Alleged hacker Lauri Love can be extradited to the US, court rules

Westminster Magistrates’ Court has ruled that alleged hacker, Lauri Love, can be extradited to the US, where he could face a 99-year prison sentence

An English judge has ruled that alleged computer hacker Lauri Love can be extradited to the US to stand trial.

District judge Nina Tempia delivered her judgement on 16 September 2016 at Westminster Magistrates’ Court, following a two-day hearing in June this year.

“Mr Love has not shown it will be either unjust or oppressive to extradite and there will be a real risk to Mr Love of being severely ill-treated,” the judge said in a written ruling.

The case will now be referred to the home secretary, the judge told a packed court, but Love has been given leave to appeal the decision.

“If you were here for justice, you missed it,” said 31-year-old Love, speaking after the hearing.

Love’s father, Alexander Love, a baptist minister, said: “I am ashamed of my country. That is all I can say.”

In a 32-page ruling, Tempia said that, although the evidence in Love’s case was digital, and could be made available to a UK court, the witnesses were in the US.

They include an anonymous informant working for the Federal Bureau of Investigation (FBI) who had access to a restricted online “chat room” used by Love and others from about 2012 to 2013, the judgement revealed.

“There are over 20 witnesses, all of whom are in the US. The digital evidence could be given in the UK, but the witnesses reside in the US, and as a matter of desirability and practicality it is easier for them to give evidence in the US,” she said.

The Courage Foundation, which is supporting Love in his legal battle, said his legal team would appeal the ruling.

US prosecutors charged the 31-year-old student with hacking into US government and private sector computer systems – offences that can attract a 99-year prison sentence.

Love was first arrested by agents of the National Crime Agency (NCA), the UK equivalent of the FBI, in October 2013, under the UK’s Computer Misuse Act.

He was arrested again, in June 2015, on behalf of the US prosecutors, who allege that Love worked with accomplices to hack into computer systems, including those of the Federal Reserve Bank, the US Department of Defense, Nasa and the Missile Defence Agency.

Strong parallels with Gary McKinnon case

The case is the first test of the ‘forum bar’ introduced by the then home secretary, Theresa May, to allow UK citizens to challenge US extradition requests, following hacker Gary McKinnon’s 10-year battle against extradition.

Love’s supporters say his case has strong parallels with McKinnon’s extradition case, which was eventually dropped following May’s intervention. Like McKinnon, Love has been diagnosed with Asperger syndrome, and also has a history of depression.

Lauri Love leaving Westminster Magistrates’ Court after the hearing

Speaking ahead of the verdict, Love’s US attorney, Tor Ekeland, told Computer Weekly that Love would face harsh treatment in the US.

“I think, along with almost everything in the US penal system, the mental healthcare is sub-standard at best,” he said. “It’s kind of atrocious to throw somebody who is suicidal into solitary confinement, but that’s what they do,” he said.

The US indictments claimed that Love was part of a sophisticated network of criminals involved in a protest by the hacktivist group Anonymous against the treatment of Aaron Swartz, code-named #Oplastresort.

In January 2013, 27-year-old Swartz, a computer activist and internet entrepreneur, took his own life in New York, rather than risk suffering within the American penal system.

US prosecutors have accused Love of uploading “shells” or “backdoors” into vulnerable servers and using them to gain administrator rights, which allowed the group to download “massive amounts” of sensitive information.

They alleged that Love used a variety of nicknames, including “nsh”, “route”, “peace”, “shift” and “Smedley Butler”, to discuss the attacks with accomplices on Internet Relay Chatrooms (IRCs).

First use of forum bar is disappointing

Sarah Harrison, director of the Courage Foundation, which runs Lauri Love’s defence fund and support campaign, said the ruling was disappointing, not just for Love and his family, but for everyone who was angry about the treatment of Gary McKinnon.

“Clear assurances were given that legal changes would prevent the McKinnon situation from happening again and, frankly, if the forum bar can’t help Lauri Love, it’s very difficult to understand how it could ever help anyone. This is not what the public was led to believe at the time, and it’s not something we should stand for,” she said.

Love has not been charged with any offences in the UK. He is pressing for the return of six computers that were seized by the NCA in 2013.

Ekeland said that there was no suggestion that Love accessed information for personal gain, or put people’s privacy at risk.

“It’s important to note that none of this information was top secret. I don’t really think any of it was that sensitive. It mainly, as far as I can tell from the indictments, consisted of names, phone numbers, email addresses and a couple of instances where there were credit card numbers which don’t appear ever to have been used anywhere,” he said.

At the extradition hearing in June this year, Peter Caldwell, representing the Crown Prosecution Service and, by extension, the US government, questioned whether Love had manipulated the opinion of medical experts who testified that he was unfit to stand trial in the US.

Fears for Love’s life

Love’s parents, Alexander and Sirkka-Liisa, who have both worked in the UK prison system, testified in support of their son, who they said would be at high risk of suicide if sent to the US.

His father told the court: “In the past 30 years of being a minister, having to take funerals of people who have committed suicide, [I have seen] the regrets that individuals have because they did not see it coming. In Lauri’s case, we do see it coming. That is the difficulty.”

Love is currently studying for a degree in engineering. He has also been working several days a week for My Hacker House, a cyber security organisation that liaises with law enforcers and business people.

Judge Tempia said she accepted that there was a substantial risk that Love would commit suicide if extradited, but was satisfied that there were safeguards in place in transit, and in the US prison system to prevent him taking his own life.

“I am also satisfied that Mr Love will receive dedicated mental and physical health care in the US,” she said.

Love gave interviews outside the court, including one in Finnish, after the judgement was delivered.

After he and his family had left, around 20 supporters returned with banners and a music system, and staged a demonstration on the crossing outside the court.

Police arrived after around 20 minutes and broke up the singing and dancing protesters to let traffic pass.

Read more on Network security strategy