An Anti-Virus Shot
in the Arm for Japan

McAfee KK was formed in January 1997, and the company purchased Jade, the only Japan-originated anti-virus company, in March. James LaLonde is director, Asia Pacific, for McAfee Associates. He came over after a five-and-a-half-year career at Microsoft Japan to join McAfee KK in April.

interviewed by Wm. Auckerman

Why did McAfee purchase Jade?

James LaLonde: Jade had very strong sales to corporations and government agencies here in Japan. Our strategy was, when you look at the Japanese market, you have the market leader Jade, Symantec, Trend Micro, and a number of smaller players, so we had a chance to buy a local player, get ourselves in quickly, acquire some staff, and hit the ground running - and, at the same time, knock out a competitor. We now have 70 people in Japan.

And how has it worked out?

LaLonde: We bought Jade at the end of March, and we got our first McAfee product (Virus Scan) out in April. It sold 10,000 copies to resellers the first day, and has led the retail market since.

We made about the fastest entry you can make into this market. We have an infrastructure that takes time to build if you have to hire them one by one. That's the beauty of the match with Jade: we merged with them and started selling their products, and we've taken the best parts of their products and worked it into our products.

In May, according to the Ministry of International Trade and Industry, there were 230 cases of viruses reported by corporations in Japan, the most ever reported to date. Are more viruses being developed today, or are companies just reporting their infections more?

LaLonde:Lately, the popularity of Microsoft Office is driving a lot of the viruses. There's a common macro language in all the Microsoft products; that's one of the features. But the popularity of that macro language has a downside: macro viruses are just exploding.

Anyway, I think there are over 12,000 known viruses recorded out there now. And with the advent of macro viruses, and the fact that they're very easy to create, we're seeing 300 new viruses a month coming in to our research facility. So it's really taken off. And with that, you get some language-specific viruses: Japanese-only viruses, Korean-only viruses, Chinese-only viruses.

There are about 300 local viruses in Korea, and just under 100 in China, but these numbers are growing. In Japan, it's probably less than 50 but growing.

So even viruses are being localized?

LaLonde: Yes, and that's a very key thing on the competitive side. If you want to have a competitive product, you can't just be good in detecting the international viruses, and you can't be good in just the local viruses. You've got to do both. That's why having a presence in a country like Japan or Korea is very important. You've got to have someone researching there, getting the local viruses so that you can put out a product that will be able to detect them.

Are small and midsize Japanese companies concerned about virus protection?

LaLonde: The thing about viruses is that you normally don't think about taking precautions until you've actually been hit by one, and had some damage or been inconvenienced. To be honest with you, most of the calls we get are after the fact. A company has a big problem - they've lost some data, or they've infected their business partner - so they call us for help.

What are the most common ways to get a virus?

LaLonde: Right now, the most common way to get a virus is by trading e-mail and sending documents around. Again, this goes back to the popularity of Microsoft Office. A lot of people are using the same word processor, the same spreadsheet. So they attach a file to e-mail, and the person opens an infected file at the other end.

It's one thing if you spread viruses around in your department, or if you spread viruses even within a company - you can kind of keep a handle on that. But once you start sending e-mail and attachments around to your customers and your business partners, it gets to be a real big problem.

Japanese companies are starting to understand that there are things they have to do to make sure that their data is clean. It's a security issue.

The need for security gets a lot of lip service in the press today, but my impression is that most companies are reluctant to spend money for it.

LaLonde: I think that's a valid point. It's the same point we had to make at Microsoft when we tried to sell the graphical user interface back in the early '90s. Companies would say, "But our computers are working; we're connecting and sharing data just fine. Why do we need a graphical user interface?" Security is a similar type of thing. Until they get it and start using it, many don't realize the value.

Now, with security, data in the US shows that over half of the security violations any corporation experiences comes from within. That's another thing companies have a hard time swallowing. Companies tend to want to focus their budget. Firewalls, for example, are an easy thing to get someone to pay for, because it's easy to conceptualize: There's this firewall protecting you from all these outside, unseen-but-very-malicious types. That's an easy sell.

But think about the situation where the financial controller might send an Excel spreadsheet with everyone's salary information and other sensitive data across the groupware network to the guy sitting two doors down from him. He doesn't think anything about it. What he doesn't know is that the guy they hired last week as a network manager can take a look at that, and send it out to anyone else he wants. In this industry - not just McAfee, but all the companies involved in the security software industry - we're out there every day educating our customers about the risks they're taking.

Where does the Internet fit into the security picture?

LaLonde: Some of the glamour and glitter about the Internet is fading away, and it's getting more practical, getting down to business. Can you make money? If you can, how? What technologies are going to be involved?

More and more with the Internet, everyone realizes that the need to be connected is very important. But we're getting into a phase where people are also starting to assess the risks of being connected, or of not being protected.

When you look at the future, it's about encryption, and we're the only anti-virus company that has encryption products. It's also about ActiveX and Java, and using your browser. There have been stories about how you can get these destructive ActiveX or Java controls that can actually waste your hard disk. That's not a virus issue; it's a security issue. It's like a virus, but it's not a virus; it doesn't have the same traits.

What's going to be the next growth area?

LaLonde: There's two areas of growth for anti-virus software: So far, companies in this anti-virus market have made their money selling desktop products to corporations. The two main markets of the future are selling the desktop product to consumers, and selling server products - and gateway products, and firewall products, and encryption - to corporations.

If you look at just our company, either Jade's product or McAfee's product is on every major new Japanese system. We have the largest OEM relationship of any anti-virus company. So, the product is getting out there; the trick to making money on the consumer side is getting them to buy an upgrade, or getting them to buy the full product afterward. More and more, we are selling the upgrades via the Internet. We're innovators here.

How often do users need to upgrade their anti-virus software?

LaLonde: It depends on your needs. If you're a corporate customer, I think you need to have your software upgraded at least once a month. The home user can probably get away with less.

What is your position on providing bilingual solutions?

LaLonde: When we bought Jade, we took all the local virus information they had and immediately incorporated it into our Virus Scan product. So all the good things about the Japanese product were put into the core product. We maintain one core engine that is not language based.

Because of that, the new releases of the English product will detect Japanese viruses. So whether you buy the English product or the Japanese product, you still get the latest engine. You could use the English product if you wanted to, and wouldn't have to worry about the Japanese part of it not being covered.

Back to table of contents