The Gentlemen's Review of Computer Viruses in the Media
by George C. Smith
About a month ago the English anti-virus firm Sophos released a report on virus incidence around the world, as compiled from its client experience. KAK Worm was numero uno. It did not make the local TV news. It was not featured above the fold. Oh, chroniclers of Love Bug, why have you forsaken us?
So surprised was I by the absence of virus-mania, I had to review Love Bug stories for quotes laden with hysteria and the astonishing.
"The speed of the 'love bug' has Michael Vatis worried sick," came from a May 7 Associated Press piece. "We're in a reactive mode," said one source. "It's like buying fire insurance once the house burns down." Love Bug, it seemed from this piece, had quickly torched the virtual house we all inhabit.
On May 7, the London Observer Service wrote: "Just by clicking on your [mail] you could have turned your PC into a pile of useless plastic. It is every computer user's worst nightmare and it's coming soon to a screen near you. Brace yourself for the supervirus." The service went on to breathlessly claim that future damage due to the coming "supervirus" plague would be "almost incalculable."
On May 18, a politician railed for the Wall Street Journal: "Until laws are created and enforced internationally which make computer vandals liable for their misdeeds, the only absolute protection from their misdeeds is a pair of wire clippers and a resignation to living in another area." The upshot of this howler seemed to be that everyone is so helpless in the face of computer viruses, the only sensible thing to do is turn off the computer.
And from the AP on June 17: "The 'Love Bug' computer virus is powerful proof that the threat from opposing armies is no longer the central danger facing America . . . the White House says." If this does not strike you as unreasonably apocalyptic, I'll rephrase it: computer viruses are more menacing than real war.
As a keen observer of the media's fascination with and reporting on the computer virus phenomenon over the past decade, I've written frequently on the topic. In March of 1992, Michelangelo virus was the featured player and while it is not directly comparable to Love Bug, the flavor of the media coverage was identical.
"Thousands of PC's could crash Friday" ran in USA Today. "Deadly Virus Set to Wreak Havoc Tomorrow" was one headline from the Washington Post. Another from the Los Angeles Times was "Paint It Scary!" Prior to March 6, it was claimed that Michelangelo would fell as many as 5 million computers. This was a figure that became the object of some acrimony and teeth-gnashing in the anti-virus community in the months immediately following.
Like Love Bug, Michelangelo gave the press an adrenaline rush. In fact, it would not be stretch to say it was the first virus to get the media well and truly jazzed. One newspaper, for example, insisted the publicity on Michelangelo had saved the day. Wearing a surprisingly straight face, another reporter told me in 1992 that "everyone's PC's would have crashed" had the media played the computer virus story differently.
In eight years, the media approach to computer viruses has, from a qualitative standpoint, changed remarkably little. Typically, the news provides little context and almost no recognition of the history of computer viruses. These are sacrificed in favor of repetitive declarations of disaster which superficially seem ominous and surprising to those unfamiliar with the topic but which are deadeningly familiar to those on the inside. Source quote is invariably supplied by vendors or someone too obviously selling something. If viruses are the equivalent of electronic war and the war is hell, it is never so hellish that it cannot be used to mount an advertising campaign. And if experts do provide complexity in their statements, it is frequently passed over in favor of the short, sweeping generalizations.
There has, however, been one substantial change. The number of news pages, real and virtual, devoted to Melissa, Love Bug et al, has exploded and will doubtless continue to do so. More, in this case, has not meant -better-. It has just meant . . . more.
Some of the faults in the media's attempt at reporting on the subject can be described by a number of structural points and biases. As someone who gets asked to comment for the press, I've experienced them first hand.
1. The need generate interest through the appearance of conflict. Purely educational news stories are rare because they are a hard sell in a highly competitive news environment. They are hard to fashion into "edutainment" and tend not to be thought of as sufficiently interesting or sexy by themselves. Therefore, computer viruses are not addressed as a now normal continuous day-to-day problem part and parcel with networked computing, but rather as spasmodic disasters in which a virus erupts volcanically and computer scientists race against time to contain it (e.g., Melissa, LoveBug). In these convulsions, the virus falls upon an unsuspecting nation and generates Congressional hearings which provide an outlet for the repetitive and it's-so-obvious-it's-stupid airing of concern (e.g., Melissa, Love Bug). However, little changes and quiet reigns until the next spasm, when the entire cycle is repeated. The overall impression given is that the nation suffers from a lurching incompetence in which it regularly teeters on the precipice of electronic apocalypse.
This is also served by a second case, one in which a vendor press release on a virus erupts volcanically and competitors race against time to contain or equal it. (Examples: Timofonica, Y2K viruses, BubbleBoy, Hare Krishna, Boza, et al.) When this artificial process gets rolling, news -of- the virus tends to be far more omnipresent than the virus itself. Follow-up stories explaining this are generally not well-played, if they are published at all.
2. The need for scapegoats, fallguys and creeping evil. Virus-writers, when anonymous, have been the best images of creeping evil. Through the middle of the decade, the Australian virus-writing group known as VLAD did yeoman's service in this area. Around the same time, a virus-writer who was arrested in England, the Black Baron, was said in press reports to have been part of a conspiracy in which a virus-writing e-pamphlet was distributed to criminal elements in America, a considerable exaggeration of the actual state of affairs (unless you considered a handful of nincompoops running underground bulletin board systems archfiends).
However, as more photos of virus-writers have been published, revealing a tubby, reclusive Sad Sack living in New Jersey or a sweaty, mumbling Philippino college student -- unimpressive as cackling malefactors -- the evil is shifting to . . . Microsoft (for the ubiquity of its security hole-ridden software).
3. The need for instant figures and statistics. The Americans press has an insane fetish for numbers. It is slave to those who wield them. It has never been enough to simply recognize that computer viruses are a problem to be steadfastly and continuously dealt with. Gravity can be assigned only by the attachment of figures, even if they are manufactured on the spot or detached from the real world. Quotes from Love Bug coverage ranged over the following: "[unspecified] billions of dollars," two . . . five . . . seven . . . or ten billion, all courtesy of Reuters, and Associated Press' whopping fifteen billion.
By comparison, it is edifying to compare virtual virus damage estimates with the costs associated with a real virus, influenza, which kills 20,000 nationally each year (40,000 in years of severe epidemics) and sickens 10-15 percent of the world's population. Influenza's costs can be split into direct -- those which relate to the supply of medical care and development and delivery of medicine -- and indirect, lost or decreased productivity by the hospitalized, homebound and ill at work. (This is an entirely legitimate comparison. The media has always been enamored of analogies drawn from biology in computer virus stories so it certainly seems fair for this essay to do the same.)
Anyway, estimates of direct loss in the United States due to influenza vary from six to twelve billion, according to information from the Centers for Disease Control and the International Influenza Educational Panel.
The newsmedia and/or manufacturers of statistics on computer virus damage, then, ask the reader to swallow the idea that one computer virus costs the country more than the 20,000 -dead- and, on average, 110,000 hospitalized, during an entire flu season.
Remarkably, a CDC estimate of 12 billion dollars in expense for a severe epidemic that leaves 40,000 or more dead is also still lower than the nuttiest Love Bug estimate.
This kind of trivial idiocy can be attributed to simple pandering. The newsmedia demands statistics and so it gets them, no matter how distorted or lacking in common sense when placed within the context of other national risks that it may consider mundane news. "How many people did computer viruses kill last year?" might occasionally be a bracing question for journalists to mull over when desirous of perspective on all things computer virus.
In addition, the Love Bug cost estimates, among computer virus cost estimates in general, do not precipitate insistent pleas for Federal emergency relief cash outlays from individuals and companies afflicted by them. Should they? What is an estimate of costs due to loss of productivity and overtime caused by simple mistakes and incompetence in computing technology? Should a Congressional hearing be convened?
4. A propensity for the crackpot quote. "Everyone's PC would have crashed," "it's every computer user's worst nightmare," "[Love Bug] was powerful proof that the threat of powerful armies is not the central danger facing America . . . " are examples of reporters writing stories that grasp too hard for eyeballs. The working assumption here is that the more fantastic a story appears to be, the more people will be persuaded to read it. Pieces that suffer from this malady can safely be disregarded as trash.
5. Herd mentality and duplication of effort. Once a scary computer virus story gets going, everyone wants -their- scary computer virus story. The same quotes appear multiple times in different sources. The phenomenon becomes unstoppable when everyone speedily gives up asking pointed questions, instead being satisfied that the validity of a news piece be determined by the number of competitors who can be seen doing it exactly the same way.
6. Love of dyspeptic futurism and/or silver-bullet fads. Computer virus story spasms are always accompanied by "what-if" companions that air reams of speculation about potential nefarious outcomes: BubbleBoy with an erasing payload, Love Bug with a corrupting routine, a "supervirus," an electronic "Ebola," a Timofonica that actually invades your cell phone rendering it into a lump of plastic.
History is not taken into account. Little mention is made that computer viruses with fairly immediate destructive payloads tend to reveal and destroy themselves, curbing their potential for spread. Or those that are genuinely destructive but cagey about it -- like Michelangelo and CIH -- don't cause the end of world computing, either.
Stories may appear that portray hapless anti-virus industry workers in unusual ways, all for the sake of appearing highly techno-savvy and cutting edge. A recent TIME Digital comes to mind, with experts tricked-up in green plastic hazardous materials suits by an out-of-control magazine art department. Of course, this to create the image that they share something, what this is remains nebulous, with virologists who work with dangerous biological pathogens. Never mind that I have -never- seen even -one- computer virus researcher kitted out in hazmat plastic nor have I ever heard the vain idea from anyone who professionally dissects PC viruses that such work might be similar to those who try to plumb the depths of those viruses responsible for fatal human hemorrhagic fevers.
The siren call of silver-bullet computer virus remedies is also hard for the media to resist. Over the years, a variety of people have been successful at persuading reporters that nirvana is either here now or just months away. One notorious gaffe, printed in a large computer magazine, was that an anti-virus program mass marketed by Microsoft, which came to be regarded as one of the -worst- examples of its type, was proclaimed as the -last- such software anyone would need. Invariably, all such claims and stories prove meretricious, the products ballyhooed, ephemeral or stunningly unsuccessful. "Immune-system" technology is regularly spotted, too. Never mind that as a future fix, it has been "a coming thing" for most of the decade. If this seems harsh on employees of IBM who research in this area, apologies are extended. Doubtless their work is interesting and worth support. But at the end of the day, computer viruses will still exist, regardless of the wishful thinking of tech writers intoxicated with glee over a whiff of some potential technology.
I know I've taken you on a rather bile-soaked view of how the mainstream media delivers news of computer viruses. Hope it didn't spoil the mood. The point has been to tickle critical thinking about the lore of the computer virus. Keep in mind that whatever is said above the fold, the safe money bet is that by the next working day it will be business as usual even though the news of it may claim the opposite.
This article originally appeared on SecurityFocus.com -- reproduction in whole or in part is not allowed without expressed written consent.