Lauri Love (33), a UK activist, was charged in 2013 with serious cybercrimes against the US Army, NASA and many other federal agencies.
US prosecutors at the time alleged:
Between October 2012 and October 2013, Love and fellow conspirators sought out and hacked into thousands of computer systems. Once inside the compromised networks, Love and his conspirators placed hidden “shells” or “back doors” within the networks, which allowed them to return to the compromised computer systems at a later date and steal confidential data. The stolen data included the personally identifying information (PII) of thousands of individuals, some of whom were military servicemen and servicewomen, as well as other nonpublic material.
The attacks were said to have been carried out through a mixture of SQL injection and an exploitable vulnerability in the Adobe Cold Fusion product.
Love was arrested and bailed in the UK, with the ultimate goal of deciding, “Should he be extradited to the US to stand trial?”
Since then, the case has gone round in something of a whirl.
After being released from his bail obligations in the UK (though not released from the risk of extradition), Love decided to fight the UK’s National Crime Agency (NCA) for the return of computer devices that were confiscated when he was arrested.
The dispute came about, it seems, because the NCA was keen to hang on to devices that contained data that hadn’t yet been decrypted, in case it might later turn out to have bearing on the case.
Love was understandably just as keen to get the devices back, claiming at the time that there was no “overt evidence of criminality sufficient to bring prosecution.”
Shortly after that, in July 2015, Love was rearrested in the UK and has been battling extradition ever since.
In a judgment handed down in the UK today, Love seems to have won the extradition battle for now: the High Court of Justice in London today ruled that his mental health would be jeopardised by trial and possible imprisonment in the US.
The UK court accepted that he was likely to be sent him to prison for longer if he were found guilty in the US, and that being separated from his family might make him a suicide risk.
But Love isn’t in the clear as a result of this judgement.
The UK judgement says:
The Crown Prosecution Service [CPS – the principal prosecution agency in England and Wales] must now bend its endeavours to his prosecution [in England], with the assistance to be expected from the authorities in the United States, recognising the gravity of the allegations in this case, and the harm done to the victims. […] If proven, these are serious offences indeed.
Love’s 2013 US indictment alleges, based on chat logs, that he said that he’d acquired “basically every piece of information you’d need to do full identity theft on any employee or contractor”, and that “you have no idea how much we can f**k with the US government if we wanted to,”…
…so Love may yet face a vigorous trial in the UK.
As the court found in today’s judgement, “the other side of the coin [to preventing extradition] is that prosecution in this country rather than impunity should then follow.”