AF/91

AF/91 was a virus hoax surrounding a computer virus purportedly created by the United States Intelligence Community as a cyberweapon during the Gulf War. The hoax originated in a 1991 InfoWorld article published as an April Fools' Day joke; in reality, no such virus ever existed, and the U.S. military is not known to have used a strategy similar to this in the Gulf War. Despite its publication date and the article clarifying it was for April Fools' Day, the story drew significant media attention, with several sources erroneously describing AF/91 as real well into the early 2000s.

Description

AF/91 originated from the article "Meta-Virus Set to Unleash Plague on Windows 3.0 Users" written by Tech Street Journal editor John Gantz, published on April 1, 1991 in InfoWorld magazine volume 13, issue 13. Gantz claimed in the article that he had first heard of AF/91 in a conversation he overheard at the 1991 Federal Office Systems Expo (FOSE), a U.S. federal government office supplies convention. Most other details relating to AF/91 came from an unnamed friend employed as a U.S. Navy automated data processing specialist, who decided he would tell Gantz about the virus' program seeing he already knew enough about it.

AF/91 was described as a "meta-virus" designed as a "machine-language palindrome" and used to disable real-time computer systems by "attacking the software in printer and display controllers". AF/91 was claimed to be able to eat windows, apparently literally "gobbling them at the edges", ultimately overloading the peripherals with a broadcast storm and permanently freezing the computer. Intel and Motorola computer chips were noted to be especially vulnerable to the virus, as were computers running Microsoft Windows operating systems, namely the then-new Windows 3.0 (as mentioned in the article's title). AF/91 used a neural network that learned with each machine cycle but required lengthy periods of time to work as intended, even after its activation time was reduced by 75%, reportedly taking several weeks to set up, learn, and activate on systems operating 24 hours every day.

According to the article, the National Security Agency (NSA) developed AF/91 to defeat Iraqi air defense systems during the Gulf War as part of the U.S. military's Suppression of Enemy Air Defenses operations. Agents of the Central Intelligence Agency (CIA) infected Iraqi systems with the virus by hiding it within software that came with a printer, smuggling it into Iraq through Jordan and shipping it to an Iraqi air defense site. AF/91 remained dormant in Iraqi computer systems until the opening stages of the Gulf War air campaign—which was supposedly delayed just so AF/91 could be smuggled into Iraq and start working—at which point it was activated, disabling Iraqi air defenses and rendering half of their computers and printers unserviceable.

However, AF/91 unintentionally made its way out of Iraq after Iraqi Air Force pilots deserting to Iran brought several infected printers with them; these were then used by the Ministry of Information and Communications Technology of Iran, allowing the virus to spread rapidly. By then, the virus had "mutated", capable of permanently embedding itself into a computer's display device and affecting its messaging software. The U.S. military, which had mostly committed to using Windows for their computer programs, became increasingly concerned about AF/91 potentially reaching them, hence why it was mentioned at FOSE. Though the NSA was said to have considered any computer with windowing technology to be "doomed", computers infected by AF/91 could last up to four years if used very infrequently due to the virus' neural network requiring continuous use to learn, potentially long enough for the NSA to develop countermeasures and dedicated antivirus software to counter AF/91.

At the end of the article, Gantz revealed the secret of what "AF/91" meant: "91 is the Julian Date for April Fool's Day."

Further additions

Over time, several apocryphal additions were made to the story of AF/91 that were not present in Gantz's original article, including that:

• A U.S. Army Special Forces unit inserted the virus into a dug-up fiber-optic cable connected to Iraqi air defenses
• The software AF/91 was installed on was specifically a computer chip
• AF/91 was installed in the printer itself, as opposed to being separate software
• The Iraqi system targeted was Kari, the actual Iraqi Armed Forces command and control system
• The printers used in the operation were French
• AF/91 actually failed, being destroyed after the U.S. Air Force bombed the building storing it

Media misinterpretation

Though AF/91 was intended as a joke, several news outlets reported AF/91's existence as though it was real, with the story presented as an early example of cyberwarfare. Media outlets said to have reported on AF/91 as fact included the Associated Press, CNN, Nightline, and several American newspapers such as The Commercial Appeal. Others that erroneously presented AF/91 as real included Popular Mechanics in their March 1999 issue, author James Adams in his 1998 book The Next World War, and a Hudson Institute analyst in a paper about Russian cyberwarfare.

In U.S. News & World Report's 1992 book Triumph Without Victory: The Unreported History of the Persian Gulf War, one section described AF/91 as though it was real, although it was not referred to by name. When questioned on the topic, writer Brian Duffy claimed his sources were unnamed "senior level intelligence officers", and stated he had "no doubt" that AF/91 existed.

Legacy

Technology writer George Smith, remarking on the wide acceptability of AF/91's existence as fact in spite of clear evidence of its fictional nature, wrote in his SecurityFocus column that he believed it resulted from "a creepy enthusiasm" for unusual weapons, the competitiveness of the media to report "the hot scoop", and the "uniquely American" belief that technology is the answer to everything.

In 2010, InfoWorld revisited Gantz' story, this time reporting that viruses similar to AF/91 had been developed. The real unnamed viruses, Trojan horses developed for penetration testing, were cloaked in printers and other office equipment similar to how AF/91 was smuggled into Iraq in the original article, with such viruses often effective against Windows and Linux systems.