Interview with Fred Cohen
There are very few people dealing with computer viruses who have never heard the name Fred Cohen. He is the person who first brought computer viruses to scientific community. Here are some well known formal information:
In 1983, Fred Cohen performed and described the first experiments with computer viruses. He gave the definition of computer virus in his paper "Computer Viruses - Theory and Experiments", originally appearing in IFIPsec 84. To quote this paper:
"We define a computer "virus" as a program that can "infect" other programs by modifying them to include a possibly evolved copy of itself."
Dr Cohen is best known for his pioneering work on computer viruses, the invention of high integrity operating system mechanisms now in widespread use, and automation of protection management functions. He regularly provides consulting services for top management worldwide. During the past 10 years of his research work, Fred Cohen wrote over 60 professional publications and 11 books. He is also a widely sought speaker, averaging over 12 invited talks per year. Dr Cohen's current interests are in the areas of high integrity distributed computing, office automation, information warfare, information theory, artificial life and social aspects of computing.....
The Fred Cohen's formal biography is much, much longer, so let's leave it for some other time. Some less formal information Fred Cohen gave himself, speaking exclusively for "Alive" :
Why did you get interested in computer viruses?
When the idea came to me, it was incredibly interesting and I followed up. The most interesting thing is the implication about life in general.
When I first started to do experiments and report on the results, I was greeted with quite a bit of hateful commentary. At one point, I was even called on the carpet of one of the Professors and accused of breaking into computers at another university. I was innocent, but treated as if guilty. That experience has helped me through the various other times I have been falsely accused of breaking into computers.
Somewhere during that period, an old saying one printed on a wall at Carnegie Tech by Alan Perlis came back to me:
Problems worthy of attack,
Prove their worth by fighting back.
What could you say about your work which is not so commonly known?
By now, I have published almost everything that has come up. The only real disappointments relate to my inability to find any paying work related to computer viruses. Lots of people have offered me work if I will say things that aren't true, or endorse a product that I think is not very good. People want the use of my name, but not the results of my effort and analysis. A good example is the controversy surrounding benevolent viruses. I have been black balled by many members of computer security community because I refuse to renounce what I feel to be the truth. Among the leaders of the black balling are academics who I think should be fighting for academic freedom and the proliferation of new ideas, but it turns out they can get more research grants by speaking out against new ideas than by giving them a fair airing. It should be no big surprise - after all, as recently as 1988, I had an NSF grant proposal rejected by poor reviews from academics who claimed that there was no such thing as a computer virus and that viruses could not work in systems with memory protection. Obviously, they never bothered to read any of the 50 or so papers I have written on the subject.
What problems did you have in presentation of your work?
Only a few years ago, I was called a heathen by the computing community including many professors at universities. The reason was that I supported the notion of benevolent viruses. They had a public effort to black ball me from research grants and other work, and it was almost unopposed. It got quite lonely at times, but I persevered, and now I am only loathed and hated by a small majority of the computing community.
In the fall of 1992, I was vocally and electronically vilified for publishing the results on the effectiveness of built-in protection in Unix and Novell networks against viruses and specifying the proper protection settings for these environments. A few months later, Novell agreed with me, and they are now changing some things about their protection scheme. Then, I was scheduled to present an updated version of the paper at the DPMA conference in New York, but they censored my benevolent virus paper, and had another speaker present a paper about Novell Netware protection that was just plain wrong, led Novel administrators to use inadequate protection, and got reprinted in a national magazine.
I guess I was wrong - you never get used to it - but you have to decide if you want to tell the truth as you see it or be popular - it is unlikely that you will ever get both until well after you are dead. I have made a personal choice that has doomed me to financial ruin over the last seven years or so, but despite the financial impact on me and my family, I have tried to keep on.
I have told you some of the problems I have encountered, and there are many more of them, but let's keep to the positive aspects for now.
Why people still do not understand what do you mean when talking about computer viruses?
There are at least two or three answers to that. The first one is that few people recognize that viruses are really only part of a pair - the life form and its environment. The life form is not alive except in an environment, and yet for linguistic ease, we speak of viruses as if they were independent.
The second one is that simple explanations are commonly used to avoid having to talk about the great breadth of issues involved in this field. It's a lot easier to sell fear when you can claim all Indians are evil than when you have to explain the difference between a Shawnee and a Mohawk. Another reason is that most people aren't very interested in mathematics or being very precise in what they do. Why bother to fully understand when you don't have to. That's my view, but who knows what is really in other peoples' minds.
What is your concept of beneficial virus?
All technology (in my experience) is a two edged sword. We tend to see one edge or the other, but both exist. When we explore both sides, we get a deeper understanding. A benevolent virus is simply a virus that is used for good purposes, but then this is a matter of context. For example, even an extremely malicious virus used against an enemy could be perceived as beneficial. Good and bad are relative. Most of the viruses I discuss as benevolent are in fact reproducing symbol sequences without any known malicious side effects. For example, the maintenance viruses that automate systems administration functions are only doing what people would otherwise have to do manually. They save extra labour by automatically distributing themselves, etc. but otherwise, that are just the same as any other program.
Why did you get interested in artificial life?
I am interested in life because I am alive and want human life to continue, to grow and evolve, and to advance and survive - both for myself and for my children. The word artificial is really only a side effect of peoples' egos requiring a special name for things they create. My interest is in deeper understanding, and thus I examine the issues of life from an informational standpoint and abstract out the specifics of whether the environment is biological, electromagnetic, or what have you. I am an information scientist by degree, training, and interest. As such, the study of information (a.k.a. symbolic representations in whatever form) is one of my passions.
Why did you write "It's alive!"?
I enjoy writing, and I had done a significant amount of work on this subject that I thought might be of interest to others. I was also somewhat disappointed by the presentation of artificial life as it is given by the growing mainstream of the field, and wanted a venue in which I could express contrary and novel ideas without the growing set of conservative researchers trying to stop me. When I talk about this topic, I am talking about real living creatures, not things that mimic real living creatures. I am talking about foundations for the understanding of life in the general sense, an expansion of biology into the general informational domain, drawing parallels between our biosphere and the infosphere, understanding the implications of the changes in our environment through information systems before we experiment on our children, understanding life forms in a different way, understanding the implications of our emerging technologies and ways of thinking about things, and other stuff like that.
In my book, I don't just talk about computers, but about the concepts of God, evolution, the generation and creation of life, death and why it must exist and why we need it to survive, the joint life forms we are now creating, diseases of the joint life forms, models of biological life and our willingness to commit memocide. I try to bring the richness of the world together in my writing so that the outbreak of Ebola Zaire can be related to the Jerusalem virus in a sensible way, and we can see the implications of our actions.
As you can see, I have a passion for this subject, and if I continue at this pace, you will have another book to review.
Why people are willing to reject the concept of beneficial viruses or artificial life in general?
I don't care to speculate further on peoples' motives at this time, but as a general guide, we might consider that people have emotions and that their motives are often complex and poorly understood. I have had people tell me that I am paving a road to hell with my good intentions, but I cannot tell which of us is really doing that because I am not omniscient. I just walk the path that seems right to me and try to understand the implications before I make big decisions.
Do you think that there is anything unethical in claims that beneficial viruses exist?
I think it is unethical to claim that there are NO benevolent viruses when we all know that they do exist and have seen published examples. The ethical questions in any research come from the analogy to the two edged sword described above. I feel we have a responsibility to present both sides of the issue, to consider the implications of our work and how it will impact others, and to consider these issues deeply and carefully before proceeding.
To me, it is very strange that people complain about my publishing results on benevolent viruses. After all, I got a lot of complaints in the 1980s about publishing results on malicious viruses, including over 40 papers in that period on protection against viruses. My conclusion is that the people complaining about the ethical issues are more often than not, expressing their frustration that somebody else thought of an interesting new line of research and published the results despite its somewhat negative impact on their research. Every once in a while, there may be an ethical issue worth bringing up, but it is patently ridiculous to claim that it is unethical to publish results of research into useful applications of computer viruses. But then, people also claim we should not publish results on useful applications of nuclear physics because there are nuclear weapons.