⌐ copyright 1994 Sarah Gordon. First presented at The 4th International
This paper presents four case studies of individuals involved in virus writing. The research was
conducted by using surveys, and by conducting interviews via e-mail (electronic mail), electronic chat
and in-person sessions. Ethnographic and demographic data were collected, as well as information
relating to how the individuals view their relationships to their peers and to society in general. Some
data relating to cognitive reasoning abilities was collected. This data was used to examine the
individuals' moral development in light of ethical and moral developmental models based on the
research of Lawrence Kohlberg. Gender based issues in virus writing are examined using the model
developed by Gilligan [1].
Introduction
In any area of scientific investigation, there is the danger of overgeneralisation and stereotyping. In
the case of virus writers, one manifestation of this danger is that of assuming that there is some
homogeneous group of people who write viruses, and that it is possible to talk about the psychology
of 'the' virus writer. In reality, there are different types of virus writers, each with his own nature,
circumstances, skills and ambitions. This paper will not attempt to be all-inclusive; it will exami ne
three 'types' of virus writers by using case studies of individuals who fit into these categories:
(a) the young adolescent individual
(b) the college student
(c) the adult/professionally employed individual.
We will try to shed some light on the differences in their make-up, and thus to assess the difference
in the nature of any danger posed by each of them. If the virus writing population is not as
homogeneous as some may assume it is, then monolithic solutions to 'the problem' (such as blanket
or overkill legislation, certain forms of ethical solutions) may well be much less effective than is being
assumed in certain quarters. We will observe differences in how they think, how they operate, and in
how they view the rest of the world.
We will also look at the ways in which people may progress through these classes. This progression
will lead us to a fourth category:
(d) the mature reformed ex-writer of viruses.
While the last category is often ignored (since the apparent threat is gone) it needs to be considered
with as much care as the other three types. Not only are people of this fourth category potentially
very skilled technically in the defence of cyberspace against members of the other three categories,
but they also represent the kind of people into which we hope members of the other three categories
will develop.
The virus writer has been characterized by some as a bad, evil, depraved, maniac; terrorist,
technopathic, genius gone mad, sociopath. This image has been heightened not only by the media,
but by the some of the actions of the virus writers themselves. Public communications from the
writers, in the form of echo-mail messages, often seem to indicate they are intent on doing as much
damage as humanly possible. Their electronic publications have in the past reinforced this, and the
very fact that they release viruses may seem to confirm it: these people are bad. This paper argues
that this is a gross oversimplification of the situation, and that the virus writing aspect of these
individuals is not sufficient to characterize them into one group simply labelled 'unethical people'.
We will show that virus writers are not all the same as each other as far as their stages of ethical and
moral development; we will show that some virus writers are within normal ethical developmental
model ranges as defined by Lawrence Kohlberg's model of moral development [2].
The Generic Virus Writer
Stereotyping is pervasive. It is especially prevalent when a new kind of entity emerges, or a new kind
of person. As there is little reliable information about such new kinds of people, differentiating
between them is difficult. Thus, there is a tendency to assume not only that there is some stereotype,
but also that anyone who can be classified as belonging to the newly perceived group is to all intents
and purposes like all the other members of that group. This often happens when the newly emergent
group is primarily composed of young people.
Moreover, such stereotyping is often accompanied by generalised value judgements. In the case of
virus writers, a common assumption is that they are all bad. While it is certainly true that the
distribution of malicious software is a bad act, and that many virus writers are motivated by bad or
even criminal intentions and desires, it is dangerous to assume that this is true of every person who
ever writes a program that can be classified as a virus. The problem of dealing with the danger posed
by the distribution of malicious software is not simplified by failing to recognise that the people who
write viruses do not form a homogeneous group. They are a diverse group. If we are to address the
problem, we must first recognise its true nature. We must discover how different virus writers
operate, and how they are as people. To this end, we will examine similarities and differences of four
individuals involved in the virus writing culture.
Ethical models
Ethics is sometimes promoted as one solution to the problem of people writing viruses. To explore
what part ethics may play in virus writing, we will examine four virus writers using a model of
ethical/moral development as a base for comparison. We chose to use a model of ethical
development that was universal and longitudinal. Virus writers come from diverse cultures, so the use
of a universal model is desirable. We chose Kohlberg's model for its universal characteristics. The
research done by Kohlberg was not only cross-cultural but longitudinal; it was performed over a
time period of 12 years. Based on this research, he designed a six-step ethical classification model,
which shows a fixed sequence of changing responses with increasing age. It has been shown to be
based on experimental and longitudinal evidence, and is based on 'methods of thinking' rather than
individual actions or decisions [3].
Kohlberg's model
Kohlberg's ethical model provides age trends in three moral levels of development, with two stages
within each level. These levels/stages of development are defined as:
Level 1: Pre-conventional morality. At this level, morals are external.
Stage 1
The first stage consists of the punishment and obedienceorientation (i.e.
there are no real rules; the seriousness ofa 'bad' act depends on the
consequence of the act). This stage is sometimes referred to as the
punishment orientation stage. 'Right' is being obedient to power and
avoiding punishment at all costs.
Stage 2
In stage two, instrumental orientation surfaces (being good to get a
reward or satisfy a need). In Kohlberg's study, 80 percent of moral
judgements of ten year-olds are in this category. This stage is sometimes
called the naive reward orientation stage. 'Right' behaviours include taking
responsibility for oneself, and letting others take responsibility for
themselves.
Level 2: Conventional morality. Parents, social groups and peers play a large role of influence at this
level. Being 'good' is important. Rules may appear 'internalized', but they may be internalized to
avoid punishment or to gain the approval of others.
Stage 3
In the third stage of development, actions are judged on the merit of their
intent. A person has to be able to recognize the point of view of others to
progress into this stage. This stage can be referred to as the
good-boy/good-girl orientation. 'Right' is having a right motive, and a
concern for others.
Stage 4
In the fourth stage, one 'accepts authority', not only because of the
possibility of punishment, but out of a sense of duty to obey rules and
maintain social order. This stage represents authority orientation. The rules
of a society are important in this state: 'Right' is keeping the rules of the
society.
Level 3: Post-conventional morality. Self-accepted moral principles are the mark of this level. In
stage five and six, morals are internalized. The stages in level three involve development of personal
codes of ethics.
Stage 5
Judgements become more flexible in stage five. Rules must be impartial,
and 'The Welfare of the Many' becomes paramount. This stage is
sometimes referred to as the social-contract orientation stage. 'Right' is
keeping the contract.
Stage 6
In stage six, the individual defines right and wrong on the basis of his/her
own ethical principles. Normative ethics, based on self-chosen principles
are applied in all situations. This form of development is consistent with
the ability to perform formal operations (the highest level of cognitive
development) [4]. This stage represents the morality of conscience. 'Right'
is an obligation to the universal principles of equality, justice and respect
for persons.
[Stage 6 may be viewed as a hypothetical construct as no group seems consistently
able to fit in this slot; in fact, this state is often eliminated from some versions of the
model. It is however, a desirable stage, and it is possible for some people to function at
this level some of the time.]
Gender Issues
While Kohlberg's model is well suited for the purposes of this study, the Gilligan model can be
helpful in addressing gender issues of virus writing from the standpoint of ethical development.
In conversations with dozens of individuals involved in the virus writing culture, we have found only
two instances of 'direct' female involvement. One was the girlfriend of a virus writer, and one was a
woman who was involved with the virus writing group NuKE. However, it is uncertain as to whether
or not she ever produced any viruses. According to Gilligan, females progress through different
states of moral reasoning. 'Females are socialized to equate 'goodness' with self-sacrifice more than
are males' [1]. Gilligan's three stages of moral development are described in the next section.
Gilligan's model
Stage 1
Self-interest. At this stage the needs of others are ignored.
Stage 2
Self-sacrifice. At this stage, women sacrifice their own needs/desires for
the well-being of others.
Stage 3
Non-violence, mature thinking; compassion and universal good.
Gilligan states that while male and female children go through stages of being subject to parental
authority and then peer pressure (where right and wrong are determined by the groups they belong
to), females do not progress through the utilitarian and deontological stages. Instead, they view moral
decisions in terms of human interdependency and needs as well as justice and rights. Females
involved in the virus writing culture are typically treated as inferior by a disproportionate number of
members of the culture. Sexual slurs and harassment are common. Women in this culture do not
appear to be able to pursue their goals independently of men. There appears to be little attention to
concepts of equality, or even a pseudo-equality.
While there are opponents to her theory [5, 6, 7], we propose it would help partially explain the
marked absence of female virus writers.
Methodology
While we had access to a varied population of virus writers, and the opportunity to draw a sample
from the population, the measurement of the sample proved to be extremely complex. Rather than
use computed descriptive statistics to make only inferences about the similarities within the
population, we also chose to examine the differences by using case studies.
We have adopted an inductive approach so that we can learn who the 'generic virus writer' might be
by observing instances of actual virus writers. We believe this is a more sound approach than trying
to produce a characteristic profile to which actual writers can later be matched. We wished to avoid
making many assumptions about what might or might not be in such a characteristic profile until we
had examined some real cases.
The virus writing community is relatively small in comparison with other underground communities
such as the hacking and phreaking communities. There is no way to define the population exactly;
however, if we consider viruses that are known to exist, we can estimate there could be at most
4500 virus writers, if one person wrote each virus. We know that more than a few of the viruses are
written by the same person. For instance, there are a number of viruses that are known to have been
written by someone calling himself Dark Avenger; so, not each of the viruses we know may have an
individual author.
When we look at the viruses 'in the wild' as opposed to research viruses or viruses which are only
sent to product development companies for inclusion in virus scanners, we find approximately 150
examples. Of those, if we estimate 100 as by different individuals, the responses we gathered would
constitute response by approximately half the writers of viruses 'in the wild'. Of course, we have no
way of knowing exactly who wrote what, or if all of our respondents actually did write the viruses
they claim. It is quite possible that there were respondents who merely wished to participate, or who
in fact deliberately wished to bias or discredit this study. However, we do know that of our four case
studies, every one of them has authored viruses that have appeared in the wild.
We distributed the survey directly to 47 virus writers known to us. From those 47, we received 18
individual responses to the survey, which was distributed to underground bulletin boards in the
United States, Germany, Australia, Switzerland, Holland, and South America. In addition to the 18
responses we received to the survey directly, we talked to an additional 43 individuals involved in
the virus writing culture who did not wish to complete the surveys, but who consented to talk about
their motivations and histories. We received 3 negative (hostile) responses. Total responses: 64.
The confidential survey (Appendix 1) was comprised of questions including requests for information
on social interactions with peers, relationships with parents and other authority figures, as well as
exercises in cognitive reasoning. We were concerned primarily with the methods of thinking used as
opposed to the 'right' answers. The actual answers were not as important as the reasons given for
the answers. Other questions concerned age, employment and educational history. Questions were
asked to provide us with data regarding the respondents relationships with parents and peers. The
response to these questions enabled us to see how the individual considers himself to 'fit in' in both
his immediate society and society in general. We also asked questions about conflict resolution to
enable us to see what processes the individual uses to solve problems involving other people.
In order to illustrate reasoning abilities, the following questions were asked:
1.You have four coloured placoloured plates: Red, Blue, Yellow, ae, ease tell me all possible
color combinations.
2.What number is 30 less than 3 times itself. When you answer this, please write (or type) for
me each step of reasoning you used to arrive at your answer.
The responses to the these types of questions provide a window into the reasoning abilities of the
individual. Reasoning abilities have been shown to related to moral development [4]. We asked the
respondents to tell us not only the 'answer' but to describe for us how they obtained the answer.
We included the classic scenario used by Kohlberg when studying the ethical development of
individuals:
Read and consider carefully the following scenario.
In Europe, a woman was near death from a special kind of cancer. There was one drug
that the doctors thought might save her. It was a form of radium that a pharmacist in the
same town had recently discovered. The drug was expensive to make, but the
pharmacist was charging $2000, or 10 times the cost of the drug, for a small possibly
life-saving) dose. Heinz, the sick woman's husband, borrowed all the money he could,
about $1000, or half of what he needed. He told the pharmacist that his wife was dying
and asked him to sell the drug cheaper, or to let him pay later. The pharmacist replied,
'No, I discovered the drug and I'm going to make money from it.' Heinz then became
desperate and broke into the store to steal the drug for his wife.
Should Heinz have done that?
Now that you have read it, and considered it, please resolve the moral dilemma. That
is, what are the problems in the story? What problems does each person have to deal
with? Who is wrong, right, and why?
When you write your response, please include the following points:
Should Heinz be punished for stealing the drug? Did the pharmacist have the right to
charge so much? Would it be proper to charge the pharmacist with murder? If so,
should his punishment be greater if the woman who died was an important person?
What would you have done if you were Heinz?
We intended the questionnaire to provide information directly as well as indirectly, as we did not
want to make too many initial assumptions.
We received very detailed responses to the questions. For example, to our question 'Which number
is 30 less than 3 times itself?' we received detailed accounts of the process by which the conclusion
was derived. One respondent stated he arrived at this answer by substituting one number after
another until one worked. Another respondent provided us with an algebraic equation.
x = the number in question x = 3x - 30 0 = 2x -30 -2x = -30 x = 15 So the answer is 15. Proof: 15 x 3 = 45 45 - 30 = 15 15 = 15 (reflexive property I think)
The differences in the responses illustrate the difference in the cognitive reasoning abilities of the
individuals which in turn correlate to the level of moral development as proven by Kohlberg.
According to further research by Carol Tomlinson-Keasey and Charles Keasey [8] and Deanna
Kuhn [9], individuals who demonstrate at least some formal operational skills on cognitive tests have
necessary skills for development of postconditional morality.
To develop the case studies, we exchanged electronic mail with some of the respondents following
collection of the survey data. These interviews used both structured and unstructured formats. We
talked with some respondents electronically using Internet Relay Chat, and the UNIX 'talk'
command. Some of the respondents telephoned us directly. We conducted interviews with some
subjects in person. In some cases, where the identity of the subject was totally unknown and he did
not wish to be identified via mail or talk sessions where we could netstat him, we arranged for him to
login to IRC via an anonymous host. We then talked on IRC in a private channel.
These interviews provided us a more detailed insight into the life history of the individuals who had
consented to be case studies.
Virus Writers
We will attempt to provide a broad classification of virus writers according to a number of
parameters. Our intention is not merely to provide an abstract schema of how such a group might be
differentiated, but to see how actual virus writers may differ. In particular, we are interested in trying
to establish how virus writers develop and progress from early beginnings to whatever it is they end
up doing. To this end, we will examine four cases studies conducted recently. These case studies are
all of people who have at some time written a virus. However, as will become apparent, each of
these people is very different from the others. By examining these differences, we hope to shed some
light on the notion of the 'generic' virus writer, and to ask whether or not such a concept is valid or
useful.
The four initial categories we chose can be described as follows:
The Adolescent
Virus writer aged 13-17; has written at least one computer virus; has
distributed at least one computer virus into the wild.
The College Student
Virus writer aged 18-24; has written at least one computer virus; has
distributed at least one computer virus into the wild. Student in university
or university level classes.
The Adult/Professionally Employed
Post-college or adult, professionally employed; has written at least one
virus; has distributed at least one virus into the wild.
The Ex-Virus Writer
Virus writer who has written and distributed one or more computer
viruses. The viruses must have been found in the wild; the author must
have supplied sufficient proof to enable determination that he did indeed
write the virus; there must be no evidence that he has written or continued
to write viruses for a period of at least 6 months prior to commencement
of this research.
The individuals who were chosen as case studies were taken from the selection of virus writers in
their respective groups. We note that in each group, while the ethnographic data varies, the
responses to questions related to ethical development and cognitive reasoning remained constant
between the individuals we selected and the others in their group.
The Adolescent
The case study selected is a 16 year-old unemployed male high school student. He states he is one
of three children, and lives with both parents in what is considered an upper-middle-class home. He
describes his relationships with his friends as daily interactions. He does not express an interest in
sports. He has no formal ethical education. He states his friends are very self-contradictory, and that
they argue frequently. The arguments appear to be of a philosophical nature; what is worthwhile,
what is valid, what is reasonable. He displays a strong conviction against racism, and bias. He
describes his friends as having no morals. He states he does not play computer games other than a
game that came with Windows. His responses to methods of conflict resolution are unclear. His
response to ethical reasoning dilemmas fall in the range of stage 2, instrumental orientation/hedonism.
For instance, one of his responses to whether or not it was OK for Heinz to steal the drug was 'Yes.
It was for a good cause'. He states that destructive code is unethical, and that he has never
researched a virus by his own definition of 'research'. He still writes viruses, and his viruses have
been found in the wild. When asked how he felt regarding his viruses that have been in the wild, he
responded:
Generally, I feel almost sorry for the people who are infected with my viruses. I believe
only three or four of my twenty some odd viruses have been found in the wild. The rest
were distributed via underground bulletin board systems.
One of the viruses, xxxxx,xxx (named by F-Prot), was found on a CD-ROM entitled
(name deleted). I'm not exactly sure how it got there, but I know for certain it
originated on Canada Remote Systems On-line located in Toronto. The bait file was
probably uploaded to that bulletin board by a local virus enthusiast.
Conversations with this individual indicated that he has a respect for his parents and for authority to
some degree. He demonstrates in his communications a knowledge of what is right and what is
wrong, and expresses that things that are illegal are wrong. He indicates that he does not favour
destructive viruses, yet seems to not have any problem with his own position of having released
viruses into the wild. He is respectful to other people, and tends to be a leader in group situations.
His responses and electronic communication were at all times very polite, respectful and thoughtful.
The College Student
The case study selected is that of an 18 year-old virus writer. The subject is unemployed and living
on his own. He grew up with one sister in a moderately well-to-do family. He enjoys martial arts and
has practised them for several years. He describes his relationships with his friends as close, and
open. He states his relationships with women are good, and that he spends time daily with his
girlfriend. His relationship with his parents is described as very good, with the normal disagreements.
Conflict resolution on the part of this person is conciliatory and mature. He states that he values the
diversities that his friends possess. When asked about the influence of others on his life, he
responded, 'In virus writing, I respect such authors as Dark Angel and Masud Kafir not only for their
technical programming skills, but also for the fact that their major viruses are not destructive'. He
indicates that while he recognizes using pirated software is not right, he occasionally uses pirated
software: he buys software when he can afford it. While he used to play computer games, he claims
he now no longer has time.
His ethical background consists of study of Kant, Mill and Aristotle. He states he feels he is most
like Mill, in that one should be able to have as much freedom as possible without harming another.
He states he knows he fails at this sometimes. His responses to ethical dilemma questions were at
level 4, which would place him at slightly higher than average position according to Kohlberg's
model.
I feel that yes, Heinz should steal the drug as it will save his wife (this would be my first
priority) if there is no other way to get it, he is in the wrong legally and should be
punished if caught.
He defines virus research as a search for truth/facts, objective series of tests. He states some
'researchers' are actually merely collectors who sell their viruses for profit, monetary or otherwise.
Where and to whom the viruses go is named as one ethical issue. The possibility of release, as well
as destruction/use appears as another issue. He cites money for viruses and/or anti-viral software as
a grey area.
He states he began writing viruses at the age of approximately 15 when he found the Stoned virus.
He became competent at assembler and has written viruses in the past three years. He writes viruses
for text publication as well.
The Adult (1)
[ (1) Adult males are typically at stage 4 and sometimes 5 [10, 2]. The adultssurveyed/observed did
not demonstrate five or six at any time of ethical development, unlike some of Kohlberg's subjects. ]
The adult case study is a single male, who describes himself as living with a ladyfriend. His income is
listed in the middle-income range; he is professionally employed. He is one of four children, and has
completed high school, with some college. He states the majority of his friends are female. He
describes his relationship with his parents as very good. His relationships with friends are described
as social interactions of a casual nature. Conflict resolution is addressed in terms of power issues. He
indicates hypocrisy and unethical actions as stimuli for provoking him to anger. For instance:
District Attorney crusades against pornography at election time, has bookstore
operator or adult BBS operator arrested, confiscates/destroys
merchandise/money/equipment but does not pursue the case. Gets re-elected
somehow.
He states his friends do not care much about morals. He states he plays computer games perhaps
4-5 hours per week, if that much.
He states he does not use pirated software. The responses to cognitive reasoning questions, and to
questions regarding ethical dilemmas place him at stage four, where obligation to law is above special
interests. He describes virus writing as a pointless exercise. It is not certain whether he has continued
to write viruses, although he has stated he does not really enjoy programming. He stated he thought
programming would get him a good job, which it did not. This individual is involved in virus
distribution, which he states is 'not illegal'.
The Ex-virus Writer
The ex-virus writer is a college student; the only child of an upper class family, raised in an
atmosphere where academic performance was greatly valued. He has never been formally
employed, but has worked as a volunteer at a library (shelving books), and as a volunteer at a
hospital where his job was to help handicapped/geriatric patients. He states he was active in track,
and describes his relationship with his girlfriend as good. However, he states he did not have a
girlfriend until his last year of high school, as he was by his own definition, 'shy'. His narration of his
peer relationships and interactions closely mirror those of the teen virus writer; he states his friends
do not have morals that are very developed for the most part: '..most of my friends have not had a
reason to question the morals they have been brought up with, so they have not fully examined their
morals. Then again, neither have I, although I am trying to do so now'. His relationship with his
parents is described as 'not good'. He described them as controlling individuals who were
performance-motivated.
He addresses conflict resolution logically; problems are identified, then solved. He does not tolerate
hypocrisy. Throughout our conversation, which was conducted in person, he frequently questioned
his own morals and values. He stated that he did not 'think about it' (the morality of releasing or
writing viruses) when he was actually doing it. I asked him specifically if his viruses were destructive.
He stated 'They can't be!'. Like the teen and college student profiled earlier, he expressed a marked
dislike for destructive code. He began writing viruses out of curiosity. He stated he quit because he
did not have any time for it. He states he sees himself as somewhat 'obsessive', although his virus
writing did not take a lot of his time. He states he does not use copyrighted software and does not
play computer games any more (he used to play them but they became too big to run on his
computer). He defines research as follows:
Doing significant work towards meaningful results in a field. Running scanners is not
research. Compiling test results is not research. Disassembling viruses is not research.
Writing a new scanner is not research. Examining the behaviour of viruses and their
consequences is research. Developing and implementing new techniques of detection
and cleaning is research. Classifying viruses in a reasonable fashion is not research, but
it is meaningful science.
He states he cannot say virus writing is ethical, nor can he state it is unethical, as
there is some degree of that (lack of ethics), but I usual don't think of it as an ethical
issue. I recognize that there is a degree of irresponsibility associated with most virus
writing.
He gave the following reason for deciding to stop writing viruses:
I decided to stop primarily because I no longer have the time to write. My productivity
in writing viruses was directly proportional to my level of boredom. I contend that my
real-world impact is low. None of my viruses are common in the wild and I have given
nobody any information that they couldn't have figured out on their own. My
philosophy has always led me to create viruses designed to be non-destructive and I
don't intend for anyone to be hassled with one of my viruses. It's a hobby, and I just
don't have time for it anymore. I've also gotten bored with viruses; they're interesting
for a while, but then there isn't much more to do with them. I really don't know what
significantly more interesting stuff there is to do with viruses.
He made the following suggestion for stopping viruses from being written/distributed:
Demystify them. If you want people to stop, demystify them. All that will be left then
are malicious people, and you can deal with them.
He stated he quit because he simply had too many other things to do. He also indicated that he did
not want to carry the 'stigma' of writing viruses, and that had he realised earlier (the consequences),
he would have been smarter. His feeling was that people could be discouraged by demystification
and 'character'. He stated that responsible computing should be taught very early.
He states respect for others is important.
People who cut me off on the road used to undergo a thorough drubbing: bright lights,
following, later cutting off and trapping. This was before I realised how dangerous a
game it was that I was playing.
He states he is angered by boasting that has no foundation.
Rock Steady is an example. I wrote an expose file on him and all his code that I was
considering giving out, in which I trashed all his code and traced its origins... people
should not get respect by others if they have nothing to back it up with.
I had approximately 4.5 hours of interview with this individual in the naturalistic setting, as well as
many hours of electronic interchange and telephone conversations. I was impressed with his genuine
openness, intelligence, and his apparent honesty and thoughtfulness. His response to the survey was
13 pages of text, which we discussed at length.
Using the Kohlberg model, his ethical/moral development appears to be at stages 4, and 5 -
occasionally 6, in both thought and action. This is slightly deviant as he is not at the age where males
normally would exhibit these levels/stages. However, his responses clearly place him there and we
have no reason to doubt them.
He states for instance that the best reason to observe a speed limit is to prevent yourself from losing
control of the car. His responses to the Heinz dilemma question were:
Heinz clearly should not have stolen the drug, even though it meant his wife's life.
However, this is based upon our society assumptions of legality and does not reflect my
own moral view... The pharmacist has a right to charge a high price, but he should be
morally obligated to charge an affordable rate... Heinz should certainly be punished for
stealing the drug. Stealing, after all, is still stealing and it is still a crime. There can't be
any 'exceptions' to the law for such cases; otherwise, what would distinguish 'good'
stealing from 'bad' stealing? And would people think they're doing 'good' stealing and
get punished? However, the sentence should be lenient to reflect the circumstances.
What do these case studies tell us? We see that the individuals are different in personal
characteristics. We see that the adolescent and college student are at developmental levels that
would be expected for their age. We see the ex-virus writer at the stage (or above) one would
expect someone with a mature view to have, slightly above the norm for his age. We see the adult at
an ethical/moral development stage below what Kohlberg's model states is the norm.
For purposes of comparison, we solicited control subjects who never wrote viruses. They were also
different in personal characteristics, and their ethical development according to Kohlberg's model
was consistent. However, the adult control subjects placed in the category defined by Kohlberg as
normal for their age, unlike our virus writing subject. This does not enable us to conclude anything,
but is worth further study, to see if there is indeed any connection. At this time, all we have proven is
that not all virus writers are the same, and that some virus writers are normal as far as ethical
development goes for their ages.
While these individual case studies would indicate some of the individuals had some evidence of a
relatively high ethical developmental stage, this does not tell us how they will actually act in a given
situation. Ethical judgements are normative in nature. Of course, in real life, we often make different
decisions than we do in theory [11, 12, 13, 14, 15]. This explains why an individual could think it is
'wrong' to write computer viruses, and yet write them and still have ethical standards which generally
appear to be normal or above normal for their age groups. According to research done by
Lawrence Walker and his team of researchers, even when people do operate at different levels on
hypothetical/real life dilemmas, they use reasoning at adjacent stages on the types of issues [16]. The
responses we received agree with Walker's work.
Research performed by Hugh Hartshorne and Mark May [17] provides an investigation of the moral
character of children aged 8-16 in a variety of settings. This study also showed that the behaviour of
a person in one situation did not predict his/her willingness to conduct the same behaviour in another
situation. Later research performed by Nelson, Grinder and Mutterer [18] and Roger Burton [19]
found that the aspects of morality do indeed become more consistent as age level increases.
What sorts of interactions and social experiences allow a person to progress to the more mature
levels of ethical development where their actions are more conciliatory with their beliefs and values?
In Kohlberg's study, we see that transitive interactions consistently result in change [4]. These
interactions, which are social experiences, facilitate moral growth by introducing cognitive challenge.
These social and verbal exchanges require performance of mental operations on the reasoning
abilities of ones peers. We can observe this form of interaction in the descriptions our college student
gave concerning his interaction with his peers. We see further evidence of this progression when we
review the sort of interactions described by the ex-virus writer. This sort of exchange is necessary
for progression to the higher levels of ethical reasoning. At a higher level of ethical development,
individuals' ethical values and actions begin to come closer together. While some don't ever get
there, most do. Some even progress to higher stages, such as stages 5 and 6.
Further studies conducted by Kohlberg and his associates have shown that the majority of
non-criminals are classified in stages three and four, while a majority of criminals are classified in
stages one and two [20]. People who obey law to avoid punishment or who are primarily motivated
by self interest appear more likely to commit crimes than those who see the law as beneficial to all of
society. Research efforts on youth have shown that a significant number of deviant youth were in
categories one and two, while non delinquents rank higher [21].
Conclusion
Based on this research, which is by no means definitive, we have observed that virus writers are not
a homogeneous group. They have characteristics similar to many populations. They vary in age,
income level, location, social/peer interaction, educational level, likes, dislikes and manner of
communication. The ethical developmental models of the young adolescent and college age virus
writers are within the norms for the age groups of the individuals. From the data collected, it is
uncertain what predisposes them to writing and releasing computer viruses. There is only one
common characteristic, and that is that their ethical development appears to be within established
norms. This is not the case with the adult participant in the culture. Where adults in the control group
exhibit level 3 stage 5 of ethical development, not one of the adult virus writing respondents
answered any of the questions in a way that would lead us to believe he/she regularly functions at
level 5 development. What does this mean? There are other segments of the population that do not
function at this level, and they are not judged to be ethically 'deficient'; however, this departure from
the norm would seem to be one factor worth further consideration. We can conclude that there is no
homogeneous group to which 'The Virus Writer' conforms. There are too many observable
differences to categorize them into a generic construct. However, we can learn from the
observations.
In our study, different manners of thinking were observed; different motivations were observed. No
one seemed to target government or military as the 'subject' of their viruses. In fact, with the
exception of anti-virus product developers, there was no direct 'targeting' mentioned or implied in
any of the interactions. 'The Enemy' was virtually non-existent to the teen and college student virus
writers. 'The Enemy' to the adult respondents consistently appeared to be 'Society'. The three
ex-virus writers varied in their perception of 'The Enemy'. One saw the enemy as society, but
seemed to feel that he could not 'win' this battle; one stated there was never an enemy and the third
stated that the enemy was 'within' the individual.
Female participation in the virus writing culture appears virtually non-existent. It is possible that
female participation may increase, following patterns similar to female involvement in other forms of
youth deviant behavioural models.
There are a number of social issues which are related to what is often perceived as the isolated act of
'computer virus writing' (used here to mean, distribution to unwilling/unknowing persons).
Environmental and social issues including abuse of substances, child abuse, education, etc., are
factors to be considered when assessing any juvenile crime or dysfunctional behaviours. Because of
this, the multi-disciplinary or interdisciplinary study of this phenomenon would appear to be the one
that will yield the most effective conclusion.
There are some similarities between the disfunctional behaviour of distribution of computer viruses to
unknowing/unwilling persons and forms of juvenile delinquency. And, as with the social phenomenon
of delinquency, we do not know why some persons involved in this subculture become chronic
'career' offenders, beginning early and continuing into adulthood. We do not know what factors
contribute to the continuation of the activity, or what factors can contribute positively to the
desistance or termination of the activity. One theory that is often advanced is the theory of ageing
out, or spontaneous remission. In work by Michael Gottfredson and Travis Hirschi, it is proposed
that age-crime relationships are constants: not only do chronic juvenile offenders commit less crime
as they get older, but all persons commit less crime as they age. Therefore, age/crime correlations
are irrelevant to the study of crime [22, 23]. Of course, there are opposing views which purport that
the earlier a person demonstrates antisocial tendencies, the longer they will continue to commit these
acts. This sort of longitudinal theory deals with life-cycle of delinquency/anti-social behaviour, and
attempts to correlate age/crime. Deterrence theory proposes that the choices young people make
can be controlled by threat of punishment: the more severe, certain and swift the punishment, the
more the deterrence value. Proponents of such theory support laws to impose severe penalties on
virus writers. However, it is not certain that such strategies work, and in fact they may be
counterproductive. According to research published in the Journal of Criminal Law and Criminology,
Little reason exists to believe that crime and delinquency can be eliminated merely by
the fear of legal punishment alone. More evidence exists that fear of social disapproval
and informal penalties, criticisms, and punishments from parents and friends may
actually be a greater deterrent to crime than legal punishments[24].
Sociologist Jack Katz feels the seduction of crime is a prime motivation for anti-social acts [25].
Research conducted in Toronto, Canada by John Hagan and Bill McCarthy supports this theory,
which places at least part of the cause for this behaviour on situational inducements [26]. Cultural
deviance theory maintains that certain actions are performed because the individuals adhere to the
value system within their own subculture. We can consider dealing with the persons who distribute
viruses maliciously in the same ways as we deal with others who do what we perceive to be
malicious acts. This includes clarifying our own positions on what constitutes malicious action;
constraint, degree, intent, knowledge, 'bad tendency' and clear and present danger.
About the Author
Sarah Gordon's work in various areas of IT Security can be found profiled in various publications
including the New York Times, Computer Security Journal and Virus Bulletin. She is a frequent
speaker at such diverse conferences as those sponsored by NS A/NIST/NCSC and DEFCON.
Recently appointed to theWildlist Board of Directors, she is actively involved in the development of
anti-virus software test criteria and methods. She may be reached as
