Lauri Love: the student accused of hacking the US

Love faces life sentence in jail

Three years later, Love, now 31 years old, faces extradition to the US and a possible 99-year prison sentence.

Indictments filed in New York, the Eastern District of Virginia and New Jersey accuse Love of breaking into computer systems belonging to US government agencies, including the FBI, the Federal Reserve Bank and the Missile Defense Agency.

The case is the first serious test of the “forum bar”, introduced by the then home secretary, Theresa May, to allow UK citizens to challenge US extradition requests, following hacker Gary McKinnon’s 10-year battle against extradition.

Update: 3pm UK, 16 September 2016: A judge ruled that Love can be extradited to the US to stand trial.

Love’s supporters argue that the electrical engineering student, who has a history of depression and has been diagnosed with Asperger syndrome, is at risk of suicide if the extradition goes ahead.

Love’s father told Westminster Magistrates’ Court in June 2016 that he was in no doubt his son would take his own life if he was sent to the US.

“In the past 30 years of being a minister, having to take funerals of people who have committed suicide, [I have seen] the regrets that individuals have are because they did not see it coming. In Lauri’s case, we do see it coming. That is the difficulty,” he says.

Different from the other kids

Although Love, who grew up in Trowbridge, Wiltshire, was not diagnosed with Asperger’s until 2014, he recalls having a feeling that he was different from other children from an early age.

“I remember in primary school walking around in blue funks back in the playground, almost like there was a distance between me and other people, feeling that nobody cared about me, that nobody understood or appreciated me, everybody else was happy and enjoying themselves,” he says.

He found solace in books – adventure stories from Enid Blyton, Lewis Carroll’s Alice in Wonderland, science fiction books from his dad’s bookshelf and a “cherished set” of Victorian children’s encyclopedias.        

Computers became another source of fascination.         

“One of the things that attracted me to computers is that they are consistent and make sense.  If it doesn’t do what you think it should do, you can eventually figure out why and it’s perfectly rational and reasonable,” he says.

Love would spend his evenings copying and sharing computer games for an early Atari computer with his younger sister during family holidays in Finland. By the time he was eight years old, he had learned how to rewrite the computer code.

He would spend hours writing games for an early handheld organiser; “a funky brick-like thing with a two-line LCD display”. In one game, that now seems prescient, the objective was to jump the border between Mexico and the US.

“There would be guards running from one line to the other and you had to dodge them – that was quite good fun,” says Love.

At primary school, Love was given one-on-one tuition because, he says, “there was nothing left to teach me on the curriculum”.

He learned about databases and how to write programs in Logo, a graphical language that allowed children to program turtles to move around a screen. 

Love enjoyed drawing geometric patterns and, for a youngster who found holding a pen awkward, Logo was an amazing tool.

“I realised I needed an hour or two to draw all these lines with a pen and ruler, but with this computer program I could write it to do it all for me, so it was quite liberating,” he says.

Mid-school crisis

When Love’s father was transferred to a different church in Lowestoft in the year 2000, Love experienced his first serious bout of depression – a pattern that started to repeat whenever there was a major change in his life.

The 15-year old disengaged from study and felt resentful towards his parents for moving. “That resulted in all my hair falling out because of the stress,” says Love, adding that he passed his exams more by luck than by study.

East Norfolk Sixth Form College gave Love the opportunity to focus on the subjects he enjoyed – maths, further maths, physics and computer science – and he had the opportunity to complete a practical qualification as a Cisco Certified Network Associate.

His social life took off as he discovered the fun of drinking with other students in the pub and playing pool.

Incompetence detected

It was Love’s skill at computers that brought him into conflict with the college’s head of computing.

Bored with the limitations of Microsoft Windows, one day Love decided to install Cygwin, a software tool that would allow him to write programs using the Unix operating system. When he came in the next day, Cygwin had disappeared.

“I had spent time downloading and building all these tools so I could do real computer science instead of the silly stuff they were trying to teach me. So I thought, ‘Well, I’ll just deal with this – next time somebody comes into my folder to delete my files that I’ve carefully amassed, they’ll have a little surprise’,” he says.

Love wrote a Java program that repeated the message, “Incompetence detected, please insert new administrator” if anyone tried to tamper with his files.

It may have been a harmless prank, but for the college’s head of computer studies, it seemed more like a denial of service attack.

“I was called into the office and kicked off the course,” says Love.

The college gave him an ultimatum – either attend every class until the end of the year, or be kicked out for good.  

“Neither of which seemed particularly enthralling. I made a third option, that I would drop out and come back the next year and start afresh,” he says.

Love took a job in a turkey factory, slicing meat as it came by on a conveyor belt. For the 16-year-old student, earning £250 for a week’s work – more than he knew how to spend –  was a formative experience. It helped him grow up, he says.

When he returned to college, Love applied himself with a new maturity and became a student governor and president of the students’ union.

Learning how to blow up tanks

Love had an understanding with his mother that he would complete his national service in Finland after his education. At the age of eight, the idea had seemed fun, but as the 20-year old made his way to Stansted Airport in July 2004, he began to have second thoughts.

“I got scared about it. I didn’t want to go. I was worried my Finnish wasn’t great because I hadn’t been there on holiday even for a few years. I didn’t like the idea particularly of shooting people with guns,” he says.

Love learned how to erect rickety iron-framed tents left over from the Second World War, how to dig up landmines on the Finnish-Russian border, and a variety of ways of blowing up tanks.

He found the experience depressing and he became increasingly anxious that he could no longer support a close friend in the UK who was struggling with anorexia and bulimia.

“I was very worried about her, and I didn’t feel that I could do what I thought was necessary to safeguard her health from Finland, so that started to weigh on me,” he says.

Three-and-a-half months into his six-month stint in the army, he returned to the UK.

Love, aged 21, enrolled in Nottingham University, to study computer science in 2005. But it was not a success. He suffered a bout of depression and glandular fever. He was unable to leave his room and “essentially became a hermit”, returning home after three months.

There he faced the stark choice of continuing his military service or facing two-and-a-half months in jail in Finland for being absent without leave. Instead, he found a third way – registering as a conscientious objector.

Lord of the fruit flies

The Finnish government allowed him to complete the rest of his service in a genetics laboratory. The job involved killing millions of “poor fruit flies” in the name of science.

“They had a good life. I made them food and they probably lived longer than they would in the wild because we were studying age-related diseases, so most of them lived to 100 days. And they had lots of sex. Then we’d knock them out with carbon dioxide, mash them up and look at their genes,” he says.

He got on well with his supervisor, a “lovely PhD student”, and when his voluntary term ended, the lab offered Love a paid job. He stayed for another six months before returning home to Scotland.

Love resumed his university career at Glasgow as a mature student in 2008, aged 27, reading physics and computer science. He took to “lecture hopping” to balance out his science-focused curriculum with arts courses.

“I used to go along to those when all the maths was getting a bit too much, and look at pretty pictures and pretty girls looking at pretty pictures, think about literature and go to the literature society and do poetry,” he says.

Love becomes interested in activism

It was at Glasgow that Love first developed his interest in activism. In his first year, he went on an anti-fascist march, and in 2011, Love found himself deeply involved in the student occupation of Glasgow University’s Heatherington Research Club.

The occupation, which lasted for seven months and led to what many thought was a heavy-handed police raid, was one of the longest-running student demonstrations of that period, attracting widespread media attention.

“Maybe because of the Asperger’s, I tend to dive into things fully and it was fantastic. It was like, here’s a free space and anyone can come along and do a talk or put on a film and we’ll cook food for free from donations, we’ll recover waste food and offer tea and coffee,” he says.

For Love, the protest made complete sense. He felt a sense of injustice that the university had closed a unique social club for post-graduates and lecturers, and that people were losing their jobs because of university cutbacks.

Later, Love became heavily involved in the Occupy Glasgow movement, taking up residence in a tent in the centre of Glasgow.

“It seemed important to get involved. I thought I could bring the experience from occupying at the university to make Occupy Glasgow more effective and successful,” he says.

He talks of the injustice of families being forced out of their homes in preparation for the 2014 Commonwealth Games in the city, Glasgow City Council’s closure of a day centre for people with learning difficulties to make way for a car park, and other injustices.

The protest ended badly for Love, who fell into another serious depression and had to be rescued by his parents.

“My mum and dad extracted me and took me home. I’ve not been back to Glasgow since. I can’t now, because I’m not allowed to leave the country, and the country – in legal terms – is England and Wales,” he says.

The online activist

Still depressed, and effectively stuck at home at his parents’ house in rural Suffolk, Love turned to the internet to continue his political activism.

“Through a computer you can raise awareness, promote causes and help with educational missions and, sometimes, people engage in electronic civil disobedience,” he says.

It was around this time that hacktivist groups such as Anonymous began making waves. The group sprang from a discussion and image posting group called 4Chan. It started off with pranks on the internet but soon found itself fighting battles against the Church of Scientology, and other more political targets.

Love took a keen interest in the activities of Chelsea Manning and Edward Snowden, but it was the tragic death of Aaron Swartz that had a profound affect on him.

Swartz, a brilliant computer specialist, helped design part of the internet when he was 14, developed RSS newsfeeds and was a creative force behind the social news site Reddit.

He was arrested in January 2011 after using a computer at the Massachusetts Institute of Technology (MIT) to automatically download academic journals from the JSTOR digital library. Supporters protested that the act was harmless, and JSTOR and MIT decided not to prosecute.

Nevertheless, Swartz was indicted with 11 counts under the Computer Fraud and Abuse Act (CFFA), and two counts of wire fraud, with a maximum penalty of 35 years in prison and $1m in fines. The stress led Swartz to take his life in January 2013.

“His death was totemic; it was symbolic. It was the death of the dream of an idealistic, optimistic internet that could be free and open. It was perceived by people as a personal attack on all of the things that they stood for,” says Love.

Barrett Brown raided

A few months before his arrest, Love found himself online, watching a live feed of the FBI raiding the home of journalist, activist and one-time member of the political hacking group Anonymous, Barrett Brown.

The young writer had been something of an irritant to the US establishment, initially through his involvement with Anonymous, and later as founder of Project PM, a crowd-funded organisation dedicated to investigating abuses by companies specialising in surveillance, often under contracts with the US government.

“I was on webcam at the time. There was the FBI and guns and ‘drop to the floor’ and a lot of shouting and manhandling. Compared with that, [my arrest] was a very civilised affair in the UK,” says Love.

Nine months later, in December 2012, the FBI charged Brown with multiple counts of identity theft and credit card fraud, essentially on the basis that he had copied a link to hacked client and credit card details from the security company Stratfor, from one internet chat site to another.

Brown was later sentenced to 63 months in jail and fines of $890,000, in what his supporters argue was clearly a politically motivated case.

Love interviewed by the NCA

When Love was arrested in October 2013, the experience was traumatic, but at least there were no guns.

The next day, Steve Brown, an officer and operations manager with the National Crime Agency (NCA), interviewed Love under caution at the Norfolk and Suffolk joint custody centre in Bury St Edmunds.

Brown quizzed Love about a series of alleged hacks on computer networks in the US and Love declined to answer, on legal advice.

“I could tell that they had been given a list of questions by the FBI or the Department of Justice,” says Love.

“There were maybe eight questions and they repeated them for all 12 networks. It was a pantomime because they knew I wasn’t going to answer the questions.” 

The NCA released Love on bail without pressing any charges. Love’s parents agreed to pay bail fees, which they raised by selling their camper van.

“They asked for my passport, so my mum had to bring my passport in, which doesn’t normally happen when you’re arrested, especially when you’re not charged with any crime,” says Love.

At one point, the NCA attempted to impose a ban on Love accessing the internet as part of the bail conditions, until the custody sergeant intervened.

“Well, you’re not charging him with any crimes. I’ve looked at his record, he hasn’t committed any crimes in the past – certainly not computer crimes. You can’t restrict someone’s liberty to that extent unless you’ve got a valid reason for it,” Love recalls him saying.

Later, Love’s lawyer confirmed he could use the internet, providing he did not use anonymous internet services such as The Onion Router (TOR) or virtual private network (VPN) services.

Charged in the US

Love was arrested again on 15 July 2015, this time by the Metropolitan Police extradition unit, before being released on bail after a short hearing at Westminster Magistrates’ Court.

He learned that he had been charged with hacking offences in the US from a BBC Radio 4 news bulletin.

“I hadn’t been charged by the UK police. I thought the BBC had screwed up and I was ready to call them to say, ‘I don’t remember being charged, where did you get that information from?’,” he says.

US prosecutors had filed indictments claiming that Love was part of a sophisticated network of criminals involved in a protest by the hacktivist group Anonymous against the treatment of Aaron Swartz, code-named #Oplastresort.

Charges filed in three US states claimed that Love worked with accomplices to infiltrate a wide range of US government computers and steal personal information and credit card details of government employees.

The group was accused of exploiting a known vulnerability in Adobe’s Cold Fusion software to break into US government servers between 2012 and 2013.

The indictments accuse Love of uploading “shells” or “backdoors” into vulnerable servers and using them to gain administrator rights, which allowed the group to download “massive amounts” of sensitive information.

The allegations rely heavily on records of discussions between the alleged hackers in internet relay chat (IRC) rooms. US prosecutors said Love used a variety of nicknames, including “nsh”, “route”, “peace”, “shift” and “Smedley Butler”, to discuss the attacks with accomplices.

On one occasion, Love is alleged to have written: “You have no idea how much we can f*ck with the US government if we want to … this stuff is really sensitive, it’s basically every piece of information you need to do full identity theft on any employee or contractor.”

US refuses to take Love’s phone calls

The lack of any human involvement in the extradition process bothered Love deeply. He wanted to talk to someone about the charges levelled against him in the US.

Ever resourceful, Love found the phone number of one of his US prosecutors and decided to call him.

Love told the prosecutor: “You keep publishing these indictments against me. I’d rather that you didn’t, because there’s an ongoing investigation in the UK and we have our own court system.

“You writing, effectively, fan fiction about me isn’t going to help me get a job, and it’s distressing to have factually incorrect assertions made about me that I’m not able to contest.”

Love also wanted to know whether the US would temporarily suspend the extradition request to allow him to attend the Chaos Communications Camp in Berlin, one of Europe’s largest gatherings of hackers and computer experts.

“I won’t disappear anywhere,”  Love told him. “It’s just kind of ruined my summer plans, and it’s not going to benefit anyone.” 

The prosecutor sounded genuinely panicked, says Love, telling Love repeatedly: “I can’t talk to you unless there’s an attorney present.”

“I felt genuinely sorry for him and I haven’t pestered them since,” says Love.

Love finds calling as security consultant

Love, as far as he can, is trying to lead a normal life. He has completed the first year of his electrical engineering degree at the University of Suffolk and is helping to teach younger students.

He comes across as highly articulate and gifted, although he says he has “obsessional tendencies”.

One obsession is his battery-operated amplifier and DJ equipment, which he takes with him everywhere, pushing it around on a porter’s trolley. He had to transfer the equipment to a pushchair to get it through court security during his extradition hearings.

He is putting his computer skills to good use at an organisation called Hacker House, which brings former hackers and activists together to work with law enforcement and businesses to improve computer security.

Security research is perfect for people who have Asperger’s, says Love.

“It is just being a scientist boiled down to its pure essence, in that there is a hypothesis, there is a system that acts deterministically, you can run experiments and, if you pick the right experiment, you can prove a theorem,” he says.

He applied for summer school at GCHQ for computer students, and – remarkably – was invited to an interview.

Love says: “I had a chat with them and they liked the way I thought. I said, ‘You know, I do have a few qualms about what you guys do, but if all of the people with qualms don’t go along and get involved, I imagine things will get worse.’

“I didn’t get the place, and I don’t know if it’s because they eventually searched my name and decided, ‘That’s a hot potato we don’t want to touch’. Or maybe I didn’t pass muster.”

Love uses origami as a way of dealing with stress. As he sat listening to witnesses during court hearings, Love would construct elaborate paper models of complex geometric shapes, and life-like red roses (see image at top of page) which he handed out to a few of his supporters.

“I have a preternatural capacity to assimilate large amounts of information and systematise information from a variety of sources. I don’t get on with arbitrariness or authority that does not stand on its own rational values,” he says.

Love is guardedly optimistic that he will ultimately be allowed to stand trial in the UK and that he will be able to continue to make a positive contribution to society.

“At the moment I work in information security, I help make the internet more secure. I fix things, and some of the things I fix are US government information systems. I could continue to do that if I’m a free person,” he says.

“Or I could languish in a cell, not get the treatment and provisions I need for my mental health, potentially die tragically, or at the very best emerge from it several decades later, broken and so far behind the technological curve that I can no longer contribute to society at all.” 

US is playing politics over Lauri Love extradition, claims US attorney

Tor Ekeland, Love’s US attorney, believes that the US charges filed against his client, like those against Aaron Swartz and Barrett Brown, are politically motivated.

Based in New York City, he is one of the leading experts in the US Computer Fraud and Abuse Act and has represented hackers, activists and journalists who have battled with law enforcement.

They include Matthew Keys, a journalist who was sentenced to two years in prison for providing a member of Anonymous with credentials to the Los Angeles Times website.

The case was widely seen as an example of prosecutorial over-reach for an attack that caused little real damage – the temporary alteration of a headline on one LA Times story – and was quickly rectified.

Ekeland’s first case was defending hacker Andrew Auernheimer, known as “weev”, who was prosecuted after discovering the US phone company AT&T had left the email addresses of more than 100,000 iPad owners publicly available. 

Ekeland believes that the US’s desire to extradite Love, and its harsh treatment of hackers generally, is rooted in what he calls a “pathological” obsession by the US to control information.

“That’s why you have these intense and severe hacker prosecutions with penalties far greater than you see anywhere else in the world,” he says.

The fact that the FBI once admitted to Ekeland that agents were reading his legally privileged communications with his clients is, perhaps, just one indication of that.

Love and his co-conspirators are accused of using a security vulnerability that had been well known in security circles for at least six months.

One researcher even published a list of all government departments that had the vulnerability in their computer systems, and it received views from more than 29,000 people, says Ekeland. That is just embarrassing for the US, he says.

“The government should have fixed their systems before any of this happened. If all these people knew about this, how does [the US government] know that they weren’t hacked multiple times by state actors such as China, Russia and eastern European criminal gangs?”

Ekeland has yet to see any evidence from US prosecutors, but he claims the allegations in the indictments, largely based on records of IRC chatrooms, are “hearsay”.

“It’s easy to pull a comment out of context, stick it in the indictment and make it look like some sort of nefarious, evil thing is going on, even though someone is bragging about something they’re never going to do,” he says.

There is no suggestion that any of the information in Love’s case was used fraudulently or for personal gain, says Ekeland. “There is not an allegation that a penny in fraudulent credit card charges happened,” he says.

Ekeland says the figures in the indictments showing the costs for government departments to repair their IT systems are “super inflated”.

“It’s the kind of hyperbolic loss number I see all the time, [mostly] as an activity to save face,” he adds.

The horrors of the US prison system

With indictments filed against him in three jurisdictions, Love would appear in three major court battles and spend years in prison before his case is finally decided.

US prisons are notorious for their harsh treatment of computer hackers, says Ekeland.

“I’ve had a lot of hacker clients be thrown into solitary confinement. With one client, because he was suicidal, they stripped him naked, threw him in a jail cell and then kept him up all night. They wouldn’t let him sleep, they wouldn’t let him do anything,” he says.

Love could be tried in the UK

Love now finds himself in the invidious position of trying to persuade the NCA to prosecute him in the UK.

There are at least 12 cases where British hackers have been successfully tried in the UK after breaking into US computer systems.

They include members of the notorious LulzSec hacking group, Topiary and Mustafa Al-Bassam, who were treated more humanely than hackers prosecuted in the US.

They received proportionate sentences and are now making a productive contribution to society, says Ekeland.

“The last time I was in London, I was having a beer in the pub with those guys. One of them is finishing his computer PhD and the other one is spending time rock climbing and being a productive member of society,” he says.

“If they’d been prosecuted in the US, they’d be in jail and their lives would have been destroyed. There’s no comparison.”