Members of the Anti-Virus Information Exchange Network (AVIEN) and the Anti- Virus Information & Early Warning System (AVIEWS) reacted with dismay today when they were informed of the intention of University of Calgary Professor Dr. John Aycock to teach the creation of malware as part of a course on Computer Viruses and Malware.

(AVIEN and AVIEWS are the largest grassroots organizations representing more than 5 million PCs and the majority of Anti-Virus developers.)

In response, most AVIEN and AVIEWS members have endorsed the following statement:

We call upon the University of Calgary to review its decision to include the instruction of programming of malware as part of its curriculum. There are numerous ways to instruct students in the subject of malware without resorting to the creation of more viruses.

The creation of new viruses and other types of malware is completely unnecessary. Medical doctors do not create new viruses to understand how existing viruses function and neither do Anti-Virus professionals. It is simply not necessary to write new viruses to understand how they work and how they can be prevented. There are also enough viruses on the Internet already that can be dissected and analyzed without creating new threats.

There is no reason to actually "write" malware to become an expert in the field or to learn how to protect against it. Writing safe programs that demonstrate an infection vector is adequate (to demonstrate a vulnerability) without building in the reproductive sequences. In general, Anti-Virus product developers do not write malicious code, as there is no need to do this to achieve a better understanding of how to defeat viruses. In fact, most have policies against the hiring of virus authors.

Just as a public relations catastrophe would ensue if a virus written in- house by a member of staff of an antivirus company escaped 'into the wild' and its source were correctly traced back to them, would not the University's reputation be sullied, very publicly, when the inevitable occurred, despite your best efforts to mitigate the risk?

There are any number of analogies which can be used to demonstrate the folly of attempting to justify the writing of malware, including that one doesn't need to design a new biohazard or caustic chemical substance in order to learn about effective NBC suits.

AVIEN and AVIEWS members would like to suggest that the University of Calgary include topics such as these in any course on Malware:

- How to use the tools available to help track down malware.
- Techniques of discovery of malware
- How to capture live virus activity on an isolated network.
- How to use data gathered to help close vulnerabilities employed by malware.
- In depth analysis of several well-known viruses of different types, recording their actions in a controlled environment.
- Subject matter relating to prevention, protection, and cure, rather than how to attack and destroy.
- Reverse engineering of malicious code.
- Virus hoaxes, chain letters, and frauds, with a discussion of the relevant legal aspects.

We are also concerned about the message being sent to students by this course. It is entirely likely that students will interpret it as supporting the 'dark side' arguments that the writing of malware is appropriate and motivated by the intellectual challenge and that these activities are pure research. The underlying message remains that the University is condoning virus writing and that they believe it has valid, educational merits. In consideration of these facts, we strongly encourage the University to re- model the course in question in such a fashion as to encourage computer security rather than diminish it.

As an organization made up Security Professionals from industry and other educational institutions, involved in the daily struggle against malicious software, our members would gladly work with Dr. Aycock to explore alternative instructional methods.