Dan Farmer

By David Bank

San Jose Mercury News

Apr. 5--Silence equals Death. That stark aphorism sums up Dan Farmer's philosophy of security on computer networks as well as his views on sex and mortality.

So the renegade computer programmer made sure the slogan was visible across his sleeveless T-shirt in a photograph to publicize Satan, the computer security software program some fear could wreak havoc on the Internet. He said he hoped people understood the double meaning.

"I am bisexual. I am into S&M. I'm into security. I'm into good wine. Why should I hide?" Farmer said as he prepared to release Satan today, his 33rd birthday. "The whole idea that what is not normal should be kept secret - that's really distasteful to me."

Farmer's ideas and his fashion sense - long flowing red hair, black leather pants, Marine dog tags, a pierced right eyebrow and a left nipple adorned with a grinning skull - are as provocative as his software. By making Satan easy-to-use, and then releasing it for free and without copying restrictions, Farmer and his co-author, Dutch researcher Wietse Venema, are giving even those with limited technical skills the ability to scan and infiltrate computer networks.

"Now the bad guys can pull it down and use your own tools against you," said Jim Settle, former head of the FBI's computer crimes squad.

Satan's supporters say Farmer's eccentricities are irrelevant. They said his contribution will make computer networks more secure, and thus more useful, by spurring network administrators to correct problems.

"He might be a little closer to the fringe than the rest of us, but technically he's solid," said William Cheswick, a senior researcher at AT&T Bell Laboratories. "I don't care who he's in the hot tub with - his (programming) code is good. As a network security guy, that's all I care about."

The controversy already has cost Farmer his job at Silicon Graphics Inc. Colleagues in the computer security establishment have launched vitriolic attacks over the Internet and in the media. He has received telephone threats of lawsuits and worse.

The furor has not silenced Farmer, who has calm confidence in the rightness of his actions. It is consistent with everything he has learned in a decade in computer security.

And he said his course is consistent with the rest of his life: His interest in Zen Buddhism; his fascination with death; the conscientious objector status that kept him out of combat in the Persian Gulf War; his bisexuality; and his passion for sadomasochistic sex.

These things exist' "These things exist, they're part of the world," he said in an interview. "If you don't want to deal with them, fine. But don't hamper other people from dealing with them."

Farmer hopes Satan will force computer hardware and software vendors, along with network administrators, to finally deal with security flaws. He said the software is a product of his long frustration with what he considers secretiveness and shoddiness in the computer security field.

Growing up as the son of a university professor in Indiana, Farmer was a voracious reader who had few friends. He had little interest in computers, which were scarce and hard to use. He wanted to be an astronaut.

At Purdue University, Farmer preferred pool halls to classrooms. He dropped out to join the Marines at 22. He said recruiters tried to steer him into administration or engineering.

"I said, 'No, I want to go and learn how to kill people,'" he said. "I was interested in implements of mass destruction - from an academic point of view. Being able to blow somebody's head off at 500 meters with an M-16, that's an interesting skill to have."

After basic training at Camp Pendleton and infantry training, Farmer spent six years in the reserves. By the time of Desert Storm in 1991, he was already out but was called up for active duty. But his views had changed. He applied for objector status and received an honorable discharge.

By then, he finally had finished his undergraduate work at Purdue, majoring in computer sciences. For his final project, he wrote a widely used software program called COPS, which does for single computers what Satan does for networks.

"Dan was the type that wanted to discover all the things that he could discover," said Eugene Spafford, the professor of computer sciences who supervised Farmer's work. "He didn't want a lot of things to be kept secret."

His work attracted the attention of the Computer Emergency Response Team, a government center at Carnegie-Mellon University in Pittsburgh. Farmer collected reports about security weaknesses, which CERT used to issue advisories on ways to patch the holes. He said most companies were unresponsive and he was bound by CERT's policy of not releasing information about problems until solutions were available. That combination left networks with gaping security holes for months at a time, he said.

At Sun Microsystems, Farmer learned that most security problems are the result of human factors. He said Sun's corporate network of 25,000 computers was hacked repeatedly. He eventually grew tired of making recommendations for changes, only to have to fix problems when his suggestions were ignored.

"That's where the idea for Satan was fueled," he said. "You have this enormous network and no one knows what's out there."

Farmer said that last year the National Security Agency became interested in his work on Satan. He said he was negotiating a $1 million per year deal for himself and three other researchers - including Tsutomu Shimomura, the San Diego computer security expert who helped track down fugitive hacker Kevin Mitnick earlier this year. As a condition of the deal he said he insisted he be allowed to give away Satan for free.

A spokesman for the NSA would not confirm the offer or comment on the Satan software.

"I think in general the NSA is scum," he said. "Still, if they offer me a good job under my conditions - which is that I can do anything I want- then, sure. The NSA is not going to change me."

Tired of waiting for the federal funding, Farmer joined Silicon Graphics in December as "network security czar." But as Satan began attracting publicity last month, SGI executives became concerned about the company's association with Farmer. He left two weeks ago after he refused to abandon the project.

Farmer says he has employment offers, once the furor over Satan's release dies down, probably within a few weeks.

He'll be monitoring that furor from inside his San Francisco apartment at the computer workstation he calls Death.

"People don't want to talk about death, just like they don't want to talk about computer security," he said. "Maybe I should have named my workstation Fear. People are so motivated by fear."



This article is here as part of the outline on a presentation on Satan that was given at Sonoma State University. You can view this outline if you have more interest.