need to know is on the computer.</s>ANNOUNCER: Children on the Web. It's not all fun and games. This is CNNdotCOM with James Hattori,</s>JAMES HATTORI, HOST: Hi everybody and welcome to CNNdotCOM, I'm James Hattori. The U.S. military came under attack this past week, not on the battlefield, but in cyberspace. A virus-like program known as a computer worm forced the Defense Department to shut down public access to most of its Web sites for almost an entire day. The code-red worm defaces Web sites with the words "hacked by Chinese," and experts say it has spread faster than any computer worm in recent history. People who create worms and viruses do so for a lot of reasons. Recently I met a woman with a rare insight into malicious hackers and the reasons they do what they do. Let's go to the world of the virus writer.</s>UNIDENTIFIED FEMALE: Primarily when we think of virus writers, we read about them in the media, we read that they're evil unethical teenagers, all dressed in black, no social lives, no girlfriends, smoking pot, living in the basement, basically just being pretty anti- social with the total end-goal of ending civilization as we know it.</s>HATTORI (voice-over): Sarah Gordon is no stranger to the dark side, to what motivates the virus writer.</s>UNIDENTIFIED FEMALE: They do it to identify with a social group, they do it in some cases because they feel they've been provoked by people who say they're stupid, unethical, malicious, dressed in black teenagers who listen to too much "Eminem." And they do it because they believe people should have access to all kinds of information, including viral information.</s>UNIDENTIFIED MALE: Sarah, how many espressos have you had this afternoon?</s>UNIDENTIFIED FEMALE: Oh, I don't drink coffee. I stopped two weeks ago!</s>HATTORI: She has spent years interviewing, profiling, and exchanging ideas with the so called "black hat" community. In turn, they talk to her, they trust her. But Gordon is a card carrying anti- virus "white hat." (on camera): And after you'd been in computers for a while, what turned you on to doing virus work?</s>UNIDENTIFIED FEMALE: I got a virus be accident and nobody could help me. So I started asking a lot of people, not just the quote, "good guys," but also the bad guys. I have this problem, can you help? And they helped me, told me how to get rid of it.</s>HATTORI (voice-over): Gordon is an anomaly in the anti-virus industry. Unlike many of her peers, she's female; she's largely self- taught, and she doesn't hesitate to discuss issues of cyber- responsibility with virus writers.</s>UNIDENTIFIED FEMALE: I don't -- I try not to provoke people, or you know, form some opinion. I don't have something I have to prove. I just want to know what's going on.</s>UNIDENTIFIED MALE: We like to do this stuff because it interested us in some strange, some strange internal way we couldn't explain, that we were just called to it.</s>HATTORI: Meet Evan, former virus writer. He doesn't want to be known by his face, or even by his computer handle. Evan could be the boy next door. He likes his cats, does his chores, works legitimately in the I.T. world. Still, he has hobbies alien to most of us.</s>UNIDENTIFIED MALE: And we will sit around and talk about, you know, gee, wouldn't a virus that had a payload, an activation payload that looked for Word documents with the word "confidential" in the summary, and uploaded them to some site on the Internet somewhere so that companies' confidential secrets would be leaking out? Wouldn't that be a really cool payload?</s>HATTORI: Evan says the viruses he wrote never did any harm. He never sent them out, and they weren't executable. While research shows a lot of virus writers act from boredom, Evan says he had different reasons.</s>UNIDENTIFIED MALE: It was some credibility in front of my hacker peers to say, hey, I can code a virus and you can't. There's almost even an aspect of "make them afraid of you," albeit, no real threat was here, but there was the mystique that hey, don't mess with that guy, he could give you a virus.</s>HATTORI: In the United States writing viruses is not illegal. Distribution of viruses is not illegal. Nationally and internationally, it is often the designation "malicious intent" which separates the hobby from the crime.</s>UNIDENTIFIED FEMALE: If I write a virus I'm going to put it on my Web site for my friends to look at, should that be illegal? It's when you actually take it and use it to do something harmful. There are not that many people taking them to do something harmful. It's just that the Internet is so widespread that once one virus gets loose, it can spread so quickly it only takes one.</s>HATTORI: David Smith, author of the infamous "Melissa" virus is one of the first virus writers ever to be prosecuted under computer crime laws. "Melissa" hit more than 1 million personal computers in North America, causing more than $80 million in damage. Another virus, dubbed the "Love Bug" caused billions of dollars in damage worldwide. But even though the person accused of creating it was quickly located in the Philippines, he was not charged. What he did was not illegal in the Philippines at the time he wrote the virus. Both the virus and the anti-virus communities agree on the best protections against getting hit with a virus. High on the list: User education, taking responsibility for preventing virus attacks. Author and security consultant Winn Schwartau has written a book on technology and behavior. He says early intervention, talking to kids about situations they will face in an Internet world, offers some help.</s>UNIDENTIFIED MALE: I am not telling you how to behave, but how would you behave in this situation? And then how would you feel if somebody else behaved that same way, and perhaps you were the victim? Does it work? Is it a two-way street? Is what's good for the goose, good for the gander in cyberspace?</s>HATTORI (on camera): How many viruses are there here?</s>UNIDENTIFIED FEMALE: Well, individual viruses, probably if you count variants, maybe 100,000.</s>HATTORI: You have in this room?</s>UNIDENTIFIED FEMALE: Yes. Different places on different hard drives. And I have got box of discs and they are stacked up.</s>HATTORI: 100,000?</s>UNIDENTIFIED FEMALE: I think it is nice that I am one of the good guys. I think that's probably a good thing.</s>HATTORI (voice-over): Not surprisingly, Gordon says computers and technology haunt her dreams. As the number of people online grows, the number of occurrences of infection grows as well. Gordon cautions that if you are using a computer you will most likely get hit. Former virus writer Evan agrees.</s>UNIDENTIFIED MALE: In my mind I see the field of a genetically perfect cow, and the farmer gets up and comes out in the morning and all the cows are dead because this virus came in, there was no diversity in the heard and they are all dead. And the same thing is happening and has been happening with corporate desk tops.</s>HATTORI: Evan feels no guilt about his past, that he never made his virus codes executable, he says, absolves him from any wrongdoing. What does bother him is the current crop of viruses and virus writers.</s>UNIDENTIFIED MALE: They are not sophisticated people and they are not thinking about what they are doing on any more of a macro scale than to say that, ooh, I will get my name out here, I will be cool, I will have notoriety. It's Spam. There aren't new techniques coming out anymore. At least that's the general feel that I am getting. I sound like crotchety old man -- these kid today and...</s>HATTORI: Meanwhile Sarah Gordon continues to straddle two hostile but interdependent worlds. She says her goal has never been to stop virus writers in their tracks. Still, when even one quits, she breaths a bit easier.