Is it ethical to teach teens about software viruses?

Question

I volunteered to instruct an after school computer club at my son's middle school. There has been a lot of interest in computer viruses. I was thinking about showing them how to create a simple batch file virus that will infect other batch files in the same directory. Also show how creating a batch file with the same name, but that is closer in the path, can replace another program.

It could also allow for discussion of anti-virus techniques - recognizing viruses and virus like behavior.

I mentioned the idea to my wife and she thought it was a terrible idea. Compared it to giving them loaded weapons. I don't see it as dangerous since this technique wouldn't be immediately applicable for any real mischief on any modern operating systems.

Am I being too cavalier or is she being too concerned? This isn't a settle this argument for me question, I am just trying to get another opinion.

Update: I don't plan to cover moving between systems (or even directories) or any malicious behavior. And lest anyone think I am revealing any deep dark secrets, here is a book from 1996 I found at the library that goes into a lot more detail than I planned to cover. If some is motivated to be malicious they will find a way.

Answer 1

I recently found a picture of me when I was 12 and reading a book about computer viruses. It was in 1988. Like your students, I was fascinated by them.

The next year I started high school and was accused to being the origin of the virus infection of all computers in the school. Of course, it wasn't me. I was good at computers, so the teachers said it was me.

If I put myself in back in time, I can tell you that since I was very well informed by the effects of those viruses, I would never have done such a thing. Why I would do that? Harm people? No way!

Therefore I think that the more they are informed by the effects, the less likely they use them.

But this statement is linked to boys that were like me, in a good environment with strong rules and education.

If you teach computer viruses to students with a history of doing bad things, not well educated, or troubled, they will certainly use them to do bad things. So it highly depends on the audience, your students.

Answer 2

I think the idea is excellent: people need to know how viruses work so that they can (a) write antivirus tools and (b) learn how to break things. The latter will serve them in good stead when they have to write solid code.

Learning about viruses and how they can propagate sounds like a springboard for many lines of investigation - how programmers make mistakes, what mistakes they make, how to avoid making them, how computers actually work, operating systems, network code, ...

I think a healthy dose of ethics would go well in the course: what damage viruses have done, for instance. You don't need to be preachy about it. Robert Morris didn't mean to write the first worm - or at least didn't mean for it to get out of hand - so it can be an instructive lesson not only in what kinds of bad things can happen, but also how something that seems like a good idea can go out of control.

Answer 3

I learned how to write a COM and EXE viruses when I was in high school back then in '96. It's what got me to programming and switching from Basic to Pascal & Assembly and learned how the underlying hardware's mechanism works. Rewriting Norton commander from Peter Norton/John Socha's book (verbatim) was quite an achievement and exhilarating.

So I think teaching teens how to write a virus could be helpful to some extent to foster their sense of curiosity and inquisitive mind, because it's interesting for them. From my own account, the only bad thing I did was to infect my friend's 5.25" disk's boot sector but that's how far I went about it.

Surely as Pierre 303 noted you have to evaluate your students' attitude and then try to exploit and direct their interests to something more useful like giving them tasks to create programs etc.

Answer 4

I don't think it's a good idea, for pragmatic rather than ethical reasons.

People (almost certainly boys) who want to learn how to write a virus or how they work will learn very well without your help. Nobody ever taught me, and I could write simple viruses by 13. Those who would be capable of using that ability for good will understand how to do it merely by learning the basics of programming. Those who would be interested only because it's a virus, rather than as a particular niche of programming, are better off having to learn the hard way.

Answer 5

They will abuse it, it will cause hell on the school network, they will suddenly be breaking the law before you can blink.

A great idea to teach them about the general concepts (peer-to-peer distribution, minimal system resource use, and decentralized communication are some of the cool things conficker did, for example) but teaching them specifics is asking for trouble.

Answer 6

I wouldn't do it. You're thinking of doing this of all the right reasons. There's just one thing you haven't taken into account. The teachers, the (non-IT) administrators. If you talk to the kids about viruses, suddenly every infection the coming 50 years or so will be your fault. You know, because you showed them how to do it with them computer thingies.

Answer 7

They are too young to know how (not) to use that knowledge. Keep in mind that there are probably a few stars in there who will take what they know and add it to what you share which will fill in the details you have chosen to leave out. Depending on where you live, if they do damage to the school's machines you may face prosecution. I think what you're doing by mentoring is great, but do take care.

Answer 8

The answer is of course going to be it depends, but as of Wednesday I'll be finished with high school and I'll say from personal experience it will probably not be much but you never know how far your influence will reach.

Now I've spent my last four years, what I've considered the 4 shittiest years, of my life making the school's network my bitch. The network guys all talked to me and threatened me with legal consequences multiple times but the sad fact is they have not been able to get me out of their system. They are probably rejoicing at the fact that I am graduating because I'll be out of their hair.

That said when I entered high school as a freshman I had absolutely no ill will towards the school. All computer security information I had learned and tested was purely academic. After a while though my high school experience became rather soured for a large number of reasons. At that point I pretty much devolved into a hateful beast and I spent many a time sitting in class watching my teacher's laptop and smartboard suddenly shutdown because I just damn well felt like doing it. I actually had the police interrogate me because I was poking around their payroll system and they flipped the hell out over that one.

So long as you are not teaching them how to write a RAT or run a botnet I really don't think it is equivocal to handing them a loaded .45 and saying have fun, but you should consider that although they may be nice little kids now, they all might not stay that way. I don't want to sound cryptic here, but life has ways of making you jaded that you would never ever think of, and once that happens you can't predict what will happen.

Answer 9

I don't think this is even an issue of ethics. It's an issue of a better, more productive, use of yours and their time.

First teach them how to write code. Then we should consider teaching them how to write malicious code - or defensive code for that matter; but in my experience, knowledge of one requires knowledge of the other.

If it's the only thing that gets these kids interested in programming, and they may not attend or be interested if you're teaching anything else (not even the old stand-bys like game programming), then there may be a legimate reason to worry about their intentions.

Answer 10

I think that they would learn about it if they want, whether you mention about it or not. In fact, they would learn more about viruses outside classes than in a class. I think that it is good if you mention and describe them. Not everyone will build a virus to make harm, but for academic's purposes

Answer 11

If they can hack code together and use Google, they can write viruses. I would expect teaching them viruses would quickly lead to a bunch of 'hurr, I virused you' to result. I would also expect that if they are already interested, they will fire up Google, whether you like it or not.

You aren't going to win by excluding knowledge. You're going to win by teaching them ethical behavior, so that when their local viruses go off, they write smiley faces on the screen (or porno on a teacher's background), instead of booting up a node in a cobbled-together botnet.

It's dangerous. Agreed. But if they are going to code... they will have the capacity to whether you like it or not.

You should- IMO- treat it in the same fashion as teaching how to use a gun. Hunter's Ed courses start at 12 years old. Maturity can exist at that age.

Answer 12

It depends.

In any case, you should include a part about the legal background and the consequences. Make it absolutely clear that spreading viruses, even ones that aren't designed to be harmful, is a severe crime. Have them formally agree not to use their knowledge to perform any illegal activities: make them (or their parents if they're minors) sign an agreement about this. It's standard procedure for any serious security and hacking related courses. Do this before you start the actual curriculum. This is not only to protect yourself, it's also to send a clear signal that says "you don't want to go there".

Even then, I'd only do this if you trust your students a little. If you suspect some of them to be of lesser ethical maturity, limit yourself to the "how do I protect myself from viruses and hacking" part.

Answer 13

I don't know that it's clear ethically. Certainly if you know all the kids well and they are all responsible and mature for their ages then it's probably okay.

I think if you do teach them potentially dangerous or damaging information you must take some responsibility for it. Both in making sure that they are well educated in the subject and in it's consequences, but also in whatever ways they end up using that knowledge.

Answer 14

It is common practice to teach students how to do bad things when programming. These types of lessons are invaluable in learning the caveats and dangers of programming. It also is needed information when learning how to identify and prevent attacks. Of course you must stress that they shouldn't do these things except on their own computers. They will. But if they are doing it to learn then they will be careful. I would consider it a failure as a teacher if you didn't cover such topics. The information they learn here actually is generally applicable. If they become proficient programmers, it is information that they will have to know.