This was little comfort for those who had suffered damage from the bug. Over twenty thousand of the AIDS diskettes had been sent out, using not only the PC Business World mailing list, but the delegate register to a World Health Organization (WHO) conference on AIDS in Stockholm. In the first few days, a number of recipients had panicked when they realized that they had just loaded a potentially destructive trojan onto their systems. The trojan had caused the loss of data at the U.N. Development Program offices in Geneva, and in Italy an AIDS research center at the University of Bologna reported the loss of ten years of research. Like many users, they had not kept backup copies of their valuable data. The trojan reached hospitals and clinics throughout Europe, and the Chase Manhattan Bank and International Computers Limited (ICL) in England both reported unspecified "problems" caused by the program. In every instance, scientists, researchers, and computer operators wasted days chasing down and eliminating the bug, even after Jim's antidote and ClearAid program became generally available.
At New Scotland Yard the Computer Crime Unit under Detective Inspector John Austen established that all twenty thousand diskettes had been posted from west and southwest London, between December 7 and I I, 1989, and that they had been sent to addresses in almost every country of the world, with one glaring exception: none had been sent to the United States.
The Computer Crime Unit does not have an easy job.
In many cases it has been frustrated by the unusual nature of computer crime, and with viruses it has been noticeably unsuccessful in bringing prosecutions. Most viruses are written abroad, by unknown and certainly untraceable authors, often in countries such as Bulgaria where the act itself is not a criminal offense. To prosecute a case against a virus writer, the unit must have a complaint against the author from a victim in Britain, evidence of criminal intent, proof of the author's identity, and finally, his presence in Britain, or at least in a country from which he can be extradited.
The legal problem with viruses, quite simply, is their internationality. They seep across borders, carried anonymously on diskettes or uploaded via phone lines to bulletin boards; their provenance is often unknown, their authorship usually a mystery. But inspector John Austen was determined that the AIDS diskette incident would be different. He viewed it as the "most serious" case the unit had faced: not only was it a large-scale attack on computers by a trojan-horse program, it was blackmail--or something very similar. In this case, he also had a complaint; indeed, he had a few thousand complaints. It was clearly time for the unit to throw its resources into tracking down the author of the trojan.
The publishers of PC Business World told the police that they had sold this particular mailing list for about $2,000 to a Mr. E. Ketema of Ketema & Associates, who purported to be an African businessman representing a Nigerian software company. The transaction had been carried out by post; no one had ever met Ketema.
Ketema & Associates operated out of a maildrop address in Bond Street, London. Company documents revealed that the firm had three other directors, supposedly Nigerian: Kitian Mekonen, Asrat Wakjiri, and Fantu Mekesse. The staff of the company that operated the maildrop had never seen the three Nigerians, but they had met Mr. Ketema. Far from being an African businessman, he was described as white, bearded, and probably American.
Computer Unit detectives then turned their attention to PC Cyborg Corporation of Panama City. Through inquiries to the Panamanian police, it was discovered that the company had been registered a year earlier. The Panamanians were also able to find the company's local telephone number.
Waiting until early evening in London, when it would be ten A.M. in Panama, a detective put a call through, and was rewarded by the sound of an American voice when the phone was answered. "Mr. Ketema?" asked the detective tentatively. "Who?" answered the voice. It turned out to be an American marine.
Panama had been invaded on that very day.
- Simultaneous inquiries in Nigeria did not turn up evidence of the three Nigerian businessmen who were registered as directors of the company.
Indeed, the Unit discovered that the three names didn't sound Nigerian at all. They might have been made up.
By then the Computer Unit's detectives were convinced that they were chasing one man, probably an American.
