 Hiya. Well, I'm going to talk really fast because if I talk really fast then I can't get down almost at the time when I was supposed to be done. So if I talk too fast, you just have to raise your hand and say you're going too fast and then I'll slow down. Okay? I'm going too fast. Okay. As preset, I'm with IBM's Thomas J. Watson Research Center. I'm actually wondering what the date is today? Is it 30th? Okay. Tomorrow is my last day there. So today I'm representing them here to you with this research. And after tomorrow, then I won't be representing them with this research. But this research will still be published on behalf of them when the rest of the research is done. So anyway, I'm there. I don't know when my new job is yet. I haven't decided. Basically, I've been coming to Defcon since the second Defcon. I will slow down. Thank you. And I'm going to talk today about something that I just called the end of innocence because there have been a lot of changes in the housing with computer viruses since I started coming to Defcon. I also have this shirt, which I was going to wear, which the code breakers guys gave me. So since I can't wear it, I'll show it to you and you can pretend I'm wearing it. The front of it says code breakers. The back of it says justice for Dave. This is Dave Smith who says he wrote the Melissa virus who's facing a long jail time and a lot of big fine. And I'm going to talk about that toward the end of this presentation because this presentation is kind of about what is justice in a society where we don't really know the impact of our actions on our really widely distributed systems. What made me start doing this research now was I started reading things in the newspaper and in magazines. And this stuff really makes me nuts. I read this quote, which said, this case the company says, and I won't name the company here, but I will be in the paper, says that virus writing, that means writing the virus, is indeed illegal despite arguments to the contrary. I don't know about you guys, but when I see somebody telling me it's illegal to write something on my own computer in my own home, and it isn't indeed illegal despite what other people say, that kind of worries me when people start thinking that what I write on my own computer is any of their business. I get more nuts when I read things like this prosecution, that prosecution being that of David L. Smith, would be a decisive event that would tend to reduce the relentlessly increasing threat and result into risk of computer viruses to society of a whole. I read this statement and I thought this is based on how do I know that this prosecution is going to really reduce the increasing threat? Had there been any scientific research to show whether these types of arrests and prosecutions in the past have caused any reduction in the risk? Finally, while you get the idea, when I read by looking at the perpetrators, the cycle of mounting numbers rate and violence of viruses will get a positive reversal. What's that based on? Is that really true? So I thought well I'm going to take a look at what's happened in the past 10 years or so with computer viruses and I'm going to see if there's any scientific evidence that would support the premise that by doing this thing we're actually spending money wisely and this is really going to cause a decrease in the problem. A little bit about why I got involved with this. Back in 1985 to about 1991, mostly I was interested in DOS and LS9 which was a Tandy Coco thing in Unix Systems and it was a whole lot of fun and I got a PC complete with the virus and that was not quite so much fun. None of my friends could help me when I got the virus. I suppose that should say none of my hacker friends could help me with viruses because the two worlds are pretty far apart packing and virus writing. So I sought out the help of people who knew about computer viruses and this would be antivirus people and virus writers and that's where all my travels started. That's where it all started going kind of crazy. As I started talking to the virus writers I realized that the good guys were saying that the bad guys were bad but the bad guys that I was talking to didn't act bad and I should know because I talked to hundreds of them but they weren't acting bad to me. In fact they were being quite helpful and pleasant and polite. So I thought let's do some science about this. So I did the science to find out exactly if these guys were all bad and the paper got accepted by an organization called Virus Believing which is a magazine that talks specifically about viruses. Their website is www.virusbtn.com. They're very, very good from information about viruses and the A.V. guys did not like the results of this study. They did not like it at all because it said that the virus writers were actually not all evil, malicious, unethical, antisocial couldn't get a date if their life depended on its scum. So there I was with all these people in the antivirus world and there I was saying you guys are wrong and I was one of those kind of outcasts which I was talking about earlier. I kept saying this. You guys are wrong. These people are not scum. They're not all sociopaths. This is not true. They keep saying you're just as bad as them. But I kept saying the truth and the truth was that these guys were mostly good social lives, mostly guys that had good relationships with women mostly some really good, some not so good, just like everybody else. Guys who had good relationships with their parents. Guys who helped in social and community projects. Sometimes pretty cool guys although a few of them are pretty not cool guys but very rarely are they not cool. And they were within what we call ethical norms for the ages and they say, well, what's that ethical norm stuff? Basically that's how we describe in the science world of how people make decisions. You know, babies reason differently than kids and they reason differently than pre-teens and they reason differently than teens and blah, blah, blah, blah, blah, blah. And to find out how people think we give them a series of ethical dilemmas they have to solve and they say, well, we think this and here's why. And series of tests with numbers, you know, how many different ways can you shape four colors? How many plates have you spin them on the end of rings? Did this and that? They take these tests and you see where they rank on these scales and there are norms for these. Biologically normal, what that means in case of virus writers is that they may come into this virus writing where it says enter here. They participate in the community for a while. They get interactions with other people who write computer viruses. They reconsider what they're doing and they age out. They begin to act like the older people who are going out and new people are coming in all the time cycling and write a few viruses. Some people stay, mostly just a big cycle going around and around and around. Now if this was true, somebody who was at level one two years later would be at level two and the next year would be at level three. The next year would be at level four. And when we watch all of these virus writers, I talk to some probably 80 or so of them. We watch them progress up the stages and how their cognitive reasoning abilities changed. So this was a long study which I did for a long period of time. And finally, we saw indeed they were going right up the scale. There were only a couple of exceptions, adults that did not age out and they tend to drift often to other more criminal activities instead of just writing computer viruses. Now what was next? I thought, well this is pretty interesting stuff. The press really liked it because we were seeing that some of the stereotypes weren't very true and things need to be reconsidered. And we saw that operating systems were becoming more common, you know, more one type. Connectivity was coming everywhere. So the old places where viruses used to come from, or what people said they came from, began to shift around. There was a shift in the zones going from, you know, people were looking at eastern blocks. They had connectivity. Then it was America. Then it was Canada. Then it was Australia. Now it's Indonesia. Where the viruses were coming from was changing. In fact, basically every place the internet came to, the viruses came from. So I don't think that's any, you know, big hard rock at science there. It makes pretty much sense to me when you've got a computer and you've got connectivity and you've got people talking about things. They're going to talk about things. They're going to do things. That's just how it is. But people, the reason they did this, it was still the same. People were curious. They wanted to do what they called research. And they were making political and social statements in some cases. Vactivism, not hacktivism, V because of virus. It wasn't just about technical stuff. And this is the stuff that really interested me the most. There were some very missed messages from the media. I mean, when you open the press from maybe 1992, the 93, 94, 95, 96, when you read about virus writers, you read about, oh, they're real renegades. They're real bad guys. You know, women might like bad guys. They're like, bad boys. So virus writers are bad boys. Let's be a virus writer. We're a bad boy, you know, and we're cool. And the media kind of promoted that, that it was a cool thing to do. They also promoted the idea that viruses were incredibly complex. You had to be a real genius to write a virus. Well, I could sit here and write one for you in about less than two minutes. This guy over here, this wasn't a fed. He could write one for you in about 30 seconds. There are some people, as I look out that I saw earlier, who could write them for you. And how pretty complex virus is in a pretty short amount of time. But it doesn't take a rocket science to be able to do it. In some cases, a little more complex. But you don't have to be a genius to write most of this stuff. You know, you just take some, write some macro commands. It's really easy if you get the, well, never mind how to do it. You can't do that. In some cases, it was taunting from the antivirus community. I mean, let me ask you, if I go up to you and say, you guys, you guys are so stupid. You couldn't raise your left hand if your life depended on it. You know, I'm going to start seeing these left hands go up like this. So when you see some guys going out saying, you know, the virus writers, obviously are too stupid to know how to use, blah, blah, blah. The next thing we see is viruses that do blah, blah, blah. There are also some technical papers written which, in my opinion, are more like how to guys for how to write certain kinds of viruses. Which means that virus writing tended to appear to be just a little bit less wrong to people. It appeared to be just a little bit cooler than it probably actually is. Which means young people aren't aging out. So we're seeing more virus writers and they're getting older. And because they don't age out, older people, people in corporations, just playing around doing what they think are some tests, which usually aren't very good tests and don't only help them, but people do like to play with computers. Pretty soon they're calling somebody to help them out of a jam. They say, oh, you know, I got this virus and I altered it and edit as a macro virus. And now it's spread throughout my company and my antivirus software doesn't attack. Can you please help me? You know, this has kind of created a few problems. And they're often calling me and I really need some sleep. I haven't had any really for three days. So if you're thinking about doing this tonight, please don't. And if you do, don't call me. But there are two viruses in particular that came to attention. Melissa and C.I.H. Is there anybody here who doesn't know Melissa virus? My C.I.H. virus? Okay. I like the skirts. I tried to make them look kind of like the virus. And Melissa, you're like a girl in C.I.H. Kind of oriental-ish. That was my creativity. There's a whole mixed message about this whole situation, which is why this T-shirt, this Justice for Day shirt, which I am going to wear, but when I tried it on you guys, it was going to itch, so I've got to wash it first. The Melissa author, David Smith, and you can read about him in lots of places on the internet, is wearing a really long sentence and looking at really huge fines for the virus that he admits to writing. But when you read reports of the C.I.H. author, which virus was much more destructive, he got a polite slap on the wrist, he got a good job, and the repress release is saying he's an absolutely brilliant above-average programmer. Now, this is a real mixed message and a real double standard, and it kind of says to me that in our whole virtual society and community as a whole, we don't really know what we think about this kind of stuff. And people are getting some real mixed messages. There are lots of people running scared because of all this, and these viruses are causing you, depending on who you talk to anywhere from $17,000 damage to trillions and billions, gazillion dollars of damages. People are running scared, and when people run scared, do you know what the solution is that they look to when they get really, really scared and they don't know what else to do? Not the bottle. Not the bottle. No, close. No, maybe they should be going for the bottle because their solution is lost. In this case, you get this case, the company says virus writing is illegal. The prosecution will be an event that will release or reduce virus writing by locking people up. It's going to solve the problem. Now, this is, I'm actually naming this only because I just took this quote before I came. Making a bomb is illegal, but writing about how to make a bomb is not. But what's a computer virus? The words are the bomb. And here we have someone on Usenet, and I've got the URLs, I could give them to you, to look up, suggesting that Congress look at making it illegal to write a computer virus. And I thought, well, how do we know that's really going to solve the problem? How are you going to force that anyway? And there's another follow. Mishka Behr, who actually is a good friend of mine, suggests that programs actually aren't speech, and therefore shouldn't be protected. So we have some pretty complex issues and pretty high-powered people pushing for ideas that may not have the best long-term effect. When we look at viruses in the world of Wide Web, we have people saying, got to get rid of them, got to get rid of them all. It's irresponsible. ISPs shouldn't let them up there. People want to make it illegal. But how do you know when something becomes bad? I mean, what point in the cycle of thinking about virus hurting somebody with virus does it become bad? Malice. Malice is a subjective judgment, isn't it? Intentional. Intentional. Intentional. Intent is kind of a hard thing to prove when you're looking at code. I could write a virus right here and give it to him on a disk, and I have no intent to harm anyone. So if all you have is a program to look at, how can you tell what the intent is? Now, even if it says, you know, this is a bad thing meant to harm, it may just be a demonstration. But do we know the impact of this potential law? I mean, how much have we actually looked at it? So let's say we're going to go through a series of things. I did a survey, or I had a bad thought. Is that wrong if you have a bad thought? And it's probably, you think it's wrong if you have a bad thought? Okay, close your eyes. Let's go and get this down thing. It's a bad thing. Again, let's solve her man to think it's in his heart. There he goes. So you have a bad thought. What if you told it to your friend? Is it bad then? What if you wrote it down on your computer? Is it bad then? What if you did it for a class project? These are all the same things you're writing. It's where you write it and make it a bad thing. How about if you put it up on your website, labeled as a virus so your friends can take a look? Is that bad? How about if you label it as a really cool, nifty disc utility so the unspecting will get it and hurt themselves? Is that bad? Maybe they shouldn't be on your website to begin with. How about if you password protect it when you put it up there? Is that bad? I decided that what I would do is I would ask people here what they thought about what is bad, what is as far as writing a virus, and what the impact of this law would be. So in order to do this and have it be something that would be scientifically valid so people would take it seriously with me just asking a bunch of questions and a bunch of people at a conference. Have you choose a target population? I could go in people who are pre-open. Have you get a number of responses in a sample set that would give me statistically relevant data so that when I published it, anybody who looks at it from a scientific angle will say, well, this certainly is statistically significant. We need to take a serious look at this. I need to make sure the samples were chosen randomly so that I didn't get three people who were all together so they're already in the same place. We're grabbing people every so often as they come in. And I've done all that now, taken the survey data. I still have to do an analysis using a statistical tool and I'll probably use some sort of analysis of covariance and have to interpret the data, which I haven't had time to do yet and I'll do that before this virus bill conference in September. We have some interesting questions and here are the questions that we asked. We said, if it would become illegal to write self-replicating code, would you be less likely to do it, makes no difference, or more likely to do it? And so we got some really interesting responses, which I won't go into now, but I'll publish them in just a little bit. And how far would you go? I have a question here at DEF CON. Is thinking about writing a virus your limit of tolerance? Is talking about a virus your limit of tolerance? Is writing a virus your limit? How about if you let it escape accidentally? How about if you give it to friends? Interestingly enough, more people thought letting a virus escape accidentally was like the worst thing you could do is far worse than anything, that being stupid is worse than being malicious. And that was very interesting to read the comments on that. It's putting it up on a site clearly labeled. And I was actually quite surprised, because several years ago when I... I think it was last year when we did the panel hand viruses, I asked how many people thought it was okay to put a virus up on a VX site clearly labeled it, and a lot of people did. But as we started sampling people, many, many people, many more people than last year, thought that putting it up even clearly labeled was probably irresponsible and maybe not a good idea. Putting virus on use net labeled as utility, say sexy.xr, when you look at me.com or whatever, it doesn't seem to mess up someone's computer really bad. So these are the questions that we ask. And what we're going to do, as I started looking at this data, there was statistical relevance. The data is chunked pretty clearly into three very distinct groups with some pretty strong patterns that are starting to emerge. But I need to do a real analysis and correlate that if it were illegal data, with how far would you go data, to see if the level of what you find acceptable has any correlation with what if it becomes illegal. Would you change your mind then? So if you look now, the lower people's tolerances for posting viruses in public, the more likely they are to totally do a flipping change about if it becomes illegal and actually start writing viruses. So it's kind of a pretty surprising result as I sort through this data. I still have to interpret it and put it through all these complex programs and type in the numbers and it will do all these complex mathematical things for me. So for now, what's been the impact of laws on virus related incidents? I mean, we can look at the number of viruses that are actually out there in the wild. The number that the antivirus companies tell you exist, just say, we protect you from, you know, 500 gazillion viruses. Pay no attention to that number. It's an irrelevant number. What really matters, the viruses are actually out there doing problems and I think there were some viruses that circulated last year around here that have caused people some problems. The number of viruses causing the problems in the wild and chart the activity of post-arrest sentencing and the different press. On these four guys, there's a guy whose name I can't pronounce, which is why I didn't write it, Ann Smith. So we look at viruses. You see these lines here? This yellow line at the top represents the total number of viruses that have been found out in the wild reported to this organization called the wildest organization. I work with them, they get reports from like over 55 people that work out in the field with viruses. Users report to them, they report to us. This blue number is viruses reported by two or more people. Those are viruses that are actually spreading out in the wild. And the red and green numbers down here, the red is the new since the last time the list was published with green being normalized because sometimes we'd skip a month so we had to normalize the data. These are the important numbers, the viruses that are new every month. And if we look here, back over here and a long time ago, when Dr. Poff was arrested, we see that there was not really a drop-off in the viruses after he was arrested. We look here at when Christopher Poff was arrested and I don't know about you guys but when I look at that, it looks to me like it goes up and it never goes down lower any point on the time chart where it would look like it was related to that arrest. Get over here to David Smith. You see that it went up and it did come back down afterwards. People could have gotten a little shaky but oh wow this looks like, the noise is just pretty constant. There's really nothing that's statistically significantly showing here that these arrests and public relations have had any impact on the amount of viruses new viruses getting released that actually caused problems. And over here the C.I.H. also, after him not even zoom, obviously, they're going up all the time, they're not coming back down so it doesn't look like there's any clear pattern of these convictions and these high-profile arrests and these stiff penalties and all this other stuff they're talking about doesn't look like it's having very much of an impact at all. So I think it will be really interesting to see when we put this data together if people with a low virus tolerance believe a law against virus writing would increase the likelihood they'd write a virus. I think it will be really interesting to see what an appropriate penalty for this guy might be for David Smith and we did ask that in a different set of survey questions and that data is still being brought in and correlated. We've got quite a few responses there and the range of penalties people suggest he should get community service or he should get ten years of hard time. I can't say what my opinion is because it would bias the survey but probably you can mostly guess. If the number of viruses in the wide web for distribution increases, decreases are still the same after Mr. Smith sentencing. We started by using the Google search engine and looking for all the viruses out of virus sites when you type in viral, how many do you see with their actual live viruses? We found that about I think it was maybe 15% of them actually had live viruses so we're going to also measure that the same way after the arrest and sentencing of Mr. Smith which has been postponed several times now and we're hoping that it comes in August before I have to actually present this data. Now what do I think? And people ask me this all the time press people ask because somehow I've become this expert on computer virus writers I guess because it actually mattered to me how people are calling people names and putting out stereotypes that seem unfair about people that are always perfectly decent to me. People are looking for specific law as a solution to a big problem. I think that there's probably no scientific evidence at least yet to show that that law is actually going to help with the problem. From this data that we collected here it looks like there may be evidence to show or at least support the hypothesis that making these sorts of laws is a big problem. But you can really blame people when the viruses are causing so much problem out there to business corporations. I mean they want a solution. So what should the solution be? What do I think? I think that viruses are indeed very cool the first time you ever see how they work. I mean people say viruses aren't cool they're boring. That's because they've been doing it for a while. The first time you see a program make a copy of itself and do something like that it's pretty cool to go off with the responsibility factor of what you're doing. I think that virus writing per se and I'm not talking about writing of self-replicating programs in university or research environments but just virus writing and putting it up on some VX website. That's not research. That's not rocket science. It's not helpful. It's not about artificial life, artificial intelligence. It's not about solving any interesting new problems. It's just stripping out some macro code, changing a few things around posting it out and before you know it that's a pretty sucking thing. Viruses can cause really big problems and I think that it's irresponsible to make them publicly available because unlike we as explorers and tools which you will put them up and somebody can get them and mess with them and you're making a choice each time with the virus once you get it going it's like the gift that keeps on giving. You can't say oh I wish I could stop it now because once I thought that you can't control it it's going to keep going. But I think that doesn't have to make it a matter of law. Finally, and because I've gone so fast I think we've finished just about on time I really think that what you do on your own computer is your own business. But that's really only for now. In some countries it's already illegal to write a computer virus and one of those companies, one of those countries was in the Netherlands. I have a list of those countries on some research I did before. I've misplaced the paper which is why I don't have a list for you here now. But if you wanted to remain once on your computer being your own business you have to remember that you have to act responsibly if you're going to be experimenting with viruses and people are going to do it. Don't leave things laying around where some idiot can get a hold of it and go out and use it to hurt people. Because then you'll be giving scare mongers and people who want to stereotype viruses and people who write programs give them ammunition to go out and ask for laws. When people are scared and they see a solution they're going to grab a hold of it. So you need to really protect yourself by acting responsibly and don't give people any ammunition to put into what is your freedom because if today they don't like the fact that you're going to write a computer virus so they're going to say if you write a virus it's illegal. Maybe tomorrow they won't like that you write an exploit and what the next day they don't like something else you write. So I mean if every time it's something they don't like becomes illegal they're doing however they are in power at the time probably would be a very bad thing. So if you act responsibly and don't just put viruses out there you're going to be doing everybody a good job and that's my really fast presentation. I think. That's it. Any self replicating program would qualify as a virus. Now I personally prefer a virus as an assembler just because I think that you actually had to write the program if I were going to prefer a virus. But the macro viruses I mean it's just exercises to me it's just exercises and stupidity. That is not a way to make yourself still so dust. You could hide yourself from the virus. Major breakthroughs that establish the way to better programming skills in that operating system. Now since I was involved in these things in the early 90s I really can't say anything about the macro viruses that are going out now. Personally I don't think of them as viruses because like you said some idiot that I say some idiot. It does some modifications and there you go you got a new screen. But back in the 90s that was really important and people are making real good progress and doing amazing stuff with a set of them. Now I think that's really true but I also think that in those days the part of the programs that made them viral was simply find first, find next and you can do that on two lines of code. So I think you could have done the viral part I mean you could have done all the other parts of things that were done in viruses without making a replica. The replication was the trivial part as far as the programming. Viruses like the 4K that are basing the virus on the find first and find next. Not to mention that a lot of viruses were never actually causing damage they just proliferated and you got to take that into consideration not all virus riders actually saw inflict damage. I agree with you 100% that not all virus riders seek to do damage. I think that's one of the stereotypes that my initial research showed was true that in most cases it was intellectual curiosity or exercise in many cases people even who don't mean to cause damage don't realize the impact of what they're doing over the large scale. So even when the virus got out and before they noticed everywhere in many cases in early days it wasn't at all intentional I believe. I agree with you Yes in the very back Hi That that computer code is an expression of speech and is legal. Yes I am I talk about it in the actual research paper from which these were taken but there are people who are saying that viruses should be exempted from that protection but they should not be given the same form of First Amendment protection and you know not all speech there is it's speech there's lots of speech but not all speech is protected speech there are things you can't say or do legally things that aren't protected and it's really conceivable that if there's a strong enough push to make writing a computer virus a non-protected speech that could happen Not my idea dude Not my idea I'm just reporting the news Yes As landmarks of the past Similarities I think certainly one thing that I've observed over the past several years is that the hacker community and the virus community are kind of separate communities. You know there's some merging of the communities but the virus routers have tended to be at the lower end of the scale kind of look down upon because you know the stuff does damage even though we say you know we think it's not intended to do damage it's kind of like the sucking part of the underground technology so I think it probably will continue to be looked more down upon unless people behave more responsibly with it I think if people behave more responsibly with what they're doing don't just leave it laying out there where somebody can get it and it just keeps going. It's possible it might not have to be looked upon as unethical, unethical, malicious, antisocial act way in the back in the white shirt What is that law? Illegal to transmit a virus? I guess I'm a criminal I mean the people that work with antivirus stuff all the time we have to transmit the viruses don't we? How do we differentiate? It's illegal for me to give him one but it's not illegal for me to give some antivirus guy one it's not a matter of intent and who's interpreting the intent and I think that's where the real concern really really is I did talk about that a little bit I talked about it more in a paper and actually the papers linked to the new security focus website it's a link to that paper it's called When Worlds Collide and it's about the different views that the antivirus and the traditional security community have on whether or not demonstrating these vulnerabilities you know programs generally don't have to be viral to demonstrate the vulnerability you can demonstrate most of these vulnerabilities straight away the virus just it's it's the part that really is the problem because it gets going out of your control but there's a little bit about the differing views on information sharing and what's okay and what's not the communities actually just like the virus writer and the hacker communities have different models of how they behave the antivirus community and the have so far been pretty much distinct different organizations we're starting to see the antivirus acting as a function of the general security corporations we're seeing security corporations bring antivirus up under that so that it's all one thing which is probably good for the users the two worlds in my opinion never were separate but they have been separate we need to really work to bring them together because there's a lot of knowledge different skill sets in those two communities yes well I've been some work now with them a lot of us are trying to do some work with the folks at Microsoft and some of these issues and there really are effective ways of getting the changes made without pelting out five billion viruses everywhere you know I'd say try a letter first windows it's been working more than I think people are aware yes fortunately I think that windows probably isn't a virus it's not spreading so much anymore we're seeing more and more Linux systems it's probably a really good product it's killing it off that's my own personal view not that of IBM yes I guess you heard it right there David Smith is an excellent script writer known as Vicod and ES and he's looking at doing lots of time in jail for releasing a virus that he admits to having written as far as him being just a normal guy like everybody else most of my research anyway has shown that most people who do this stuff are just pretty much they could be just the guy next door anybody it doesn't take some special evil malicious horrible person it's not some guy sitting in the basement listening to Danzig all day and night you know it's just it's just a guy and sometimes it's just a guy at school a guy who works for an ISP could be anybody it's not double behind the door sorry I can hear you it doesn't self replicate it doesn't even install itself again one final question over there I think that in order to have a functional operating system you're going to have to be able to write at some place in the system and make copies and as long as you can do that you're going to have the potential to have a virus I don't think it's really the issue of operating system manufacturers I think that the culpability in the case of viruses lies in a lot of places it's what you do with the thing that you create and I think we need to look a lot more personal responsibility in what we do with our creations instead of looking elsewhere for who's responsible for ourselves obviously one final last question I don't know what everybody needs to do I certainly couldn't recommend any kind of action of holding operating system manufacturer responsible probably would be interesting to see what happened if anybody did but I don't know that anybody's doing that do you know you're not going to see Lancaster's act? why not? okay well if anybody has any questions about the research or the later research or this study this project from here will be on the DEFCON site probably and if you look at the IBM www.av.ibm.com the paper will be there or you can contact me I've got a bunch of email addresses you just type Sarah Gordon and virus and a search engine somewhere if I'm around if I haven't given up on all this insanity so thank you very much for coming and bye