A computer virus expert looks at CoVID-19

[rslade]

First off, let me say that, while "virus" was and is a reasonably good choice as a term for replicating malware, it doesn't do to push the analogy too far.  A computer; any computer, even a supercomputer; is a fairly simple entity in comparison with the complexity of the human body.  And it's easy to say whether or not a computer is infected with a computer virus.  It's pretty quantum.  Either the computer is infected or not.  Either a computer virus is running in memory or it's not.

When I worked in the isolation ward and in industrial first aid, I learned a lot of things that later pointed out just how different biological and computer viruses were.  And, when you study the various fields of science, which I did, it's easy to analyze some of the factors that determine how viruses work.

In comparison to a computer, any body is more akin to, well, the Internet itself.  A network of billions of computers (all the cells in your body), any one of which may or may not be infected.

A computer virus is just code.  I have several thousand computer viruses in the office with me.  Hundreds of them are on each of the computers I have.  They are of almost no risk to anyone, since they are all on either floppy disks (those are of no risk to anyone who doesn't have a floppy disk drive anymore) or in "zoo" directories.  They aren't going to execute.  They won't replicate unless I copy them somewhere.  (No, don't ask.  We old malware researchers are funny that way.)

A biological virus is alive.  Actually, get a few microbiologists in a room together, and making that statement is a good way to start an argument.  There are a large number of factors that we generally consider necessary for life that viruses don't have.  But we can say that viruses are, at some point, viable and will replicate (under the right conditions), and, at another point, are not viable, and won't replicate.

It's rather difficult to say that a person (a body) is infected or not.  I probably have some rhinovirus in me somewhere, but I don't (at the moment) have a cold (that I know of).  I probably have some flu virus (viruses?) in me somewhere, but I don't have the flu.  There is a progression in most virus infections.  You get a virus on or in you.  (Actually, it's probably more than one "copy" of the same virus.  Infectious disease people talk about viral "load," in reference to the number of viruses that you need to infect, or that you have, or that you shed when/while you are infectious.)  Your body has defences that are running all the time to fight off viruses, bacteria, parasites, and other things that shouldn't be in your body.  But if there are enough copies of the virus, they may either get past or overwhelm your defences and start to replicate.

At that point, you probably can be said to be infected, but you probably don't know it yet.  The virus is attacking and spreading in your body, but not to the point of causing symptoms yet.  That is why you can be infected, and infectious, before you realize it.

The virus replicates by inserting it's own genetic material into one of your cells, and getting the cell to reproduce it (generally destroying your cell in the process).  (CoVID-19's genetic material is RNA rather than DNA, but since we use RNA in the process of recreating our own DNA this is not a problem.  For CoVID-19.  It is kind of a problem for us.)  Viruses tends to have certain types of cells that they prefer.  CoVID-19 prefers lung tissue (among other types).  Once a virus has started to reproduce on a large scale in your body, the fact that you are loosing some of your cells, and the fight that your defences are making against the virus, starts to produce symptoms.  At this point you are infected, and infectious, and probably know something is wrong.

Your defences have some generic ways to identify and fight off intruders.  (These are akin to the change detection or activity monitoring types of computer antivirus programs.)  But, when an infection actually takes hold, your defences start to learn how to recognize and target the specific infection.  This process often involves antigens.  (This is similar to computer virus signature scanning types of antiviral programs.)  (We'll come back to antigens.)  These defences may, initially, create additional symptoms, or make the existing symptoms worse, but, eventually, they will build up and overwhelm the specific virus, drive it--well, not away completely, but to a very low level--and cure you.  If the infection doesn't kill you first.  As your defences are getting the better of the virus, you are still somewhat infected, and still shedding copies of the virus, and therefore are still infectious, but your symptoms are disappearing and you are feeling better.

I've mentioned the issue of viruses being alive versus being viable.  CoVID-19 seems to need to be wet to be viable.  It travels between people in drops of water or mucus.  (Very small drops, so we call them droplets.)  The virus itself can't exist (or, at least, isn't viable) as a single virus with no water that can be breathed out and hang in the air for some time, bouncing between air molecules.  Some viruses can; we call them aerosols (and there are other types of small particles that hang in the air that we call aerosols); but CoVID-19 doesn't seem to be able to do this.  (Sometimes people say that coughing aerosolizes your saliva, but the droplets with water are much bigger than true aerosols.) The droplets have to be big enough to contain water for the CoVID-19 virus to be viable, in order to be infectious, so that means that the droplets are heavy, and therefore fall out of the air fairly quickly and can't travel very far from the person who produced them.  (This is where the "six feet"/"two metres"/"fingertip to fingertip" rules come from, and why we now talk about social distancing, which sounds cute but isn't accurate, or physical distancing, which is more accurate but isn't as catchy as a phrase.)

This is why masks aren't very effective at preventing people from getting the virus (although they do help in some specific and dangerous situations where you are encountering a number of people with a high viral load who are coughing up droplets a lot).  Masks are somewhat more effective at preventing people who are sick from spreading infections, since the masks, even just dust masks, catch the droplets.  If you get the virus, you probably won't breath it in.  You will probably touch a surface (any surface, even the surface of yourself or another person) where a droplet has landed, and then touch the mucus membranes of your eyes, nose, or mouth, which are nice and moist and CoVID-19 really likes.  And remains viable.  And infects.  (Are you eyes getting itchy just thinking about this?  When was the last time you touched your eyes because they felt itchy?  You touch your face a lot more than you realize.  This is why constant hand-washing, with soap, or hand sanitizing, is important. The outer envelope of a coronavirus is mostly a layer of fat, and, if you know chemistry, it easy to see why coronaviruses really don't like soap or alcohol.)

You may have heard that CoVID-19 can be detected in air hours after an infected person has been there.  You may have heard that CoVID-19 can be detected on surfaces up to three days after an infected person has been there (depending on the type of surface).  There is a difference between "can be detected" and "is viable."  Remember that our current tests for CoVID-19 are checking for strings of the viruses RNA, in the same way that computer antivirus programs check for strings of code that are unique to the computer virus.  The virus, or fragments of the virus (even if not wet or viable), can hang in the air, or be on surfaces, and be detected by RNA tests, long after it has ceased to be viable and infectious.

(There is another type of test, one form of which is currently under trial, involving the antigens we spoke of earlier.  This type of test will not detect the virus directly, but detects whether someone has been sufficiently exposed to the virus to develop specific defences to it.  This would indicate that a person has had the virus, and then recovered, whether or not they demonstrated any symptoms.  This test will tell us other, different, things about the virus and how it spreads, particularly about how many people in a given population get infected.)

We are security professionals.  We deal with risk.  We know that risk always involves probability.  A biological infection situation is not quantum.  It is not "if you leave the house you will get infected."  It is "if you leave the house there is a higher likelihood you will become infected."  Biological virus infection involves proximity to an infected person, time of exposure, that person's viral load, number of proximal contacts, and a number of other factors.  And all of the various factors involve probabilities.

The probabilities can add up.  If you pass someone on the street or in a store, there is maybe a one in a million chance you will get infected.  (Don't quote me on the "million."  It's just for this example.)  That isn't big.  If you own a pool there is twice that chance that you will die by drowning, but many people accept that risk.  We could avoid that risk by not going out, but then there is a risk we could starve to death, so we have to calculate and balance those risks.  But if we encounter ten people at that store, those risks add up, so now we are at one in a hundred thousand.  And if we go to ten stores, then we go to one in ten thousand.  And if we keep that up for ten days then we go to one in a thousand, and if we keep it up for three months we are at one percent.  Which starts to sound like it might be a bit dangerous when the impact is that we might die.

So we have rules. But the rules are based on probabilities. It's not that at six feet you are safe but at five foot six inches you will be infected, but that it is unlikely that droplets will easily jump six feet. They will more easily jump three feet, although it's still not guaranteed. Rinsing your hands with water will get rid of 80% of germs on your hands. Washing with soap and water for 20 seconds and the proper process will get rid of 99.9% of germs. But, if you are pretty sure that you've touched something that might be dangerous, but you can't right now, wash thoroughly but you can, right now, rinse your hands, then rinsing your hands right now is better than doing nothing. (Although you should make sure you wash your hands thoroughly, as soon as you can.)  All of our "six feet," "wash hands," "don't congregate" rules are risk mitigation.

(No, for those students of risk management, there is no risk transfer in this scenario.)

And remember the tests that can't tell the difference between viable and dead viruses, and the studies that say the virus can live on surfaces for three days (if metal or plastic) or four hours (if copper or cardboard or steel but in direct sunlight)? It's not that all the virus copies stay alive for seventy two hours and then die on the seventy third. Copies of the virus are dying all the time, and after a certain number of hours half of them are dead, and after that same number of hours half of the remaining ones are dead, and all that time the viral load is going down and the probability that there will be enough copies of the virus to actually infect you is reducing.

So, you calculate the risks, and assess them, the same way that you calculate that it is unlikely that you will be stabbed to death if you go to a party.  (Wait. You were at a party? During the CoVID-19 crisis? What kind of risk management decision is that?)