The man who wrote the original anti-virus program tells Paul Rodgers he wants to make data safer

Sunday, 18 October 2009

Where Sergey Brin and Mark Zuckerberg have made geekdom funky, Peter Tippett is a bit of a throwback. He has on a grey suit with a conservative blue tie when we meet; his hair would please a marine drill sergeant and he wears wire-frame glasses that are almost as unstylish as (though undoubtedly more expensive than) mine.But in his own fashion, Tippett has been just as revolutionary as the founders of Google and Facebook. Long before the internet took off, in the days when software spread from one machine to another on 5 1/4-inch floppy disks, Tippett wrote the world’s first anti-virus program, called Vaccine – at the same time inventing, almost as an afterthought, the undo command (control Z in many applications) and the restore disk. He also built not one but two big security companies, the first evolving into the business now known as Norton.

Along the way, he developed a security philosophy that is so full of common sense, yet so defies commercial imperatives, that one can only conclude that the buying public is mad. “This is how we’ve done security in the real world for ever,” says Tippett, leaning forward to make his point with an enthusiasm that belies his dour dress sense. “Why people don’t want it on their computers is beyond me.”

Most people consider themselves lucky to have a single career. Tippett has qualified for six. For starters he’s a pilot, licensed to fly jumbo jets loaded with passengers across oceans. “I’ve been flying since I was 15,” he says. “It’s my hobby.” He also has a PhD in biochemistry from Case Western Reserve University in Cleveland, and a commercial radio engineer certificate. Plus he’s a medical doctor, which led, circuitously, to his jobs as entrepreneur and security guru.

“For 32 years I’d had no income,” he says. “When I got my first job as a doctor I didn’t know what to do with the money, so I hired four guys and put them to work writing programs in my living room.”

That was shortly before the first computer virus was developed by Frederick Cohen at Lehigh University in Pennsylvania in 1983. Tippett and his chief programmer met a Lehigh student at a trade show in California and got a copy of the virus from him. “Writing Vaccine took us five weeks, including the manual and the sales brochure,” says Tippett.

Yet when McAfee came along three years later with its own anti-virus suite, it quickly ate into Vaccine’s still-small sales. The two programmes worked with philosophies that were diametrically opposed. Vaccine checked that the software on your machine was approved and hadn’t been tampered with. Anything else it considered to be a threat, an approach known in the jargon as “default denial”. McAfee’s program allowed any bit of code as long as it wasn’t on its list of known viruses, an approach called “default permit”. When a new bit of malicious programming emerged, McAfee had to get a copy, write a bespoke response, and distribute it to customers. “It’s like putting a big sign outside your house inviting everyone in to root through your stuff as long as they’re not convicted criminals,” says Tippett in his slightly nasal Michigan accent. “It’s not what we do in the real world.”

The story reminds me of the superiority of Betamax over VHS in the late 1970s, and of Apple over Microsoft a decade later. So why didn’t buyers go for the better product in this case? “What people wanted from an anti-virus program,” says Tippett, “was the ‘scan’ function.” They wanted to be reassured that every line of code had been checked.

For now, at least, the battle has been lost. Like McAfee, Norton works on a “default permit” philosophy these days. And Tippett has moved on. By the start of the 1990s he was an acknowledged expert on information security, and advised the US Joint Chiefs of Staff on cyber warfare during Desert Storm in Iraq. He sold his company to Symantec in 1992, though he stayed on to help them for more than two years. “I left after they decided they didn’t want me to be chief executive,” he says candidly, adding: “I don’t hate them; they bought me a jet plane.” A little one, he adds.

Tippett made his second fortune building Cybertrust, a company that would eventually become the Virginia-based security arm of Verizon, the world’s largest internet service provider, where it does, among other things, the lion’s share of the forensic work after hackers break into corporate and government databases. And its a Verizon report on this work, in its own way as iconoclastic as Vaccine, that he’s here to talk about.

“Computers are at the same point in the growth cycle as airlines were at the time of the DC3,” he says. “Back then we could fly to France, but we’re 5,000 times less likely to die doing it today. How did we make airlines so safe?” The answer, he says, is rigorous scientific investigation of every case where the system fails.

Admitting that corporate firewalls have been breached and sensitive customer data, often financial data, have been stolen is bad for business, he says, so only a third of cases are reported publicly, usually because its a legal requirement. Verizon, however, investigates 90 per cent of such cases around the world, putting it in a unique position to analyse who the hackers are and how they work. The results contradict many popular myths in the information security world.

It is widely thought, for example, that most hacks start with an insider. But Verizon’s stats show that only 11 per cent of cases are down to employees acting alone, while in another 9 per cent outsiders are helped inadvertently by an employee’s actions. Seventy-four per cent of hacks involve outsiders, says Tippett. And those outsiders were far more effective thieves, stealing 99.9 per cent of the records. The remaining cases are initiated by people from partner organisations, such as suppliers, with access to the target’s computer network.

The hackers are also unlikely to work for state organisations – the popular KGB scenario. While there’s no evidence of governments backing hackers, plenty of it points to known organised crime gangs.

Tippett also pours cold water on some of his industry’s favourite remedies, such as encrypting every piece of data, applying security patches immediately, or using long passwords. Most uses of encryption won’t stop hacking, he says – though it might be helpful on easily stolen laptops – few cases of data theft involved recently discovered vulnerabilities in the system and when thousands of user names are being attacked, an eight-digit code is only slightly more secure than one five digits long. The bigger risk is that passwords will be left on the default settings, such as “admin” or “password”, especially on servers.

What’s needed, he says, are layered defences, each catching most, though not all, attempts at invasion. “The number one thing to do,” he says. “is a lot of little things.”

The robot trolleys scooting around Canon’s Toride photocopier assembly plant quietly beep a little melody – “Toryanse”, a traditional folk song – to warn workers that they’re coming. The lyrics translate as: “Unless you are going to the shrine, don’t take this path”, a typically obtuse Japanese way of saying, “be careful or you’ll meet your maker”. It’s an appropriate choice for the famously conservative company; Canon hopes to sidestep the deadly economic juggernaut that is bearing down on its rivals in the electronics sector. Yet it’s doing so in a typically conservative way.

Japan’s economy is already officially in recession. Along the road from Tokyo to Toride, yards full of parked cranes and earthmovers are emblematic of the weakness in the construction industry. Financial institutions have laid off newly recruited staff or put their hiring plans on hold. Exporters have been hit by the rising yen, which has added 30 per cent to their costs in a matter of months, while their global markets, from Arkansas to Vladivostok, have been credit crunched.

Panasonic revised its annual profits forecast down by 90 per cent last week, from 300bn yen (£2bn) to ¥30bn. Sony and Toshiba both said last month that they had suffered dramatic profit falls in the previous quarter, Sony by 93 per cent year-on-year, Toshiba by 210 per cent. Canon, too, has felt the pain – but not the agony. Its third-quarter results show a mere 21.1 per cent decline to ¥83bn.

So Canon sees no reason to grasp for cost-cutting lifelines, like other, more troubled companies. It has no plans to close factories, at home or abroad, and is sticking with its rather quaint employment-for-life policy. If it tightens its belt at all, that will probably be through reducing the number of casual workers supplied by agencies. At worst, it may cut its intake of engineering graduates this year.

Besides, the imaging firm could teach Gordon Brown a thing or two about prudence. Canon eschewed recent trends for leveraged growth and is in the enviable position of having no net debt. Instead, it is sitting on a yen yama, a cash mountain, of ¥737bn. Tsuneji Uchida (pictured below), the president and chief operating officer, says the firm is looking for “complementary” businesses to acquire, though he has ruled out hostile takeovers.

That Canon is in such a strong position going into this downturn is the result of the reorganisation begun by Mr Uchida’s predecessor, Fujio Mitarai, after he became president in 1995. Crucially, he shifted the group’s focus from the usual Japanese obsession with sales and market share to old-fashioned profitability. Mr Mitarai, now the chairman, says proudly: “I closed eight divisions and grew the profit-making ones.” Those that remain mainly produce cameras, copiers and printers. Niche segments where Canon is still active include medical imaging, such as x-rays and scanners. It also makes the large optical devices used to miniaturise and etch complex circuit diagrams on to silicon chips. And if you watched the Olympics, there’s an 80 per cent chance the television images you saw were shot using Canon optics.

Mr Mitarai also changed Canon’s production methods, dramatically. Out went 20km of conveyor belts as the company introduced cell-based production – a return to a system used before Henry Ford popularised mass production nearly a century ago. The green floors of the Toride plant are now marked with white tape into U-shaped areas where copiers are assembled by groups of up to six workers dressed in the company jacket (beige, with blue and orange vertical stripes). The (staff-designed) musical trolleys deliver a full set of parts to the team members, who are responsible not only for assembling the copiers but for thinking up better ways to do their jobs. Almost everything is mounted on wheels, and workers are encouraged to shave fractions of a second off their times for each task. One employee deftly pushed away a stool with his foot as he rose, while his left hand reached for a part and his right swivelled the chassis he was working on into a new position. Top assemblers, designated “super meisters”, can build a copier, single-handed, from more than 3,000 parts, using instruction manuals that stretch to 10 volumes, in less than three hours.

This system is more flexible, more efficient and less wasteful, says Canon, though it is unable to quantify the improvements because so many other factors were changed at the same time. But one clear benefit is job satisfaction, with workers rating their jobs twice as highly as they used to, despite not being allowed to chat with their colleagues or listen to music.

The company that was to become Canon was founded in 1937 as Precision Optical Industry. It soon changed its name to match that of its first camera, Kwanon, named after the 1,000-armed Buddhist goddess of mercy. Like most Japanese companies, Canon started by taking foreign technology, improving it and making it cheaper. But by the 1960s it was innovating in its own right: it produced the world’s first 10-key digital calculator, the Canola 130, in 1964. The company now prides itself on its inventiveness, and especially on being ranked second highest (after IBM) among companies applying for US patents, with more than 19,000 granted in the decade to 2007.

But that does not mean it is always the first out of the starting gate. It was slow to move into digital photography, mainly because it did not want to have its name attached to an immature, hence inferior-quality, product.

When Canon did enter the market in 1996, it quickly rose to the top, though it is now engaged in a bitter battle with Nikon for dominance, and just last week was reported to have fallen into second place in the UK market for 35mm digital single-lens reflex cameras – the kind used by professionals and serious hobbyists. Mr Uchida is confident that the market for mid- and high-end digital cameras will continue to grow, and sees the mobile camera phone market as a junior league, inspiring its future customers, rather than as a rival.

Canon also has its eyes on other sectors. It is working, for example, on robots and particularly robotic sight, though mostly for in-house use at first. It already has automated camera systems to do visual quality checks on more than 200 points on its finished copiers in a matter of seconds. Potentially more dramatic is its interest in flat-screen displays. Pending the final settlement of a long-running legal battle over licensing rights, it could soon enter the television market with a technology called surface conduction emission display, in essence putting a miniature cathode ray tube (like the one that drove your old TV) behind each pixel in a flat screen.

Canon’s big strategic buzzwords are “globalisation” and “diversification”. But it is well established as a global brand now and recently it has focused on core competencies rather than branching out into new fields. Perhaps more telling is its ambition to be one of the world’s top 100 groups, against stiff competition from faster-growing new businesses in other fields. Its role models, says Mr Uchida, are the likes of Du Pont, Procter & Gamble and Siemens, which have been around for over a century.

Longevity like that requires constant innovation, he argues. And if that means conservative manufacturing techniques, so be it.