In any area of scientific investigation, there is the danger of
overgeneralisation and stereotyping. In the case of virus writers, one
manifestation of this danger is that of assuming that there is some
homogeneous group of people who write viruses, and that it is possible to
talk about the psychology of 'the' virus writer. In reality, there are
different types of virus writers, each with his own nature, circumstances,
skills and ambitions. This paper will not attempt to be all-inclusive; it
will examine three 'types' of virus writers by using case studies of
individuals who fit into these categories:
(a) the young adolescent individual
(b) the college student
(c) the adult/professionally employed individual.
We will try to shed some light on the differences in their make-up, and thus
to assess the difference in the nature of any danger posed by each of them.
If the virus writing population is not as homogeneous as some may assume it
is, then monolithic solutions to 'the problem' (such as blanket or overkill
legislation, certain forms of ethical solutions) may well be much less
effective than is being assumed in certain quarters. We will observe
differences in how they think, how they operate, and in how they view the
rest of the world.
We will also look at the ways in which people may progress through these
classes. This progression will lead us to a fourth category:
(d) the mature reformed ex-writer of viruses.
While the last category is often ignored (since the apparent threat is gone)
it needs to be considered with as much care as the other three types. Not
only are people of this fourth category potentially very skilled technically
in the defence of cyberspace against members of the other three categories,
but they also represent the kind of people into which we hope members of the
other three categories will develop.
The virus writer has been characterized by some as a bad, evil, depraved,
maniac; terrorist, technopathic, genius gone mad, sociopath. This image has
been heightened not only by the media, but by the some of the actions of the
virus writers themselves. Public communications from the writers, in the form
of echo-mail messages, often seem to indicate they are intent on doing as
much damage as humanly possible. Their electronic publications have in the
past reinforced this, and the very fact that they release viruses may seem to
confirm it: these people are bad. This paper argues that this is a gross
oversimplification of the situation, and that the virus writing aspect of
these individuals is not sufficient to characterize them into one group
simply labelled 'unethical people'.
We will show that virus writers are not all the same as each other as far as
their stages of ethical and moral development; we will show that some virus
writers are within normal ethical developmental model ranges as defined by
Lawrence Kohlberg's model of moral development [2].
While we had access to a varied population of virus writers, and the
opportunity to draw a sample from the population, the measurement of the
sample proved to be extremely complex. Rather than use computed descriptive
statistics to make only inferences about the similarities within the
population, we also chose to examine the differences by using case studies.
We have adopted an inductive approach so that we can learn who the 'generic
virus writer' might be by observing instances of actual virus writers. We
believe this is a more sound approach than trying to produce a characteristic
profile to which actual writers can later be matched. We wished to avoid
making many assumptions about what might or might not be in such a
characteristic profile until we had examined some real cases.
The virus writing community is relatively small in comparison with other
underground communities such as the hacking and phreaking communities. There
is no way to define the population exactly; however, if we consider viruses
that are known to exist, we can estimate there could be at most 4500 virus
writers, if one person wrote each virus. We know that more than a few of the
viruses are written by the same person. For instance, there are a number of
viruses that are known to have been written by someone calling himself Dark
Avenger; so, not each of the viruses we know may have an individual author.
When we look at the viruses 'in the wild' as opposed to research viruses or
viruses which are only sent to product development companies for inclusion in
virus scanners, we find approximately 150 examples. Of those, if we estimate
100 as by different individuals, the responses we gathered would constitute
response by approximately half the writers of viruses 'in the wild'. Of
course, we have no way of knowing exactly who wrote what, or if all of our
respondents actually did write the viruses they claim. It is quite possible
that there were respondents who merely wished to participate, or who in fact
deliberately wished to bias or discredit this study. However, we do know that
of our four case studies, every one of them has authored viruses that have
appeared in the wild.
We distributed the survey directly to 47 virus writers known to us. From
those 47, we received 18 individual responses to the survey, which was
distributed to underground bulletin boards in the United States, Germany,
Australia, Switzerland, Holland, and South America. In addition to the 18
responses we received to the survey directly, we talked to an additional 43
individuals involved in the virus writing culture who did not wish to
complete the surveys, but who consented to talk about their motivations and
histories. We received 3 negative (hostile) responses. Total responses: 64.
The confidential survey (Appendix 1) was comprised of questions including
requests for information on social interactions with peers, relationships
with parents and other authority figures, as well as exercises in cognitive
reasoning. We were concerned primarily with the methods of thinking used as
opposed to the 'right' answers. The actual answers were not as important as
the reasons given for the answers. Other questions concerned age, employment
and educational history. Questions were asked to provide us with data
regarding the respondents relationships with parents and peers. The response
to these questions enabled us to see how the individual considers himself to
'fit in' in both his immediate society and society in general. We also asked
questions about conflict resolution to enable us to see what processes the
individual uses to solve problems involving other people.
In order to illustrate reasoning abilities, the following questions were
asked:
- You have four coloured placoloured plates: Red, Blue, Yellow, ae, ease tell me all possible color combinations.
- What number is 30 less than 3 times itself. When you answer this,
please write (or type) for me each step of reasoning you used to
arrive at your answer.
The responses to the these types of questions provide a window into the
reasoning abilities of the individual. Reasoning abilities have been shown to
related to moral development [4]. We asked the respondents to tell us not
only the 'answer' but to describe for us how they obtained the answer.
We included the classic scenario used by Kohlberg when studying the ethical
development of individuals:
Read and consider carefully the following scenario.
In Europe, a woman was near death from a special kind of cancer.
There was one drug that the doctors thought might save her. It was a
form of radium that a pharmacist in the same town had recently
discovered. The drug was expensive to make, but the pharmacist was
charging $2000, or 10 times the cost of the drug, for a small
(possibly life-saving) dose. Heinz, the sick woman's husband,
borrowed all the money he could, about $1000, or half of what he
needed. He told the pharmacist that his wife was dying and asked him
to sell the drug cheaper, or to let him pay later. The pharmacist
replied, 'No, I discovered the drug and I'm going to make money from
it.' Heinz then became desperate and broke into the store to steal
the drug for his wife.
Should Heinz have done that?
Now that you have read it, and considered it, please resolve the
moral dilemma. That is, what are the problems in the story? What
problems does each person have to deal with? Who is wrong, right, and
why?
When you write your response, please include the following points:
Should Heinz be punished for stealing the drug? Did the pharmacist
have the right to charge so much? Would it be proper to charge the
pharmacist with murder? If so, should his punishment be greater if
the woman who died was an important person? What would you have done
if you were Heinz?
We intended the questionnaire to provide information directly as well as
indirectly, as we did not want to make too many initial assumptions.
We received very detailed responses to the questions. For example, to our
question 'Which number is 30 less than 3 times itself?' we received detailed
accounts of the process by which the conclusion was derived. One respondent
stated he arrived at this answer by substituting one number after another
until one worked. Another respondent provided us with an algebraic equation.
x = the number in question
x = 3x - 30 0 = 2x -30 -2x = -30 x = 15
So the answer is 15.
Proof: 15 x 3 = 45 45 - 30 = 15 15 = 15 (reflexive property
I think)
The differences in the responses illustrate the difference in the cognitive
reasoning abilities of the individuals which in turn correlate to the level
of moral development as proven by Kohlberg. According to further research by
Carol Tomlinson-Keasey and Charles Keasey [8] and Deanna Kuhn [9],
individuals who demonstrate at least some formal operational skills on
cognitive tests have necessary skills for development of postconditional
morality.
To develop the case studies, we exchanged electronic mail with some of the
respondents following collection of the survey data. These interviews used
both structured and unstructured formats. We talked with some respondents
electronically using Internet Relay Chat, and the UNIX 'talk' command. Some
of the respondents telephoned us directly. We conducted interviews with some
subjects in person. In some cases, where the identity of the subject was
totally unknown and he did not wish to be identified via mail or talk
sessions where we could netstat him, we arranged for him to login to IRC via
an anonymous host. We then talked on IRC in a private channel.
These interviews provided us a more detailed insight into the life history of
the individuals who had consented to be case studies.
The case study selected is a 16 year-old unemployed male high school student.
He states he is one of three children, and lives with both parents in what is
considered an upper-middle-class home. He describes his relationships with
his friends as daily interactions. He does not express an interest in sports.
He has no formal ethical education. He states his friends are very
self-contradictory, and that they argue frequently. The arguments appear to
be of a philosophical nature; what is worthwhile, what is valid, what is
reasonable. He displays a strong conviction against racism, and bias. He
describes his friends as having no morals. He states he does not play
computer games other than a game that came with Windows. His responses to
methods of conflict resolution are unclear. His response to ethical reasoning
dilemmas fall in the range of stage 2, instrumental orientation/hedonism. For
instance, one of his responses to whether or not it was OK for Heinz to steal
the drug was 'Yes. It was for a good cause'. He states that destructive code
is unethical, and that he has never researched a virus by his own definition
of 'research'. He still writes viruses, and his viruses have been found in
the wild. When asked how he felt regarding his viruses that have been in the
wild, he responded:
Generally, I feel almost sorry for the people who are infected with my
viruses. I believe only three or four of my twenty some odd viruses have
been found in the wild. The rest were distributed via underground
bulletin board systems.
One of the viruses, xxxxx,xxx (named by F-Prot), was found on a CD-ROM
entitled (name deleted). I'm not exactly sure how it got there, but I
know for certain it originated on Canada Remote Systems On-line located
in Toronto. The bait file was probably uploaded to that bulletin board
by a local virus enthusiast.
Conversations with this individual indicated that he has a respect for his
parents and for authority to some degree. He demonstrates in his
communications a knowledge of what is right and what is wrong, and expresses
that things that are illegal are wrong. He indicates that he does not favour
destructive viruses, yet seems to not have any problem with his own position
of having released viruses into the wild. He is respectful to other people,
and tends to be a leader in group situations.
His responses and electronic communication were at all times very polite,
respectful and thoughtful.
The case study selected is that of an 18 year-old virus writer. The subject
is unemployed and living on his own. He grew up with one sister in a
moderately well-to-do family. He enjoys martial arts and has practised them
for several years. He describes his relationships with his friends as close,
and open. He states his relationships with women are good, and that he spends
time daily with his girlfriend. His relationship with his parents is
described as very good, with the normal disagreements. Conflict resolution on
the part of this person is conciliatory and mature. He states that he values
the diversities that his friends possess. When asked about the influence of
others on his life, he responded, 'In virus writing, I respect such authors
as Dark Angel and Masud Kafir not only for their technical programming
skills, but also for the fact that their major viruses are not destructive'.
He indicates that while he recognizes using pirated software is not right, he
occasionally uses pirated software: he buys software when he can afford it.
While he used to play computer games, he claims he now no longer has time.
His ethical background consists of study of Kant, Mill and Aristotle. He
states he feels he is most like Mill, in that one should be able to have as
much freedom as possible without harming another. He states he knows he fails
at this sometimes. His responses to ethical dilemma questions were at level 4,
which would place him at slightly higher than average position according to
Kohlberg's model.
I feel that yes, Heinz should steal the drug as it will save his wife (this
would be my first priority) if there is no other way to get it, he is in the
wrong legally and should be punished if caught.
He defines virus research as a search for truth/facts, objective series of
tests. He states some 'researchers' are actually merely collectors who sell
their viruses for profit, monetary or otherwise. Where and to whom the
viruses go is named as one ethical issue. The possibility of release, as well
as destruction/use appears as another issue. He cites money for viruses and/or
anti-viral software as a grey area.
He states he began writing viruses at the age of approximately 15 when he
found the Stoned virus. He became competent at assembler and has written
viruses in the past three years. He writes viruses for text publication as
well.
[ (1) Adult males are typically at stage 4 and sometimes 5 [10, 2]. The adults
surveyed/observed did not demonstrate five or six at any time of ethical
development, unlike some of Kohlberg's subjects. ]
The adult case study is a single male, who describes himself as living with a
ladyfriend. His income is listed in the middle-income range; he is
professionally employed. He is one of four children, and has completed high
school, with some college. He states the majority of his friends are female.
He describes his relationship with his parents as very good. His relationships
with friends are described as social interactions of a casual nature. Conflict
resolution is addressed in terms of power issues. He indicates hypocrisy and
unethical actions as stimuli for provoking him to anger. For instance:
District Attorney crusades against pornography at election time, has
bookstore operator or adult BBS operator arrested, confiscates/destroys
merchandise/money/equipment but does not pursue the case. Gets re-elected
somehow.
He states his friends do not care much about morals. He states he plays
computer games perhaps 4-5 hours per week, if that much.
He states he does not use pirated software. The responses to cognitive
reasoning questions, and to questions regarding ethical dilemmas place him at
stage four, where obligation to law is above special interests. He describes
virus writing as a pointless exercise. It is not certain whether he has
continued to write viruses, although he has stated he does not really enjoy
programming. He stated he thought programming would get him a good job, which
it did not. This individual is involved in virus distribution, which he states
is 'not illegal'.
The ex-virus writer is a college student; the only child of an upper class
family, raised in an atmosphere where academic performance was greatly valued.
He has never been formally employed, but has worked as a volunteer at a
library (shelving books), and as a volunteer at a hospital where his job was
to help handicapped/geriatric patients. He states he was active in track, and
describes his relationship with his girlfriend as good. However, he states he
did not have a girlfriend until his last year of high school, as he was by his
own definition, 'shy'. His narration of his peer relationships and
interactions closely mirror those of the teen virus writer; he states his
friends do not have morals that are very developed for the most part: '..most
of my friends have not had a reason to question the morals they have been
brought up with, so they have not fully examined their morals. Then again,
neither have I, although I am trying to do so now'. His relationship with his
parents is described as 'not good'. He described them as controlling
individuals who were performance-motivated.
He addresses conflict resolution logically; problems are identified, then
solved. He does not tolerate hypocrisy. Throughout our conversation, which
was conducted in person, he frequently questioned his own morals and values.
He stated that he did not 'think about it' (the morality of releasing or
writing viruses) when he was actually doing it. I asked him specifically if
his viruses were destructive. He stated 'They can't be!'. Like the teen and
college student profiled earlier, he expressed a marked dislike for
destructive code. He began writing viruses out of curiosity. He stated he
quit because he did not have any time for it. He states he sees himself as
somewhat 'obsessive', although his virus writing did not take a lot of his
time. He states he does not use copyrighted software and does not play
computer games any more (he used to play them but they became too big to run
on his computer). He defines research as follows:
Doing significant work towards meaningful results in a field. Running
scanners is not research. Compiling test results is not research.
Disassembling viruses is not research. Writing a new scanner is not
research. Examining the behaviour of viruses and their consequences is
research. Developing and implementing new techniques of detection and
cleaning is research. Classifying viruses in a reasonable fashion is not
research, but it is meaningful science.
He states he cannot say virus writing is ethical, nor can he state it is
unethical, as
there is some degree of that (lack of ethics), but I usual don't think
of it as an ethical issue. I recognize that there is a degree of
irresponsibility associated with most virus writing.
He gave the following reason for deciding to stop writing viruses:
I decided to stop primarily because I no longer have the time to write.
My productivity in writing viruses was directly proportional to my level
of boredom. I contend that my real-world impact is low. None of my
viruses are common in the wild and I have given nobody any information
that they couldn't have figured out on their own. My philosophy has
always led me to create viruses designed to be non-destructive and I
don't intend for anyone to be hassled with one of my viruses. It's a
hobby, and I just don't have time for it anymore. I've also gotten bored
with viruses; they're interesting for a while, but then there isn't much
more to do with them. I really don't know what significantly more
interesting stuff there is to do with viruses.
He made the following suggestion for stopping viruses from being
written/distributed:
Demystify them. If you want people to stop, demystify them. All that
will be left then are malicious people, and you can deal with them.
He stated he quit because he simply had too many other things to do. He also
indicated that he did not want to carry the 'stigma' of writing viruses, and
that had he realised earlier (the consequences), he would have been smarter.
His feeling was that people could be discouraged by demystification and
'character'. He stated that responsible computing should be taught very early.
He states respect for others is important.
People who cut me off on the road used to undergo a thorough drubbing:
bright lights, following, later cutting off and trapping. This was before
I realised how dangerous a game it was that I was playing.
He states he is angered by boasting that has no foundation.
Rock Steady is an example. I wrote an expose file on him and all his
code that I was considering giving out, in which I trashed all his code
and traced its origins... people should not get respect by others if they
have nothing to back it up with.
I had approximately 4.5 hours of interview with this individual in the
naturalistic setting, as well as many hours of electronic interchange and
telephone conversations. I was impressed with his genuine openness,
intelligence, and his apparent honesty and thoughtfulness. His response to the
survey was 13 pages of text, which we discussed at length.
Using the Kohlberg model, his ethical/moral development appears to be at
stages 4, and 5 - occasionally 6, in both thought and action. This is slightly
deviant as he is not at the age where males normally would exhibit these
levels/stages. However, his responses clearly place him there and we have no
reason to doubt them.
He states for instance that the best reason to observe a speed limit is to
prevent yourself from losing control of the car. His responses to the Heinz
dilemma question were:
Heinz clearly should not have stolen the drug, even though it meant his
wife's life. However, this is based upon our society assumptions of
legality and does not reflect my own moral view... The pharmacist has a
right to charge a high price, but he should be morally obligated to
charge an affordable rate... Heinz should certainly be punished for
stealing the drug. Stealing, after all, is still stealing and it is still
a crime. There can't be any 'exceptions' to the law for such cases;
otherwise, what would distinguish 'good' stealing from 'bad' stealing?
And would people think they're doing 'good' stealing and get punished?
However, the sentence should be lenient to reflect the circumstances.
What do these case studies tell us? We see that the individuals are different
in personal characteristics. We see that the adolescent and college student
are at developmental levels that would be expected for their age. We see the
ex-virus writer at the stage (or above) one would expect someone with a mature
view to have, slightly above the norm for his age. We see the adult at an
ethical/moral development stage below what Kohlberg's model states is the
norm.
For purposes of comparison, we solicited control subjects who never wrote
viruses. They were also different in personal characteristics, and their
ethical development according to Kohlberg's model was consistent. However,
the adult control subjects placed in the category defined by Kohlberg as
normal for their age, unlike our virus writing subject. This does not enable
us to conclude anything, but is worth further study, to see if there is
indeed any connection. At this time, all we have proven is that not all virus
writers are the same, and that some virus writers are normal as far as ethical
development goes for their ages.
While these individual case studies would indicate some of the individuals
had some evidence of a relatively high ethical developmental stage, this does
not tell us how they will actually act in a given situation. Ethical
judgements are normative in nature. Of course, in real life, we often make
different decisions than we do in theory [11, 12, 13, 14, 15]. This explains
why an individual could think it is 'wrong' to write computer viruses, and yet
write them and still have ethical standards which generally appear to be
normal or above normal for their age groups. According to research done by
Lawrence Walker and his team of researchers, even when people do operate at
different levels on hypothetical/real life dilemmas, they use reasoning at
adjacent stages on the types of issues [16]. The responses we received agree
with Walker's work.
Research performed by Hugh Hartshorne and Mark May [17] provides an
investigation of the moral character of children aged 8-16 in a variety of
settings. This study also showed that the behaviour of a person in one
situation did not predict his/her willingness to conduct the same behaviour
in another situation. Later research performed by Nelson, Grinder and
Mutterer [18] and Roger Burton [19] found that the aspects of morality do
indeed become more consistent as age level increases.
What sorts of interactions and social experiences allow a person to progress
to the more mature levels of ethical development where their actions are more
conciliatory with their beliefs and values? In Kohlberg's study, we see that
transitive interactions consistently result in change [4]. These interactions,
which are social experiences, facilitate moral growth by introducing cognitive
challenge. These social and verbal exchanges require performance of mental
operations on the reasoning abilities of ones peers. We can observe this form
of interaction in the descriptions our college student gave concerning his
interaction with his peers. We see further evidence of this progression when
we review the sort of interactions described by the ex-virus writer. This sort
of exchange is necessary for progression to the higher levels of ethical
reasoning. At a higher level of ethical development, individuals' ethical
values and actions begin to come closer together. While some don't ever get
there, most do. Some even progress to higher stages, such as stages 5 and 6.
Further studies conducted by Kohlberg and his associates have shown that the
majority of non-criminals are classified in stages three and four, while a
majority of criminals are classified in stages one and two [20]. People who
obey law to avoid punishment or who are primarily motivated by self interest
appear more likely to commit crimes than those who see the law as beneficial
to all of society. Research efforts on youth have shown that a significant
number of deviant youth were in categories one and two, while non delinquents
rank higher [21].
Based on this research, which is by no means definitive, we have observed
that virus writers are not a homogeneous group. They have characteristics
similar to many populations. They vary in age, income level, location,
social/peer interaction, educational level, likes, dislikes and manner of
communication. The ethical developmental models of the young adolescent and
college age virus writers are within the norms for the age groups of the
individuals. From the data collected, it is uncertain what predisposes them
to writing and releasing computer viruses. There is only one common
characteristic, and that is that their ethical development appears to be
within established norms. This is not the case with the adult participant in
the culture. Where adults in the control group exhibit level 3 stage 5 of
ethical development, not one of the adult virus writing respondents answered
any of the questions in a way that would lead us to believe he/she regularly
functions at level 5 development. What does this mean? There are other
segments of the population that do not function at this level, and they are
not judged to be ethically 'deficient'; however, this departure from the norm
would seem to be one factor worth further consideration. We can conclude that
there is no homogeneous group to which 'The Virus Writer' conforms. There are
too many observable differences to categorize them into a generic construct.
However, we can learn from the observations.
In our study, different manners of thinking were observed; different
motivations were observed. No one seemed to target government or military as
the 'subject' of their viruses. In fact, with the exception of anti-virus
product developers, there was no direct 'targeting' mentioned or implied in
any of the interactions. 'The Enemy' was virtually non-existent to the teen
and college student virus writers. 'The Enemy' to the adult respondents
consistently appeared to be 'Society'. The three ex-virus writers varied in
their perception of 'The Enemy'. One saw the enemy as society, but seemed to
feel that he could not 'win' this battle; one stated there was never an enemy
and the third stated that the enemy was 'within' the individual.
Female participation in the virus writing culture appears virtually
non-existent. It is possible that female participation may increase, following
patterns similar to female involvement in other forms of youth deviant
behavioural models.
There are a number of social issues which are related to what is often
perceived as the isolated act of 'computer virus writing' (used here to mean,
distribution to unwilling/unknowing persons). Environmental and social issues
including abuse of substances, child abuse, education, etc., are factors to be
considered when assessing any juvenile crime or dysfunctional behaviours.
Because of this, the multi-disciplinary or interdisciplinary study of this
phenomenon would appear to be the one that will yield the most effective
conclusion.
There are some similarities between the disfunctional behaviour of
distribution of computer viruses to unknowing/unwilling persons and forms of
juvenile delinquency. And, as with the social phenomenon of delinquency, we do
not know why some persons involved in this subculture become chronic 'career'
offenders, beginning early and continuing into adulthood. We do not know what
factors contribute to the continuation of the activity, or what factors can
contribute positively to the desistance or termination of the activity. One
theory that is often advanced is the theory of ageing out, or spontaneous
remission. In work by Michael Gottfredson and Travis Hirschi, it is proposed
that age-crime relationships are constants: not only do chronic juvenile
offenders commit less crime as they get older, but all persons commit less
crime as they age. Therefore, age/crime correlations are irrelevant to the
study of crime [22, 23]. Of course, there are opposing views which purport
that the earlier a person demonstrates antisocial tendencies, the longer they
will continue to commit these acts. This sort of longitudinal theory deals
with life-cycle of delinquency/anti-social behaviour, and attempts to
correlate age/crime. Deterrence theory proposes that the choices young people
make can be controlled by threat of punishment: the more severe, certain and
swift the punishment, the more the deterrence value. Proponents of such
theory support laws to impose severe penalties on virus writers. However, it
is not certain that such strategies work, and in fact they may be
counterproductive. According to research published in the Journal of Criminal
Law and Criminology,
Little reason exists to believe that crime and
delinquency can be eliminated merely by the fear of legal punishment alone.
More evidence exists that fear of social disapproval and informal penalties,
criticisms, and punishments from parents and friends may actually be a greater
deterrent to crime than legal punishments[24].
Sociologist Jack Katz feels
the seduction of crime is a prime motivation for anti-social acts [25].
Research conducted in Toronto, Canada by John Hagan and Bill McCarthy supports
this theory, which places at least part of the cause for this behaviour on
situational inducements [26]. Cultural deviance theory maintains that certain
actions are performed because the individuals adhere to the value system
within their own subculture. We can consider dealing with the persons who
distribute viruses maliciously in the same ways as we deal with others who do
what we perceive to be malicious acts. This includes clarifying our own
positions on what constitutes malicious action; constraint, degree, intent,
knowledge, 'bad tendency' and clear and present danger.
