Viruses Threaten NAS Alameda’s Computers

by

Robert Figueroa

They're called viruses, which aptly describes these parasitic, renegade programs that reproduce themselves as they quickly spread from one machine to another. Some are mere nuisances; others can cripple entire networks and destroy or corrupt vast volumes of irreplaceable data. Often designed by twisted geniuses, viruses have infected some of the world's most elaborate, expensive, and supposedly secure computer systems, causing damage in the millions of dollars and disrupting crucial operations for days.

No wonder, then, that the report of a virus on any one of the hundreds of personal computers at NAS Alameda elicits an immediate response from Computer Specialists Judith Hopkins and Vicki Hanson. Hopkins is NAS Alameda's Automated Data Processing (ADP) Security Officer, while Hanson's responsibilities include ADP systems inventory, maintenance, and trouble-shooting. But the skills and duties of the two women, who together oversee all hardware and software functions of the station's computers, substantially overlap; both drop whatever else they are doing when a call comes in reporting the presence of a virus.

Which was the case recently when a memory-resident virus was discovered on a computer located in one of base's busiest departments. "I gave the caller detailed instructions what to do," said Hopkins, a tall, prim, career civil servant who has worked with computers for over 25 years. "They had to have gotten the virus sometime yesterday or last night. We think it may have come over the modem, when a file was downloaded from Philadelphia. But the problem is that this machine is heavily used by a lot of people. They're going to have to go through every single machine and disk in their department." To make matters worse, she said, that department shares a building with another. "So I'm going to have to have those people go through all their machines as well."

The job of removing the virus from the infected machine fell to Hanson, who in manner and appearance presents a marked contrast to her colleague. Smallish in frame and earthy, preferring blue jeans and tennis shoes to dresses and pumps, Hanson is the more mechanically-inclined, hardware-oriented of the two. But with over 15 years of experience in all aspects of computers, including programming, she is no slouch in the software department either. "I have to go in with a screwdriver and very carefully break the CMOS," she said, referring to the operation required to vanquish the virus from the computer's internal operating memory. "Chances are they got the virus from an electronic bulletin board," she added, concurring with Hopkins' deduction.

Hopkins and Hanson deal with several viral infections a year, most of which occur as a result of unauthorized and improper practices, they said. Both emphasize that the Navy has strict regulations intended--among other things--to minimize the risk of exposure. "The Navy is very emphatic about that," said Hopkins. "Regulations state that only authorized people can use the machines. If somebody wants to use a machine, they have to check in with an ADP Site Security Officer [SSO]." SSO's, she explained, are computer-oriented workers in each department who she assigns the collateral duty of computer security for their areas.

Another no-no, according to Hanson, is unauthorized software. "I have a check-off list of software that's supposed to be on the machines," she said. "If something's there that they're not supposed to have, I'll tell them to remove it, or I'll wipe it out myself." This can cause ill will and evasive behavior on the part of people fond of copying their favorite home programs to computers at work. "Some people, when they see me coming, they'll close their doors and shut down their computers." Hanson laughed, but then added: "But really, it's not funny. That's how we get infections. We're all here to do a job, so don't stop me from doing mine." Regulations not only forbid installing unauthorized software, but also extend to bringing in data disks from home, Hanson said. In other words, taking, say, a report home on a WordPerfect file, revising it on your home computer, then bringing the revised version back and loading it on the computer at work, represents a violation of Navy regulations. If this seems extreme, it simply reflects how seriously the Navy regards viruses, said Hopkins. "They'd rather be safe than sorry."

In addition to combating viruses, Hanson pointed out, the rules are intended to keep Navy personnel from breaking copyright laws. Copying software from one computer to another is almost always illegal, as software licenses are generally restricted to single machine use. That is, buying a program usually entitles the purchaser to use that program on just one computer; for each additional computer, a separate license must be purchased. The exception is called a site license, which involves a much higher fee and permits one program to be shared by all computers at a particular site. Site licenses at NAS Alameda would not be cost-effective or practicable, said Hansen. Thus, a strict accountability and one-to-one ratio between software packages and computer systems has to be enforced in order to comply with the law, she said. "All hardware and software has to come through ADP. You can't transfer software to another machine. If you move equipment, you have to let me know. If you acquire computers from somewhere other than ADP, you should physically bring them in to me. I need to put them on inventory, account for them, give them numbers. There are several machines out there now I have no record of. Some of them don't have enough memory to run half the programs they need to."

While part of their duties involves enforcing policies that--however strict or unpopular--are intended to protect the Navy's computers as well as the people who use them, both Hopkins and Hansen emphasize that their function is really to serve NAS Alameda's computer users rather than police them. "If you have any problem with your computer equipment, call me," said Hansen. "I'll come and fix it." She's set up a small workshop in the back room of her office where she conducts repairs, replacements, and upgrades. "I cannibalize old machines for parts," she said.

Hopkins added that some repairs are beyond the scope of ADP, which is not a true repair facility. But they will see that equipment gets repaired--either through vendors or the Navy's Regional Data Automation Center (NARDAC). In the case of problems operating software, both she and Hansen are more than willing to help. "It's part of our job." she said. "I really like teaching people," added Hansen. "I wish there were more hours in the day to do it."

Of course, they might not have all the answers, Hopkins added. In the field of electronics and computers, nobody has all the answers, she said. "I don't believe in experts. When things change so fast, it's impossible to keep up with it so well that you're an expert."

As far as procuring equipment and software, Hopkins said, "Let me know what you need, and I'll generally go out and get it." She recently purchased special systems for Security and the Facilities Management Office (FMO), and planned to meet a request by the Chaplain's office for a Local Area Network installation, she said. In terms of software, while the Navy has several standard programs (including WordPerfect, Dbase, Lotus, and MS-DOS 5), in areas like graphics in which the Navy has no standard, she is free to purchase whatever programs are requested--with certain restrictions. "I don't buy games. Anything else they ask for, I'll get." She listed recent purchases of Harvard Graphics and Freelance as examples.

One piece of software no one needs to request, since every computer at NAS Alameda is supposed to contain a copy, said Hopkins, is an anti-virus program from Central Point. The program functions as a kind of inoculation, automatically checking for virus "signatures" and sounding alarms and activating safeguards when it finds one. It was this program that flagged the latest virus at NAS Alameda. Such a program can represent the difference between an isolated infection and a disastrous epidemic.

If there's one program Navy personnel should make darn sure is installed and working properly, it's that one, Hansen agreed. "Call us," she said. "My number is 3317 and Judith's is 3318. Call us."