Hacker Lauri Love Wins Extradition Appeal; Won't Be Shipped Off To The US

from the phew dept

We've been writing about the saga of Lauri Love for almost four years now. If you don't recall, he's the British student who was accused of hacking into various US government systems, and who has been fighting a battle against being extradited to the US for all these years. For those of you old timers, the situation was quite similar to the story of Gary McKinnon, another UK citizen accused of hacking into US government computers, and who fought extradition for years. In McKinnon's case, he lost his court appeals, but the extradition was eventually blocked by the UK's Home Secretary... Theresa May.

In the Lauri Love case, the situation went somewhat differently. A court said Love could be extradited and current Home Secretary Amber Rudd was happy to go along with it. But, somewhat surprisingly, an appeals court has overruled the lower court and said Love should not be extradited:

Lawyers for the 32-year-old, who lives in Suffolk, had argued that he should be tried for his alleged crimes in the UK and that he would be at risk of killing himself if sent to the US.

The court accepted both of the main arguments advanced by Love’s lawyers that there was no reason he could not be tried in England and that he might suffer serious damage to his health if he were extradited.

Love may now face a trial in the UK -- but that is considered a much better option than being shipped overseas. After the ruling, Love noted that this could impact future cases of individuals in similar circumstances, and the link above quotes some lawyers suggesting that it's going to be much more difficult for the US to extradite people for computer crimes going forward. Given the ridiculousness of the CFAA and the way that the US treats computer crimes, this is clearly a good thing.

Filed Under: cfaa, computer crimes, extradition, hacking, lauri love, uk, us

UK Court Says Lauri Love Can Be Extradited To Face Hacking Charges In The US

from the big-brothers-gotta-stick-together dept

Lauri Love, the British hacker the DOJ has been dying to get its hands on, has just been handed over to the US by his own government. The decision issued today [PDF] basically states that honoring extradition agreements is more important than any concerns issued about Love's health and well-being once handed over to US federal agents.

Mr Love’s Article 8 rights are clearly engaged. In balancing the factors for and against extradition I am satisfied that the very strong counter-balancing factors required to find extradition would be disproportionate are not found in this case. Mr Love faces extremely serious charges for offences of computer hacking over a period of one year from October 2012 to October 2013. I accept Mr Love suffers from both physical and mental health issues but I have found the medical facilities in the United States prison estate on arrival and during any sentence if he is convicted available to him, are such that I can be satisfied his needs will be comprehensively met by the US authorities.

I am satisfied Mr Love’s extradition would be compatible with his Convention rights and I send this case to the Secretary of State for her decision as to whether or not Mr Love should be extradited.

Once in the US, authorities have promised to address Love's mental and physical health concerns by placing him in "segregated housing" while determining if he's capable of being housed in the general population. As anyone who's followed prosecutions of whistleblowers and hackers knows, "segregated housing" is just a colorful term for "solitary confinement" -- not generally known to improve the mental well-being of people who've already expressed suicidal thoughts.

On top of a trip to solitary, Love will be facing charges from three jurisdictions related to the alleged hacking of multiple government/government contractor websites and databases.

Mr Love is accused in three indictments in three districts as follows:

(i) Southern District of New York – Mr Love faces two counts on Indictment, one of computer hacking (maximum sentence of 10 years imprisonment) and one of aggravated identity theft (maximum sentence of 2 years imprisonment to be imposed consecutively to the sentence for count 1).

(ii) The New Jersey request details two counts on one indictment. One count is conspiracy to access a computer without authorisation and obtain information from a department or agency of the United States (maximum sentence of 5 years imprisonment) and one of accessing a computer without authorisation and obtaining information from a department or agency of the United States (maximum sentence of 5 years imprisonment).

(iii) The Eastern District of Virginia request contains nine counts on an Indictment, count 1 – conspiracy to cause damage to a protected computer and to commit access device fraud (maximum sentence of 5 years imprisonment); counts 2 -7 – causing damage to a protected computer and aiding and abetting (maximum sentence of 5 years imprisonment); count 8 – access device fraud and aiding and abetting (maximum sentence of 10 years imprisonment) and count 9 – aggravated identity theft and aiding and abetting (maximum sentence of 2 years imprisonment).

There's little to be gained by adding up the maximum possible jail sentence facing Love. Rest assured, if convicted, it will likely be over a decade. Consolidation of the cases and charges is likely, but more than one of the charges carry possible 10-year sentences.

Meanwhile, back in the UK, Love has managed to escape being jailed for refusing to turn over passwords and encryption keys to law enforcement. UK investigators fought hard to force Love -- who they've never formally charged -- to crack open multiple seized devices for them. This attempt was shot down in May by a judge who viewed this as an end run around protections built into RIPA, the laws governing law enforcement's investigatory powers.

The final decision on Love's extradition is in the hands of Elizabeth Truss, the recently-appointed Secretary of State for Justice. Truss' previous government work doesn't really provide much guidance on which side she'll come down on this, but her voting record tends to indicate she's more sympathetic to national security/law enforcement interests than those of her constituents. Considering the UK and US have a very cozy surveillance relationship, it stands to reason Truss will likely decide to appease the DOJ, rather than overturn the court's decision.

Filed Under: cfaa, extradition, hacking, lauri love, uk, us

Judge Rejects Attempt To Force Lauri Love To Decrypt His Computers, Despite Never Charging Him With A Crime

from the finally,-a-good-ruling dept

Back in March, we wrote about the troubling situation in the UK, in which the UK's National Crime Agency (NCA) was trying to force hacker/activist Lauri Love to decrypt his computers, despite never actually charging him with a crime. Back in 2014, US authorities sought to extradite Love for supposedly hacking into government computers. As part of that process, the government took all of his electronics and demanded he turn over his encryption keys. He refused. Under the RIPA (Regulation of Investigatory Powers Act) law in the UK, prosecutors could then charge him for failing to disclose his passwords... but, importantly, they did not do so.

Last year, the NCA actually returned most of Love's stuff, but held onto six items: three computers, two hard drives and an SD card. Love sought to get them back, using a civil legal action against the NCA. The NCA then, somewhat ridiculously, sought to use that civil action to again force Love to decrypt the devices it held, in particular asking that he decrypt some TrueCrypt files on the SD card and hard drives. Thankfully, the court has flatly rejected the NCA's demand, noting that it appeared to be a clear attempt to do an endrun around RIPA, which has a variety of protections.

After reading the papers and hearing from the parties, I am not granting the application because in order to obtain the information sought the correct procedure to be used, as the NCA did 2 ½ years ago, is under section 49 RIPA, with the inherent HRA safeguards incorporated therein. Case management rules are necessary to fulfil their objectives which include the early identification of the real issues in the case and, as per the new CPR relating to applications under the PPA, the applicant to explain his interest in the property. The NCA submits this “lends some support to its submission that Mr Love should in this case be required to provide the encryption key or password as only thus will the court be able to adjudicate fairly upon the complete contents of the devices” (paragraph 3 of supplementary skeleton argument dated 5th April 2016). I am not persuaded by this argument. The case management powers of the court are not to be used to circumvent specific legislation that has been passed in order to deal with the disclosure sought.

The court does note that the issue is not completely closed. But it appears that while Love will not have to disclose his key, that may be used against him in trying to regain control over his stuff:

Finally, I would also add that this court has already directed Mr Love to give particulars of the contents of his files as part of the evidence as to ownership in a witness statement. The NCA accepts the case can be heard in July and they will invite the court to draw interferences

Still, on the whole, not forcing him to disclose under these conditions is nice to see.

Filed Under: decryption, encryption, forced decryption, lauri love, nca, ripa, uk

UK Law Enforcement Trying To Force Man They've Never Charged With A Crime To Decrypt His Computers

from the see-smoke,-presume-arson dept

British hacker Lauri Love stands accused of causing "millions of dollars" in damages to US government computers -- charges he's been facing for more than two years. These charges originate in the US, but it's the UK that's been trying to get Love to give up his encryption keys for the past couple of years.

Under RIPA (Regulation of Investigatory Powers Act of 2000), the UK government can charge Love with "failure to cooperate" by refusing to comply with the order to decrypt files. To date it has not done so, despite Love blowing off its demands since the middle of February 2014.

The only charges Love is facing have been levied by the US Department of Justice. He has fought extradition for the past couple of years and the UK government has yet to make any progress on that front. However, UK law enforcement has stepped up its efforts to force Love to turn over passwords and keys. J.M. Porup at Ars Technica has seen a copy of the request and has more details.

In the NCA's submission to the court, which Ars has seen a copy of, the government demanded that Love turn over the passwords and encryption keys to his confiscated devices. The devices in question include a Samsung laptop, a Fujitsu Siemens laptop, a Compaq computer tower, an SD card, and a Western Digital hard drive. The NCA in particular wants Love to decrypt TrueCrypt files on the SD card and external drive.

This seems like a very severe demand from the National Crime Authority, considering it still hasn't -- despite two years and two arrests -- seen fit to bring criminal charges against Love. This is also its second attempt -- one using a separate legal authority (not RIPA Section 49, as was used earlier) -- to compel Love to comply with its demands.

Meanwhile, Love is (logically) suing the UK government for the return of his devices.

Love's argument in his civil case is that if the police aren't going to charge him with a crime, they should return his property. "The problem is that the NCA are effectively arguing that any information that cannot be read and comprehended by the police has a presumption of guilt," Love told Ars in an e-mailed statement.

As Love points out, equating encryption with guilt has severe ramifications for anyone who uses it.

"This has clear and troubling implications for groups that handle sensitive communications or other data—journalists, advocates, activists and whistleblowers, and members of the legal profession.

"An executive body of the state is saying that any information to which they are not privy... cannot be owned and kept securely but instead confiscated and access denied," Love added. "This is a fundamental reversal of rights and the potential for abuse is alarming."

The NCA claims it wants Love to decrypt his devices so he can prove his ownership of any information or data found on them -- which allegedly includes pirated film and documents obtained (without permission) for US government websites. Love sees this as nothing more than the NCA trying to help out its American counterparts by using the UK's more permissive laws to obtain information about Love's hacking activities. And, it must be pointed out again -- the NCA wants to force the uncharged Love to crack open his devices so it can find something to charge him with.

Maybe there's something incriminating stored on Love's computers. Maybe not. But either way, UK law enforcement is working backwards from a presumption of guilt. And it's basing this all on things it can't see. This belief system is similar to that held by many law enforcement agencies, which have spent much of the last few months claiming an encrypted phone is a "guilty" phone in front of judges, Congress and to members of the media.

Filed Under: decrypt, doj, encryption, lauri love, nca, passcode, ripa, uk, us

British Hacker Faces Extradition To US, Not To Mention Five Years' Imprisonment In UK For Failing To Hand Over Encryption Keys

from the anything-else? dept

Techdirt followed the the saga of the hacker Gary McKinnon, whom the US authorities wished to extradite from the UK to face charges of causing damage to military computers, for some years before the UK Home Secretary blocked his extradition, and the case against him in the UK was dropped. That was a great result for McKinnon after a 10-year fight to avoid extradition, but it meant that the key issues that his situation raised were never addressed. Now a new case with many similarities to that of McKinnon's looks like it will revisit some of those legal questions -- and add some more of its own:

A British man has been charged in the US with hacking into thousands of computer systems, including those of the US army and Nasa, in an alleged attempt to steal confidential data.

Lauri Love, 28, is accused of causing millions of pounds of damage to the US government with a year-long hacking campaign waged from his home in Stradishall, a village in Suffolk.

But even before he can begin to fight that case, Love has an additional problem to deal with because of the following:

On February 7th the deadline for Lauri Love to turn his encryption keys over to the UK government expired.

As the post on FreeAnons explains:

The UK government are now free to charge Lauri for his lack of cooperation with their demand for his passwords, in accordance with section 49 of the controversial Regulation of Investigatory Powers Act 2000, but what is section 49 and why is it being levied against Lauri Love?

Section 49 essentially allows the UK government to compel, under threat of up to five years imprisonment (this doubles to ten years if national security is seen to be at stake), any citizen to disclose their personal encryption keys. The law allows for this legal compulsion on grounds ranging from "the interests of national security" to "the purpose of preventing or detecting crime" and "interests of the economic well-being of the United Kingdom".

Actually, RIPA's punishment for withholding keys seems to be up to two years' imprisonment in general, and up to five when the magic spell "national security" is invoked, but it's still a long time. And the crucial point is the following:

Lauri has been charged with no crime in Britain, yet their government is still invoking this law to attempt to force him to provide information that could incriminate him or damage his defense should he go to trial.

So Love faces two extremely serious problems: the threat of imprisonment from RIPA, and the threat of extradition to the US, with a long prison sentence there if he's found guilty. Here's what the US Department of Justice is accusing him of:

The indictment, which was released by the US department of justice on Monday, describes Love as a "sophisticated and prolific computer hacker who specialised in gaining access to the computer networks of large organisations, including government agencies, collecting confidential data including personally identifiable information from within the compromised networks, and exfiltrating the data out of the compromised networks".

"Gaining access", "collecting confidential data", "exfiltrating data out": isn't that precisely what the NSA and GCHQ have been doing around the world on a rather larger scale...?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: encryption, extradition, gary mckinnon, hacking, lauri love, uk