Benny -- that's his handle, not his real name -- is most famous for having written a virus that infected Windows 2000 two weeks before Windows 2000 was released. He'd met a Microsoft employee months earlier who boasted that the new operating system would be ''more secure than ever''; Benny wrote (but says he didn't release) the virus specifically to humiliate the company. ''Microsoft,'' he said with a laugh, ''wasn't enthusiastic.'' He also wrote Leviathan, the first virus to use ''multithreading,'' a technique that makes the computer execute several commands at once, like a juggler handling multiple balls. It greatly speeds up the pace at which viruses can spread. Benny published that invention in his group's zine, and now many of the most virulent bugs have adopted the technique, including last summer's infamous Sobig.F.
For a virus author, a successful worm brings the sort of fame that a particularly daring piece of graffiti used to produce: the author's name, automatically replicating itself in cyberspace. When antivirus companies post on their Web sites a new ''alert'' warning of a fresh menace, the thrill for the author is like getting a great book review: something to crow about and e-mail around to your friends. Writing malware, as one author e-mailed me, is like creating artificial life. A virus, he wrote, is ''a humble little creature with only the intention to avoid extinction and survive.''
Quite apart from the intellectual fun of programming, though, the virus scene is attractive partly because it's very social. When Philet0ast3r drops by a virus-writers chat channel late at night after work, the conversation is as likely to be about music, politics or girls as the latest in worm technology. ''They're not talking about viruses -- they're talking about relationships or ordering pizza,'' says Sarah Gordon, a senior research fellow at Symantec, an antivirus company, who is one of the only researchers in the world who has interviewed hundreds of virus writers about their motivations. Very occasionally, malware authors even meet up face to face for a party; Philet0ast3r once took a road trip for a beer-addled weekend of coding, and when I visited Mario, we met up with another Austrian virus writer and discussed code for hours at a bar.
The virus community attracts a lot of smart but alienated young men, libertarian types who are often flummoxed by the social nuances of life. While the virus scene isn't dominated by those characters, it certainly has its share -- and they are often the ones with a genuine chip on their shoulder.
''I am a social reject,'' admitted Vorgon (as he called himself), a virus writer in Toronto with whom I exchanged messages one night in an online chat channel. He studied computer science in college but couldn't find a computer job after sending out 400 resumes. With ''no friends, not much family'' and no girlfriend for years, he became depressed. He attempted suicide, he said, by walking out one frigid winter night into a nearby forest for five hours with no jacket on. But then he got into the virus-writing scene and found a community. ''I met a lot of cool people who were interested in what I did,'' he wrote. ''They made me feel good again.'' He called his first virus FirstBorn to celebrate his new identity. Later, he saw that one of his worms had been written up as an alert on an antivirus site, and it thrilled him. ''Kinda like when I got my first girlfriend,'' he wrote. ''I was god for a couple days.'' He began work on another worm, trying to recapture the feeling. ''I spent three months working on it just so I could have those couple of days of godliness.''
Vorgon is still angry about life. His next worm, he wrote, will try to specifically target the people who wouldn't hire him. It will have a ''spidering'' engine that crawls Web-page links, trying to find likely e-mail addresses for human-resource managers, ''like careers@microsoft.com, for example.'' Then it will send them a fake resume infected with the worm. (He hasn't yet decided on a payload, and he hasn't ruled out a destructive one.) ''This is a revenge worm,'' he explained -- for ''not hiring me, and hiring some loser that is not even half the programmer I am.''
Many people might wonder why virus writers aren't simply rounded up and arrested for producing their creations. But in most countries, writing viruses is not illegal. Indeed, in the United States some legal scholars argue that it is protected as free speech. Software is a type of language, and writing a program is akin to writing a recipe for beef stew. It is merely a bunch of instructions for the computer to follow, in the same way that a recipe is a set of instructions for a cook to follow. A virus or worm becomes illegal only when it is activated -- when someone sends it to a victim and starts it spreading in the wild, and it does measurable damage to computer systems. The top malware authors are acutely aware of this distinction. Most every virus-writer Web site includes a disclaimer stating that it exists purely for educational purposes, and that if a visitor downloads a virus to spread, the responsibility is entirely the visitor's. Benny's main virus-writing computer at home has no Internet connection at all; he has walled it off like an airlocked biological-weapons lab, so that nothing can escape, even by accident.
