By: Eric Wolferman
Editor’s note: This “Digital Input” column appeared in E&P Technical, a special supplement on newspaper production published Oct. 22.
Many of us spent the better part of a week last month battling a computer infection called “Nimda.” It wasn’t the first time our networks have been crippled by foul play. In fact, we are being attacked with alarming frequency.
At a time when security concerns are paramount, there are some unfortunate similarities between terrorist activities and computer infections. Terrorism and acts of violence are hardly new phenomena. What makes them so insidious today is the enormous damage that can be done with such little effort. Jetliners traveling at 400 miles an hour smashing into skyscrapers filled with thousands of people can cause indescribable destruction, wrought by just a handful.
A hundred years ago, we had technology that could cause destruction, but not nearly to the extent of the World Trade Center tragedy. It is the very advancement of technology that has multiplied the potential danger.
Wrongdoing in the computer world is not new, either. But like advances in air travel and architecture, advances in computer communications have magnified the damage that can be done with a single punch. The Internet has brought us great benefits, but it has left us vulnerable to massive attacks by a single individual. A would-be cyberterrorist can strike from great distances with anonymity and little chance of being discovered.
Authoring a virus or a worm — the two are distinguishable chiefly by the fact that the former needs to attach itself to a host program and the latter does not — has become easier than ever. There are actually do-it-yourself kits available on the Web that will allow even novices to write infectious programs. And these programs have become more pernicious, as evidenced by a new generation of worms that target servers on a network and overload them to the point of failure.
Fighting computer infections is costing us billions of dollars in resources and time. Research analysts estimate the financial damage caused by the “ILOVEYOU” virus last year was as much as $8.7 billion. But, for all our efforts to curb their spread, the viruses and worms seem to keep coming faster and harder.
New laws prescribe ever-harsher penalties for hackers. A violation of the federal Computer Fraud and Abuse Act is punishable by five years in prison and up to $250,000 in fines. In other parts of the world, punishment can be even more severe. A man in China was sentenced to death a couple of years ago for hacking into the computer network of a bank and shifting funds to his own account. Yet nothing seems to deter those code writers bent on computer vandalism.
Approaches to controlling the infection problem raise some of the same concerns as the war against terrorism: balancing freedom and privacy against stricter scrutiny, for example. Should authorities risk breaches of fundamental rights by “profiling” terrorist suspects in the name of tighter security? Likewise, should we risk jeopardizing our closely guarded rights of privacy in the interest of diminishing anonymity (and impunity) in cyberspace? It is the contemporary manifestation of the age-old dilemma of democracy: How do we protect the interests of the many while preserving the rights of the individual?
Regardless of the dilemma, something must be done. Certainly we must practice safe computing in our plants — with adequate firewall protection, up-to-date anti-virus software, proper education of users, and other precautions. But despite these efforts, it seems that fighting infection is taking more of our time, not less.
Given the billions of dollars in damage, it is surprising that the business community has not launched a full-court press to combat the culprits. Anti-virus software alone will not stop the onslaught; as fast as we can introduce vaccines, cyberterrorists will circumvent them. It is an endless game. To break the cycle, we must get to the source — those who are motivated, for whatever reason, to cause disruption and damage.
We must continue to improve the means to trace the origin of the offending programs. And we must continue to escalate the penalties — including the notion of reparation. Perhaps holding those who cause the infections responsible for the costs they inflict on their victims will provide a degree of deterrence.
The Web and newsgroups are peppered with opinions about how to stop infections and their creators, ranging from better education of would-be deviant programmers to capital punishment. But, before you can do anything to them, you’ve got to identify them. Along those lines, here’s an idea that doesn’t get much press: rewards.
It is known that most virus and worm writers are young, between 14 and 24 years of age. It is not unreasonable to assume they associate with others who are ardent computer devotees. To that crowd, a lucrative bounty could mean a lot of new computer equipment — and it may be just the right incentive to smoke out perpetrators.