A youthful prank or a dangerous act of terrorism? Lauri Love faces up to 99 years in a US prison for allegedly hacking into dozens of government websites
By Cara McGoogan, Monday 27 June 2016
In October 2013, Lauri Love had just got home from work and was having a cup of coffee when his mother called him downstairs: there was a UPS delivery for him at the door.
“How was she to know that it wasn’t a package, that it was a trick?” says Love, smiling wryly as he recalls that day.
When he reached the front door, the two men in UPS delivery uniforms grabbed him and said, “We’re from the National Crime Agency. We’re like the police.” They were swiftly joined by a dozen officers who raided the family house in Suffolk for computer equipment, seizing a total of 29 iPads, laptops and hard drives.
“They stormed through the door and started ransacking the place,” says Love, sipping coffee in the garden of an East London cafe, in a T shirt, jeans and cap.
“My father, who has chronic heart disease, broke down in tears and started having crushing chest pain. They wouldn’t let him leave the house or make phone calls.”
Love’s terrified parents - his father is a chaplain at a prison and was still wearing his collar - had no idea what their son was supposed to have done. After a five hour search of the house, the police took 28-year-old Lauri to the local police station, announcing that he was being investigated under the Computer Misuse Act.
Love, now 31, is accused of hacking into dozens of US government websites, including the Federal Reserve, Nasa and the US Army, stealing the personal details of hundreds of thousands of employees and defacing numerous websites. This week, a two day hearing will open at Westminster Magistrates Court where he faces extradition to the States. If the extradition goes ahead he faces criminal charges in three states and, if found guilty, could be sentenced to up to 99 years in prison and up to $9 million in fines.
The case has parallels with that of Gary McKinnon, whose decade-long battle against extradition to the US over hacking allegations ended in 2012 when Home Secretary Theresa May intervened due to McKinnon being a suicide risk. There wasn’t sufficient evidence to charge McKinnon in the UK, but he is still wanted by the US.
Like McKinnon, Love has Asperger’s syndrome, a history of mental health problems, and is at risk of taking his own life. But May is powerless to block this case, as the government handed all extradition powers to judges in 2013.
Given his history of problems - he has suffered from depression and anxiety throughout his life, being hospitalised on more than one occasion - Love and his family are desperately worried about the outcome of the hearing.
“For someone with my particular brain composition, my prospects of doing well in prison in the US are not good,” he says. He’s wearing tape around three of his fingers, which he knocks off as he talks with exaggerated, slightly shaking hand gestures. The tape is covering eczema that Love has started to scratch until it bleeds, because of his heightened anxiety.
“I can say quite unequivocally that I have no intention of being extradited to America.”
His father Alexander Love tells me later: “If there’s an ocean between us and him he will die, of that I have no doubt.”
The NCA didn’t charge Love when his home was raided that day in 2013. It was two years later, in July 2015 - when he and his parents were gearing up for a holiday to Finland to visit his sister and her young child - when the Metropolitan Police’s Extradition Unit returned to their home to arrest him on behalf of the US government.
The US alleges that in 2012 - a period when Love was at home recovering from severe depression - he was plotting dozens of attacks on US government servers over a year-long period. He is accused of being one of four hackers that orchestrated hacker collective Anonymous’ Operation Last Resort, a ‘hacktivism’ campaign protesting the government’s treatment of Aaron Swartz, a computer programmer and activist who committed suicide while facing up to 35 years in prison for charges under the notorious Computer Fraud and Abuse Act.
Love equates Swartz’s importance among hackers to Princess Diana’s: “Because of what she represented through her work, her death felt very personal for a lot of people,” he says. “I was completely distraught after Aaron died.”
The Anonymous campaign ran from October 2012 and involved sustained breaches of US government computers and resulted in the personal information of hundreds of thousands US government employees being stolen. After accessing the details of Department of Energy employees, Love allegedly wrote to other hackers, “YASSSS, I AM INVINCIBLE!!!”
The allegations aren’t as serious as they sound, says Tor Ekeland, Love’s American lawyer. “The information he allegedly copied was never distributed anywhere, it was more a youthful prank. And the security exploit they allegedly used had been publicly disclosed months before and used by tens of thousands of people.”
One attack turned the US Sentencing Commission’s website, which featured guidelines for internet-related crimes, into a version of the computer game asteroids. The site was offline for users for three weeks.
Love disputes the image the Department of Justice paints of him. “It has set this narrative that I’m some terrorist or some threat to the security of Western civilization. I’ve held some radical political positions, but not bringing down the US government, because all hell would break loose,” he says.
The Love family bought their first computer when Lauri was 10. Lauri loved playing games on it with his sister, who’s two years his junior, and his talent for computers soon became apparent. “We realised you could program some of the games so that you won when you should have lost,” he says.
Hacking has never landed Love in serious trouble before now, although when he was studying his for A-Levels he was banned from his computer science course for taking a joke too far and hacking into a school computer.
“He has an extraordinary mind,” says his father. “But he doesn’t see the consequences of things.”
His battle with depression, and Asperger’s syndrome - which wasn’t diagnosed until 2014, when he was 29 - has hampered his young adult life. One of his biggest achievements was completing his national service in Finland, where his mother is from, during which he worked in a lab studying neurodegenerative brain diseases. He was accepted to study computer science at the University of Nottingham and physics with computer science at the University of Glasgow, but twice had to drop out because of his depression.
In the second instance in 2011, he lived solitary and homeless for six months after the Occupy Glasgow movement collapsed before his parents took him back to their home. “We look after him now because it’s the only way he can function,” says Love’s father.
As this is an extradition hearing and not a criminal trial, Love has not responded to the allegations against him. “The US is not required to prove anything so the allegations themselves are irrelevant,” he says. “There’s no ability to question the sources, there’s no questioning the witnesses, this is not a trial.
“Once the extradition is dealt with then we can navigate some sort of justice.”
In the wake of major companies such as TalkTalk, Ashley Madison and LinkedIn being hacked, fighting cybercrime has become a priority for international law enforcement agencies. Love’s case is emblematic of the difficulty police face when prosecuting such crimes. In the first place, it can be hard to find the evidence needed for prosecuting sophisticated cyber-attackers who are adept at covering their digital tracks. But it is also unclear whose responsibility it is to investigate: law enforcement in the country where the crime is committed, or that where the victim is based.
Despite having Love’s computers for nearly two years, the NCA didn’t collect enough evidence to charge him. Meanwhile, the FBI and US Army Criminal Investigation Command compiled evidence, including chat logs, proxy servers, payment details and an IP address that led straight to Love’s parent’s home and the extradition request.
The US Army Investigation Command traced the attacks back to Love through an IP address in Romania that was allegedly paid for through a PayPal account linked to Love. The Command claims to have tracked Love down to his parent’s home address and verified his online pseudonyms through Twitter.
If Love was to face charges in the UK the maximum sentence would be far less severe than in the US, according to Ekeland, who describes the UK justice system as more civilised and humane. “They don’t generally destroy people’s lives, the US system just crushes people.” The longest sentence for a computer crime in the US is currently 20 years, whereas in the UK it is 2 years and 8 months.
For his part, Love is putting on a show of calm and positivity.
He has started a new degree in electrical engineering and is taking on work in cybercrime prevention - he was recently hired by a major high street bookmaker to hunt for vulnerabilities in its computer network and has just had a proposal for a game to teach children cybersecurity skills accepted by Prince Andrew.
“I’m going to be working for the Queen,” he jokes.
But beneath the brave face, he admits he’s frightened. “In the wee hours of the night, I do lie there worrying about my future, my family and my friends.”
In spite of it all, Love says that his ambition is to use his skills to help companies and governments fight cybercrime.
“I don’t see Washington or the Department of Justice as my enemies,” he says. “I hope that after the extradition is dealt with they don’t see me as a threat but as someone that can help achieve the ends that we do share - which is a secure world.”
Read more from the Telegraph's Technology desk
Find more features at Telegraph.co.uk/in-depth