Secret world of the virus writer

What drives these mystical beings to create bugs capable of causing computer chaos? ROBERT UHLIG reports

With their potential power to cause considerable economic damage with almost total anonymity, virus writers have always occupied a mystical position in the collective imagination. Hollywood likes to portray them as evil, technopathic geniuses trapped in the bodies of pale, pimply teenagers, hunched at computers in their suburban bedrooms. But the truth could not be further from the image.

Virus writers have a number of notable characteristics. They have strange names, often spelt phonetically and smattered with capital letters, such as dA KuRioUS ChiLD, SuperGh0d and NiTR8 (pronounced nitrate), all members of a virus group called "phrozencrew".

Sociological studies of computer virus writers have found that most are highly educated, middle to upper-middle class males, with a respect for authority coupled to a contempt of hypocrisy, and healthy relationships with parents, friends and girlfriends or wives. They enjoy problem solving, are curious and, invariably, male. In a decade's study into the sub-culture, Sara Gordon, a virus researcher who works for IBM, found no cases of active female involvement.

Eastern Europe, in particular Bulgaria, is widely regarded as the birthplace of virus writing, thanks to a huge army of young and extremely qualified unemployed computer wizards who, because of economic conditions, became adept at cracking the piracy-protection codes on commercial software. After Bulgaria, the scene moved to Canada and the US. Australia, Sweden and Norway seem to dominate the virus scene.

However, Britain can also claim a notable first in computer virus history. On November 15 1995, Christopher Pile, a reclusive unemployed 26-year-old from Devon who called himself Black Baron, became the first person to be jailed for writing and distributing a computer virus. Pile, who was sentenced to 18 months, said he wanted to raise his self-esteem by creating a British virus to rival foreign ones. He wrote two viruses, called Pathogen and Queeg.

Both were "polymorphic" viruses, able to change their characteristics each time they reproduced so they could not be detected by virus detection software. They wiped the computers they infected clean of data, shortly after disabling the keyboard and taunting the user with a message on the screen: "Smoke me a kipper, I'll be back for breakfast . . . unfortunately some of your data won't."

Pile's creations were exceptions. Most viruses do not destroy the computers they attack, and the motivation is often just an intellectual challenge to beat virus detectors and to highlight the deficiencies of computer security systems.

According to Gordon, "justifications vary from 'we do this because we can' to 'we do this because someone said we were not capable of doing it'." Mostly, she said, it is something they just do without ever considering why.

The impersonal, dehumanised world of computers and the Internet has led virus writers to undertake acts that they would scorn on principle in the real world, she said. "The effect of their actions is often seen, at least by them, as affecting machines, not human beings."

With the proliferation of the Internet, virus writing has become easier and the number of virus writers has grown dramatically. Anybody with basic computer knowledge can adapt a virus and add his name to it, and many teenagers do so by using simple pieces of computer code available on the Net.

Melissa is one such virus, created by adapting one of many macro viruses in circulation on the Internet, which exploits a simple programming language used by many Microsoft programs.

After Melissa first struck, the FBI pounced on an unsuspecting businessman, Scot Steinmetz. The virus writer had stolen some of his code, which is why he was suspected. In fact, he was an unwitting pawn and his computer company one of Melissa's victims.

Such simplistic macro virus techniques are scorned by the hard core of the community, particularly as very few copycat viruses reproduce efficiently, with the result that although 17 000 viruses have been identified, only 300 are circulating in the wild. Metabolis, who describes himself as the "fearless leader" of Vlad, a group which developed the first Windows 95 virus, said he had no respect for Melissa's writer. "Macros aren't viruses, they're jokes. They don't deserve the name."

Vlad is inactive but, like most serious virus groups, its 40 members located around the world did not release their creations into the wild. Instead, they traded with other virus groups and largely scorned destructive viruses in favour of viruses that displayed irritating graphics or snippets of text to declare their infiltration of a computer. In doing so, they avoided prosecution.

It is not a criminal offence to write a virus; the crime is to damage someone else's computer or the data stored on it by using a virus, or to incite others to spread viruses.

While many virus writers are mischievous and curious adolescents, others are highly talented programmers with real skills and perseverance who create stylish, elegant viruses that are spoken of with hushed awe by the wannabes of the virus world.

One of the most fascinating of these is an aggressive Bulgarian known as Dark Avenger. When Sara Gordon published an interview she conducted with Dark Avenger in the course of her research, she was nicknamed the Clarice Starling of the virus world and he the Hannibal Lecter.

The interview does indeed read like an excerpt from Silence of the Lambs, particularly after he dedicated a virus to her after she made her first attempt to contact him, via an electronic bulletin board.

"Why didn't you contact me directly?" he asked.

"I was afraid of you," she replied.

"You should see a doctor," he said. "Normal women don't spend their time talking about computer viruses."

When Gordon asked him why he had started writing viruses she stumbled on the motivation that drives the most sophisticated virus writers - a distorted desire to be creative rather than destructive.

"I think the idea of making a program that would travel on its own and go to places its creator could never go was the most interesting thing for me," Dark Avenger replied. "The American government can stop me going to the United States, but they can't stop my viruses."