First published: 27th May 2010
Reseacher Dr Mark Gasson from the University of Reading has claimed that he is the first human being to be infected by a computer virus. The "infection" was a deliberate part of his research at the University's School of Systems Engineering. Dr. Gasson claims that he contaminated an RFID chip, which was then embedded in his hand. The normal function of the chip is to allow Dr. Gasson to pass security doors and activate his mobile phone, but Dr Gasson showed in trials that the chip was able to cause external control systems to be infected by the computer virus.
The research has bee widely criticised, by anti-virus experts such as Graham Cluely and the technical press as a meaningless publicity stunt. Infection can be defined as the detrimental colonisation of a host organism by a foreign species. Dr. Gasson's stunt does not fulfil this definition - the computer virus is restricted to the RFID chip which has no information interaction with his body. The location of the RFID chip is incidental - just as having an infected thumbdrive in your pocket when you get into a car does not make the car infected.
Furthermore, even a far lesser claim that an RFID chip can infect other devices is on shaky ground. Note that the claim is that "external control systems" became infected - why wasn't the system named? Graham Cluley explained, "The fact is that that code would not be read until an RFID reader came into contact with the affected RFID chip and even then the software connected with the RFID reader would need to have a vulnerability that would allow the code to be run". Therefore, it seems that the "system" was not a standard computer or phone, but one which had been specially modified to read and execute commands from an RFID chip. Then there is the question of what was stored on the RFID chip. RFID chips do not have large storage, 1Kbi is considered "large". Those who remember boot sector viruses might recall that this is sufficient for a complete virus, but most recent viruses are larger and more complex. The BBC video interview with Dr. Gasson shows a fragment of the code stored on the RFID chip. This appears to include a SQL statement and "<script>" tags surrounding a URL. So, the RFID chip does not contain the virus itself, merely a link to where a suitably-programmed device can go to download the virus and infect itself.
There are serious security concerns to be addressed when there are practical, effective systems for direct two-way communication between biological and non-biological information systems, but they are closely related to the current concerns we have with today's indirect two-way communication. Dr. Gasson's stunt is detrimental to the public understanding of the real issues.
