Research question
How much of today's incident response was recognizable in a Soviet KGB directive issued on 28 July 1989?
The directive and its attached advisory describe suspending affected work, examining suspected programs against trusted reference copies, and restoring affected programs from clean copies. The document establishes what was recommended; it does not prove that every reported incident occurred as described or that the guidance was consistently applied.
MacBook lab: checking a file against a reference
On a 2019 Intel MacBook Pro, I created an ordinary text file containing Approved version, recorded its SHA-256 digest, and copied it as a reference. I then changed only the working file to Changed version. The two hashes differed, and diff -u showed the exact line change.
This demonstrates a file-integrity check. A mismatch shows a change, not a malicious cause. SHA-256 is a modern demonstration; the 1989 directive did not prescribe that algorithm. The files in this exercise were harmless text, with no malware involved.
Three virus descriptions
| 1989 description | Later comparison | Assessment |
|---|---|---|
648-byte .COM virus | Vienna | Strong match |
| 1,701-byte virus; falling screen characters | Cascade | Strong match |
| 710-byte virus; Friday the 13th damage | Possibly Jerusalem | Unresolved size conflict |
The later virus descriptions help compare families. They do not independently verify the incidents reported in the 1989 advisory.
Modern comparison
The advisory and NIST SP 800-61 Revision 3 share broad concerns: contain an incident, investigate what changed, and recover using trusted material. Their tools, scale, and institutional setting differ. Similar response goals do not establish identical capabilities or effectiveness.
Sources and limits
- Lithuanian archive catalog record; ten-page Russian scan reviewed for this project, F. K-51, ap. 3, b. 58, l. 70–74.
- Oleg Shakirov, “How the KGB Discovered Computer Viruses” (2026), secondary analysis and selected translation.
- NIST, SP 800-61 Revision 3 (2025).
The original scan is a faint Russian image. English summaries here are paraphrases, not a certified translation. The 710-byte identification and several incident details remain open questions.