TruthTest

Week of August 14, 2001

From 'Software Hard Sell - Are computer viruses running rampant, or is John McAfee's antivirus campaign running amok?' by Joshua Quittner, Newsday 5 April 1992 p. 68.

John McAfee is doing one of the things he does best: warning a reporter about the perils of a new computer virus.

'We're into the next major nightmare - the Dark Avenger Mutating Engine,' McAfee says, ever calm in the face of calamity. 'It can attach to any virus and make it mutate.' The ability to 'mutate' makes it virtually undetectable to antivirus software, he explains.

'It's turning the virus world upside down.'

But wait. This is John David McAfee, the man who once ran a service that revolved around the curious premise that, if you paid him a membership fee and tested HIV-negative, you could have AIDS-free sex with other members for six months. This is the man who jumped from biological viruses to computer viruses and quickly became a flamboyant expert on the new demi-plague, showing up at the scene of infected PCs in his Winnebago 'antivirus paramedic unit.'

And this is the same man who started something called the Computer Virus Industry Association, and, as chairman, made national headlines last month by saying that as many as five million computers might be infected with a virus named Michelangelo.

The virus turned out to be a dud, in the opinion of many industry experts. But not before McAfee became a media magnet: In the weeks before March 6, when Michelangelo was supposed to erase the hard disks of infected IBM and compatible PCs, he was featured by Reuters, the Associated Press, USA Today, the Wall Street Journal, 'MacNeil/Lehrer News Hour,' CNN, 'Nightline,' National Public Radio and 'Today.'

What some news reports failed to point out, however, is that McAfee is also the man who runs Santa Clara, Calif.-based McAfee Associates, a leading manufacturer of antivirus software, and that he stood to benefit from publicity about Michelangelo. McAfee won't reveal sales, but it seems clear they shot up during the two-week frenzy.

'People kept saying I hyped this, I hyped this,' said McAfee, who still defends the notion that Michelangelo was widespread. 'I never contacted the press - they called me.'

McAfee's detractors say the Michelangelo scare was mainly hype and media manipulation, a parade in which most of the floats were built by McAfee. They say McAfee helped drive the rush to buy antivirus software - with his products poised to sell the most - while boosting the profile of McAfee Associates, a company that recently received $10 million from venture capitalists McAfee says are waiting to sell stock publicly.

And, critics say, while McAfee touts a recent evaluation that rated his software alone as 100 percent effective in finding virtually every known virus, he funded the evaluation and picked his competitors.

'He does know the issue of viruses, no doubt about it,' said Ken Wasch, executive director of the 900-member Software Publishers Association. 'But his tactics are designed to sell his software.'

McAfee says the media consistently misquoted him about how widespread Michelangelo was. And his company didn't profit from the virus, he says, but actually suffered due to the free advice his staff was dispensing. 'It does not benefit me in any way or shape or form to exaggerate the virus problem.'

Even McAfee's detractors admit his programs do what they're supposed to do: track down coding that's maliciously placed in software to make it do anything from whistle 'Yankee Doodle' to erase valuable data.

His strongest distribution channel is shareware, a kind of software honor system common on electronic bulletin boards. PC users can download the programs over phone lines and pay later if they find them useful.

McAfee's programs are 'probably the most popular shareware programs of all time, second only to PKZIP,' which compresses data, said George Pulido, technical editor of Shareware Magazine. He said McAfee's programs have been copied by millions of people, although only about 10 percent of shareware users actually pay.

A more reliable money-maker is corporate site licenses, where McAfee is one of the three biggest players. Michael Schirf, sales manager of Jetic Inc., a Vienna, Va., company that is McAfee's sales agent for the Mid-Atlantic region, claimed more than 300 of the Fortune 500 companies have licensed his software, paying $3,250 to $20,000, depending on the number of PCs. During the Michelangelo scare, 'you couldn't get through to us at one point because of people asking about it and trying to get it,' Schirf said.

Certainly, McAfee's software wasn't the only antivirus software selling. Fueled by giveaways of 'special edition' programs that scanned exclusively for the Michelangelo virus, sales of general antivirus packages were a bonanza for everyone in the business, including Norton/Symantec and Central Point Software, two other leading sellers.

'Our sales of antivirus software were up 3,000 percent,' said Tamese Gribble, a spokesman for Egghead Software, the largest discount software retailer in the country. 'We were absolutely swamped.'

Rod Turner, a Norton executive vice president, said antivirus sales increased fivefold. 'We didn't make any product in advance,' he said, 'so we were caught with our pants down.' Companies like Norton that sell factory-shipped software couldn't ramp up quickly enough to take full advantage of the situation. But McAfee's software comes mostly through electronic bulletin boards and sales agents, giving him a nearly limitless capability to meet demand. 'I can supply as many copies of the software as I have blank diskettes to put it on,' Schirf said.

The Michelangelo scare was also good for pay-by-the-hour on-line information services such as Compuserve, which saw a huge increase in the time users logged on looking for advice on Michelangelo.

Indeed, a virus forum on Compuserve was hugely popular, with users downloading antivirus programs, including McAfee's, 49,000 times that week, Compuserve spokesman Dave Kishler said. Compuserve made more than $100,000 from the online time.

McAfee makes an attractive industry spokesman. Tall and lean, with a mellifluous voice, he speaks in perfect sound bites - an antidote to the unquotably bland men who otherwise dominate the antivirus business.

A mathematician who got into programming when he graduated from Roanoke College, McAfee, 47, said he has held a dozen jobs, ranging from work on a voice-recognition board for PCs to consulting for the Brazilian national phone company in Rio de Janeiro. His first mention in the media was in connection with the American Association for Safe Sex Practices, a Santa Clara club formed so that its members could engage in AIDS-free sex. For a $22 fee, members whose blood tested HIV-negative were given cards certifying them AIDS-free, buttons saying 'Play it Safe,' and were entered on McAfee's on-line data base. Updates, every six months, cost $7.

Anyone who knows anything about AIDS knows a certificate that someone is AIDS-free is good only until the person has sex with or shares an intravenous needle with an infected person.

When asked now about the safe-sex group, McAfee at first denied anything but a passing affiliation: 'I worked for those people as a contractor,' he said, adding, 'It was not my company.' But later, when he was reminded that both the San Diego Tribune and the San Francisco Chronicle described him in feature stories as the entrepreneur who started the organization ('I believe I am providing an environment where people who are sexually active can feel more safe and secure,' he told the Tribune in a March 9, 1987, story), McAfee sidestepped the ownership question. He said the group performed a valuable function, maintaining a data base on AIDS and information about the disease.

'I thought they were pretty well ahead of their time,' he said, quickly locating a 1987 newsletter put out by the group, which featured articles such as 'Kissing and AIDS' and 'The Apparent Racial Bias of the AIDS Virus.'

The association no longer exists. 'They came and went pretty fast,' McAfee said, chuckling.

McAfee got his first taste of computer viruses at around that time. 'It was an accident, like anything else in life,' he recalled. 'I got a copy of the Pakistani Brain. I think I got it from one of the local colleges. It was the program of the year.' The program, reportedly written by two Pakistani students trying to foil software pirates, destroyed some PC data.

By 1989, McAfee was a virus expert, selling the first antivirus software and offering to make house calls with his Winnebago cum computer lab.

'John's antivirus unit is the first specially customized unit to wage effective, on-the-spot counterattacks in the virus war,' McAfee and a co-author reported in 'Computer Viruses, Worms, Data Diddlers, Killer Programs, and Other Threats to Your System,' their 1989 book. 'Eventually, there will be many such mobile search, capture and destroy antivirus paramedic units deployed around the world.'

He had also founded the Computer Virus Industry Association, with himself as chairman.

'The CVIA is nothing more than McAfee,' said Wasch, of the Software Publishers Association. 'I had a run-in with him three years ago about that.' Wasch said he had been asked by other antivirus businesses to look into McAfee's group after claims surfaced that he was railroading companies into joining - something McAfee vigorously denies. Wasch said he believes the assocation was a self-serving group that did little more than support McAfee's business.

'It would be like Microsoft creating the Windows Support Association as a front to promote its Windows software,' Wasch said.

McAfee denies the CVIA is a front and said Wasch's group was threatened by the creation of the virus association. 'They wanted to take us over,' he said. In any event, he said, the association is now managed by others and his involvement is minimal, adding, 'It's more of a nuisance to me.' But he does say the association is dependent on his private business for much of its virus data. 'McAfee Associates has all the numbers,' he said.

Detractors say McAfee now uses another association to hype his programs.

The National Computer Security Association released one of the few ratings of antivirus software, with McAfee's program on top - a comparison he's quick to cite. But that may be because he influenced which software would be compared with his and how the tests were run, said David Stang, who founded the for-profit association in Washington, D.C., two years ago. Stang recently left the association and started a new one after a falling-out with McAfee over testing procedures.

Stang said one of the assocation's functions was to 'certify' antivirus software - to test and rate competing programs. 'It was his [McAfee's] idea that we certify products,' Stang said. And when no company rushed forward to pay $500 to have its software rated, McAfee 'sent me the products and the check and said 'go certify.''

McAfee says he spent thousands of dollars to evaluate some of his competitors' programs. In February, 1992, in fact, he paid for his own and the other five programs to be certified. His was ranked 100 percent effective. The others ranged from 44 percent to 88 percent effective.

'If your product competes with mine, I'd like for those customers of mine to know that your product isn't as good as mine,' he said. But in the February certification, notably absent were McAfee's biggest competitors: Dr. Solomon's ToolKit and Skulason's F-Prot.

'I've got 75 competitors. I pick the ones who are going to give me the most trouble that month,' McAfee explained.

The February evaluation was actually a second, and more favorable test, that Stang says he performed at McAfee's request. Stang said McAfee was dissatisfied with the assocation's methods - it tested the software against a 'library' of viruses that McAfee thought wasn't comprehensive enough. So Stang said he agreed to use a new library that he claims was built on viruses McAfee found and supplied. Scores for McAfee's program rose while some others dropped sharply. McAfee said Stang's virus library was incomplete and his testing methods 'wishywashy,' and he defended the new library's independence.

'This is not something that anybody, let alone me, could mess with,' said McAfee. 'You can't jimmy these scores. You can't say that McAfee buys more certifications, therefore he'll get a better score, because other vendors would complain.'

'They wouldn't let me get away with it.'