89 lines
4.1 KiB
Plaintext
89 lines
4.1 KiB
Plaintext
To: Mr. Don Goldberg
|
||
House Judiciary Subcommittee on Criminal Justice
|
||
U.S. House of Representatives
|
||
H2-362
|
||
Washington, DC 20515
|
||
202-226-2406 voice; 202-225-3788 fax
|
||
|
||
From: David Stang
|
||
National Computer Security Association
|
||
Suite 309, 4401-A Connecticut Ave. NW
|
||
Washington DC 20008
|
||
202-364-8252 voice; 202-364-1320 fax
|
||
|
||
Subject: NCSA Testimony on Virus Bills
|
||
|
||
Date: August 17, 1990
|
||
|
||
We understand that HR 55 and HR 287 -- the two virus bills -- may
|
||
have died as a result of unexpected action elsewhere in Congress on
|
||
the Comprehensive Crime Control Act of 1990.
|
||
|
||
We believe that the magnitude of the problem caused by a virus in just
|
||
one computer is serious. As you and the committee well know, and have
|
||
heard through prior testimony, the enormity of the damage caused by a
|
||
virus can be stunning. I recently talked to one of our members who had
|
||
spent $16,000 in consulting fees trying to save files that had been
|
||
ravaged by a computer virus. Yesterday, I spoke to someone who had erased
|
||
three months worth of work in an attempt to eradicate a virus.
|
||
|
||
These may not be isolated cases. NCSA is now conducting a damage
|
||
survey, to try to get some more honest numbers for the costs of
|
||
viruses. We will be sharing our findings with your committee.
|
||
|
||
In the balance of this letter, I will update our previous testimony in
|
||
regard to the virus problem.
|
||
|
||
There are now over 245 named viruses. More viruses were written so
|
||
far in 1990 than in all prior years combined. The number of virus
|
||
incidents is increasing at an alarming rate, although there are no
|
||
reliable statistics on this. Many good self-defense measures and
|
||
programs are now available, but the public is largely unaware of them,
|
||
or of the magnitude of the problem. The damaged caused by viruses
|
||
may be in the hundreds of millions of dollars annually.
|
||
|
||
Only 25% of viruses appear to have U.S. origins. The committee needs
|
||
to consider the international scope of the crime. An international
|
||
symposium would be valuable.
|
||
|
||
Most of the viruses that have been written have not yet spread widely.
|
||
Many have not yet entered the U.S. Their damage is yet to come.
|
||
Legislation should consider whether such virus authors will be
|
||
grandfathered, or whether they are exempt from this legislation for
|
||
viruses already written.
|
||
|
||
Virus authors do not sign their work, but may show it to friends.
|
||
Legislation which paid rewards to informers would be more effective
|
||
than legislation which merely offered to punish those apprehended.
|
||
The NCSA offers a $1,000 reward for anyone who plays a pivotal role
|
||
in the conviction -- with jail time -- of a virus author. Legislation could
|
||
do the same.
|
||
|
||
The program code for many viruses has been published in many
|
||
sources, making imitation and the creation of new viruses fairly
|
||
simple. There may be 10,000 programmers in this country alone who
|
||
are now capable of creating a new virus. Many more can modify an
|
||
existing virus in a few minutes, using commercially-available software.
|
||
The committee might consider whether the publication or distribution
|
||
of virus code should be punishable, as it seems to aid and abet the
|
||
crime.
|
||
|
||
Because most viruses are reasonably easy to prevent with proper
|
||
procedures, and easy to detect with software, legislation should
|
||
encourage/support public education efforts for virus prevention and
|
||
detection. Ultimately, we may shift some of the burden of virus
|
||
damage to users who haven't shown reasonable care.
|
||
|
||
There are no trustworthy statistics on incidents of virus infection. A
|
||
national clearinghouse for such information would be valuable.
|
||
|
||
We wish you well in your efforts to provide a serious, measured
|
||
response to a serious international problem. As our society becomes
|
||
increasingly dependent on computers, it will become increasingly
|
||
victimized by viruses, and the work of your committee will become
|
||
more important than ever. If there is anything we can do to support
|
||
your efforts, please let us know.
|
||
|
||
#=> END <=#
|
||
|
||
|