eWeek Magazine has a chilling report in its current issue: University of Calgary to Offer Virus-Writing Class. The report sent me to the university’s news center, where I found this press release about its class in “Computer Viruses and Malware,” boasting that it will “focus on developing malicious software such as computer viruses, worms and Trojan horses.” According to the professor who’s teaching the course, “By looking through the eyes of the people who develop these viruses, our students will learn what their targets actually are and what needs to be protected…. This attitude is similar to what medical researchers do to combat the latest biological viruses such as SARS. Before you can develop a cure, you have to understand what the virus is and how it spreads – why should combating computer viruses be any different?”
Can we all agree that this is insanely irresponsible? Public health researchers learning to fight SARS or Ebola don’t start by going into the lab and creating their own designer disease first. They work in carefully controlled environments with existing viruses, learning from the inside out. Responsible computer security researchers have plenty of existing viruses to deconstruct if they want to learn how malware works. We don’t need to teach people how to write hostile code.
Given that the age group most often associated with virus-writing is the same as the undergraduate university population, this just seems stupid.
Ed Bott 