Lauri Love will not face extradition to the US to face hacking charges, the court of appeal ruled this morning.
In a landmark legal decision, the lord chief justice, Lord Burnett, ruled that extraditing Love, a 33-year-old engineering student who has Asperger’s and suffers from depression, would be oppressive to his physical and mental health.
“We allow the appeal on both those grounds and extradition will not take place,” he said.
The case is the first major test of the forum bar, introduced by Theresa May as home secretary to protect vulnerable people from extradition, after she dropped extradition proceedings against former hacker Gary McKinnon, following a 10-year legal battle.
The court accepted that Love would be at high risk of suicide should the extradition go ahead.
Love had faced up to 99 years in jail in the US after being accused of working with others to hack into US government computer systems, as part of an online protest over the death of internet pioneer Aaron Swartz.
The engineering student, who lives with his parents, now faces a trial in the UK under the Computer Misuse Act, over allegations described by the Lord Burnett and Justice Ouseley as “serious indeed” in a 35-page judgement handed down today.
“The CPS [Crown Prosecution Service] must now bend its endeavours to his prosecution, with the assistance to be expected from the authorities in the United States, recognising the gravity of the allegations in this case, and the harm done to the victims,” the judgement said.
Love was arrested after US prosecutors filed indictments accusing him of hacking into the US Federal Reserve, US Army, US Department of Defense, the Missile Defense Agency, Nasa and the FBI Regional Computer Forensics Laboratory – viewed by law enforcement as a particularly sensitive target – and other US government computer systems.
The US government now has 14 days to make a request to the high court if it wants to appeal to the supreme court.
A CPS spokesperson said: “We have received the High Court’s judgment on Lauri Love which we will now consider before making any further decisions.”
Setting a legal precedent
Love appeared dressed in a dark suit and white shirt, and flanked by his parents and girlfriend, at the high court in the Strand.
The verdict was greeted by a cheer from 50 people in the public gallery, who had turned up to support Love at the hearing this morning.
Speaking after the decision, Love thanked his supporters, including MP Barry Sheerman, for their compassion and understanding.
“As a society we are having now a conversation about how different kinds of mental make-up can be accommodated. There’s many ways of being a human,” he said.
Love said he hoped the case would set a legal precedent that would stop someone less fortunate facing a similar experience.
“There is an expectation that the CPS will review the case... this is what we are fighting for. It is not pleasant to be prosecuted,” he said. “The max imprisonment here would be 18 months at the very worst. Compared with the US, it can be quite humane and proportionate.
“I’m greatly relieved that I no longer have to be locked up in a country where I have never been, and I am also hopeful that it will set a precedent.
“It’s really nice for my family to be able to breath a bit more easily.”
Law firm Kaim Todner, which is representing Love, said the case was a landmark judgement and was the first time the forum bar had been successfully argued in court.
“What is particularly important about this is that the British justice system has taken the stand that we should deal with the matter ourselves rather than accept the US government’s demands,” said a spokesman for the law firm.
“It has also been recognised that mental health provisions in US prisons are not adequate to satisify [the court] that Lauri would not have come to serious harm if he were extradited,” he said.
MPs support trial in UK
Love’s case had won political support from MPs across all political parties. More than 100 UK Members of Parliament signed a letter to Barack Obama as US president in October 2016, urging him to drop an extradition request against Love.
And in November 2017, more than 70 MPs wrote to prime minister Theresa May and the attorney general Jeremy Wright, questioning why the 32-year-old engineering student could not be tried in the UK courts.
Speaking after the verdict, Barry Sherman MP, who helped to co-ordinate the campaign said: “I do not often cry in Parliament. The stress on this family has been incredible. They’ve stood up to it. It’s been such an emotional rollercoaster and now that cloud has gone.
“You’ve been inspirational, this will stand as an exemplar that if you stand up for what you believe in, you will win,” he told Love.
The appeals court victory follows a decision by judge Nina Tempia, at Westminster Magistrates’ Court in 2016, that Love’s extradition could go ahead – a decision later endorsed by the home secretary, Amber Rudd.
Extradition ‘unjust and oppressive’
The court of appeal agreed with Love’s legal team that extraditing Love to the US would be “unjust and oppressive”.
Edward Fitzgerald QC and Ben Cooper, who previously represented Gary McKinnon, told the court of appeal that judge Tempia had failed to give adequate weight to Love’s medical conditions deteriorating in the US prison system and the likelihood that he would commit suicide if his extradition went ahead.
Lawyers have described conditions in the US Federal Prisons, particularly at the Metropolitan Correction Centre (MCC) in Manhattan, and Metropolitan Detention Centre (MDC) in Brooklyn, New York – where Love would be likely to be detained – as “medieval”, with only one psychiatrist available for nearly 2,500 inmates.
Normal practice to prosecute US hacking cases in UK
Former director of public prosecutions Ken Macdonald supported Love, arguing in a witness statement that it had been normal practice to prosecute in the UK hackers accused of attacking overseas computer systems, with the notable exception of Gary McKinnon, whose extradition was halted by Theresa May.
At least 13 people accused of hacking US computer systems have been tried in the UK. The UK has prosecuted at least 13 computer hackers who have been accused of illegally accessing US computer systems.
They include members of the notorious LulzSec hacking group, Topiary and Mustafa Al-Bassam, who were treated more humanely than hackers prosecuted in the US, who often receive draconian prison sentences under the US Computer Fraud and Abuse Act.
The appeal judges agreed that the district court had not properly considered evidence from Michael Kopelman, a forensic psychiatrist at King’s College London, that Love’s mental state would deteriorate significantly if he were placed on suicide watch in the US, compromising his ability to make rational decisions.
Kopelman said in a report: “In the light of Mr Love’s current mental state, I continue to believe there is a very high risk that Mr Love would not be fit to stand trial in the United States of America.” That fact alone warrants refusal of extradition under the forum bar.
Prosecution claimed US would be able to care for Love
Peter Caldwell, representing the Crown Prosecution Service and the US government, had argued that Love would get a fair trial in the US and that US prisons had systems in place to protect vulnerable defendants and meet their medical needs.
High-profile detainees were watched 24 hours a day, and the US would put Love immediately on suicide watch because of his history while US marshals would manage his delivery to prison, he argued in court.
Caldwell told the court it could take years, rather than months, before Love could be tried in the UK, as police would have to rely on evidence provided by the US authorities across several states.
Love is using his skills to help businesses
Love lives with his parents – Alexander, a Baptist minister and chaplain at nearby Highpoint prison, and Sirkka-Liisa, a teacher – in Stradishall, Suffolk.
Since his arrest, Love has attempted to put his computer skills to good use, initially through an organisation called Hacker House, which brings former hackers and activists together to work with law enforcement and businesses to improve computer security.
When the WannaCry ransomware virus was released last year, Love set up an IRC research group, which attracted more than 250 security researchers, to assess the risks, and to encourage organisations to patch their computer systems before the malware was inevitably exploited.
More recently, he warned US telecoms company AT&T that it had left its computer systems vulnerable to hacking. “I just sent an email to the guy who’s job it was to get it fixed, and he said, ‘So you want any AT&T swag?’ and I said, ‘No, I am good’,” said Love, in a talk at the Byline Festival last year.
Love said he hoped to continue in his computer security work. “Security is such a large and growing problem and growing at such an exponential rate ... I imagine I will be called upon to do internet security ... and the outcome I shall not be blacklisted. There has been a large toll and large ordeal.”
Sherman said: “Lauri shows such talent. If we do not use it from people on the autism spectrum, we are wasting it.”
Love said the case, which had taken up four years of his life, had caused him difficulties with his work.
Love faced charges in three US states
Love had faced potential trials in three US states, after indictments were filed in the Southern District of New York, New Jersey and the Eastern District of Virginia.
He is accused of downloading confidential information belonging to individuals, including credit card details, from US government computers and private companies, causing millions of dollars’ worth of damage, between October 2012 and October 2013. There is no suggestion he profited from the information or made it public.
According to the US indictments, Love gained unauthorised access to computers by exploiting vulnerabilities in Adobe ColdFusion and by using SQL injection attacks.
Once inside, working with fellow hackers, he is alleged to have placed “shells” in the networks to steal confidential data, including telephone numbers, social security numbers, credit card and salary details of employees.
The allegations rely heavily on records of discussions between the alleged hackers in internet relay chat (IRC) rooms. US prosecutors said Love used a variety of nicknames, including “nsh”, “route”, “peace”, “shift” and “Smedley Butler”, to discuss the attacks with accomplices.
On one occasion, Love is alleged to have written: “You have no idea how much we can f*ck with the US government if we want to … this stuff is really sensitive, it’s basically every piece of information you need to do full identity theft on any employee or contractor.”
Lauri Love’s family grateful
“This is a victory for justice and for my son,” said Love’s father after the verdict. “I want to keep him here so I can keep an eye on him.
“The other person who should be happy is the prime minister, because she’s got the forum bar to work. At the core of our country is justice. I want to thank the lord chief justice, who has exercised wisdom and compassion,” he added.
Naomi Colvin, case director at Courage, which is backing Love’s legal case, said the ruling was a victory for free expression that would draw attention to the draconian way the US treats hackers and activists.
“This is the result Lauri and his family have spent four years waiting for. This ruling is a massive victory for free expression online, for the fair treatment of neurodiverse people and for those of us who have drawn attention to the dire treatment of hackers and information activists in the US,” she said.
“Lauri was only ever in this position because he had been marked out for unfair, discriminatory and vindictive treatment. With any luck, today’s ruling will mean that prosecuting authorities finally start respecting the clear will of the British public: we do not extradite our geeks to face medieval punishment in the US.”
Emma Norton, head of legal casework for Liberty, which intervened in the case, said Love should have been prosecuted in the UK from the beginning.
“Where unlawful activity is alleged to have taken place in the UK, those suspected should be tried in the UK – not packed off to foreign courts and unfamiliar legal systems. This is especially important in cases of vulnerable people like Lauri Love,” she said.
“It’s shameful that Lauri and his family have been put through this terrible ordeal.”
Jake Davis, a former member of the LulzSec hacking group, where he was known as Topiary, said: “It is really genuinely heartening to know that the arguments have been dismissed and the mental health issues of those on the autistic spectrum are being taken seriously.”
Mustafa al-Bassam, a former hacker, now a security specialist, said: “There was a pretty good chance of winning. This is what the forum bar was supposed to do. I think it was a David versus Goliath [case]. It is good because it shows that Britain has sovereignty [in these issues].
Lauri Love’s road to justice
25 October 2013: The National Crime Agency (NCA) arrests 28-year-old Lauri Love under the UK’s Computer Misuse Act, on suspicion of network-intrusion offences against the US Army, US military and US government. He is released on bail until February 2014.
28 October 2013: Love is indicted in New Jersey for hacking US government computer systems run by the Army, Missile Defence Agency, Environmental Protection Agency and Nasa. Authorities allege he worked with accomplices to hack into thousands of computer systems and downloaded confidential information on thousands of people, including members of the military.
February 2014: Police attempt to force Love to hand over his encryption keys under Section 49 of the Regulation of Investigatory Powers Act (Ripa). Love refuses, facing a possible jail sentence of two years. UK police make no attempt to prosecute.
27 February 2014: Love is charged in New York, with allegations of working with other computer hackers to access the computer servers of the US Federal Reserve Bank. He is accused of stealing confidential information – including emails and phone numbers – and posting it to a website.
7 July 2014: The NCA releases Love on bail.
24 July 2014: The Eastern District of Virginia indicts Love for allegedly hacking computers at the Department of Energy, the US Department of Health and Social Services, the US Sentencing Commission, the FBI’s Regional Computer Forensics Laboratory and two companies – Deltek and Forte Interactive.
15 July 2015: Love is arrested again, by the extradition unit of the Metropolitan Police, and is granted bail after an appearance at Westminster Magistrates’ Court.
12 April 2016: Westminster Magistrates’ Court hears arguments by the NCA that Love should be forced to disclose his encryption keys, as part of case management proceedings.
10 May 2016: District judge Nina Tempia rejects the NCA’s attempt to “circumvent” statutory privacy protections by obtaining a forced decryption direction.
28-29 June 2016: The first two days of Love’s extradition hearing are heard at Westminster Magistrates’ Court. The defence argues that Love is at high risk of suicide, if extradited, while the Crown Prosecution Service argues that Love is using his illness as a shield.
25 July 2016: Westminster Magistrates’ Court hears the final arguments in Love’s extradition hearing.
16 September 2016: District judge Nina Tempia approves Love’s extradition, passing the case on to home secretary Amber Rudd.
24 October 2016: 105 MPs sign a letter to US president Barack Obama asking him to withdraw the extradition request against Love. Later signatures take the total of MPs opposing Lauri’s extradition to 114.
14 November 2016: Home secretary Amber Rudd approves Love’s extradition to the US.
18 November 2017: 73 MPs – including Barry Sheerman, Heidi Allen and Love’s local MP, culture minister Matt Hancock – write to the prime minister and attorney general, asking them to intervene with the US, in support of a UK trial.
29-30 November 2017: Love’s appeal against extradition is heard over two days at the Royal Courts of Justice in London.
Reporting team: Bill Goodwin, Julia Gregory, Niels Ladefoged