Other publishers have resorted to more extreme methods. One celebrated case involved an American cosmetics conglomerate that had leased a program from a small software house to handle the distribution of its products. On October 16, 1990, after a disagreement between the two about the lease payments, the soft- ware company dialed into the cosmetic giant's computer and entered a code that disabled its own program. The cosmetics company's entire distribution operation was halted for three days. The software house argued that it was simply protecting its property and that its action was akin to a disconnection by the telephone company. The cosmetics company said that it was "commercial terrorism."
The Cleveland District Court, however, rejected arguments that the AIDS diskettes simply contained some sort of elaborate copyright-protection device. It also ruled that Popp was fit to stand trial and ordered his extradition to Britain to face charges.
Popp was the first person ever extradited for a computer crime and the first ever to be tried in Britain for writing a malicious program. From the welter of complaints, the police had prepared five counts against him; he faced ten years in prison on each charge. According to the police, Popp had perpetrated a scam that could have grossed him over $7.5 million, assuming that each of the twenty thousand recipients of the diskette had sent the "lifetime" license fee. More realistically, it was estimated that one thousand recipients had actually loaded the diskette after receiving it; but even if only those one thousand had sent him the minimum license fee, he still would have earned $189,000.
The police also discovered a diskette that they believed Popp intended to send out to "registered users" who had opted for the cheaper, $189 license. Far from being an antidote, it was another trojan and merely extended the counter from 90 boot-ups to 365 before scrambling the hard disk. In addition, there was evidence that the London mailing was only an initial test run: when Popp's home in Ohio was raided, the FBI found one million blank diskettes. It was believed that Popp was intending to use the proceeds from the AIDS scheme to fund a mass, worldwide mailing, using another trojan. The potential return from one million diskettes is a rather improbable $378 million.
The police also had suspicions that Popp, far from being mentally unstable, had launched the scheme with cunning and foresight. For example, he had purposely avoided sending any of the diskettes to addresses in the United States, where he lived, possibly believing that it would make him immune to prosecution under American law.
But the case was never to come to trial. Popp's defense presented evidence that his mental state had deteriorated. Their client, his British lawyers said, had begun putting curlers in his beard and wearing a cardboard box on his head to protect himself from radiation. In November 1991 the prosecution accepted that Popp was mentally unfit to stand trial. To this day, the Computer Crime Unit has never successfully prosecuted a virus writer.
For Popp, whatever his motives and his mental state, the AIDS scheme was an expensive affair--all funded from his own pocket. The postage needed to send out the first twenty thousand diskettes had cost nearly $7,700, the envelopes and labels about $11,500, the diskettes and the blue printed instruction leaflets yet another $11,500--to say nothing of the cost of registering PC Cyborg Corporation in Panama, or establishing an address in London. To add insult to injury, not one license payment was ever received from anyone, anywhere.
Popp's scheme was not particularly well thought out. The scam depended on recipients of his diskettes mailing checks halfway around the world in the hope of receiving an antidote to the trojan. But, as John Austen said, "Who in their right mind would send money to a post office box number in Panama City for an antidote that might never arrive?" Or that may not be an antidote anyway.
It seems unlikely that anyone will ever again attempt a mass blackmail of this type; it's not the sort of crime that lends itself to a high volume, low cost formula. It's far more likely that specific corporations will be singled out for targeted attacks. Individually, they are far more vulnerable to blackmail, particularly if the plotters are aided by an insider with knowledge of any loopholes. An added advantage for the perpetrators is the likely publicity blackout with which the corporate victim would immediately shroud the affair: every major corporation has its regular quota of threats, mostly empty, and a well-defined response strategy.
