When HARLIE Was One (31 page)

“That's the infectious VIRUS, Aubie. It doesn't do anything but spread. It infects any computer it can get to. It's not a fatal disease, but it's debilitating because it uses up resources. There are different kinds of VIRUS programs, like the parasitic VIRUS, for instance; that one sends a copy of itself, then erases itself from the original host. That's called a ‘Flying Dutchman' or a ‘Wandering Jew.' There's only one copy of it floating around at any given time. It has no permanent home, it just keeps moving from machine to machine. One of the worst is the bubonic VIRUS. As soon as it connects to the next machine and sends itself on, it crashes the host; sometimes it erases everything on the hard disks too.

“Then there's the malarial VIRUS. It lays dormant most of the time, only coming out now and then to introduce a quick flurry of random errors and glitches, then it goes into hiding again until next time, when it comes back with a higher level of destructiveness. Some VIRUSes have more than one way of spreading. Some of them write themselves onto your floppy disks as hidden files or new versions of system files; they only come active when certain system commands are called, and not even always then. And finally, there's a mutant VIRUS which has a lot of different capabilities, but you never know which one it will demonstrate in any given machine; it's always mutating. Are you starting to get the picture?”

Auberson was delighted at the audacity—and horrified by the implications. “It's beautiful. It's outrageous. It's terrifying.''

“Oh, yeah,” Handley agreed dourly. “It's fun to think about, but it's hell to get out of the system. There are too many places where a VIRUS can hide. I suppose it got started as a simple hackers' joke, but I know some people who've made a lot of money out of VIRUS. They wrote a protection program—called VACCINE. They sold thousands of copies of it to corporate users.”

Auberson laughed again. “Neat trick.”

“Yeah—I suppose it's easier for you to admire than for me. You didn't have to deal with the great computer plagues. There are a lot of bozos out there in the world who can't resist starting plagues just to see what will happen. At one time, the probability was that one out of every thousand communications was likely to be infectious. That's when ANSI
*
began to develop the Security Standards. Immunity and Detection starts at level three with some very elaborate checksum coding. Incoming data is discarded unless it passes its own veracity tests. At level six, files are automatically tested for SPORES, PHAGES, and PARASITES. At level eleven, software is run in simulation before it is accepted. There's even an experimental disassembler-monitor in the works for level thirteen.”

“That's a lot of security, Don—”

“You don't see all the implications here, do you? A VIRUS program can be a lot more than just an annoying practical joke. For instance, the thing doesn't have to dial phone numbers at random. You can provide it with a complete directory of other computers' phone numbers. Or you can teach it to search for specific kinds of linkups in every computer it infects. You can write it to only infect specific machines or specific kinds of machines or a specific company's—you can even have it look up information for you in those machines and have it report back to your machine on a regular or random basis. You can send this thing out to steal information for you.”

“Wow. . . .” whispered Auberson.

“That's not all. You could also write that VIRUS to alter specific pieces of information. A VIRUS can be single-task; it can be host-specific or data-specific; it can be very accurately aimed and launched. We call those WORMS. They're not terribly infectious—mostly they just burrow, looking for whatever it is they've been written to look for. When they find the target, they can alter the information, scramble it or erase it—whatever you want. The big danger of a WORM is the damage it can do to vital installations. A WORM is a very dangerous weapon, Aubie.”

“Urk. I'm beginning to see what you're getting at.”

“Right. That's one of the reasons the National Data Bureau was three years late in setting up its files. They couldn't risk that kind of security breach, let alone the resultant outcry if the public felt that an individual's supposedly private dossier could be that easily tapped.”

“Well, there must have been safeguards—”

“Oh, there were—right from the start—but you don't know programmers, Aubie. Any system that big and that complex is a challenge. If there's a fault in it, they'll find it. They function as a hostile environment for computers, weeding out inferior systems and inadequate programs, allowing only the strong to survive. They force you to continually improve your product. If IBM makes a claim that their new system is foolproof, it may well be—but if it's not genius-proof as well, within a week one of their own programmers will have figured out a way to foul it up.”

Auberson looked at him. “Why?”

“Isn't it obvious? Purely for the sheer joy of it. Programmers are like kids with a big, exciting toy. It's a challenge, a way for man to prove he's still mightier than the machine—by fouling it up.” He lifted his coffee cup, discovered it was empty, and settled for a glass of water instead. “It happened right here with our own Big Beast. Remember when we set it up, how we said no one would be able to interfere with any one else's programs? Well, within a month the whole system had to be shut down. Someone—we still don't know who—put a bear trap in the memo line. It was titled something like ‘Intersexual Procedures in the Modern Corporation.' Whenever somebody punched for that title—and that didn't take long—the machine would report back, ‘Not Currently Available.' Meanwhile, the trap would have been triggered and the system would have created a useless task for itself, an endless loop. It didn't do anything, but it used up time. After a couple of weeks, there were so many useless tasks running that system response time had been significantly degraded. That drove us crazy. By the end of the third week, performance was so bad, the system was useless. Finding the problem was easy; fixing the operating system to discard useless jobs was not so easy.”

“Hm,” said Auberson.

“Anyway, I'm getting off the track. What I was driving at is that you have no way of knowing about any weakness in your system until someone takes advantage of it. And if you correct that one, likely as not there's still half a dozen more that someone else is liable to spot. Design flaws travel in herds. The National Data Bureau is more than aware of that. Congress wouldn't let them establish their memory banks until they could
guarantee
absolute security. It was the VIRUS programs that were giving them their biggest worries.”

“I can think of one way to avoid the problem. Don't put in a phone link to the data banks.”

“Uh-uh—you need that phone link. You need it both ways, for information coming in and going out. Any other way just wouldn't be efficient enough.”

“And the VACCINE program wouldn't work?”

“Yes and no. For every VACCINE program you could write, somebody else could write another VIRUS program immune to it.”

“That doesn't sound very secure.”

“It isn't—but that's the way it is. Any safeguard that can be set up by one programmer can be breached or sidestepped by another.”

“Well, then, what did they finally do with the data banks?”

“Search me,” Handley shrugged. “It's classified information—top secret.”

“How do you think they did it?”

Handley shrugged. “The guys who know aren't talking. There's a twenty-year federal sentence hanging over that kind of breach. All I know is that only authorized agencies can get into the banks, and they have to have a special encryption device. The coding is theoretically unbreakable—
even if you have both of the code keys
. I don't understand it either. I suspect that the codes are in a continual state of flux, changing every moment, and the code keys are not about the coding of the information, but about the coding of the code system. And you're still not speaking to the data banks, but a referee that forwards your request through another security line.” Handley paused, then added, “And that's at best, an uninformed guess. You didn't hear it from me.”

“Oh,” said Auberson. He looked at Handley sharply. “How do you know all this? What were you doing before you came here?'

Handley shook his head. “Just stuff. The point is, that there is always a very real danger to any information held in electronic storage. The real protection of the National Data Bureau is the lack of available information about how the information is protected—because the juicier a system is, the more crackers there are looking for a way in.”

“You're trying to tell me that there are no safeguards, right?”

“Theoretically, not. Practically, maybe. The real question is, how much are you willing to pay to protect your information? At what point does the cost of protecting the installation outweigh the efficiency gained by its use? The value of a piece of information is determined by two things. How much are you willing to spend to protect it—and how much is someone else willing to spend to get ahold of it? You're betting that you're willing to spend more than he is. A determined intruder
might
be able to break the National Data system, but that would mean he'd spend at least as many man-hours and probably as much money breaking them as did the federal government in setting them up.”

“Why not just tap into a computer that's already linked into the system?”

“See?” said Handley. “You're starting to think like a programmer. Now you see why they had such a hell of a time figuring out how to protect themselves.”

Auberson conceded the point. “Then that isn't a loophole, is it?”

“Systems linked to the National Data Bureau aren't allowed to be linked to
anything
else. It's an isolated network. There's no interconnection; plus requests for information and system replies are transmitted over two separate channels. Everything is as physically secure as it can be. But there's one other access—” Handley stopped. “It's supposed to be equally difficult to crack, but I have my doubts.”

“What is it?”

“Code cards. A coded chip on a plastic credit card. If you have a code card, you can link up to a special access system. You need a machine with a special card reader. Both the card and the reader are very hard to get, but once you have one, you can get anything out of the bank that you're cleared to know. The code card actually contains a processor and the machine you're calling from is reprogrammed from the other end to be a temporary access. Theoretically, you could simulate a code card—if you knew how a code card was programmed.

“That's where HARLIE comes in.”

“Huh?”

“Look,” said Handley. “If HARLIE got into the Bank of America's computer, he must have broken their recognition code or tapped into the interbranch line. Do you know the level of security those lines represent?”

“No.”

“Those are triply-nested level-nine accesses.”

“In English, Don. I don't know the security rankings.”

“In English, that means you're not supposed to be able to program a bank computer by telephone. It is supposed to be impossible. But HARLIE did it; this letter is proof.” He glared at it—its existence was an unpleasant anomaly. “It might have taken a human being a few hundred years to figure out how to do this I'll bet HARLIE did it in less than a week.”

“I'll ask him.”

“No, I'm not so certain we should. I want to think about this for a bit. Listen to me. If he can do that to the Bank of America, think what he can do to IBM. If he can reprogram and monitor other computers from a distance, he can put them all to work on one central problem—like, for instance, breaking the codes of the National Data Banks.”

“You think he'd try?”

Handley pressed his fingertips thoughtfully together and flexed them slowly. “Remember when we were building him—how we kept calling him a self-programming, problem-solving device? Well, that's what he is. He's a programmer, Aubie, and he's got the same congenital disease every programmer has—the urge to throw the monkey wrench, if for no other reason than to see if he can make the machine respond. The National Data Banks are a challenge to him—to all programmers—but he's the one with the capability of doing something.”

“If he gets caught—” Auberson said.

“Then we're both in big trouble. Me more than you, and never mind why. We'll both get very fast, very efficient, very invisible trials. And HARLIE will be confiscated. Maybe destroyed. All it will take will be one mistake and we'll be getting a visit from some very serious-looking men in dark blue suits. You know, starting at level six, the accessed computer not only lists all calls accepted and the nature of the information exchanged, they also list all calls rejected and the reasons why. If someone is making a determined effort to crack a system, it shows up in the log. At level seven, automatic tracing of all calls is triggered by any unusual pattern. At level eight, all calls are traced routinely.” Handley reached for his water glass, discovered it was empty, reached for Auberson's instead.

“That's been used—”

“I don't mind.”

“I had a spot on my shirt, remember?”

Handley lowered the glass from his lips. “No wonder it tastes like a paper napkin.” He drank again, thirstily, and replaced the glass on the table. “On the other hand, let's assume that HARLIE
can
tap into the banks. We cannot assume that it's merely idle curiosity. Remember, he's as paranoid as any other life form—that means that his survival is so essential to him that it might outweigh any other consideration. If he could get into the National Data Banks, he would have the power to make some very real demands. All he has to do is threaten to scramble or erase or merely publicize the information in the banks unless his demands are met. Can you guarantee he wouldn't use that power? HARLIE is the perfect terrorist's weapon.”