The Myths of Security

Chapter 22. Do AV Vendors Write Their Own Viruses?

One frequent (and typically serious) question I get is whether McAfee has people writing and spreading viruses to increase the need for its own product.

I’ve seen other people I know who work for a big AV company get asked that question, and the answer is often an indignant, “Of course not,” primarily because that would be illegal. In most people’s minds, that’s defensive, and might be taken as guilt.

Personally, I think I’m ethical, and if McAfee were doing something that explicitly illegal, I’d very much feel the obligation to blow the whistle. Certainly, I wouldn’t have gone back to the company for a second tour of duty.

The short answer is, of course, no; at least at McAfee (and hopefully everywhere else), that does not happen. But a more accurate answer would be that even though the business doesn’t condone it, there might be some very slim chance that somewhere somebody in the organization is a maverick producing malware.

If that were to happen, it seems highly unlikely that the incentive would be to improve company performance. It’s such an indirect way to benefit the company for a smart engineer who is good enough to write malware, and he or she would know it’s unethical. If the employee were that unethical, I suspect he’d be more inclined to do it to benefit himself, and the fact that he was at a big company would be incidental.

I’m sure that this kind of thing has happened in the lifetime of our industry, but as far as I’m ...