Path: utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: Jeff_Spitulnik@um.cc.umich.edu
Newsgroups: comp.virus
Subject: Questioning ethics at computing sites
Message-ID: <0004.9001081228.AA09399@ge.sei.cmu.edu>
Date: 5 Jan 90 14:28:30 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 43
Approved: krvw@sei.cmu.edu

I write this commentary on ethical issues concerning the dissemination
of information about the existence of viruses and how to get rid of
them as both an employee of the University of Michigan and as a
concerned member of the UM community.  The following scenario
describes the events leading up to my questioning the ethicality of
the procedures (or more appropriately, the lack of procedures) here.
Finally, I ask for comments and suggestions (e.g. how informing the
public is done at your institution) with hopes that the UM policy
makers are listening.

  I recently joined the ranks of the many computer experts employed at
the University of Michigan.  About 1 month after I started working
here, I became familiar enough with downloading Mac files from a
public file to notice that there was a new version of Disinfectant.  I
downloaded it and noticed the report of the WDEF virus.  I checked my
personal disks as well as the school owned disks in my public lab ---
all were infected with the WDEF virus.  I sent an e-mail message to
the online_help people (most of which are student "consultants"),
asking them what was to be done.  It was apparent from the response,
that the virus had been here such a short time (a few days?) that no
one was doing anything yet.  I expected a public announcement of some
sort informing users that they may be infected and that they run the
risk of being infected when they use the UM public facilities.  No
announcement was made.  Furthermore, as a specialist employed to
preside over a public computing facility (most of the computers are
Macs), I expected to be both informed that there was a new virus as
well as instructed what to do about it I heard nothing.  Two weeks
after the WDEF virus hit UM, most users were still not aware of it.  I
sent an e-mail message to my most immediate contact in the Information
Technology Division expressing my concerns.  "Shouldn't the public be
informed," I asked.  I expected a response from him and hoped that he
would forward the message on to the appropriate policy makers if he
was not in the position to deal with it himself.  I have not received
a response to my message nor have I heard any public mention of the
WDEF virus.  Users continue to infect the disks in my lab and be
infected by the disks in my lab and, as far as I know, other public
facilities at the Universtiy of Michigan.  The virus persists here.
  What should be done to rid UM of the WDEF virus or of any virus for
that matter?  How does the bureaucracy at your institution handle it?
I question the ethicality of a laissez-faire attitude on viruses at
any institution.

  Jeff Spitulnik