There is an old saying in American business, "No one ever got fired from recommending IBM." In this case, IBM isn't selling any hardware or software. IBM is hosting the servers and is one of the big sponsors of this project. (Thanks and kudos to IBM, by the way) IBM has too much reputation to lose by being sloppy with their security, so they are treating this project with great care.

I would challenge your friend to follow the links supplied by earlier posters, contact his anti-virus vendor if he doesn't trust his scan results (against the FightAIDS@Home download), and ask his supervisors. There are many thousands of computers throughout the world that trust this software, and we don't get any side benefit, such as music sharing, other than helping Scripps fight this modern plague.