Computer viruses slow African expansion


Alan Mercer was at his desk in the regional capacity building bureau in Assosa, western Ethiopia, when a man burst into his office, distraught. Right at the end of a four-year master's degree programme, he had lost the only copy of his thesis to a computer virus. Mercer, an IT trainer with Voluntary Service Overseas (VSO), wasn't surprised. "Show me an Ethiopian computer without a virus and I'd ask which foreigner it belongs to," he says.

While western countries have partially learned to neutralise the threat of computer viruses, Africa has become a hive of trojans, worms and exploiters of all stripes. As PC use on the continent has spread in the past decade (in Ethiopia it has gone from 0.01% of the Ethiopian population to 0.45% through 1999-2008), viruses have hitched a ride, wreaking havoc on development efforts, government programmes and fledgling businesses.

"It wouldn't be unreasonable to say 80% of all computers you find in Africa will have some nastiness on them," says Tariq Khokhar, the chief development officer of Aptivate, a non-governmental organisation that focuses on IT. This compares to around 30% in the UK, according to Panda Security. The cost is hard to measure, but ask IT consultants and development workers about the impact, and the stories pour out. Mercer tells of an agriculture bureau employee who lost the multi-year plan for agricultural improvements for the Benishangul-Gumuz region, Ethiopia's fourth poorest area. Jeremy Brown, an IT consultant in Cameroon, says that one client was operating with more than 200 infected files, drastically slowing down its PCs, corrupting confidential information and exposing it over the internet. Even the Congress of South African Trade Unions found in May that its website was spreading viruses to visitors. "Viruses are pretty endemic," says Brown. "All organisations and individuals are affected by them."

Viruses spontaneously reboot computers, destroy vital data, and clog Ethiopia's already severely pinched internet connection (it is not unusual to wait 10 minutes to access a single web page). The result: funding applications delayed, small businesses hurt, and hours wasted. "PCs that were bought with limited funds or donated sit collecting dust in the corner of the room because they have been devastated by viruses," says André Mohamed, an IT professional in Ethiopia. "It's a major reduction in productivity and efficiency."

"Viruses are our enemy," says Debebe Fikreselassie, the head of ICT at the Benishangul-Gumuz bureau where Mercer is a VSO volunteer. "We are installing free antivirus but the behaviour of the virus is changing [over] time … and developing countries lack money to buy licensed antivirus like Symantec."

That hits the nail on the head, agrees Tim Unwin, the Unesco chair of ICT4D, an IT development collective at Royal Holloway, University of London. "The fundamental problem is that institutions in much of the developing world cannot afford the antivirus [AV] protection that those in richer countries can," he says. Khokhar agrees. "For Africa, the cost of AV is pretty damn high. An annual licence of £30 per user per year can get pretty daunting when you've got 1,000 users."

Without special pricing, poor countries are forced to rely on free antivirus products, such as AVG. "Writing antivirus software is a fairly brain-intensive task, and AVG just don't have the resources," Khokhar says. "It's not to say something's not better than nothing, but ultimately, the viruses that are going to cause real damage are going to get through."

Brand-new PCs are often ridden with viruses from the start when vendors install pirated, infected copies of Windows – Khokhar estimates that around a third of pirated software is already infected. And even when antivirus software is installed, it is almost impossible to keep up to date. The daily update of new virus definitions from Symantec is around 40MB; McAfee's is around 100MB. "On a 56Kb dialup link, we are talking all day to download," Mercer says. Sometimes the update file is removed and replaced by a newer one before the download has had time to complete.

"The entire national bandwidth for Ethiopia, I can simulate that in my house," Khokhar says. This keeps Ethiopia off the antivirus software provider Kaspersky's annual list of the top 10 countries both originating and being targeted by viruses; in 2008, China led both categories. The Eastern Africa Submarine Cable System (EASSy) would help Ethiopians download antivirus updates faster, but would also expose them to more attacks. "If you wanted a way to get [African countries] on to that top 10 list of countries affected by viruses, the first step is to install a big internet connection," Khokhar says.

The financial and technical problems are compounded by the developing world's dire shortage of IT education. "The IT degrees here are totally theoretical. People do not understand the concept of backups, antivirus and data security in the first place," says Mercer.

Computer viruses are not the only reason Africa lags behind the west in IT development. Electricity supply, training, and bandwidth management issues make e-business a pipe dream in most places. But people are fighting back. Mercer does a day of antivirus and power-protection training as part of all his training courses, as do many people at VSO on an informal basis.

Unwin says replacing Windows with Linux would help (80% of viruses are written in China, where Windows dominates). The Ethiopian government has, in fact, made open source software central to its IT plans. Khokhar says it's no magic solution. "If you suddenly had an increase in Linux or Mac use in China, you'd find those two platforms are just as vulnerable." Using better software in general, he argues, would be a better place to start. "If you could somehow clobber RealNetworks, Adobe and Microsoft to say, 'Can you please write software that doesn't have that many exploits, or if exploits are identified, have some mechanism for closing them more quickly' – then that would really help."

It's a good bet that virus writers devising ever more ingenious ways of sticking a knife between Microsoft's ribs rarely consider where their handiwork ends up.

"I'd take them to Ethiopia," says Mercer. "I'd show them the man who lost his agricultural development plan to the virus he wrote. Then I'd show him the kids who will die in two years because the agricultural reforms came too late and the annual harvest failed because the agricultural development plan at the regional agricultural bureau was destroyed by his virus."

The sad irony is that Ethiopia's enthusiastic embrace of the computer has made it more vulnerable, as people start dispensing with paper records. "Now, with no backup, and important data on a computer, they are at risk – they have something to lose," Mercer says. Mohamed agrees: "The computer, instead of being an enabler for development, often becomes a hindrance."

The Guardian