Of Google, sewers and English ale
The site was down for the best part of a day, at least to some people: Google's response to the attack was to refuse access to those ISPs who were producing the biggest load -- roughly the same strategy as grounding all aircraft after a hijack, and as unsustainable. The most frustrating aspect of the affair was that the culprit, MyDoom, is a thoroughly known quantity. At heart, the virus is the same as the one that's previously attacked Microsoft and SCO: forget super-smart hackers sniffing out subtle vulnerabilities, this was the same old same old. If MyDoom can get through months after it's been identified, then the very idea of antivirus software is flawed.
To find an answer to the problem we have to go back 150 years, to London in the late summer of 1854. Dr John Snow, a far-sighted medic who also pioneered anaesthesia, was studying cholera epidemics - and between 31 August and 9 September, 500 people died from the disease in a pestilent area of Soho only a few hundred metres square.
Dr Snow had long suspected that cholera was carried in water and produced a map showing that the deaths clustered around a water pump. The mythology of the story relates that he persuaded the local authority to remove the handle and thus stopped the epidemic: the truth is more complex but it boils down to the same thing. Dr Snow was right, and subsequent investigations showed the route of infections -- porous brickwork letting sewerage leak into the water supply -- and the effectiveness of his predictions. The good Doctor can thus be remembered both as a father of modern epidemiology, the study of disease in populations, and a pioneer of GIS, geographical information systems.
And so to the present day, where the global shower of IT malware seems constant and unstoppable. The first we know about another venomous nasty on the rampage is when sites are down, email is clogged and even the BBC's heard about it. Yet each infection carries with it a great deal of information that could be used in real time to map and isolate them - information that's currently not being gathered, let alone analysed. Each computer on the Internet is a potential tripwire: as fast as a virus can spread, the news can spread faster.
We're already used to sharing information across the Net for utilitarian reasons: Seti@Home and other distributed processing schemes show the value of communal computing. Who wouldn't volunteer to run a heuristic analysis package that monitored traffic and email at their PC and reported when something suspicious was underway? It wouldn't be necessary on every computer -- if we can't get everyone to maintain updated antivirus software, the chances of making that happen are vanishingly small -- but a statistically significant monitoring group will be easy to set up.
The problem with heuristic virus detection is that it's not very reliable: by attempting to identify a virus by what it does, the chances are high that the analyser will misidentify legitimate software as malware -- a false positive. Yet with thousands of PCs watching the net, these false positives will be so much noise. The introduction and spread of a real virus will create an unmistakable fingerprint with the nature of the virus and the area of the Net from whence it spreads immediately obvious to whoever's checking.
As to who does this and what happens subsequently: the politics here will be far more troublesome than the technicalities. Ideally, a new virus will be picked up within two or three generations and the infected areas isolated -- or at least filtered -- before the exponential spread gets going, but the powers required to make this happen are not to be lightly bestowed. It shouldn't be hard to persuade the likes of Google and Microsoft to support an independent agency dedicated to giving the Internet a proper immune system.
If you can't wait, one way to avoid cholera is to drink beer, as the brewing process is naturally antiseptic. Visitors to Soho, and the still-pestilential area of Broadwick Street, can see a model of the pump close to a pub named after Dr John Snow himself -- who, as a lifelong teetotaller, would not have approved.