THE BULGARIAN THREAT
In March 1990 the first attempt was made to quantify the extent of the threat posed by computer viruses. Dr. Peter Tippett, a Case Western University scholar and the president of Certus International, a software company, predicted that 8 percent of all PCs would be infected within two years, even if no new viruses were written. He estimated the cost of removing the infections at $1.5 billion over five years--not taking into account the value of the data that would be destroyed. In 1991 he estimated that organizations in North America with over four hundred computers had a 26 percent probability of being hit by a virus within the next year; they also had a 5 percent chance of that virus causing a "disaster," which he defined as an infection that spread to twenty-five or more machines. A more recent projection, made in late 1991, went farther. It suggested that as many as 12 million of the world's 70 million computers--or roughly 17 percent--would be infected within the next two years.
But predictions such as those made by Dr. Tippett have proved difficult to substantiate: most virus attacks simply aren't reported; there is no body that regularly collects reliable statistics about the virus problem, and estimates of costs are always just guesses. When Dr. Tippett made his predictions, the number of new viruses that were appearing made it seem possible that their sheer volume would overwhelm the world's computer systems. By 1992, there were over 1,500 catalogued viruses and variants in the West by spring 1993, there could well be twice that number.
Tippett had based his predictions on the behavior of just one virus, called Jerusalem. It was first discovered in December 1987 at the Hebrew University in Jerusalem, though it is thought to have been written in Haifa, the country's principal port and the home of its leading technical college, Technion University. At least, that is one theory. No one has proved that the virus was written in Haifa, nor has anyone ever claimed authorship.
The Jerusalem virus was a malicious joke, which would delete any program files used on Friday the 13th. There are two Friday the 13ths in any given year; in between those dates the virus signaled its presence by displaying a little box in the lower half of the computer screen and then slowing down infected systems to an unacceptable crawl. It also contained a gremlin that, contrary to the programmer's intentions, caused it to reinfect--or add itself to--many of the same program files. Eventually the files would grow so big that the virus would take up all of the computer's memory.
The virus quickly acquired a fearsome reputation. Maariv, one of Israel's leading daily newspapers, heralded its discovery with an article on January 8, 1988, that warned, "Don't use your computer on Friday the 13th of May this year! On this day, the Israeli virus which is running wild will wake up from its hibernation and destroy any information found in the computer memory or on the disks."
The report was somewhat exaggerated. It wasn't true that Jerusalem could destroy "any information found in the computer memory or on the disks," as it had been written to delete only programs that were used on Friday the 13th. In practice, few users suffered any real damage. Most operators would delete the virus as soon as they saw the little box appear on the screen and noticed the system slow down--which generally happened about half an hour after the virus had infected a computer.
While Jerusalem may not have been as destructive as its publicity suggested, it was exceptionally virulent and spread quickly and widely. Unlike most previous viruses, Jerusalem could infect nearly any common program file, which gave it more opportunity to travel. (By contrast, the Pakistani virus, Brain, could only infect the boot sector on specific diskettes, and Lehigh could only infect one particular type of program file.) Jerusalem's propagation rate was phenomenal. From Israel it spread quickly to Europe and North America, and a year after its discovery in Israel it had become the most common virus in the world. In 1989 it was said to have been responsible for almost 90 percent of all reported incidents of viral infection in the United States.
