89 lines
4.1 KiB
Plaintext
89 lines
4.1 KiB
Plaintext
To: Mr. Don Goldberg
|
|
House Judiciary Subcommittee on Criminal Justice
|
|
U.S. House of Representatives
|
|
H2-362
|
|
Washington, DC 20515
|
|
202-226-2406 voice; 202-225-3788 fax
|
|
|
|
From: David Stang
|
|
National Computer Security Association
|
|
Suite 309, 4401-A Connecticut Ave. NW
|
|
Washington DC 20008
|
|
202-364-8252 voice; 202-364-1320 fax
|
|
|
|
Subject: NCSA Testimony on Virus Bills
|
|
|
|
Date: August 17, 1990
|
|
|
|
We understand that HR 55 and HR 287 -- the two virus bills -- may
|
|
have died as a result of unexpected action elsewhere in Congress on
|
|
the Comprehensive Crime Control Act of 1990.
|
|
|
|
We believe that the magnitude of the problem caused by a virus in just
|
|
one computer is serious. As you and the committee well know, and have
|
|
heard through prior testimony, the enormity of the damage caused by a
|
|
virus can be stunning. I recently talked to one of our members who had
|
|
spent $16,000 in consulting fees trying to save files that had been
|
|
ravaged by a computer virus. Yesterday, I spoke to someone who had erased
|
|
three months worth of work in an attempt to eradicate a virus.
|
|
|
|
These may not be isolated cases. NCSA is now conducting a damage
|
|
survey, to try to get some more honest numbers for the costs of
|
|
viruses. We will be sharing our findings with your committee.
|
|
|
|
In the balance of this letter, I will update our previous testimony in
|
|
regard to the virus problem.
|
|
|
|
There are now over 245 named viruses. More viruses were written so
|
|
far in 1990 than in all prior years combined. The number of virus
|
|
incidents is increasing at an alarming rate, although there are no
|
|
reliable statistics on this. Many good self-defense measures and
|
|
programs are now available, but the public is largely unaware of them,
|
|
or of the magnitude of the problem. The damaged caused by viruses
|
|
may be in the hundreds of millions of dollars annually.
|
|
|
|
Only 25% of viruses appear to have U.S. origins. The committee needs
|
|
to consider the international scope of the crime. An international
|
|
symposium would be valuable.
|
|
|
|
Most of the viruses that have been written have not yet spread widely.
|
|
Many have not yet entered the U.S. Their damage is yet to come.
|
|
Legislation should consider whether such virus authors will be
|
|
grandfathered, or whether they are exempt from this legislation for
|
|
viruses already written.
|
|
|
|
Virus authors do not sign their work, but may show it to friends.
|
|
Legislation which paid rewards to informers would be more effective
|
|
than legislation which merely offered to punish those apprehended.
|
|
The NCSA offers a $1,000 reward for anyone who plays a pivotal role
|
|
in the conviction -- with jail time -- of a virus author. Legislation could
|
|
do the same.
|
|
|
|
The program code for many viruses has been published in many
|
|
sources, making imitation and the creation of new viruses fairly
|
|
simple. There may be 10,000 programmers in this country alone who
|
|
are now capable of creating a new virus. Many more can modify an
|
|
existing virus in a few minutes, using commercially-available software.
|
|
The committee might consider whether the publication or distribution
|
|
of virus code should be punishable, as it seems to aid and abet the
|
|
crime.
|
|
|
|
Because most viruses are reasonably easy to prevent with proper
|
|
procedures, and easy to detect with software, legislation should
|
|
encourage/support public education efforts for virus prevention and
|
|
detection. Ultimately, we may shift some of the burden of virus
|
|
damage to users who haven't shown reasonable care.
|
|
|
|
There are no trustworthy statistics on incidents of virus infection. A
|
|
national clearinghouse for such information would be valuable.
|
|
|
|
We wish you well in your efforts to provide a serious, measured
|
|
response to a serious international problem. As our society becomes
|
|
increasingly dependent on computers, it will become increasingly
|
|
victimized by viruses, and the work of your committee will become
|
|
more important than ever. If there is anything we can do to support
|
|
your efforts, please let us know.
|
|
|
|
#=> END <=#
|
|
|
|
|