Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!cs.utexas.edu!usc!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: davidbrierley%lynx.northeastern.edu@IBM1.CC.Lehigh.Edu
Newsgroups: comp.virus
Subject: Re: The AIDS "Trojan" is a Copy Protection System
Message-ID: <0006.9002131641.AA18689@ge.sei.cmu.edu>
Date: 13 Feb 90 02:58:15 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 39
Approved: krvw@sei.cmu.edu


     In Virus-L 3:38 Mr. Ian Farquhar defended the AIDS "trojan" by
stating that it was only a copy protection system and that users were
properly warned.  I would like to counter his remarks with a few
thoughts:

 1) The AIDS disk did not have copy protection at all.  Copy protection is,
    by definition and tradition, a mechanism that attempts to prevent
    unauthorized copies from being made.  It is not a system that seeks out
    and hides (or even destroys) the user's files that have nothing to do
    with the software package in any way.  Those unrelated files belong to the
    user and it is the user which has the right to decide which software
    packages should have access to them.  I'd hate to think what it would be
    like if any form of "copy protection," no matter how draconian, could
    enjoy complete legal protection.

 2) The disks were unsolicited.  It is my uderstanding that none of the
    organizations that were mailed disks asked for them, and therefore had
    no way to learn about the software unless they actually used them.  In
    the US unsolicited objects received by mail are gifts, therefore, the
    so-called license agreement is void (and may possibly be illegal).  (Yes,
    I know "you should never look a gift horse in the mouth.")  I don't know
    how the laws are in the nations that were infected but its very likely
    that they are similar to those of the US.  I would even wager that the
    aforementioned postal regulation could be one of the reasons that the
    disk's instructions stipulated that the software could not be used in
    the United States.

 3) The market to which the disks were targeted was especially sensitive.
    It is very likely that vital medical records could have been tampered
    with by the AIDS disk, since medical organizations were the ones that
    received copies.  If the author was truly professional, I'm sure he/she
    would have marketed the package through conventional means (i.e. demo
    disks, advertising, etc.)  Of course this aspect may not be applicable
    to the alleged author, if in fact his judgement has been impaired by his
    psychological problems and/or treatment.

                                            David R. Brierley
                                            davidbrierley@lynx.northeastern.edu