1. Introduction

The first known incidence of ransomware is the AIDS Trojan developed and distributed by Dr. Joseph Popp in 1989 (Mungo and Clough 1992). Popp was a medical researcher who distributed 20,000 floppy disks to fellow researchers who attended the 1989 World Health Organization’s (WHO) conference on AIDS. Popp claimed that his program could analyse an individual’s risk of acquiring AIDS; however, the disk he distributed to his colleagues also contained a malware program (Trojan) that activated after the victim’s computer was rebooted 90 times. Once the malware was initiated, all the user’s files and directories were encrypted in the computer system’s root directory. Once the encryption process was completed, the malware displayed a message asking the user to pay $378 (USD) for renewing a license which could recover the lost files and directories. The request for payment asked the user to mail the ransom payment in the form of a cashier’s cheque to a post office box in Panama. The trouble and time delay in paying the ransom and receiving the decryption key ultimately limited the profitability of the attack (Solomon et al. 2000). It is unclear how many people fell victim to the attack; however, it didn’t take long for the Federal Bureau of Investigation (FBI) to attribute the attack to Popp, and he was arrested in February 1990 and extradited from London to the United States to face trial.