Lauri Love, the 34-year-old who successfully fought a five-year battle against extradition to the US to face hacking charges, is taking legal action against the National Crime Agency to recover computer equipment seized by the UK police.
Love, who has Asperger’s, told Westminster Magistrates’ Court yesterday (18 December 2018) that there was no evidence that his computers contained encrypted data, and that under the Police and Criminal Evidence Act, the police had a duty to return his property.
Love’s legal action comes 10 months after the Court of Appeal quashed a US extradition request against Love, after hearing evidence that he would not be properly cared for in the US prison system and would be at high risk of suicide. The court urged the Crown Prosecution Service (CPS) to begin a prosecution in the UK.
NCA seeking evidence from US
The National Crime Agency (NCA), the UK’s equivalent of the FBI, told the court that the police were seeking evidence from the US to bring a prosecution against Love.
Representing the NCA, Andrew Bird told the court: “There is now a domestic criminal investigation ongoing.”
There was relevant information to the UK’s investigation on Love’s computers, he said, which were seized by police in 2013. That information includes “the addresses of police officers subscribed to the Police Oracle [a publication for police] and large amounts of information from the US Department of Energy”. He said data on the computers had been encrypted.
Bird told the court he could not give a timeframe for the UK police investigation. “We now have to get into the States to get their records,” he said. “We can’t get a timescale.”
He said the court had three options: wiping, wiping and returning the equipment, or not returning at all. “It is not in the public interest for these computers to be returned to Mr Love,” he added.
Love, representing himself, appeared in the court wearing a dark suit, neat long hair and kefir tied around his waist. He is bringing the case under the Police Property Act 1897.
Love told the court it was now 10 months since the Court of Appeal quashed extradition procedures, but he’d had no communication from either the NCA or the police.
Police have ‘duty to return seized equipment’
Senior district judge and chief magistrate Emma Arbuthnot questioned why Love wanted the computers back. “If there is a criminal investigation, you are not going to get your equipment back,” she said. “Why don’t you just wait until they have finished the investigation?”
Love told the judge that the police had a duty to return equipment under the Police and Criminal Evidence Act, since they had made copies to preserve forensic evidence.
“The NCA has, at times, offered to wipe and return [the equipment] without resolution of criminal investigation,” he said.
Love argued that there was a public interest case in returning the equipment. “I am an innocent man; I have not been charged,” he told the court. “There is no evidence of any criminality.”
Arbuthnot said she would not expect the police to produce a timeline for the investigation.
Use of encryption ‘has not been proved’
Love said there were statutory guidelines for the police to return seized equipment and that it was important to hold a hearing to test the National Crime Agency’s contention that his computer contained encrypted data.
He told the court that it was difficult for anyone to disprove an allegation that their computers contained encrypted information. “It’s very difficult to refute,” he said.
Love said it had been five years since the NCA seized his computer equipment, but there had been a problem with the warrant.
He said it had been a further 10 months since his extradition case was quashed by the High Court, and the NCA and the Crown Prosecution Service (CPS) had not given any indication of a timeline for prosecution.
“It sounds as though they are conducting an investigation. It would take a year and a half, I think,” said Arbuthnot.
Arbuthnot agreed to schedule a day to hear the case in February 2019.
Love said the application would test “claims there is data encrypted [on Love’s equipment] or that it contains information belonging to someone else”.
Bird said there may be further evidence from the US “if we can get it from the Americans for the proceedings”.
Case raises dangers for people who use encryption
Speaking after the hearing, Love said the case raised an important point of principle for people who use encryption.
He said the NCA had been unable to show that his computers contained encrypted information or that Love was able to decrypt it.
Police had made forensic images of the hard disks and could return his computers, without interfering with any investigation, he said.
“The reason I am doing this is not for the objects themselves, because the physical value has now dwindled. The data did represent everything that I had in my life and it is of inestimable sentimental value, if not material value, but the reason I am doing this is the principle,” said Love.
“It is very dangerous for people who want to use strong information security practices because they work in the legal profession, or as a political activist.”
Love said he could not afford to hire lawyers for the case, and had decided to represent himself, claiming he was in a better position to explain encryption to the court than legal experts. “It is mathematically impossible to prove in a particular case that data has been encrypted,” he said.
The US extradition proceedings had “scuppered” his studies in electrical engineering at university in Suffolk, Love told Computer Weekly. “They allowed me to resume studies as a part-time student, but unfortunately I don’t have the funding from the Student Loans Company to finish the course,” he said.
Love’s battle with the National Crime Agency and the US Department of Justice
25 October 2013: The National Crime Agency arrests 28-year-old Lauri Love under the UK’s Computer Misuse Act, on suspicion of network intrusion offences against the US Army, US Military and US Government. He is released on bail until February 2014.
28 October 2013: Love is indicted in New Jersey for hacking US government computer systems run by the Army, Missile Defence Agency, Environmental Protection Agency and Nasa. Authorities allege he worked with accomplices to hack into thousands of computer systems and downloaded confidential information on thousands of people, including members of the military.
February 2014: Police attempt to force Love to hand over his encryption keys under Section 49 of the Regulation of Investigatory Powers Act (Ripa). Love refuses, facing a possible jail sentence of two years. UK police make no attempt to prosecute.
27 February 2014: Love is charged in New York, with allegations of working with other computer hackers to access the computer servers of the US Federal Reserve Bank. He is accused of stealing confidential information – including emails and phone numbers – and posting it to a website.
7 July 2014: The National Crime Agency releases Lauri Love on bail.
24 July 2014: The Eastern District of Virginia indicts Love for allegedly hacking computers at the Department of Energy, the US Department of Health and Social Services, the US Sentencing Commission, the FBI’s Regional Computer Forensics Laboratory and two companies, Deltek and Forte Interactive.
November 2014: The NCA offers to return Love’s remaining property, on condition that it forensically wipes the data on the devices. Love refuses, saying the devices contain everything he owns digitally, including personal photographs, writing and other creative pieces of work.
March 2015: Love launches his first legal action against the NCA for the return of computer equipment seized from his home, under the Police (Property) Act. Bury St Edmunds Magistrate’s Court gives case management directions that Love provides decryption keys. Love objects, then withdraws his application to recover his property.
May 2015: The NCA returns a number of items it had seized from his parents' house, but holds on to two desktops, a laptop and other devices which officers said they had been unable to decrypt.
3 July 2015: Love withdraws his court action against the NCA, after it returns 25 items seized from his home, including laptops, computers, memory sticks and hard drives. The NCA retains six other items of computer equipment, which it alleges contain encrypted files.
15 July 2015: Love is re-arrested by the extradition unit of the Metropolitan Police.
November 2015: Lauri Love launches legal action against the NCA for the return of his computer equipment: a desktop computer, two laptops, two external hard drives and an SD card.
April 2016: In an unusual legal move, the National Crime Agency (NCA) attempts to use civil court proceedings to force Love to hand over encryption keys and passwords at a hearing at Westminster Magistrates’ Court.
10 May 2016: Westminster Magistrates’ Court rejected an attempt by the NCA to order activist Lauri Love to hand over encryption keys. Judge Nina Tempia tells the court on that she “was not persuaded” by the NCA’s demands that Love disclose the passwords to computer equipment seized from his home.
16 September 2016: District judge Nina Tempia approves Love’s extradition, passing the case on to home secretary Amber Rudd.
14 November 2016: Home secretary Amber Rudd approves Love’s extradition to the US.
29-30 November 2017: Love’s appeal against extradition is heard over two days at the Royal Courts of Justice in London.
5 Feb 2018: The Court of Appeal rules that Lauri Love will not face extradition to the US to face hacking charges. In a landmark legal decision, the lord chief justice, Lord Burnett, ruled that extraditing Love, a 33-year-old engineering student who has Asperger’s and suffers from depression, would be oppressive to his physical and mental health. The court urges the NCA to prosecute Love in the UK.
Reporting team: Bill Goodwin, Julia Gregory, Niels Ladefoged