Passive Virus Distribution Ethics in Cybersecurity Research

While most computer viruses are spread deliberately and actively, others are distributed more passively, through virus exchange Web sites. Many virus writers support exchange sites, and often cite research or the constitutional right to free speech as a reason to let . . . While most computer viruses are spread deliberately and actively, others are distributed more passively, through virus exchange Web sites. Many virus writers support exchange sites, and often cite research or the constitutional right to free speech as a reason to let these sites exist. Those who use the sites explain that they don't intend to harm, but to provide information that will help researchers better understand how viruses proliferate (and perhaps how they can be stopped). These arguments, however, fall apart under scrutiny.

It's true that the scientific community encourages research, but only when it's conducted within the ethical boundaries of a given discipline. It's unethical to make viruses available for (relatively) anonymous distribution to persons of unknown ability or motive. It's also bad science. How a virus replicates isn't hard to understand; in fact it's fairly common knowledge among researchers. We don't need to see the replication mechanism to figure out what makes viruses "work." The argument doesn't hold up once you understand that viruses are, for the most part, trivial programming exercises.

The United States Constitution protects free speech, but virus writing and subsequent distribution aren't pure speech. Rather, they're speech plus action. The U.S. Supreme Court has recognized that speech and action, while closely intertwined, aren't one and the same. Thus, the act of putting virus code on the Internet isn't necessarily protected.

The link for this article located at new.architect is no longer available.