Appeals court rules Lauri Love will not be extradited over US hacking charges

Setting a legal precedent

Love appeared dressed in a dark suit and white shirt, and flanked by his parents and girlfriend, at the high court in the Strand.

The verdict was greeted by a cheer from 50 people in the public gallery, who had turned up to support Love at the hearing this morning.

Speaking after the decision, Love thanked his supporters, including MP Barry Sheerman, for their compassion and understanding.

Niels Ladefoged

“As a society we are having now a conversation about how different kinds of mental make-up can be accommodated. There’s many ways of being a human,” he said.

Love said he hoped the case would set a legal precedent that would stop someone less fortunate facing a similar experience.

“There is an expectation that the CPS will review the case... this is what we are fighting for. It is not pleasant to be prosecuted,” he said. “The max imprisonment here would be 18 months at the very worst. Compared with the US, it can be quite humane and proportionate.

“I’m greatly relieved that I no longer have to be locked up in a country where I have never been, and I am also hopeful that it will set a precedent.

“It’s really nice for my family to be able to breath a bit more easily.”

Law firm Kaim Todner, which is representing Love, said the case was a landmark judgement and was the first time the forum bar had been successfully argued in court.

“What is particularly important about this is that the British justice system has taken the stand that we should deal with the matter ourselves rather than accept the US government’s demands,” said a spokesman for the law firm.

“It has also been recognised that mental health provisions in US prisons are not adequate to satisify [the court] that Lauri would not have come to serious harm if he were extradited,” he said.

MPs support trial in UK

Love’s case had won political support from MPs across all political parties. More than 100 UK Members of Parliament signed a letter to Barack Obama as US president in October 2016, urging him to drop an extradition request against Love.

And in November 2017, more than 70 MPs wrote to prime minister Theresa May and the attorney general Jeremy Wright, questioning why the 32-year-old engineering student could not be tried in the UK courts.

Speaking after the verdict, Barry Sherman MP, who helped to co-ordinate the campaign said: “I do not often cry in Parliament. The stress on this family has been incredible. They’ve stood up to it. It’s been such an emotional rollercoaster and now that cloud has gone.

“You’ve been inspirational, this will stand as an exemplar that if you stand up for what you believe in, you will win,” he told Love. 
 
The appeals court victory follows a decision by judge Nina Tempia, at Westminster Magistrates’ Court in 2016, that Love’s extradition could go ahead – a decision later endorsed by the home secretary, Amber Rudd.

Extradition ‘unjust and oppressive’

The court of appeal agreed with Love’s legal team that extraditing Love to the US would be “unjust and oppressive”.

Edward Fitzgerald QC and Ben Cooper, who previously represented Gary McKinnon, told the court of appeal that judge Tempia had failed to give adequate weight to Love’s medical conditions deteriorating in the US prison system and the likelihood that he would commit suicide if his extradition went ahead.

Lawyers have described conditions in the US Federal Prisons, particularly at the Metropolitan Correction Centre (MCC) in Manhattan, and Metropolitan Detention Centre (MDC) in Brooklyn, New York – where Love would be likely to be detained – as “medieval”, with only one psychiatrist available for nearly 2,500 inmates.

Normal practice to prosecute US hacking cases in UK

Former director of public prosecutions Ken Macdonald supported Love, arguing in a witness statement that it had been normal practice to prosecute in the UK hackers accused of attacking overseas computer systems, with the notable exception of Gary McKinnon, whose extradition was halted by Theresa May. 

At least 13 people accused of hacking US computer systems have been tried in the UK. The UK has prosecuted at least 13 computer hackers who have been accused of illegally accessing US computer systems.

They include members of the notorious LulzSec hacking group, Topiary and Mustafa Al-Bassam, who were treated more humanely than hackers prosecuted in the US, who often receive draconian prison sentences under the US Computer Fraud and Abuse Act.

The appeal judges agreed that the district court had not properly considered evidence from Michael Kopelman, a forensic psychiatrist at King’s College London, that Love’s mental state would deteriorate significantly if he were placed on suicide watch in the US, compromising his ability to make rational decisions.

Kopelman said in a report: “In the light of Mr Love’s current mental state, I continue to believe there is a very high risk that Mr Love would not be fit to stand trial in the United States of America.” That fact alone warrants refusal of extradition under the Forum Bar.

Prosecution claimed US would be able to care for Love

Peter Caldwell, representing the Crown Prosecution Service and the US government, had argued that Love would get a fair trial in the US and that US prisons had systems in place to protect vulnerable defendants and meet their medical needs. 

High-profile detainees were watched 24 hours a day, and the US would put Love immediately on suicide watch because of his history while US marshals would manage his delivery to prison, he argued in court.

Caldwell told the court it could take years, rather than months, before Love could be tried in the UK, as police would have to rely on evidence provided by the US authorities across several states.

Love is using his skills to help businesses

Love lives with his parents – Alexander, a Baptist minister and chaplain at nearby Highpoint prison, and Sirkka-Liisa, a teacher – in Stradishall, Suffolk.

Since his arrest, Love has attempted to put his computer skills to good use, initially through an organisation called Hacker House, which brings former hackers and activists together to work with law enforcement and businesses to improve computer security.

When the WannaCry ransomware virus was released last year, Love set up an IRC research group, which attracted more than 250 security researchers, to assess the risks, and to encourage organisations to patch their computer systems before the malware was inevitably exploited.

More recently, he warned US telecoms company AT&T that it had left its computer systems vulnerable to hacking. “I just sent an email to the guy who’s job it was to get it fixed, and he said, ‘So you want any AT&T swag?’ and I said, ‘No, I am good’,” said Love, in a talk at the Byline Festival last year.

Love said he hoped to continue in his computer security work. “Security is such a large and growing problem and growing at such an exponential rate ... I imagine I will be called upon to do internet security ... and the outcome I shall not be blacklisted. There has been a large toll and large ordeal.”

Sherman said: “Lauri shows such talent. If we do not use it from people on the autism spectrum, we are wasting it.”

Love said the case, which had taken up four years of his life, had caused him difficulties with his work. 

Love faced charges in three US states

Love had faced potential trials in three US states, after indictments were filed in the Southern District of New York, New Jersey and the Eastern District of Virginia.

He is accused of downloading confidential information belonging to individuals, including credit card details, from US government computers and private companies, causing millions of dollars’ worth of damage, between October 2012 and October 2013. There is no suggestion he profited from the information or made it public.

According to the US indictments, Love gained unauthorised access to computers by exploiting vulnerabilities in Adobe ColdFusion and by using SQL injection attacks.

Once inside, working with fellow hackers, he is alleged to have placed “shells” in the networks to steal confidential data, including telephone numbers, social security numbers, credit card and salary details of employees.

The allegations rely heavily on records of discussions between the alleged hackers in internet relay chat (IRC) rooms. US prosecutors said Love used a variety of nicknames, including “nsh”, “route”, “peace”, “shift” and “Smedley Butler”, to discuss the attacks with accomplices.

On one occasion, Love is alleged to have written: “You have no idea how much we can f*ck with the US government if we want to … this stuff is really sensitive, it’s basically every piece of information you need to do full identity theft on any employee or contractor.”

Lauri Love’s family grateful

“This is a victory for justice and for my son,” said Love’s father after the verdict. “I want to keep him here so I can keep an eye on him.

“The other person who should be happy is the prime minister, because she’s got the forum bar to work. At the core of our country is justice. I want to thank the lord chief justice, who has exercised wisdom and compassion,” he added.

Naomi Colvin, case director at Courage, which is backing Love’s legal case, said the ruling was a victory for free expression that would draw attention to the draconian way the US treats hackers and activists.

“This is the result Lauri and his family have spent four years waiting for. This ruling is a massive victory for free expression online, for the fair treatment of neurodiverse people and for those of us who have drawn attention to the dire treatment of hackers and information activists in the US,” she said.

Niels Ladefoged

“Lauri was only ever in this position because he had been marked out for unfair, discriminatory and vindictive treatment. With any luck, today’s ruling will mean that prosecuting authorities finally start respecting the clear will of the British public: we do not extradite our geeks to face medieval punishment in the US.”

Emma Norton, head of legal casework for Liberty, which intervened in the case, said Love should have been prosecuted in the UK from the beginning.

“Where unlawful activity is alleged to have taken place in the UK, those suspected should be tried in the UK – not packed off to foreign courts and unfamiliar legal systems. This is especially important in cases of vulnerable people like Lauri Love,” she said.

“It’s shameful that Lauri and his family have been put through this terrible ordeal.”

Jake Davis, a former member of the LulzSec hacking group, where he was known as Topiary, said: “It is really genuinely heartening to know that the arguments have been dismissed and the mental health issues of those on the autistic spectrum are being taken seriously.”

Mustafa al-Bassam, a former hacker, now a security specialist, said: “There was a pretty good chance of winning. This is what the forum bar was supposed to do. I think it was a David versus Goliath [case]. It is good because it shows that Britain has sovereignty [in these issues].

Reporting team: Bill Goodwin, Julia Gregory, Niels Ladefoged