Controversy continues two weeks after the University of Calgary announced a course in which students will study computer viruses. The course, entitled Computer Viruses and Malware, drew criticism for including a component in which students would study computer viruses by re-creating existing ones.

Graham Cluley, Senior Technol- ogy Consultant for Sophos Anti-Virus, challenged the university's assertion this week that students would not be writing computer viruses.

"I don't think that was the perception I got from your press release where you said: 'A necessary step in stopping viruses is that the computer professional could also write one so we are using the "writing" of computer viruses as a teaching method.' Can you explain where the mistake lies?" asked Cluley.

In response, instructor Dr. John Aycock remained adamant.

"As the instructor for the course, I can tell you that students will be writing both simple viruses as well as [anti-virus] software," said Aycock. "My plans for the course have not changed."

Computer Science Department Head and Professor Dr. Ken Barker said last week that students would be writing computer viruses in the sense that they would re-create elements of existing viruses in order to study them.

"It is time for critics to take their heads of the sand and work with us to start developing the next generation of computer professional (sic) who will be proactive in stopping computer viruses," wrote Barker in a statement on Thu., May 29 (emphasis in original). "The current approach of reacting to the viruses is simply not working."

Most current anti-virus software programs can only stop a new virus once they have been programmed specifically to detect it. The university has stated that learning about viruses by re-creating them--a practice uncommon in industry--will help students learn to combat malicious software.

"It would be unfortunate if companies and individuals were to have knee-jerk reactions based on little or no information, wouldn't it?" said Aycock.

Gauntlet reader John York, who claimed to be a student entering his first year in the fall, pointed to two on-line news articles from PC World and silicon.com with information to the contrary. The articles, both dated Fri., May 30--about one week after the course drew worldwide attention--state that two leading anti-virus software companies Trend Micro, Inc. and Network Associates Technology, Inc. (which produces the anti-virus software used on most U of C computers) will not hire virus writers.

"As a potential [Computer Science] student, I've become wary of the University of Calgary's program," wrote York in response to our May 29 story about the Computer Viruses and Malware course. "[With] all this talk in the industry about how U of C grads with this course will be unemployable, I don't think I want to be one of them."

Sophos CEO Dr. Jan Hruska was one of the first to state that they would not hire virus writers.

"Don't bother applying for a job at Sophos if you have written viruses because you will be turned away," said Hruska on Wed., May 28. "You are of no use to us. The skills required to write good anti-virus software are far removed from those needed to write a virus."

The university had stated last week that students should seek work elsewhere, in a company that would value their education and training. But with at least three of the top four anti-virus companies in North America rejecting virus writers, that may be difficult.

"I guess I'll discover after first year if the U of C risk is worth it," wrote York.

Network Associates did not return calls seeking comment.