anti-virus companies don't hire virus writers

this is an urban myth/conspiracy theory that pops up again and again... some people are convinced that the anti-virus industry hires virus writers, either to put their 'virus writing expertise' to good use stopping viruses, or to actually write viruses to keep the anti-virus industry in business...

it's absurd...

first of all, writing a virus isn't the slightest bit comparable to writing detection algorithms to find thousands of viruses... virus writing isn't actually all that difficult a task in and of itself, and it's made even easier by the existence of published code to do just about anything a new virus writer might want... in order to evade detection a virus need only have an implementation that is new in a sufficiently non-trivial way... anti-virus development, on the other hand, involves reverse engineering, code emulation, and a host of other skills that are really orthogonal to writing viruses... the average virus writer's skill set just isn't useful in anti-virus development...

second, under most versions of the conspiracy theory, hiring virus writers is supposed to be a clever move by the anti-virus companies but this cleverness doesn't hold up under scrutiny... why hire virus writers to write viruses when there are (provably) lots and lots of people willing and able to make viruses for free?... that would be the opposite of clever...

finally, any anti-virus company that hired a virus writer would be crucified by it's competitors in the court of public opinion... these are businesses, they are motivated by money and if they can get more money at the expense of one or more of their competitors they will... and it's not like you can keep something like this secret - disgruntled employees will leak the info, employees who switch companies will leak the info, etc... that's a risk no anti-virus company can afford...

just keep these things in mind next time you hear the silly conspiracy theory...