Early in the evening of 25 October 2013, a man dressed as a UPS delivery guy arrived at Lauri Love's family home in Suffolk holding a box. When Love's mum answered the door, she was told that only her son could sign for the delivery. She called him downstairs, and when he emerged wearing his dressing gown, he was told that the man was in fact an officer of the National Crime Agency, and that he was being arrested on suspicion of hacking into a long list of systems, including those controlled by the US Federal Reserve, NASA, and the FBI. Love asked if he still got to keep the box.
Almost three years later, on 25 July 2016, 31-year-old Love and his parents were at Westminster Magistrates' Court in London for the final arguments in his extradition hearing. Judge Nina Tempia is hearing the case, and will rule on 16 September as to whether the UK will allow Love to be extradited to the US where he would face three separate trials in New York, New Jersey, and Virginia.
"It's been harrowing, this whole process," said Love, speaking to me a couple of days later. "The US didn't even really make any arguments, they were just casting doubt on the evidence from us."
The US is not alleging that Love profited from any illegal activities, or that anybody came to harm. They are accusing him of being part of #OpLastResort, a series of online protests that followed the persecution and death of the hacktivist Aaron Swartz and that were seen as exposing frailties in US government systems. "You shouldn't send anyone somewhere where they can expect decades in prison for crimes that were not violent," argued Love. "At the worst they caused financial losses and embarrassment, if we're honest about it."
The defence's expert witness testimony, which Judge Tempia heard over two days at the end of June, focused on Love's ability to cope with being imprisoned in the American penal system. Love has Asperger Syndrome, and autism expert Professor Simon Baron-Cohen testified in court that, "[while] Lauri is very intelligent, he has a severe disability. His condition is extremely dangerous in terms of the risk of suicide."
Love could face a sentence of up to 99 years if he is sent to the US, and the length of his potential sentence compared to more lenient sentencing in the UK, coupled with his mental health, and the American prison system's use of solitary confinement and "suicide watch" rather than therapeutic intervention, have all informed Love's defence case fighting the extradition order. Love has stated simply that he would kill himself if he were extradited.
While Love said he was "guardedly optimistic" that the judge will rule against extradition in September, his case will probably end up at the High Court anyway
In a similar case in 2012, then Home Secretary Theresa May withdrew alleged hacker Gary McKinnon's extradition order on human rights grounds, as she considered him too much of a suicide risk. Love's case is considered the first real test of the "forum bar" which was introduced in the wake of the McKinnon decision, which allows defendants threatened with extradition to the US to question whether their cases should be heard in the UK instead.
At present, Love has not been convicted or even tried for any crimes, so finds himself in the Kafkaesque position of arguing that it would be easier for him to be convicted here in the UK even though it's still far from clear whether he could or should be convicted at all.
"It seems a bit twisted that we have to convince the judge that it would be easy to convict me here, because generally in a criminal prosecution your defence is trying to make that seem hard," Love told me. "There seems to be a conflict of interest in the way that the extradition hearing is structured, as the prosecution, the barrister representing the USA, basically makes a bunch of claims without having to prove them."
At the extradition ruling on 16 September, Judge Tempia will also set a date for a separate civil suit that Love is bringing against the National Crime Agency. When Love was first arrested, his house was searched and all computers and digital media—including those belonging to his parents—were seized. In May 2015, after almost two years, the NCA returned 25 of the 31 items but it still holds a desktop computer, two laptops, two external hard drives, and a SD card. In November 2015, Love launched legal action to try and get those items back, and in May this year Judge Tempia refused the NCA's request to force Love to divulge his passwords.
"It becomes an important issue [because of] the basis on which they refused to return the property," explained Love. "That was because there were parts of it that they couldn't understand, effectively because I'd refused to cooperate with their requests—very polite requests on pieces of paper with seals on them—that I assist them in making certain bits of data comprehensible. I told them that they would have to do a few things before I would entertain that suggestion: prove that it's encrypted data, prove that I'm able to decrypt it, and prove that they're able to compel me to do so. They refused to do that."
There's a wider issue at stake here, which is that the presence of unidentifiable data on a computer shouldn't itself be enough to suggest wrongdoing. Properly encrypted data is indistinguishable from random data, and it is almost impossible to prove if a defendant is refusing to decrypt it or is genuinely unable to, especially given that random data may be sent to your computer without your knowledge. Love pointed out that this is particularly worrying for anyone involved in political activistism: "If the police can draw an adverse inference just from the fact that it's encrypted, and that justifies not giving it back to the person they took it from, then it's very open for arbitrary interference, especially if it's people in groups who come under special scrutiny from the state."
While Love said he was "guardedly optimistic" that the judge will rule against extradition in September, his case will probably end up at the High Court anyway, as either side will likely contest the verdict if it goes against them.
Until that point, he must continue to live with the very real threat of extradition hanging over him. Meanwhile, he's currently working with a startup called Hacker House which plans to run training, "capture the flag games" and bug bounties to encourage young people with computer skills to help companies improve their cybersecurity.
Love hopes that in time those with the talent to find the flaws in the online systems that control so much of our lives can work to improve them. "There's a hidden, latent talent pool of people who are very good at this sort of stuff, but the differences in their brain make-up that make them good at that also causes them problems with society, particularly when it comes to the job market," he said. "Some of them also get into trouble because of their talents and their attitudes. We really risk squandering the troubleshooters that we desperately need at the moment."
The Hacks We Can't See is Motherboard's theme week dedicated to the future of security and the hacks no one's talking about. Follow along here.