Edward Wilding
Virus Bulletin, January 1992, pp.2-3
ISSN 0956-9979
January 1992
Dr. Joseph Lewis Popp, the alleged author of the notorious AIDS Information Diskette (VB, January 90, pp.2-10; VB, March 90, p.2) has been set free by a UK court. Judge Geoffrey Rivlin QC at Southwark Crown Court dismissed the case against Popp, who faced charges on eleven counts of blackmail, after testimony from London psychiatrist Paul Bowden to the effect that Popp, 41, was psychologically unfit to plead. New Scotland Yard’s Computer Crime Unit initially had high hopes that Popp would stand trial; the CCU, in conjunction with the FBI with assistance from computer analyst Jim Bates had, over the course of a two year investigation, assembled a veritable barrage of forensic evidence to link Popp with the development and distribution in December 1989 of some 20,000 Trojanised diskettes.
According to the psychiatrist’s report Popp’s mental condition since his extradition to the UK from the United States in May of this year declined considerably. A spell of several days on remand at Brixton Prison is understood to have had a particularly adverse effect on his mental state. His recent antics have included wearing a cardboard box, putting hair rollers in his beard to protect himself from ‘radiation’ and ‘micro-organisms’ and wearing condoms on his nose. In recent months Popp has been resident at the Maudsley hospital, a psychiatric care unit in south London.
Following Judge Rivlin’s decision, Popp, currently persona non grata due to the confiscation of his US passport by British immigration officials, will soon be free to fly back to his home town of Willowick, near Cleveland, Ohio. Investigators and plaintiffs have been dismayed by rumours that Popp has been approached to appear on television and intends to write a book. Prosecuting council Mr Richard Curtis mused ‘we just hope that he doesn’t do it again, and that we don’t hear about him until his book comes out.’
The details of this incident were related in the January 1990 edition of VB. In December 1989 some 20,000 diskettes were posted in London to a mailing list of subscribers of PC Business World (which has since ceased publication), other business lists and delegates to a World Health Organisation conference on AIDS. The 5.25 inch envelopes which contained the disks bore first-class postage stamps. The disks contained an interactive questionnaire and risk assessment of exposure to the biological AIDS/HIV virus, the copyright for which was claimed by the ‘PC Cyborg Corporation’. However, the actual effects of installing and running the diskette amounted to what is construed by many as an elaborate but rather cack-handed attempt to extort money - after approximately ninety reboots the root directory of the hard disk was encrypted and a ‘ransom’ note demanding payment in US dollars was issued to any connected printer. The money was to be sent to a post office box number in Panama.
The Aids Information Diskette caused enormous disruption, not least to AIDS research. One AIDS organisation in Italy lost ten years of irreplaceable research as a result of panic after installing and running the program. A number of PC administrators were dismissed from European companies as a result of slack procedures exposed by the AIDS disk. Encrypted root directories, which occurred after the Trojan triggered, were still being reported up to one year after the initial distribution of the diskette. Copies of the AIDSOUT restorative program, written by Jim Bates, were requested in some ninety countries worldwide; Detective Inspector John Austen, who led the police investigation, estimates that the disk itself was installed by about 5 percent of those who received it, i.e. on approximately 1,000 computers. The police investigation itself amounted to the most intense and costly ever conducted in the history of computer crime.
Police officers leading the investigation were interested as to why no diskettes were mailed to the United States despite the appearance of US subscribers on the rented list; this fact suggested early on that the perpetrator might be familiar with American law. The lists themselves had been bought by a ‘Kenyan businessman’ by the name of E Ketema - neither he, nor Kitain Mekonen, Asrat Wakjira and Fantu Mekesse (the ‘directors’ of PC Cyborg, a company registered in Panama on 12 April 1989) have ever been traced.
The actual breakthrough in the investigation occurred on Christmas Eve 1989 when Detective Inspector John Austen of the CCU was telephoned by a Dutch colleague and informed that a Dr. Popp had been apprehended in an emotional state at Schipol airport. Popp had returned from a World Health Organisation seminar in Nairobi after reading of the disruption caused by the AIDS disk which was widely reported in PC magazines and newspapers worldwide. At this point he appears to have suffered a nervous breakdown. On arrival at Schipol he alerted the authorities by scribbling ‘DR POPP HAS BEEN POISONED’ on a passenger’s luggage!
He was subsequently found to be in possession of materials relating to the PC Cyborg Corporation. However, Popp was released by the Dutch authorities and allowed to proceed from Amsterdam to Ohio where an FBI team kept the house in which he lived with his parents under surveillance. Extradition proceedings followed the issue of an arrest warrant by New Scotland Yard in early January 1990.
The motivation of Popp, who according to his lawyers admits having sent out the disks, remains the subject of much speculation. His UK solicitor Gareth Peirce is adamant that Popp is innocent of any attempted blackmail charge on the grounds of diminished responsibility. His defence council in the United States argued in earnest that Popp intended to donate any ‘revenues’ from his project to AIDS research - the HIV virus itself is reported to fascinate Popp. The whole incident is explained by Popp’s lawyers as the manifest actions of a mind at its most irrational. Certainly, his behaviour during the past 24 months would appear to be deranged.
However, a number of people conversant with this case harbour doubts. The cost of disk duplication and distribution alone exceeds £10,000. A massive logistic effort was undertaken in executing this crime - there was the bulk duplication of diskettes, mail-list purchasing and de-duplication, packaging, applying stamps and address labels, the hire of an accommodation address in London, the registration of PC Cyborg in Panama - if Popp was insane and did commit this crime, then there was method in his madness. If all the recipients of the disk had paid the full ‘licence fee’ for the programs (US$378), then the perpetrator(s) stood to net somewhere in the region of $7.5 million dollars! If just one percent of the intended victims had paid the minimum ‘licence fee’ (US$189), the ‘PC Cyborg Corporation’ would have received a figure approaching US$38,000 - sufficient finances to recover its costs.
The technical evidence accrued from examination of Popp’s computer and media in Ohio suggests a more calculated mind at work than Popp’s lawyers have suggested. His US attorney confirmed earlier this year that Popp had been prepared to duplicate and distribute a further two million diskettes. One diskette obtained by the police contained an encrypted diary detailing the conception and development of the AIDS Information Diskette. Jim Bates, who decrypted this disk, discovered that the encryption key was ‘Dr. Joseph Lewis Andrew Popp Jr.’ - a discovery akin to a forensic jackpot. The police also obtained the entire source code to the AIDS disk, although the exact circumstances of this find have not been disclosed. As the diary information dated from April 1988, it appears this plan had been in development for some twenty months prior to its execution. Rarely, for a computer crime case, the technical evidence linking Popp to the development (if not the distribution) of the disk is close to being incontrovertible.
The legal eagles are still debating the fine print of the case; the fact that the ‘documentation’ supplied with the diskettes warned the user of unpredictable results, albeit in the smallest of small print, is seen by some lawyers as a loophole in any prosecution case. Moreover, filenames were encrypted rather than destroyed which reduces the impact of a charge of criminal damage. The only lasting outcome of this incident was the expedited passage of the Computer Misuse Act which became English law in August 1990.
The legal debate is now academic. By the time that this edition of VB is published, Dr. Popp will have returned to the United States and is unlikely to face further charges. Popp was no evil genius and his alleged crime was far from perfect. However, one could be forgiven for getting the impression that having learned the secrets of effective direct mail, he is now laughing all the way to his publisher. We look forward to reading his version of events.
[Back to index] [Comments (0)]