Mark Compton

In recent months, Chemdex has been at it again — making moves to establish itself as a player in the mammoth health-care field. The first public evidence of that new direction came in late September with the announcement of plans to acquire Promedix.com, an infomediary trading in specialty medical equipment and supplies. Then in December things really started to pop. On the very same day it revealed plans to acquire SpecialtyMD.com, an Internet information search-and-retrieval service designed specifically for physicians, Chemdex announced its intent to join with Tenet Healthcare Corporation to form a new company focused on developing business-to-business solutions spanning the entire health-care industry. Tenet’s own global purchasing organization currently handles procurements for more than 1,000 medical facilities and nearly 45,000 physicians.

And, yeah, that would qualify as getting up to speed in a hurry.

You’ve had yourself quite the busy little week in December.

You know, they’re all busy. The amazing thing about B2B e-commerce is that the pace just continues to accelerate.

So are you saying there’s now a difference between Internet time and B2B time?

That may be a little strong, but a year ago it seemed as if I had to start every customer/supplier presentation with: “Here’s what the Internet is. Here’s why you should care.” And now, in just the last three weeks, I’ve probably met with 10 Fortune 100 CEOs, each of whom wanted to learn more about e-commerce. Everybody out there is trying to figure out their e-commerce strategy. And because of that, the world is moving at a pace I never would have believed just six months ago.

Is it the case that many of these CEOs don’t know exactly what B2B is, but they’re pretty sure they need to get some anyway?

By and large, that’s true. And because we were one of the first movers in that area, we have a ton of credibility and therefore we get a ton of phone calls.

What is it about the life sciences market that inspired you to build a business-to-business exchange in the first place?

The idea behind Chemdex actually came to me when I was at Virogen, a biotech company in Boston that I helped to found. Because we employed scientists, we bought all the things scientists need. And because we were also on the supplier side of the industry, we knew what was involved in selling things to other scientists. So I became well acquainted with the problems that afflicted both sides — problems that were due mostly to fragmentation.

Typically, if you were a buyer, you needed to sift through one catalog after another. The average scientist had 40 or 50 catalogs and typically spent more than five hours a week looking for the things they needed. Meanwhile, if you were involved in sales, depending on catalogs wasn’t so great because many would only get published every year or two due to the tremendous expense of printing and distribution. The result was that there wasn’t an efficient way to introduce new products. Your prices and products were always out of date. And there really was no cost-effective way to market new products or reach out to new customers.

Certainly you’re not the only one to have perceived this, given that the life sciences market seems to be proving irresistible to other entrepreneurs as well. Things have really heated up, in fact, with Sciquest.com’s recent IPO. How do you propose to hold off challenges from competing online exchanges?

There’s no such thing as an attractive market without competition. But I think we probably have a 12-month lead on Sciquest at this point. We certainly can’t rest on our laurels, but assuming we continue to execute at our current pace, we’ll be fine.

Ultimately, how many online exchanges do you suppose the life sciences market can sustain?

I think it’s winner take most. If you look at the consumer market, you’ll find that about 60 percent of the market cap in any industry goes to the market leader. And that’s pretty much the case if you look at Yahoo versus the other search engines, or Amazon versus the other online bookstores. In B2B, I think the advantage of market leadership will prove to be even greater. I think the difference between being No. 1 or No. 2 is going to be enormous — so great, in fact, that if you’re No. 2, you’re probably wasting your time and your investors’ money. And if you’re No. 3, you probably don’t have a chance.

Based on your recent announcements, it’s obvious you’re now moving aggressively to achieve primacy in the health-care segment. Is it your intention to essentially cover every single procurement requirement a hospital might have — from the most sophisticated imaging gear all the way down to that yummy hospital haute cuisine?

That’s exactly right. As we’ve matured in the life sciences business, we’ve recognized a couple of things. We were really the first of the B2B companies, but we were entirely focused on the life sciences segment. As time went on, we recognized that there were a lot of opportunities outside that market and, because we’d been doing this B2B stuff for a while, we’d developed a number of assets that were likely to be valuable in other industries as well. So we began to actively pursue other opportunities, leading to our decision to move into health care with the acquisition of Promedix.

I guess it’s safe to say that health care is a much larger space than life sciences research.

Absolutely. And that’s one of the reasons it was attractive to us. But it’s a market that also has a lot of very similar characteristics in terms of fragmentation, product complexity and channel inefficiency. And those are just the sorts of problems we like to solve.

Sounds a bit like Chemdex Manifest Destiny. What new frontiers will you soon set off to conquer?

Health care actually encompasses the second and third vertical markets we’ve entered. Through the acquisition of Promedix, we first went into the specialty medical products market. Then, through the joint venture we just announced with Tenet, we’re entering into the higher-volume commodity health-care products segment. Those two companies together will offer a complete purchasing solution for hospitals and other medical providers.

And we see an opportunity to continue doing this in other segments. So, over the next 12 months, you’ll see us continue to execute similar sorts of agreements where we seek to enable other vertical markets using our technology infrastructure, our capabilities, our customer service, our professional services and all our other operational components as well.

And it’s fair to say the markets you pursue will be characterized by fragmentation and channel complexity?

Exactly right. And we’ve been looking at this long enough to know there’s no shortage of opportunity there.

Although presumably you’ll stop somewhat short of pork belly futures, right?

Let’s hope so.

The brass at JPL was so impressed by the new image sensors they awarded the NASA Group Achievement Award to the team, while Fossum himself was bestowed with promotions and honors in keeping with his accomplishments. But industry could barely stifle a yawn. People just didn’t get it. And that, in turn, bemused and irked the scientists — particularly Fossum and his wife, Sabrina Kemeny, who was also part of the JPL active-pixel development team. Ultimately, they and several other core members decided to look at this as an opportunity to get in touch with their inner entrepreneurs. The result is Photobit Corp., an up-and-coming “camera-on-a-chip” image-sensor maker situated in Pasadena, Calif. — just a short Scud trajectory from JPL itself.

Kemeny, who runs the business, says the transition from white smocks to business suits hasn’t proved to be traumatic at all, no doubt true since Photobit is now showing every sign of becoming a real player in the imaging industry.

For decades, digital imaging has evolved around the expanding capabilities of CCD chipsets. But then along comes this new CMOS “camera-on-a-chip” technology, which some say will transform the worlds of photography and video. What are the revolutionary differences?

Well, power, cost and accessibility; those are the three biggest. Reducing the power requirements is key for the wireless world, as well as for all other portable electronics. With CMOS image sensors, people can now have cameras on their wrists, on their laptops, on their PDAs, on their cellphones — all because you can basically run a CMOS sensor off a watch battery.

The economic difference has to do with the fact that we can now produce high-quality images using standard CMOS and leverage off the multibillion-dollar CMOS fabrication industry. And that allows for low production costs.

But the thing that has really changed the face of imaging in recent years is access. In the not-so-distant past, the major Japanese camera suppliers — companies like Sony, Panasonic, Sharp and Toshiba — also made their own CCD image-sensor chipsets. So they were completely vertically integrated, building everything from the CCDs up through the optics to the full camera assemblies. And that meant new product development was basically determined by just a few companies. But the advent of CMOS image-sensor technology … has opened up all that so other companies can compete on the basis of new innovations … That’s why Logitech and Intel and Kensington — companies that really aren’t your traditional camera companies — now are able to enrich the field with all kinds of new solutions.

One other difference I should probably mention is that, much to my dismay, the cost of CCDs has also been forced down dramatically over the past few years. So even those customers that aren’t buying CMOS are now able to buy CCD sensors at a much more reasonable price because of how CMOS has affected the market.

Tell us about some of the novel applications that CMOS image sensors make possible.

The whole biometric area is one that’s up and coming. Fingerprint sensing, retinal scanning — all that sort of thing for security devices. That could be big. Automotive is another huge area where we could eventually see a lot of activity. You might have sensors that help with collision avoidance, airbag sensing or even collecting black box information for insurance purposes. Even stupid little things like rearview sensing so people can avoid backing over their kid’s bicycle.

Security is another promising area. For home security, you may someday have a half dozen cameras around the house, all hooked up to your PC. That way, you could call in from your computer at work to take a look at what’s going on at home: nanny cams and all that sort of thing. And then there are many other possibilities, like Dick Tracy-type watches and cellphone cameras, which I suppose will probably prove to be more mainstream.

Just out of curiosity, why would you want a camera on your watch or your cellphone?

Once you’re doing e-mail on your cellphone maybe you’ll want to send an attachment saying: “Look where I am.” So then you’ll be able to take a picture and send it off as an attachment. For professionals like insurance adjusters and real estate people, that sort of capability would be really important. We can almost think of that as a digital still camera, but instead of storing the images right there, you’d end up transmitting them somewhere else for storage.

So you’re also thinking of putting cameras in PDAs, right?

Yes, absolutely. And then there’s lots of other applications. Currently, you see all kinds of scanners that use both linear arrays and area arrays. When you go to the supermarket, all the bar-code scanners use CCDs now. So that’s another promising area for CMOS penetration.

You seem quite confident about your ability to beat all your CMOS competitors. Why is that?

Well, we do have the highest-quality sensors and we also have the dominant intellectual property position, as indicated by our very strong patent portfolio. We have the exclusive license to the original patented work we developed while working at NASA. And then, in addition to that, we have a huge portfolio of image processors generated by Photobit engineers and scientists.

The core of your engineering team came from the Jet Propulsion Labs group that invented the “active pixel” technology that you’ve since commercialized. So, in a way, you all made the jump from rocket scientists to industrialists. Any regrets?

No. It’s very exciting being in the real world of business and affecting everyday life on a grand scale. And you also get to be very creative in the way you strike business agreements with various partners.

What initially convinced you to take the plunge? Was it just because your husband [Fossum is now Photobit's chairman and chief scientist] was the person who actually invented the technology?

It was a combination of things, the most important being the realization that there was a tremendous commercial potential to this new technology. That really spoke to my own entrepreneurial spirit, which has always been part of my personality. And another factor was that Eric felt especially frustrated at the business community’s initial reluctance to take up the technology.

In the early years, before we had any thoughts of Photobit, he spent a lot of time going around the world evangelizing the technology. Many U.S. companies had the opportunity to commercialize it from JPL since there was a very big push at that time for technology transfer. But it turns out that people make technology transfer happen. It’s not just a matter of licensing the technology. So we just decided to do it ourselves, and then things really sped up.

So now you run the business and he handles the technology side. What do you talk about in the evenings?

We try to leave Photobit at work. We do, of course, have to talk about it at home from time to time. But we try to separate out the family life, especially when we’re with our children.

Your Ph.D. work at Columbia was CCD-centric and you designed a CCD image sensor for the 1990 Mars Observer mission. Yet you come today not to praise CCD, but to bury it. Does that ever make you wince?

No, I think it’s that background in solid state image sensors that enabled me and the other people here to succeed at what we’re doing today. So all that CCD work is very much part and parcel of our success with active-pixel sensors. The breakthroughs we’re achieving now have a lot to do with understanding all that we learned from going down a lot of blind alleys over the past 30 years of CCD research. Learn the lessons of history, and it will make you strong.

In the consumer electronics field, there are plenty of examples that show technical superiority doesn’t always lead directly to wins. Of course, the most celebrated instance of that would be Betamax vs. VHS. So given the current market presence of CCD, do you ever get the sinking feeling that big manufacturers like Sony and Matsushita might just end up looking right past your CMOS technology?

I think we’re already past that point. The momentum is so strong right now for CMOS. Between our sales and that of our competitors, I’m fairly sure CMOS is closing in on 15 percent market penetration. And once you’ve claimed that much of the market, you’re not going to go away.

So here we find American innovation eroding markets built by Sony and Matsushita on the strength of superior manufacturing. Is this just another cycle in that long-standing race between U.S. R&D and Japanese manufacturing? And, if so, doesn’t that suggest the Japanese consumer electronics manufacturers are just going to turn around and take over the CMOS market sooner or later?

Well, that certainly was the CCD story. Will it happen again? I think it’s hard to say. Will the Japanese be involved? Yes. I don’t think they’re going to give up the imaging business. I think there will be a shakeout in the image-sensor business and I expect Photobit will be among the top three or four companies that survive. But I also think that among the other survivors, there will be some Japanese companies. I don’t see Sony giving up its position.

CCD proponents continue to claim that CMOS image quality is inherently inferior.

That may be true for some of our competitors, but not for us. That is, the quality we’ve been able to achieve here is fully on par with CCDs. And CCD imaging has achieved a very high quality. There’s no doubt about that. They’ve had 30 years to perfect it and they’ve done a really good job in a number of areas. But basically, when we have visitors who are savvy in the technology, their mouths just drop when we show them what we’re capable of doing. We’ve been plagued by the bad reputation earned by some of our competitors, especially in earlier years.

Having said all that, there still are a couple of parameters where we keep on struggling to meet the quality of CCDs. But there also are other areas where we excel. For instance, there’s something called “blooming,” which you’ve probably seen on TV. That’s where a very bright light source ends up creating a big, white streak across an image. With CMOS sensors, you have a natural anti-blooming, so you don’t get that. Also, we have almost no lag.

What are the areas where you’re still struggling to improve?

In very low light imaging, the sensitivity for very small pixels is difficult to achieve at a low cost. That’s challenging for CCDs too, by the way, but they have a more mature manufacturing process that helps a bit.

And, increasingly, Whitfield now also finds himself in the public eye. Distressingly so, in fact. Incyte Genomics has become one of the most visible players in a pitched debate between academics and entrepreneurs over how to share the knowledge that’s rapidly being gained into the workings of the human genome. Now, as a rough draft of the complete Human Genome Project appears likely to be released in just a matter of weeks, the voices of dissent have become shriller than ever. Even heads of state have felt moved to make their views known.

And at much of this, Whitfield can only shake his head in wonder.

When President Clinton and British Prime Minister Tony Blair recently took the position that genome data should be made freely available to scientists everywhere, people holding biotech stocks stampeded to the exits. You were quoted at the time as saying the panic owed largely to a failure to distinguish between genome sequences and gene sequences. What distinction should investors be making?

What Clinton and Blair were talking about was genomic data — the raw code. When you have that, you actually don’t have any genes at all. The genes have to be predicted from the raw code. And so what Incyte and other companies in the genomics field have been doing for the past five to six years is sequencing the genes themselves. And we’ve managed to compile an almost complete list of those genes. What Clinton and Blair were talking about was making the genomic sequence freely available. And that’s been happening right along. But that’s quite different from the genes themselves, which is where all the commercial utility lies.

For example, when Chromosome 22 was published last December, the Human Genome Project scientists predicted we’d find 545 genes on that chromosome. But because we’d actually sequenced the genes at Incyte, we knew that over 1,000 of our genes would match that chromosome. So they missed nearly half of them. Don’t laugh. They admit it. It’s not like they don’t know about this problem. In fact, they said in their paper that they wished they had a transcribed gene sequence database, which is exactly what we have. And that, of course, is why almost all the major drug and biotechnology companies subscribe to our database.

Now, there’s a lot of academic value in the genome. It gives you things like the gene structure, the promoter regions and all that. It really is the crowning glory from a scientific point of view. But there’s not a lot of commercial value in that. Still, for most people, you say “human genome” and they automatically think you’re talking about all the genes. But that’s not the case. To find all the genes requires a database like ours. And another thing: Once you’ve found the genes, what you then want are physical copies, or clones. And we’ve archived all those so we can make them available to medical researchers worldwide.

In the last few weeks, Tony Blair has come out to say that public opinion should be weighed heavily in the ongoing debate over biotech regulatory policies. That means Britain now joins Switzerland and Iceland, two other countries that have insisted the public’s voice be heard. Do you feel the general public should be part of that discussion?

Absolutely. And the fact of the matter is that they’re involved already. I’m on the board of directors for the Biotechnology Industry Organization, which works all the time with various government agencies on issues surrounding biotechnology. This sounds like an exhortation to do something that’s already happening.

But what that really signifies is growing public awareness. People suddenly want to know what it means to have a copy of every human gene. What does it mean to have genetically modified foods? And these are all legitimate questions, right? So I see these as promising developments — much better, certainly, than people making ill-advised comments or policy decisions based on ignorance.

Incyte describes itself as the leading genomic information company, and, indeed, a recent article in the Wall Street Journal indicates that you hold over 375 U.S. patents on human genomic structures (essentially three times as many as any other organization) and that you have another 6,500 patent applications pending. Are those numbers accurate? And do you plan to make all that information publicly available?

Let me just clarify: What you’re talking about are full-length gene patents, where the medical use of the gene has been described as part of the patent application. As for making that information publicly available, your question actually is a classic example of the general misunderstanding I was just talking about.

What do you suppose happens when a patent issues? Just by virtue of being patented, the information is put into the public domain. So the patents that have already been issued — and we now have 400, by the way — are all, by definition, in the public domain right now. And it’s actually even broader than that, since we’re releasing more than just gene sequence databases; there also are other types of information that are even more valuable. And all that will be put online before the end of the year.

That will solve a huge problem, since, until now, a customer pretty much had to sink $1 million into computer hardware just to be able to run the Incyte database. But by putting all that data on the Internet, everybody will be able to come and use our computer power to perform their searches. So even though the information has been publicly available right along, there was a barrier in terms of computer power. That’s why, historically, it’s only been the drug companies that have been able to work with us. But now we can finally eliminate that last barrier.

But if the information is patented, isn’t there still a cost barrier?

No. That’s another great misconception about gene patents. What the debate is really about is licensing strategy. It’s not about patents at all. When people get upset about a patent, it’s usually because they think they’re going to be barred from using the information. But that only rarely happens. If you look at companies like Intel and Motorola, you’ll find they have thousands of patents. But you very rarely hear anyone complain that they’ve been barred from doing something — and that’s because the high-tech companies generally just cross-license each other. They look at the patent system as a way of getting a financial return on their R&D. And that’s exactly our approach. We license our patents broadly, not exclusively. And so far, drug companies have taken out over 30,000 licenses to our intellectual property.

What about academics and nonprofits? As I understand it, Celera Genomics has announced its intent to make its human genome sequence information freely available to academics without any restrictions whatsoever. Is that your intent as well?

Well, let’s just step back and talk about Celera for a moment. Celera made that statement over two years ago, when they first started, and, as far as I know, they’ve still not put a single bit of human data in the public domain. So I think we should have these debates once people have actually done what they said they were going to do. But as to your question: We absolutely mean to make our information freely available for academic and nonprofit researchers. For us, it’s really just a matter of getting the Web-based distribution mechanisms in place.

What exactly is the basis for asserting patent protection over a gene sequence, since what we’re talking about here is something discovered, as opposed to something invented or created?

Well, now that’s a loaded question. So let’s step back just a bit. Gene patents have been around for 20 years. They’re the whole basis of today’s biotech industry.

Incyte is getting quite a number of gene patents now and, all of a sudden, people are paying attention — and somehow forgetting that this is something that’s actually been of great benefit to the economy for the past two decades. That’s point No. 1. Then all this business about discovery vs. invention — are you familiar with taxol, the breast cancer drug that comes from the yew tree? Well, there again, you have something that’s out there in nature, but has to be purified and isolated before you can make it usable.

If you look at all the genes in the human body, they’ve been around for — what? — 200,000 years. Yet only in the last couple of years have the technologies been developed to purify and isolate those genes for the good of mankind. You saw a trickle of that with Genentech and Amgen, and now you’re seeing much more of it from Incyte and all the other genomics companies. And that’s revolutionizing medical research.

You just look at all the things that are happening today. Doing 100,000 gene scans of patient samples, new ion channels — all that. And it’s just great for the human race. So to imply that these things were just lying around out there for somebody to come along and pick up — well, that’s just a complete mischaracterization of what’s actually happened. People have put a huge amount of capital at risk to purify and isolate all these genes so they can be used for medical research. That’s great for the economy. And that’s just exactly what the patent system was designed to encourage.

Getting more specific, though, my question has to do with how broad the definition of use is. The U.S. Patent and Trademark Office says now that it will grant patents for genes wherever applicants can describe a plausible function. But often those explanations are broad and sketchy. In fact, a highly publicized controversy currently swirls around the development of CCR5 drugs designed to inhibit the transmission of AIDS. While Human Genome Sciences currently holds the patent on the gene that CCR5 targets, the HGS patent application made no mention of the potential HIV connection. And four other research teams, meanwhile, have since filed patents on the same gene that make far more specific claims about the gene’s potential role in the fight to stop AIDS. Under these kinds of circumstances, who should properly be able to claim royalties from the sale of CCR5 drugs? That’s the kind of dilemma I’m looking at.

Again, part of the problem with this debate is that people want to make sweeping generalizations. But every gene patent that’s filed is totally different — different genes, different information, different arguments, different competitors, different research, different methodologies, different patent examiners, the works.

So to make a generalization from the CCR5 matter would not necessarily do the biotech industry any service. That patent has got to have its day in court. It can be challenged just like any other patent.

But one thing I will say about gene patents from Incyte’s perspective is that our customers aren’t expressing any of these concerns. And that’s true throughout the biotech industry. So that means the very people who have to pay these royalties aren’t complaining. And people who wouldn’t have to pay any royalties in any event — which generally are the academics — seem to be the ones who have a problem. So it’s a bit strange, if you don’t mind my saying so. A big part of the problem here is that people’s knowledge of genes is pretty dim. And their knowledge of patents is even dimmer. You put the two together and you get plenty of confusion.

It seems to me that the debate, from a public policy point of view, should turn on questions like: What evidence do we have that these patents are good for the economy? What evidence do we have that they’re bad for the economy? And, as I’ve just told you, the evidence that they’re good for the economy is pretty compelling. You’ve got this biotechnology industry which is growing extremely fast and creating lots of jobs. There are a number of products — human growth hormone, insulin, you name it — that are already out there. And huge pipelines of new products are lining up at all the drug companies. We’re making quantum leaps in medical research.

Now, on the negative side, I say to people: Name an example of how one of these patents has restricted research or led to some negative result. Or make me an argument for why it’s been bad for the economy. And, you know, I’m still waiting.

Princeton molecular biology professor Lee Silver wrote recently in a New York Times Op-Ed piece that the debate over gene patents should be “focused on fair business practices and regulatory issues, not on ethics.” Is that consistent with your view?

Yes. But I wouldn’t phrase it that way. I think the real issues here are about licensing. These are not patent issues, for all the reasons I’ve indicated. From our perspective, the patent system is fundamental to the well-being of the global economy. Issues about any patent, really, always come down to licensing anyway. I think there’s a statute that says if you’ve got a patent on something and you can’t produce it, you have to license it. I’m just using that as an example of the sort of remedies out there to ensure the patent system works for the public good. And it’s an example of how you can fix patent issues through licensing policy. I think we’re looking at all the same issues when it comes to gene patents.

In the Incyte database, for example, there are many new and exciting targets for fighting Alzheimer’s, cancer and the like. But we don’t develop those drugs ourselves. Our policy is to license the patents broadly for a low, single-digit royalty to drug companies — which turns out to be great for them. The genes have already been discovered, purified and isolated, so they save years in drug development. We collect a small royalty and license our information broadly. It’s a win-win all the way around. And that’s the way the system should work. Let’s say Incyte didn’t do that and wanted a 50 percent royalty off every drug, or would only allow its own researchers to work on a particular gene. Then, maybe some public policy issues would need to be discussed. But again, there’s nothing different between that scenario and any other type of licensing arrangement.

It turns out, actually, that one suggestion put forth by a legal scholar at the University of Michigan would have the Patent Office issue “cross-licensing arrangements” in lieu of broad gene ownership patents. Are you comfortable with the Patent Office exploring alternatives like that?

Again, if it ain’t broke, why fix it? I really think the lack of empiricism here is quite appalling. Where is the problem? We are licensing these things nonexclusively anyway. I just wish people would take an intellectually honest view of what’s actually going on instead of projecting problems before they occur. I mean, I keep on hearing academics say, “This is bad because it’ll inhibit research.” But I’m still waiting to see the examples. Where is research being stopped? The fact is, through access to our data, researchers now have thousands more genes to work with than ever before.

So, basically, the great debate amounts to a lot of hand-wringing over nothing?

Yes. At this point, that is empirically the case.

But instead of cutting at this point to the seedy Hell’s Kitchen walk-up of some aging, tough-as-nails gumshoe, we find ourselves in the bright, cheery offices of AntiOnline.com, an Internet security consultancy that tracks hackers and monitors their activities from smack-dab in the middle of Beaver, Pa. And the P.I. the feds are pinning their hopes on? Why he’s no more than some fresh-faced kid in his early 20s named John Vranesevich, a guy who looks like he could just as easily be working the counter at Baskin-Robbins.

But that very same fresh face also graced “Wanted” posters circulating at last July’s Defcon Convention in Las Vegas — the most celebrated hacker gathering anywhere. And it’s Vranesevich’s AntiOnline.com Web site that hackers love to attack above all others. By Vranesevich’s own count, hundreds of hack attacks daily are pretty much the norm.

Why? Vranesevich markets his services not just to the authorities but also to companies looking to protect their systems from hackers — which hardly seems extraordinary. And the site itself simply contains news and information for security professionals, interspersed with ads from big technology players like Microsoft and Verisign. That, too, seems benign enough. But what’s not immediately apparent is that this all represents quite a shift from the site’s earlier roots — stemming from its launch while Vranesevich was still in junior high. For years, the site chiefly trumpeted hacker exploits and provided a channel for hackers to explain their actions and voice their opinions.

All that changed a couple of years back, when Vranesevich stopped praising hackers and started pursuing them. Hackers say it’s because he saw an opportunity to cash in on his inside knowledge. He says it’s because he came to see most hack attacks not as the heroic challenges to authority their perpetrators purport them to be but, instead, as indulgent, self-serving acts of malice. Either way, he declared war on his former comrades in arms. And the skirmishes continue to this day.

Hackers mount assaults on your Web site so relentlessly that you’ve included a feature visitors can use to see who’s attacking at that particular moment. Does all that enmity serve as one of your best security credentials?

Perhaps to some degree. It certainly removes any doubt about whether we’re in cahoots with any of these individuals.

Has anybody ever managed to get through?

As a matter of fact, yes. Just a few weeks ago, somebody got into AntiCode.com, which is our security file library where we archive some 140,000 security sites. One part of that is a community area where people are encouraged to post security information. And the software enabling that is a third-party package. Now, we went through that pretty thoroughly and we did a lot of updates, but apparently we missed one file. And some guy found a way to exploit that to upload files to the home directory — which is how he managed to deface the site.

Did he compromise any data?

No. It was just a matter of defacing, but it was a pretty creative attack. It looked like somebody invested a good deal of time.

What I find so curious is that after struggling so hard to get into your system, some guy chooses to do nothing more than leave his mark, which seems innocuous enough.

But just because I don’t lock my door doesn’t mean you can come into my house and leave a note that says: “Hi, I was here.”

Still, you’ve got to admit these people have a sense of humor. And it seems they’re primarily interested in demonstrating their technical prowess.

Well, that depends. One of the things we do here is break down hacker motivations. And what you’re talking about is what we call the “social motivation,” which almost always revolves around peer acceptance. Generally speaking, the guys we’re talking about would be out tagging their initials on shiny buildings were it not for the fact that they’re already essentially doing the same thing online.

And is this the sort of motivation you suggested when you developed a perp profile for the FBI after last month’s spate of denial-of-service attacks?

Profile? We did better than that. We turned over actual names.

How long a list are we talking about?

Three people. But the profile we initially produced suggested the attacks had been mounted by three to six people.

What else did your profile say?

We said the majority, if not all, of these attackers were operating in the United States. We said 35 to 100 computers had been used in the attacks. We said these people were socially motivated, since we never bought into all the speculation that this was the act of a group looking to manipulate market behavior. And we also said we thought the attackers were in their late teens or early 20s.

What told you that?

Well, for one thing, these denial-of-service attacks haven’t really been around for all that long. The utilities the attackers used didn’t even become publicly available until the latter part of last year. So there really wasn’t a whole lot of time for these people to install their software on all these hacked computers. Imagine installing software on 100 computers. It’s a time-consuming process. It’s also boring and repetitive.

Now further imagine that before you install all that software, you first must break into each computer, and once you’re done loading the goods you have to erase any evidence that you were ever there. That just makes an already time-consuming process a lot longer. So we believe it has to be a group of people who worked together to break into all those sites, install the software and then combine their lists into some master list.

For psychological reasons, these groups tend to always include three people or more, but almost never more than six. Because the hacker culture tends to be rather volatile and very ego-driven, groups of more than six are inherently unstable. In any event, had this group included more than six people, leaks would surely have begun to appear long before now. As for why we focused right from the start on hackers in their late teens and early 20s, that was mostly because people older than that typically won’t run these sorts of risks purely for peer acceptance. That’s just one of those things most people grow out of as they mature. We’re also fairly certain they couldn’t be any younger than their late teens simply because they’ve been mature enough to keep quiet.

Be that as it may, do you think they’re going to get nabbed?

Well, like I said, we turned over three names and explained to the FBI why we think these are the responsible parties. But one of the things that’s hurt this case has been all the publicity seekers. Here you have all these security companies that came out and did investigations, only to announce their findings to the press before going to the FBI. So, in the course of monitoring hacker postings to the IRC [Internet Relay Chat], we came across someone in the security industry posing as mafiaboy, obviously in hopes of finding [someone] who would try to contact him. But while he was trying to figure out who mafiaboy’s friends were, some other security companies were posing as mafiaboy’s buddies to see if they could get in touch with him directly. So these two security companies ended up having several interesting conversations with each other. It was really funny, actually. I spent many a night watching the IRC space, just howling. But, unfortunately, this also helped to create a very confusing picture for the FBI.

Is there anything that could be done to stop distributed denial-of-service attacks?

Not really. That’s what’s so funny about all this.

Don’t you think the recent attacks may have raised awareness enough to encourage people to start thinking about plugging the holes hackers can use to hijack their computers?

That’s never going to happen. Honestly. There’s always going to be someone like my mother who doesn’t know about the latest Windows 98 service package she needs to install. There are so many people online anymore that that’s become unrealistic.

So that leaves you to lurk in the dark recesses of the IRC in hopes of gathering all the hacker intelligence you can?

I wouldn’t use the word “lurk.” We simply monitor public IRC space — about 142,000 forums at present. That includes Web pages, forums, IRC channel newsgroups, mail lists — you name it.

On your Web site, you talk about how the intelligence you gather can be used to stop attacks before they start. Walk us through how that works.

That can happen in many different ways. One obvious example came about when we could see that a group was planning to attack the FAA’s [Federal Aviation Administration's] Web site and we had a good idea of how they meant to go about it. So we simply called the FAA and said, “We know of a hacker group that in 15 minutes plans to break into your site using this vulnerability. You might want to patch it.” That was pretty straightforward. At other times, we’ve obtained more subtle clues. One individual’s motivations, for example, might tell us what sort of targets they’re likely to go after.

You’ve also advocated that your clients, and I quote, “turn the hacker culture against itself to eliminate the threat once and for all.” That sounds deliciously intriguing. But is it legal?

Sure, it’s legal. Why wouldn’t it be? You have these people who are hiding their true identities while they’re getting ready to commit felonies against you. So if you can assume your own hidden identity and somehow convince them not to proceed, I don’t see what the problem is. This may come as a shock, but if I were to represent myself as being from AntiOnline.com, there aren’t a whole lot of people who would want to talk to me about what they’re doing. So what we try to do is simply play the culture against itself. The culture inherently is built upon people seeking to protect their anonymity. But what that means is that disguises are the norm. So when yours is convincing enough, you can fit right in.

But when operating under this assumed identity, I take it you’re not only gathering intelligence but also fomenting dissent.

Why not? A perfect example was when we were trying to break the CD Universe case. What we managed to do was invent people who were part of the scam. And we invented people who could make buys as well as people who could sell, and the whole nine yards. That gave us a way to monitor potential suspects for a while until we could find out what they liked, what they disliked, what their political beliefs were, what sort of jargon they used and all the rest of it. Then, using that, we were able to create a best friend for them who believed the same things, talked the same way and could quickly gain acceptance.

These sound like classic police techniques, only applied in cyberspace.

Absolutely. Basically, we caught the guy who did the CD Universe hack [in which 350,000 credit card numbers were made public] in much the same way an FBI agent would bring down a drug ring. The techniques are classic, but they’re not used very often in the digital realm. There are a lot of adaptations that need to be made, of course. And you really need to understand the culture — just like the people who do undercover work for the FBI need to know a lot about the gangs they intend to infiltrate.

And clearly most cops don’t have a clue when it comes to the Internet — which leads me to wonder what’s going to happen once somebody begins to engage in some real cyberterrorism. Is our so-called New Economy ready for that?

Real cyberterrorism? No way. We’re not ready for that. And I think the best evidence of that came from something called Project Eligible Receiver, which was sponsored by the DOD [Department of Defense] and carried out by the NSA [National Security Agency]. The NSA hackers managed to gain access to systems which they could have used to shut down the entire Pacific command fleet, shut down a significant portion of the nation’s power grid and basically send the whole country into a spin. So I think that shows pretty conclusively that we’re vulnerable. But at least we recognize that and are taking steps to try to mitigate that vulnerability.

And what do those steps entail?

You know, the No. 1 thing is education. With any given network, the weakest security link is always the end-user. So when the Melissa virus was making the rounds, the word went out telling people not to open up e-mail attachments. And that stopped the spread of the virus cold in its tracks. Some people still have to be told not to give out their password when somebody calls, no matter who they represent themselves to be. In the DOD, one of the biggest security concerns has to do with what we call “slippage,” which happens whenever data coming from a secured, classified network finds its way onto an unclassified network.

So data slips really do sink ships?

Yeah. Write that one down. As you know, a certain former CIA director has already been called on the carpet for that very thing.

But in any event, isn’t network security something of an oxymoron?

Yes. We live in extraordinary times. Security right now is a folk art. It really is. If you hired four different security firms today and asked them to secure the same network, each would come back with a different solution. And probably a year from now, each would be compromised in a different way.

Does that mean we’re just a bunch of e-commerce lemmings about to take the plunge?

Yes, I’m afraid so. E-commerce right now is a very dangerous thing. After reading recently about online voting in Arizona, I’ve had recurring nightmares about electing President [Kevin] Mitnick. I mean, if everything else can be hacked, surely a voting system can be broken into. I think, in general, we’re rushing forward much too fast. The Internet was originally designed for the free exchange of information between a large number of people — scientists and researchers, mostly. Now, all of a sudden, the Internet has become commercialized. But it’s still a long way from being industrial strength. So should you be nervous? Yes, very nervous.

The conglomeration process picked up a whole lot of steam in December with the finalization of the company’s merger with Sandpiper Networks, which served to fuse Sandpiper’s content-delivery capabilities with Digital Island’s data delivery and hosting services — as well as its global string of data centers. That was enough to encourage Sun Microsystems and Inktomi to jump on board not just as technology partners but also as significant investors, no doubt with an eye to building the world’s dominant infrastructure for interactive e-business. Real Networks had already announced it would work with Digital Island and Inktomi to enable advanced media streaming across the network and, in January, Digital Island managed to expand on this by acquiring Live On Line, a leading supplier of live multicast and on-demand streaming media services.

Ruann Ernst, Digital Island’s hard-charging chairman and CEO, is at the helm — living life on fast-forward and developing a real taste for the rough-and-tumble.

Digital Island is one of the better company names I’ve come across — it sounds more like prime-time programming than high-speed networking. Still, given all the strategic partnerships you’ve entered into over the past few months, wouldn’t “Let’s Make a Deal” be more apt?

Yeah. Why didn’t we think of that? The thing is, we’re looking to provide the most robust global e-business infrastructure possible. No one company can do it all. It requires selective strategic partnerships to deliver what enterprises need. And those partnerships have to be executed in Internet time. So yes, strategic deals are important to us, and we’ll continue to aggressively pursue those that we think are beneficial to our customers.

Improving performance at the edges of the network has been a big story for you right along, but does the strength of that story get diluted as the pipes and switches of the public Internet continue to get bigger and faster?

Well, actually, what we’ve promised all along is faster, better, guaranteed and richer end-user experiences. That’s really what’s most important. And we’ve always made the trade-offs that were necessary between bandwidth and storage at the edge of the network or at the heart of the network, for that matter, to enhance that experience. Our job is to use the best technology available at any point in time. Part of that, of course, has to do with being the leader at pushing content to the edges, but it’s just as important to be able to guarantee the round-trip response. For example, it doesn’t do E-Trade much good to be able to stream a video clip providing vital background on a company if potential traders don’t have enough bandwidth to be able to respond immediately with orders.

As to whether we’ll ever get to the point where bandwidth is free, I have to say I doubt it. Ultimately, there will always be some trade-off between where to put computer power and storage power and where to use bandwidth in a truly intelligent, distributed network. It’s not just about the size of your pipes. It also has to do with where the content is hosted and many other issues.

You’ve made the claim that your proprietary Footprint technology makes it possible to deliver content more efficiently while dramatically improving overall Web site performance. How will you be able to make good on that?

The Footprint technology, which is patent-pending, contains very sophisticated algorithms that allow us to keep a monitor on the Internet so we know where the congestion points are and how to navigate around those so as to get content to end users as fast as possible. And by “content,” I’m really referring to large software files or streaming media things that are quite large and complex. Footprint also determines the best routing for the user’s response.

In terms of helping clients strengthen their e-business offerings, you also claim to imbue content delivery with “geographic intelligence.” What exactly does that mean? And how does that contribute to improved e-commerce?

Our geographic intelligence is enabled by a capability we call TraceWare. This, too, is patent-pending, and it contains very sophisticated algorithms and a master database that essentially informs an application about where in the world the user is located, with 96 percent accuracy. That may not seem terribly important. But on the Internet, you can’t always even tell what country a user is coming from. So let’s say you’re in the business of marketing music around the world — selling CDs — and that as part of your program you offer visitors to your Web site samples from that week’s top 10 CDs in hopes that they’ll hit the “buy” button while listening to one of them. But if someone signs on in Brazil, my guess is that the top 10 CDs there will be different from the top 10 in Sweden.

What TraceWare does is let you know right off what language the interface should use and which top 10 clips to present. It also helps you determine delivery time, the right payment method to use and much, much more — all without putting the customer through very much. The point is that this can have great value for any international e-business effort. Net Gravity, in fact, takes advantage of TraceWare to determine what ads it can place on a country-by-country basis. After all, why place ads for products that can’t be sold? You can’t pump an ad for Viagra into Singapore, for example, because it’s illegal there.

Since you’ve raised the issue of advertising, let’s slide right over into the media world for a bit. AOL’s recently announced intentions to acquire Time Warner have largely been characterized as a broadband play. Given that AOL already is a customer of your content delivery service and that you’ve already announced plans to integrate those same services into the Road Runner broadband cable network (in which Time Warner has a huge interest), how is the AOL Time Warner deal likely to affect you?

Let me add just one more piece to that: Warner Brothers is also a customer of ours, which does create an interesting scenario. We, of course, are very interested in the proposed acquisition and believe that, if anything, it will just increase our opportunities, since we already have established relationships with so many of the involved parties. But even beyond the synergies that come out of the acquisition itself, we feel we’re well aligned with the goals the combined companies will ultimately pursue.

What are the strategic implications?

Whether you’re talking about AOL or Road Runner, their content distribution focus so far has revolved around the last mile. And AOL Time Warner is certainly going to have plenty of content to move around. Put those two points together and I think you can see that this is likely to create some significant global infrastructure opportunities that we’ll be more than ready to satisfy. What could be better? We’re not in the local access business or the content business. They, on the other hand, aren’t in the global infrastructure business.

Another merger I’d like to focus on is your own with Sandpiper Networks. Looking back just a few months, you’d have to say that what amounted at the time to a $630 million acquisition looks very much like a steal today especially given that Sandpiper’s principal competitor, Akamai, currently enjoys a market valuation somewhere in the $20 billion neighborhood. That’s the good news. The bad news is that, with all that money flowing in, Akamai is beginning to look like the 900-pound gorilla of content delivery. Does that keep you up at night?

One certainly has to recognize that a player like that is on the horizon. But it doesn’t keep me awake at night because the market is so huge. No matter how fast Akamai moves, there are plenty of customers that need the sort of e-commerce service we offer. Also, while both companies provide for content delivery, I happen to think our technology is much better. And what’s even more important is that we also provide the ability to handle the round trip to complete the transaction. And that’s something Akamai doesn’t do. So I think they have a piece of the solution, but not the total solution. And we believe corporations moving to e-business will want a better integrated approach.

So you’re saying that Akamai is a content pusher while you’re an e-business solution?

An e-business delivery network, actually. We’ll be happy to have other people handle the applications. We just want to be the carrier.

Twenty years later, Basu was heading up HP’s 1,400-person e-business software department when she called it quits to join a new start-up. Basu plans to shake up the way companies think about their customer support. And it’s a field where she thinks women have an edge.

The number of senior women executives certainly has increased significantly in recent years, along with the growth of e-commerce. Do you see a relationship?

I certainly do. I think the Internet is a medium that rectifies a lot of inequities. You have 22-year-olds launching companies, you have women achieving very senior positions in a short period of time. And that’s all quite different from the more entrenched brick-and-mortar world.

Do you think that’s because Internet companies tend to be run by younger executives?

That’s part of it, but what I think is even more important is that the whole Internet phenomenon is very customer-focused. And one of the things about women is that we’re able to look at customer needs, be appreciative of them and develop cooperative, win-win relationships.

What do you see as your most immediate challenge?

Today, what I really lose sleep over has to do with building the company from a scalability point of view. That may not sound very sexy, but I believe if you want to be involved in the Internet infrastructure for the long term, you have to make the necessary investments to scale your operations and ensure the reliability and predictability of your services.

That sounds suspiciously like corporate IT thinking. Is that your principal focus at the moment?

Well, corporate tech support is an important market. But you also have to bear in mind what e-support means to our customers — and the relationships they have with their customers. Often the only contact point the customer has with the vendor is the “support analyst.” And that’s especially true if you sell on the Web.

So I believe you’re going to find that support becomes an increasingly important area in terms of helping our customers differentiate themselves from the competition. We can’t think of customer support as just being technical support, because it’s also becoming the focal point for interacting with customers.

You’ve said your goal is to make Support.com the Inktomi of support sites. Can you explain what you mean by that?

After leaving H.P., I consulted with Inktomi for a while and I really admire the company. They provide the infrastructure behind most of the successful destination portals. They’re the traffic cops and it’s their search engine and caching technology that makes that whole thing go. So in the same way, I’d like Support.com to become the infrastructure behind every Internet support portal, every intranet support portal, and every extranet support portal.

What do you offer to help make that happen?

Our DNA Probe [technology] lets us provide technical support to any computer user anywhere on the network. Since desktop systems and the applications they run can be configured in many different ways, it’s vital that the help desk be able to look at how a system has been put together before it tries to troubleshoot. The DNA Probe makes that possible by going out to discover the application’s state, the way that state is managed and the configuration dependencies that have to be accounted for. That’s the first step. And on the basis of that, the DNA Probe creates a real-time map of the system. That means that at any time, on any trigger, we can go out and create that map. Then we can use it to diagnose the problem.

And once we’ve got that handled, there’s a healing component within the DNA Probe that automatically fixes problems. So that gives you automated discovery, diagnosis and healing — and all of it over the Web.

“Healing” sounds like a great idea, and it’s a term that PC manufacturers are throwing around a lot these days. But exactly what does it mean?

I think what’s happening is that PCs aren’t even commodities anymore. They’re getting dangerously close to being giveaways. So now PC manufacturers are getting into the business of offering managed PC services. Micron is one example. In fact, their managed PC service is called Connectedsupport.com. And they use our technology to deliver that. For them, it’s a means of survival. And self-healing in that case means that customers are able to help themselves to the information and support services they need.

I believe that for subscription computing [where hardware is sold for a monthly fee] to be successful, support has to be an integral part of the offering. I cannot believe that any consumer would sign up unless they could be assured of good, solid e-support as part of the deal.

Given the accelerated depreciation cycles for computers, I wonder if it even makes sense to buy hardware anymore.

I agree. Certainly, I don’t want to buy hardware. I just want to get the service I need — with the knowledge that in six months, if the hardware needs to be upgraded, the vendor will go ahead and handle that for me.

For now, though, the vendors that have embraced the subscription model seem to be targeting small businesses. Why not larger organizations as well?

Actually, I think we’re already beginning to see some evidence of that. Some of our larger customers — companies like Computer Sciences Corporation and Compaq — are becoming service providers not just to small and medium-sized businesses, but to large corporations as well. And within those corporations, I think you’ll soon see that their IT departments start to use the service-provider model to improve the delivery of internal support.

Do you see Support.com doing some evangelizing?

Yes. We’ve worked enough with the earliest ITSPs [information technology service providers] to know what’s required there. And I expect we’ll continue to be one of the leading enablers in that space. But we’re very clear that our job is to provide Internet infrastructure for support. So we’re not just about to eat our own children by setting up destination portals and acting as a service provider ourselves. I know that it’s sexy to be in the destination portal business and to be branded. But I think that competing with your own customers is not the way to build long-term, stable growth.

Word has it that you decided to leave your 20-year career at H.P. while trekking in the Himalayas. Looking back, would you say the higher elevation allowed you to see more clearly? Or were you just oxygen-deprived?

I’d like to believe it was the pull of the mountains — being able to step back and look at things in a spiritual context. But maybe the lack of oxygen helped, too.