A PLAN to teach virus writing at university has come under severe criticism at a conference of the Association of anti-Virus Asia Researchers.
"Stopping virus writers is the job of law enforcement, not of computer science graduates," Dr Vesselin Bontchev, a computer virus and security expert at FRISK Software in Reykjavik, Iceland, said at the Sydney conference.
"The job of graduates is to stop the creations of these criminals — not the criminals themselves.
"And for that they need to know how to analyse viruses, how to write anti- virus programs and how to stop a virus attack. They do not need to know how virus writers operate."
Dr Bontchev said a proposal by Professor Ken Barker, head of computer science at Canada's University of Calgary, to teach virus-writing as part of its IT security course "is madness".
"There is no such thing as a 'good' virus," he said.
"If a serious educational institution endorses virus-writing, scores of
young people will say they are 'doing research' when they engage in this form of electronic vandalism."
Reputable anti-virus companies have strict policies against hiring virus writers, so students who acquire those skills risk losing job opportunities.
"We are operating in an environment where trust is essential," Dr Bontchev said. "It doesn't matter whether the virus writers are still active or have 'reformed' — once a virus is created and released from the author's control, it exists forever.
"Even if the environment in which the virus is capable of replicating no longer exists, we are still forced to implement detection, recognition, identification and removal of it."
He said it was immensely more difficult to develop a good anti-virus program than to write a virus, while the skills required were completely different — even contradictory.
"It's simply impractical to teach all the tricks used in viruses because there are so many and, even worse, new ones are created all the time," he said.
"If students are trained to analyse viruses, they will have no trouble understanding how new viruses work and how to handle them."
Dr Bontchev concedes that while students will generally pick up enough information to be able to create their own viruses, the wider ethical and professional training around IT security will help prevent the misuse of their abilities.