
Alleged hacker Lauri Love to be extradited to US - dharma1
http://www.bbc.co.uk/news/uk-england-suffolk-37385201
======
zelon88
What's scary to me is that the crime doesn't fit the punishment. We're going
to take a genius away from civilization where he could use his potential in
constructive ways, and lock him up for something that, realistically, isn't as
bad as when bankers launder many millions of dollars, or when identity thieves
steal. So we will probably give this guy a life sentence for being smarter
than 90% of the American workforce and almost uncovering secrets that
shouldn't be being kept anyway. Why can't we throw the book at corrupt
politicians and businessmen this hard?

~~~
tptacek
He's a genius? I thought the US was embarrassed by how dumb the
vulnerabilities he exploited were. Which is it?

~~~
s_q_b
Well, in fairness he is somewhat smart. Most people don't successfully hack
the FBI and the Federal Reserve.

------
spdustin
It's stories like this that make me, as the parent of a high-functioning child
with autism spectrum disorder, scared shitless. My son, as he gets older,
shows over and over again that he has an amazing aptitude for pretty much
anything he decides to learn.

He's not even a teenager, and can:

* Play the trombone better than peers two years older than he is, all because he inherited a trombone from his late grandfather, and wanted to honor his memory

* Compose music in GarageBand on his iPhone or Mac, and arrange covers of songs from memory, as well as play them on the trombone or piano/keyboard

* Write properly-formatted screenplays, direct and produce (with iMovie) and create VFX (with Apple Motion) for his own creations

* Write automation scripts for various Mac tasks with JavaScript

He has an amazing ability to understand advanced math and science concepts,
and recently started positing theories about dark matter (!) during our
nightly reading and chatting time. And he's proven that he'll effectively
learn (and put into practice) anything he wants to, given the resources to do
so. He's expressed more and more interest in computer programming, and I've
indulged that interest by teaching him JavaScript (his first request) and now
Swift.

And one day, he's going to frighten someone with his skills, and he won't
understand why; for all his genius and talent, he's still on the autism
spectrum, and one common disadvantage for those on the spectrum is an
inability to put themselves in someone else's shoes. He cannot understand why
others don't think exactly the way he does, or understand the intentions
behind his actions. It is completely alien to him that subterfuge is employed
by others, that words and deeds should be taken by anything but their literal
or face value. He can't begin to comprehend why his stated intentions behind
his words or deeds would not be completely and unconditionally believed by
everyone else. It simply does not compute.

He gets services in school to help with his pragmatic communication, and I do
everything I can to guide him as well. Once he's out of school, I can only
hope we've made enough of a difference for him to live productively and
happily in a world that vilifies people with above-average intelligence but
below-average pragmatic or social communication skills.

~~~
balabaster
Would there be an opportunity to take advantage of his ability to learn
anything he puts his mind to in the sense of understanding everyone else's
motivations for why they do and say what they do some kind of fascinating
project - treat it like a game. Perhaps spinning social function around like
this will help him to grasp that empathy and understanding of others
motivations(?)

I ask this rather than put it out there as a solution mostly because my only
understanding of autistics that have come and gone in my life have all had
this thread of bottomless abilities to absorb information on topics that
fascinate them as well as loving things they can game. Would turning
understanding emotions into a game assist his learning here?

~~~
throwanem
> understanding everyone else's motivations for why they do and say what they
> do some kind of fascinating project - treat it like a game

Worked for me, although 'game' is perhaps unduly reductive; for me, it's more
in the sense that this is how I can best make myself worthwhile. I don't claim
to be on the spectrum, though, so I'm not sure how much 'worked for me' is
worth.

------
k-mcgrady
Seems like his mental conditions (psychosis, Asperger syndrome and depression
according a psychologist who testified on his behalf) should have been enough
to have the request denied.

Edit: Apparently he's facing 99 years for the charges (yes I know he might get
much less). I wonder if he can appeal to the European Court of Human Rights. I
know in the past they've said whole-life sentences are ok but I can't see how
such a sentence wouldn't be considered inhumane for computer hacking.

~~~
tptacek
No. He _will_ get "much less". If he's given a custodial sentence at all (he
could plausibly be given probation, given his cognitive issues and the fact
that his crime was non-remunerative), it'll almost certainly be low single-
digits.

These "99 year" sentences are conjured by taking every charged count of an
offense, assuming the maximum possible sentence for that class of offense, and
then adding all the charges together.

But that's not how federal sentencing works. Like: at all. What happens in
reality is that "like" charges group, and you're sentenced only according to
the most severe count in the group of charges.

The federal sentencing guidelines are freely available. You can read through
them to get a ballpark of where this case will land. There's a reason most
convicted hackers who aren't running giant credit card rings spend single
digit years in prison: the sentencing guidelines won't allow for a different
sentence.

~~~
celticninja
Single digits is still excessive, we are talking 5 or 6 years in jail for
crimes which were void of any financial gain. I'm thinking g of weev and
swartz who are both dealt with in the article.

[https://www.eff.org/deeplinks/2013/03/41-months-weev-
underst...](https://www.eff.org/deeplinks/2013/03/41-months-weev-
understanding-how-sentencing-guidelines-work-cfaa-cases-0)

~~~
tptacek
I agree†. Sentences in general are too long. I don't think there's a
corrective goal that a 5 year sentence for a non-financial computer crime that
isn't served just as well in 1.

† _With the nit that I don 't believe a 5 year sentence would be in the cards
for this particular offender._

~~~
celticninja
I'm not so certain, his targets meet the "official victim" requirement, they
will be free to choose the loss value which is unlikely to be Conservative,
means of identification is likely met as it is a simple as accessing email
addresses and even though they attacks have been called simplistic and the
weaknesses well known they will claim that sophisticated means were used by
virtue of a computer being involved. This on the face of it seems worse than
weev as there were multiple targets involved.

~~~
tptacek
He's not the first person to get caught hacking the USG, and thus far insane
sentences haven't been a consequence of that sort of thing. We'll see, I
guess.

------
kalsk
Is Asperger's _really_ a valid excuse for this sort of thing? People on the
autism spectrum aren't incapable of understanding that actions can lead to
consequences and that some things are wrong. Otherwise there would be an
epidemic of autistic bank-robbers and murderers.

I will agree that it is bullshit thaw you can get extradited to a country
you've never even been to and tried under their laws for committing a cyber-
crime, though. He should remain in Britain for that reason alone. It's also
pretty disgusting how if he had committed the exact same crime under the
employment of the government they wouldn't have even filed charges.

------
dharma1
It looks like BBC has updated the title to say he is being extradited. Why did
the UK not veto this, as we did with Gary McKinnon?

~~~
hood_syntax
Possibly because of Brexit, the UK wants to keep its ties with the US as
strong as possible by bowing to demands like this

~~~
mindslight
This situation shows why, unfortunately, movements like Brexit are inherently
legless. Here we have a case of a British citizen breaking a British law on
British soil, yet being abducted by a foreign justice system under treaties
that have destroyed national sovereignty. Yet because the UK is currently
pushing back against one such agglomeration of power, it will actually
supplicate harder to a different power rather than simply acting as its own
country!

(And I say this as a USian who is actually concerned with the disastrous
effects that exercising world jurisdiction is having on _our own_ society. Why
bother spending the effort to secure computers when you can just assuredly
throw the witches into cages for decades?)

~~~
foldr
US citizens get extradited to Britain too. It works both ways.

In this instance we have someone who's pretty clearly committed a serious
crime (stealing credit card info, for example), being extradited to the
country which has jurisdiction with respect to the offense committed. It's a
completely normal and proper instance of extradition. I'm surprised to see
people here falling for the guy's rather overwrought sob story.

~~~
mindslight
It's only "normal and proper" if one believes such treaties are reasonable.
Clearly I do not, and just insisting it is does not form an argument.

I reject the idea that merely communicating with some place creates a legal
nexus giving that place jurisdiction over you - it contradicts the general
concept of freedom of speech. By such reasoning, holocaust denial is
effectively criminalized in the US because such speech will reach Germany and
possibly change people's minds there.

~~~
foldr
Lauri Love wasn't merely communicating, he was hacking into US government
computer systems and stealing credit card info.

If you are just opposed to all instances of extraposition, then ok, but that
has nothing to do with this specific case.

~~~
mindslight
The specific crimes you list are generally accomplished completely through
communication, and this seems to be true in this case.

(I assume you meant to type 'extradition'). I'm not opposed to all instances
of extradition. It seems perfectly reasonable that if someone commits a crime
on US soil and flees, that their destination isn't a a safe haven and they be
brought back to the jurisdiction they were in.

But that's not what happened here - the alleged crime was committed while on
British soil, and I don't think he's ever visited the US. So "extraditing" him
is actually _exporting_ him to a completely foreign jurisdiction!

~~~
foldr
You originally said that Love was "merely" communicating. That is not the
case. He was also committing a crime. To say that he was merely communicating
is like saying that a Nigerian scammer was "merely sending an email", or that
a double agent was "merely carrying some documents in a briefcase".

There is no legal precedent for limiting extradition to instances where the
person being extradited has been physically present within the jurisdiction in
question. If you hack into US government computers, it obviously makes sense
for the US government to prosecute you.

By the way, in relation to your Holocaust denial example, you should look into
the concept of "dual criminality".

~~~
mindslight
It is "mere communication" in the sense that the whole action is
communication, as opposed to eg also physically gaining access. The strict
sense you're attempting for "mere" is nonsensical - every communication is for
some ultimate purpose, and so can be described as that purpose. By a strict
sense, asking Aunt Mildred for her cookie recipe wouldn't be "mere"
communication, because you're also "making cookies".

The dual criminality thing isn't surprising because it's the crudest way of
resolving the immediate conundrum. But this case precisely highlights its flaw
- a person has only violated the law if they are found guilty in a court.
Lauri has not been found guilty in a UK court, and therefore his actions have
not been found illegal under UK law! Not to mention the vastly different
punishments between the places (owing to societal differences that he never
opted into). So either the principle needs to be extended to take these things
into account, effectively making him stand trial in a UK court but perhaps
with a US prosecutor, or another basic principle needs to be found.

Obviously there is no legal precedent, because if there were we wouldn't be
having this conversation (it is the tendency for these systems to grow and
erode rights). But I'm arguing that there should be - if someone is not
physically present in a jurisdiction, how can they be said to have positively
assented to that jurisdiction?

In the age of instant global communication, we either have one world
jurisdiction (role currently being filled by USG) or we need to adopt logical
demarcation points between different ones. I believe freedom of speech scaled
up to nation states makes a lot of sense, for the same pragmatic reasons that
it makes sense applied to individuals - a receiver of information is able to
easily filter much garbage, and so the onus should be on them to prevent being
affected by it.

~~~
foldr
If that's what you mean by 'mere' then it doesn't matter that he was 'merely'
communicating. Clearly it's possible to be 'merely' communicating in your
sense and yet also committing a crime. The Nigerian scammer is 'merely'
sending emails and yet also committing fraud. The idea that freedom of speech
somehow makes hacking, fraud, or other such crimes permissible is simply
silly.

You're also misunderstanding how dual criminality works. The requirement is
that the offence for which the individual is being extradited must be a crime
in both countries. That requirement is met in Love's case but not in your
hypothetical Holocaust denial case.

I don't see why people should have to assent to being under any given
jurisdiction. I didn't assent to being under British jurisdiction, but since I
live in Britain, I am. You seem to be suggesting that the physical location of
a person should impose hard-and-fast restrictions on which country's laws they
may be subject to, but see no reason why that should be so.

~~~
mindslight
Reread my comment if you think I didn't understand dual criminality. What I'm
pointing out is that the concept needs to be extended or augmented for the
modern networked world.

Previously it was adequate because one basically had to visit a jurisdiction
to commit a crime there. But taking a look at
[https://en.wikipedia.org/wiki/Pornography_by_region](https://en.wikipedia.org/wiki/Pornography_by_region),
surely you wouldn't think it just for someone to be extradited from Iceland to
Sudan for setting up a pornographic website.

I started off this thread explicitly saying that I reject the idea of
communication creating a legal nexus. Borders and physical locations are a
strong Schelling point for determining jurisdiction. I'm referencing free
speech for its aspect of "what is said cannot hurt me", which is another
Shelling point.

The Nigerian scammer is still committing fraud, but _in Nigeria_.

~~~
foldr
Your previous comment certainly appeared to misunderstand dual criminality
since you thought it was relevant whether or not Lauri had been convicted of a
crime in the UK. Clearly, however, that is not relevant to the satisfaction of
the dual criminality requirement, which is the requirement that the _offence_
for which the person is being extradited is also an offence in the country
they're being extradited from.

With regard to your Iceland example, I doubt that Iceland and Sudan have an
extradition treaty. If they do, I don't see in principle why someone who lived
in Iceland but was involved in producing pornography in Sudan should not be
extradited for it. In practice, however, the probable lack of an extradition
treaty, and the probable flaws in the Sudanese justice system, would make it
very unlikely that an Icelandic court would approve such a request.

I'm not really sure why you bring the example up. People don't in fact get
extradited from Iceland to Sudan, so it's not as if it highlights a problem
with the present system.

>The Nigerian scammer is still committing fraud, but in Nigeria.

I don't see how that is necessarily the case, if the victims are in other
locations.

~~~
mindslight
> _Your previous comment certainly appeared to misunderstand dual criminality
> since you thought it was relevant whether or not Lauri had been convicted of
> a crime in the UK_

An action can only be an _offense_ if it illegal. And something can only be
illegal if found so in a court of law. So, in abstract, dual criminality would
require a proper trial in the extraditing country to determine if an offense
was committed. The actual implementation takes shortcuts (because bureaucrats'
goal is focused on achieving punishment), but this is an erosion of the legal
system as I've been pointing out.

Surely you don't think that someone in a country with due process should be
mechanically extradited to a country with no due process, but you're relying
on a merciful extradition court to essentially try the case and provide due
process before extradition.

> _I don 't see in principle why someone who lived in Iceland but was involved
> in producing pornography in Sudan should not be extradited for it_

And _distribution_? eg just setting up a website that isn't not accessible
from Sudan? I made this example because it shows how something can be
technically "illegal" in two different places, yet have entirely different
criminal procedures and punishments.

> _I don 't see how that is necessarily the case, if the victims are in other
> locations._

I have repeatedly stated that I'm rejecting the idea that communication can
create a legal nexus. In this context since the fraudster has not left
Nigeria, all his crimes are happening within Nigeria. This has been my main
argument the whole time.

Rather than directly addressing my main point, you've only countered with how
things currently are. Obviously if I thought the current state of affairs was
worthwhile I would not be making this argument, so it's hardly a refutation.

~~~
foldr
>So, in abstract, dual criminality would require a proper trial in the
extraditing country to determine if an offense was committed.

No, dual criminality requires that the person be extradited for (allegedly)
doing something which is a crime in both countries. So for example, you can be
extradited from the UK to the US on a murder charge because murder is a crime
in both countries. Whether or not you have been found guilty of murder in the
UK is irrelevant.

>Surely you don't think that someone in a country with due process should be
mechanically extradited to a country with no due process,

That is why extradition treaties are generally only signed with countries
which have due process. But all of these extradition requests have to go
before a court; they're not "mechanical".

>I have repeatedly stated that I'm rejecting the idea that communication can
create a legal nexus. In this context since the fraudster has not left
Nigeria, all his crimes are happening within Nigeria.

This is just wrong on the face of it, and you've provided no supporting
argument. If the fraudster is defrauding people in another country then his is
potentially subject to the jurisdiction of that country.

~~~
mindslight
>> _I 'm rejecting the idea that communication can create a legal nexus_

> _This is just wrong on the face of it, and you 've provided no supporting
> argument_

All of my comments have contained the supporting arguments, to which you've
merely responded with how things _currently are_. This does not make for much
of a refutation.

IMHO this is one of the problems with a common law legal system. It's all too
easy to forget that its various principles and precedents are actually _man
made_ and not manifest immutable truths.

~~~
foldr
Your arguments were based on various hypothetical scenarios (extradition to
Sudan on pornography charges, etc. etc.), which could not happen in the
present system due to some combination of (i) the dual criminality
requirement, (ii) the probable non-existence of the relevant extradition
treaties, and (iii) the discretion that courts have to refuse extradition
requests to countries which are unlikely to give a fair trial, or where
disproportionate penalties are applied.

------
dv_dt
The US seems like it has a very undeveloped policy on digital defense. It
seems like with this issue and the large breaches in security in the past, and
the FBI pushing for even more weakening of encryption that the US government
lacks a strong internal advocate to promote the development and installation
defensive infrastructure for both in gov't and the US tech infrastructure.

~~~
tptacek
_Every country in the world_ has underdeveloped digital defense. There is no
secure country anywhere. It has nothing whatsoever to do with encryption
policy (one of the rare tech policy issues that I agree wholeheartedly with
the HN conventional wisdom on). It's that software security is simply an
unsolved problem, but the world is plowing full speed ahead into deploying
more and more of it, and will continue to do so.

~~~
dv_dt
I guess I'm thinking less about the state of the technology deployment (which
will always be in some sort of play), and more about the
political/bureaucratic organizations within the government and their focus. It
feels, from a very, very outside position, that the gov't (NSA, et al) used to
put more resources on systematically figuring out how to move defensive side
work forward. Maybe the orgs that used to be tasked with that were reorged or
demphasized, I don't really know.

------
gramstrong
Says Lauri Love's lawyer.

------
jpgvm
Sometimes I wonder how US prosecutors live with themselves.

~~~
ashark
For the ones with the best intentions they probably think that, on average if
not in every particular case, they're pulling the switch to make the trolley
hit one person instead of five (so to speak), and that _not doing so_ would
make the world a worse place.

For the ones with the worst intentions, it's likely something to do with
chasing material and/or social rewards. (edit) And they don't much care about
how much it hurts others.

------
Kazamai
The US should give him a job hacking China

~~~
brian_herman
Like they did with
[https://en.wikipedia.org/wiki/Frank_Abagnale](https://en.wikipedia.org/wiki/Frank_Abagnale)

