A hacker's fight against extradition

The NCA didn’t charge Love when his home was raided that day in 2013. It was two years later, in July 2015 - when he and his parents were gearing up for a holiday to Finland to visit his sister and her young child - when the Metropolitan Police’s Extradition Unit returned to their home to arrest him on behalf of the US government.

The US alleges that in 2012 - a period when Love was at home recovering from severe depression - he was plotting dozens of attacks on US government servers over a year-long period. He is accused of being one of four hackers that orchestrated hacker collective Anonymous’ Operation Last Resort, a ‘hacktivism’ campaign protesting the government’s treatment of Aaron Swartz, a computer programmer and activist who committed suicide while facing up to 35 years in prison for charges under the notorious Computer Fraud and Abuse Act.

Love equates Swartz’s importance among hackers to Princess Diana’s: “Because of what she represented through her work, her death felt very personal for a lot of people,” he says. “I was completely distraught after Aaron died.”

The Anonymous campaign ran from October 2012 and involved sustained breaches of US government computers and resulted in the personal information of hundreds of thousands US government employees being stolen. After accessing the details of Department of Energy employees, Love allegedly wrote to other hackers, “YASSSS, I AM INVINCIBLE!!!”

The allegations aren’t as serious as they sound, says Tor Ekeland, Love’s American lawyer. “The information he allegedly copied was never distributed anywhere, it was more a youthful prank. And the security exploit they allegedly used had been publicly disclosed months before and used by tens of thousands of people.”

One attack turned the US Sentencing Commission’s website, which featured guidelines for internet-related crimes, into a version of the computer game asteroids. The site was offline for users for three weeks.

Love disputes the image the Department of Justice paints of him. “It has set this narrative that I’m some terrorist or some threat to the security of Western civilization. I’ve held some radical political positions, but not bringing down the US government, because all hell would break loose,” he says.

The Love family bought their first computer when Lauri was 10. Lauri loved playing games on it with his sister, who’s two years his junior, and his talent for computers soon became apparent. “We realised you could program some of the games so that you won when you should have lost,” he says.

Hacking has never landed Love in serious trouble before now, although when he was studying his for A-Levels he was banned from his computer science course for taking a joke too far and hacking into a school computer.

“He has an extraordinary mind,” says his father. “But he doesn’t see the consequences of things.”

His battle with depression, and Asperger’s syndrome - which wasn’t diagnosed until 2014, when he was 29 - has hampered his young adult life. One of his biggest achievements was completing his national service in Finland, where his mother is from, during which he worked in a lab studying neurodegenerative brain diseases. He was accepted to study computer science at the University of Nottingham and physics with computer science at the University of Glasgow, but twice had to drop out because of his depression.

In the second instance in 2011, he lived solitary and homeless for six months after the Occupy Glasgow movement collapsed before his parents took him back to their home. “We look after him now because it’s the only way he can function,” says Love’s father.

As this is an extradition hearing and not a criminal trial, Love has not responded to the allegations against him. “The US is not required to prove anything so the allegations themselves are irrelevant,” he says. “There’s no ability to question the sources, there’s no questioning the witnesses, this is not a trial.

“Once the extradition is dealt with then we can navigate some sort of justice.”

In the wake of major companies such as TalkTalk, Ashley Madison and LinkedIn being hacked, fighting cybercrime has become a priority for international law enforcement agencies. Love’s case is emblematic of the difficulty police face when prosecuting such crimes. In the first place, it can be hard to find the evidence needed for prosecuting sophisticated cyber-attackers who are adept at covering their digital tracks. But it is also unclear whose responsibility it is to investigate: law enforcement in the country where the crime is committed, or that where the victim is based.

Despite having Love’s computers for nearly two years, the NCA didn’t collect enough evidence to charge him. Meanwhile, the FBI and US Army Criminal Investigation Command compiled evidence, including chat logs, proxy servers, payment details and an IP address that led straight to Love’s parent’s home and the extradition request.

The US Army Investigation Command traced the attacks back to Love through an IP address in Romania that was allegedly paid for through a PayPal account linked to Love. The Command claims to have tracked Love down to his parent’s home address and verified his online pseudonyms through Twitter.

If Love was to face charges in the UK the maximum sentence would be far less severe than in the US, according to Ekeland, who describes the UK justice system as more civilised and humane. “They don’t generally destroy people’s lives, the US system just crushes people.” The longest sentence for a computer crime in the US is currently 20 years, whereas in the UK it is 2 years and 8 months.