A Dutch justice minister just agreed that the long arm of American law is able to reach out and pluck hacking suspects from overseas. Vladimir Drinkman, a Russian who was arrested in the Netherlands for an alleged role in a cyber heist organization, will be extradited to the United States.
The extradition comes after Drinkman spent two and a half years in custody amid questions about the legality of sending him to a federal court in New Jersey for crimes he allegedly committed from across the ocean.
Last year, US prosecutors accused Drinkman, former esports team owner Dmitriy Smilianets, and three other Russian and Ukrainian men of perpetrating "the largest hacking and data breach scheme ever prosecuted in the United States." They were charged with running a cyber heist ring that dated back to 2005 that hacked 17 companies including Nasdaq OMX Group Inc., Dow Jones, and 7-Eleven Inc., in the service of stealing and selling "at least 160 million credit and debit card numbers resulting in losses of hundreds of millions of dollars."
According to Fred Pals at Bloomberg Businessweek, in August the Dutch Supreme Court dismissed Drinkman's appeal of an earlier ruling that declared the US extradition request admissible. Russia had also requested that Drinkman be extradited to his native country, but it came 14 months after the US had requested extradition, and apparently it's a first-come, first-served situation.
Smilianets was arrested in Amsterdam and extradited to the United States in 2012 and pled not guilty in federal court in Newark, NJ in August 2013. According to his lawyer, the case is "a rather complex international charge of hacking. If it goes to trial, it's going to be a lengthy trial."
There isn't really a hard-and-fast system for figuring out jurisdiction when prosecuting hackers, for whom jurisdictions and international borders are of no concern. The US has had mixed success getting suspects in front of American judges. The British refused to extradite Gary McKinnon to face charges of hacking into the Pentagon and NASA, and didn't prosecute him in the UK either.
Domestically, the hacker weev was sent to a court in New Jersey where his case was dismissed because none of the alleged criminal activity occurred there. And obviously, the US hasn't gotten Edward Snowden, although that's a slightly different situation.
But getting Drinkman is a strong reminder that the US is aggressive about prosecuting cybercrime, even if it involves foreign nationals. Drinkman's case also reinforces the notion that America owns the internet and will surveil it and prosecute as the government sees fit.