Truth About Computer Security Hysteria
Michelangelo Fiasco: a Historical Timeline
Monday, 1 June 1992
1/28/92: Newswire reports say Leading Edge shipped up to 500 computers in December with the
Michelangelo virus. It apparently came from a third-party subcontractor; an alert customer detected it.
1/28/92: Osicom Technologies announces it will bundle an antivirus package with all personal
1/29/92: UPI reporter Jack Lesar files a newswire saying "the
Michelangelo Virus could erase data from hard disks of hundreds of thousands of computers around the world
on Michelangelo's birthday, March 6." Winn Schwartau, executive director of the Nashville-based International
Partnership Against Computer Terrorism, attributes magical powers to the virus: "`It's usually been a rule
that a virus can't be propagated by just reading from a data disk. But in this case it appears to no longer be
true,' said Schwartau. `You may consciously just be reviewing data, not moving data, but the virus is hidden and
executable and it's doing its thing.' "
Interestingly, the report continues: "[John] McAfee said the Michelangelo Virus is the third most common in
terms of reports of infection. It accounts for 14 percent of infection reports — a total of about 6,000 last year.
And he notes the figure represents the number of sites at which infection has been reported — each of which may
have one machine, or 100."
2/3/92: Newswire reports say Da Vinci Systems distributed about 900 disks infected with the
Michelangelo virus during January.
2/11/92: Reuters reporter Wilson da Silva files the first newswire saying the
Michelangelo virus resides on "millions of personal computers around the world." The estimate —
five million worldwide — comes from John McAfee. In the story, researcher Wayne Boxall of Australia's Computer
Virus Information Group erroneously states the virus spreads via computer bulletin boards.
2/13/92: Microcom announces it has released a free program to disinfect the Michelangelo
virus. The program also detects (but does not disinfect) 668 other viruses.
2/17/92: Washington Post reporter John Burgess writes a Michelangelo story
questioning gigantic estimates and the role of people who made those claims. "It remains unclear whether large
numbers of computers contain undetected copies of the virus, though estimates of millions of machines have been
published in the news media... Past scares about viruses often have proven to be overblown.
"`I'm finding virus catastrophes everywhere,' said Martin Tibor, a data recovery consultant in San Rafael,
Calif., whose repeated calls to the media after the Leading Edge incident helped publicize Michelangelo. `These
things are replicating like crazy.'
"Consultant Tibor conceded that the calls he made to the media about Michelangelo were in part motivated by
hopes of bringing business his way — it in fact brought in only one client, he said. But his main motivation,
Tibor said, was to get the word out about a serious computer danger. 'I see the victims of viruses all the time,'
2/18/92: Leading Edge announces it will provide free antivirus software with its entire line of
computers. "Because of the increasing number of computer virus outbreaks throughout the industry, no one
should assume that software they acquire will be free from infection," claims president Albert J. Agbay.
2/19/92: Symantec announces it has released a free program to disinfect the Michelangelo
virus. The software searches for no other viruses (though it pretends to), unlike Microcom's free
program which detects 669 different infections. Symantec also purchases a full-page ad in
Computerworld's 2/24 issue to warn readers about the virus.
2/19/92: Kurt Hansen of Parsons Technologies, in a public message left on the GEnie network,
claims: "Based on what we have seen with customers sending in data disks for electronic filing, Michelangelo
is very wide spread. It is more common than Stoned right now. I believe it is a significant problem."
2/21/92: Chris Torchia files an AP newswire describing how Michelangelo
"could send millions of computer users around the world through the ceiling." Tori Case, product manager
for Central Point Software (a McAfee competitor), claims as many as five million computers worldwide may suffer,
including 500,000 in the United States.
2/24/92: The artist Michelangelo would have turned either 516 or 517 years old this March —
newswires no longer agree on his age.
2/24/92: Computer columnist Lawrence Magid offers dangerous advice when he tells readers they can
avoid Michelangelo's devastating effects if they activate a computer "on March 5 and leave it running
until March 7." Magid claims viruses travel by computer bulletin board, then oddly advises readers to download
antivirus software from a bulletin board.
2/28/92: An executive with Fuji's floppy disk division makes the newswires by offering advice on
how to detect Michelangelo.
2/28/92: Egghead offers to ship a copy of "the special `Norton AntiVirus Michelangelo
Edition' for just $4.99." They also offer to send "a free brochure about computer viruses," but some
customers will complain it arrived more than a week after the Michelangelo threat had passed.
3/2/92: John McAfee, after previously claiming five million computers have Michelangelo,
appears on the Today show and tells Bryant Gumbel "there are over a million systems infected
now." McAfee doesn't use the word "estimate," though he may have meant to.
3/2/92: Intel Corp. ceases shipment of its LANSpool program after discovering 839 packages
carried Michelangelo. "Basically, we were using anti-virus software that could not detect the latest
generation of the virus," says spokesman Mark Christensen. Ironically, the company will send a free copy of
its $995 LANProtect software to anyone who received an infected LANSpool package.
3/2/92: AP writer Laura Myers files a story authoritatively stating
Michelangelo "lies dormant in an estimated 5 million IBM-compatible personal computers worldwide."
The story includes quotes from John McAfee & Martin Tibor.
3/2/92: Computer columnist Lawrence Magid clarifies his advice to leave computers on through March
7 so as to avoid Michelangelo's devastating effects. "This will work in most cases, but if there is a
power failure, many personal computers will automatically reboot themselves. Thus, a power failure on March 6 would
have the same effect as turning on the computer."
3/2/92: ABC's Ted Koppel devotes a Nightline episode to Michelangelo with a
lead-in announcement of how it "could be devastating, destroying the memories of millions of computers around
the world... I just wanted you to understand I'm coming at [this broadcast] with a wealth of ignorance." John
McAfee, Patricia Hoffman, and Martin Tibor contribute to the lead-in story, with Tibor ominously stating
"[viruses are] the equivalent of doing germ warfare in your own neighborhood."
3/3/92: A Reuters reporter files another erroneous newswire claiming
Michelangelo spreads via computer bulletin boards.
3/3/92: Good Morning America science editor Michael Gillan claims "as viruses
go, there aren't that many reported incidents [of Michelangelo]... but there is an enormous fear
factor." Unfortunately, he advises viewers to leave computers running from March 5 to March 7, following in
the dangerous footsteps of computer columnist Lawrence Magid.
3/3/92: Reuters reports Intel stock has dropped $0.50 below its $65.75 close from the
day before. "While Intel is to unveil new versions of its most powerful computer chips later today — the 486
DX2 microprocessor — dealers said the shares eased on news Intel had ceased shipment of its LANSpool 3.01 print
server utility because some units were found to be infected with the `Michelangelo' virus."
3/3/92: Another Reuters report about the Michelangelo virus mistakenly claims
"it spreads via computer bulletin boards."
3/3/92: CompuServe's electronic newspaper, Online Today, erroneously reports the
Michelangelo virus spreads via online services such as CompuServe. Management will later pull the
embarrassing "GO OLT-93" story after receiving complaints from alert readers.
3/3/92: AP writer Laura Myers files a sensationalist story on Michelangelo.
Many TV news anchors read the first paragraph verbatim: "Do you know where that floppy disk has been? Taking a
page from safe sex manuals, experts are warning computer users to practice safe computing because of viruses like
one called Michelangelo, which could trigger millions of computer crashes and erase data on hard disks this
week." TV anchors then follow with the authoritative statement: "The virus lies dormant in an estimated 5
million IBM-compatible personal computers worldwide and is poised to strike on Friday, the artist's
3/3/92: Reuters reporter Steve James files a newswire from Bonn, Germany with
Michelangelo estimates in the tens of millions just for the United States.
"Hamburg University computer virus expert Klaus Brunnstein estimates that 15% of all Personal Computers (PCs)
in Germany — around half a million — are infected and will lose their data banks on Friday. He also said that 30%
of PCs in Britain and 25% in the United States [about 15 million] are believed to have been infected by the
Michelangelo virus, as a result of pirated computer games and infected original floppy discs."
3/3/92: The AP ominously reports "the Michelangelo computer virus has invaded
Capitol Hill, sending congressional staffers scurrying for a cure before Friday's trigger date."
3/3/92: John McAfee appears in the AP daily quotes column: "This is one of the
most widespread viruses. It's out there in a large way and could cause lots of damage if it isn't stopped."
The quote comes from various newswire stories filed by AP reporter Laura Myers.
3/3/92: A Reuters newswire by David Morgan claims John McAfee receives "about 120
reports [worldwide] of Michelangelo infection a day," prompting some experts to ask how this could justify
McAfee's previous estimates of five million. Morgan's story also claims "computer viruses, which first
appeared nine years ago, are now growing in number at a rate of about six a day" and that "some experts
say the recent proliferation of viruses has much to do with the fall of communism in eastern Europe, specifically
3/3/92: A Reuters newswire says "Poland's biggest daily [newspaper] carried a
front page story headlined `Michelangelo, The Mass Murderer, Will Attack On Friday.' " Later reports will
detail panicked efforts by Polish citizens to obtain antivirus software.
3/4/92: Ross Greenberg, the programmer behind Microcom's Virex-PC package, takes an
unscheduled four-day vacation. "Nobody [in the mass media] likes to hear somebody say `Make a backup. Type
FDISK /MBR. Go away.' Headlines such as `Virus Eats Planet Earth' sell more papers," he will say upon
3/4/92: Numerous reporters log onto CompuServe, GEnie, America Online, and Prodigy to ask the same
question: "Want to be interviewed for a story on the Michelangelo virus?" One USA Today
reporter, expecting an avalanche of calls, asks people not to tie up his phone unless they actually get hurt by the
virus on March 6.
3/4/92: The AP shifts its focus on Michelangelo after receiving phone calls
from outraged virus experts. Stories now begin to center on the fear sweeping the world rather than
the virus. Bart Ziegler files the first AP report with contradictory opinions of the situation:
"`You're more likely to spill a cup of coffee on your keyboard than to get this virus,' said Peter Tippett,
chairman of Certus International Inc., a maker of anti-virus software. `There's definitely hysteria,' said Marianne
Guntow, a computer analyst at the University of Chicago."
3/4/92: Multiple UPI newswires erroneously claim Michelangelo spreads via
computer bulletin boards.
3/5/92: Scattered reports from around the globe say Michelangelo triggered a day early due
to a fluke in some computers. Their internal clocks ignore leap days and changed to March 1, 1992 a day too
3/5/92: AP reporter Robert Dvorchak files the first major newswire with a
lead-off paragraph questioning impending sabotage estimates. "Computer users took precautions to disinfect
their machines from a virus set to strike on Michelangelo's birthday Friday, although some experts did not expect
widespread damage from the electronic prank."
3/5/92: John McAfee debates Charles Rutstein on the MacNeil-Lehrer News Hour show.
Rutstein: "ten to twenty thousand worldwide" will suffer on March 6. McAfee: "anywhere from 50,000
to five million" will suffer, but "we're still talking $60 million at the very low end" for damage
3/5/92: UPI reporter Joe Fasbinder files a newswire claiming the pending devastation
from Michelangelo "is certainly expected to be in the millions of dollars. In addition to the data lost
to the virus, millions of dollars in employee time will be needed to re-install damaged software."
TRIGGER DATE 1992
3/6/92: V-DAY ARRIVES!? Yet while fear over Michelangelo
continues, the major newswires echo similar stories about a fizzled event. Reuters: "As March 6
dawned in Asia, New Zealand reported scattered infections by the virus — but there was more media hype than
electronic havoc." Associated Press: "Personal computer users reported scattered outbreaks
today of the Michelangelo virus but no widespread damage from the much-hyped software invader." UPI:
"The long-awaited Michelangelo virus struck around the world Friday, though it did not appear to be the
data disaster that some had predicted."
3/6/92: A Reuters newswire claims Michelangelo "was unwittingly spread
round the world by a single Taiwanese software copying house, Dutch police said on Friday. `Taiwan is the source of
the mass distribution of the virus,' police computer fraud expert Loek Weerd told Reuters. `The
Taiwanese authorities have not so far given us the name of the software copy house,' Weerd said."
3/6/92: In scattered freak coincidences, 1,200 automated teller machines in New York shut down
from a power outage, three-fourths of New Jersey's lottery ticket machines shut down due to a computer glitch, and
Philadelphia cable subscribers find their TVs locked to the channel they watched the night before. Panicked
customers incorrectly blame Michelangelo for the problems.
3/6/92: Various UPI newswires finally explain Michelangelo
doesn't spread via computer bulletin boards.
3/6/92: Reuters now reports John McAfee "estimated at least 10,000 computers had
been hit worldwide" by Michelangelo, in stark contrast to previous Reuters stories where he
had estimated five million. Other newswire reports mention McAfee's name while outlining a worldwide "media
3/6/92: AP reporter Bart Ziegler files a scathing newswire: "The day of
techno-doom turned out to be a dud... For days, news media relayed forecasts of impending doom from Michelangelo.
The story had all the right elements: a mysterious invader with a sexy name that could cause havoc by a definite
deadline in machines relied upon by millions. The reports often failed to mention that many projections of
potential damage were provided by companies that make anti-viral software and stood to benefit from the scare.
"One source was John McAfee of McAfee Associates, the largest seller of virus-killing programs. McAfee was
widely quoted as saying Michelangelo had infected up to 5 million computers worldwide. Asked Friday whether he had
overstated the case, he said the low rate of actual Michelangelo damage was due partly to precautions so many PC
3/6/92: Symantec claims over 250,000 users around the world obtained a copy of their free
Michelangelo disinfector program. Of the online services, Prodigy and GEnie charged nothing for customers to
download special antivirus packages; CompuServe pocketed its regular hourly connect fees for the service.
3/6/92: Michelangelo gets another mention in the AP daily quotes column, this
time downplaying the scare — "`It has been overhyped, without question.' Charles Rutstein, staff researcher
for the National Computer Security Association, as computer users braced for a computer virus to strike on
Michelangelo's birthday Friday."
3/6/92: But while NCSA's Charles Rutstein may have called Michelangelo "overhyped,
without question," he praised it in a public message to one of John McAfee's employees. "It
really doesn't matter that much any more [how many had the virus]. I think we can all give McAfee Associates...a
round of applause... Regardless of the amount of hype, if it helped to save one critical machine at, say, a
hospital, I feel that the hype is justified."
3/6/92: AT&T reports Michelangelo erased data on two — yes, "two" — company
computers. A spokesman claims AT&T operates about 250,000 IBM PCs around the world.
3/7/92: AP's daily quotes column rationalizes the hysteria: "`I'd say we would
have had serious problems if we hadn't been so worried by all the hype.' Joe Pujals, California's computer
information manager, on the minimal effect the Michelangelo virus had on computers."
3/7/92: All major newswires cease reporting about computer viruses by 6:00am Eastern time.
3/8/92: Microcom's Ross Greenberg returns from his abrupt vacation.
3/8/92: No newswire service files a story about computer viruses.
3/9/92: John McAfee resigns from the National Computer Security Association on the first business
day after the Michelangelo media fiasco. Patricia Hoffman also resigns, but only from the Washington branch
— she does not withdraw from NCSA's Pennsylvania branch. NCSA will suppress knowledge of the resignations
for more than a week.
3/9/92: No newswire service files a story about computer viruses.
3/10/92: No newswire service files a story about computer viruses. However, Reuters
mentions them in passing as part of a story on counterfeit software: "[Microsoft] said buyers of counterfeit
software risk the possible consequences of using defective products and contracting software viruses."
3/11/92: Microcom announces it has released an updated version of its free program, this one with
ability to disinfect the Maltese Amoeba virus. It also detects (but does not disinfect) 723 other
3/11/92: No newswire service files a story about computer viruses.
3/12/92: John McAfee fails to appear at the fifth annual Data Processing Management Association
conference in New York. DPMA scheduled him several months in advance to speak on the computer virus threat.
3/12/92: No newswire service files a story about computer viruses.
3/13/92: Scheduled activation date for the Friday the 13th virus. No newswire service files
a story about computer viruses — an interesting change considering the media's hype about Friday the 13th
in October 1989 and as a footnote to many Michelangelo-related stories.
3/14/92: No newswire service files a story about computer viruses.
3/15/92: Scheduled activation date for the Maltese Amoeba virus. No newswire service files
a story about computer viruses — another interesting change considering the media's hype about Maltese
Amoeba as a footnote to many Michelangelo-related stories.
3/16/92: No newswire service files a story about computer viruses.
3/17/92: No newswire service files a story about computer viruses.
3/18/92: No newswire service files a story about computer viruses.
3/19/92: No newswire service files a story about computer viruses.
3/20/92: AP writer Larry Blasko files the first major newswire report since 3/7/92,
another attack on the antivirus industry: "Snake-oil salesmen aren't dead. They've just reprogrammed their
pitch. If you believed what you saw in the media in early March, the computerized world was going to end on March 6
when the computer virus Michelangelo would destroy data on disk drives from Kalamazoo to Katmandu. All was doomed
on the 517th anniversary of the artist's birth. But wait. Maybe you were one of the lucky people who owned or could
buy virus protection software. Which, by great coincidence, just happened to be on sale...
"So what damage was done? Lots. First, computer viruses are real, just like rattlesnakes and copperheads. But
irresponsibly beating the drum and shouting that they're under every bush - when they aren't — will lead the
thoughtless to conclude that they don't exist. Second, the huge wave of hype created the notion that low-cost
software, whether from bulletin boards or shareware distributors, was fraught with peril. That's a disservice to a
source of many of the best utility programs, from DOS utilities to the ubiquitous PKZip and LHArc archiving
software. Third, some of the hype was so misinformed that it created myths. Avoid commercial computer bulletin
boards, said one myth. Avoid office networks, said another. Never buy generic diskettes said a third. Hogwash
[unknown edition published
ca. June 1992]