The first ransomware arrived by post

We talk about ransomware as though it were a product of the cryptocurrency era — as if the ability to receive anonymous payment created the crime. It did not. It only made it scale.

In December 1989, Joseph Popp posted around twenty thousand floppy disks to attendees of a World Health Organization AIDS conference and to subscribers of a medical mailing list. The disks were labelled AIDS Information — Introductory Diskettes. They contained a questionnaire that assessed your risk of contracting HIV, which worked exactly as described.

They also contained code that counted boot cycles. After the ninetieth restart it encrypted the filenames on the hard drive and displayed a demand for $189, payable to a post office box in Panama.

Everything we now consider characteristic is already present. Mass distribution to a target list chosen for its urgency. A delay between infection and detonation, long enough to defeat any association between the disk and the damage. Payment routed to an anonymised drop. A ransom priced to be annoying rather than impossible — low enough that paying feels rational.

The encryption was symmetric and was broken within weeks. That is not the interesting part. The interesting part is the damage done before anyone knew that, by researchers who panicked and reformatted disks containing years of work. Some of that data was AIDS research, in 1989. It is difficult to calculate that cost and easy to feel it.

Popp was arrested and found unfit to stand trial. He later established a butterfly conservatory in upstate New York.

Thirty-seven years on, the delivery mechanism has changed and nothing else has. We got better at encryption and worse at the underlying problem, which was never cryptographic. It was that a plausible package arrived from a trusted-looking source, and somebody put it in the machine.