In the US prosecutorial system, conspiracy charges are regularly used as a tool to leverage and encourage plea negotiations because conspiracy is so broad and allows for broad interpretations of seemingly innocuous actions and trifling intents. As I've said elsewhere, this smells more like an intelligence operation than a criminal investigation.
Reading through the indictment [1], the conspiracy charge does not allege anything that isn't in the other charges. For the most part, the other charges allege "knowledge" that the software can be used for some purpose rather than actual use.
I'm using "conspiracy" in the colloquial sense, not the legal sense. Obviously, he's charged with more than simply being a member of a conspiracy.
I don't know what you think the prosecution of an actual banking trojan operation would look like and so can't evaluate the implication of something seeming "more like an intelligence operation than a criminal operation". Maybe you could clarify. This isn't the first malware conspiracy case the DOJ has gone after.
Prosecutors told a Las Vegas court on Friday that Mr
Hutchins had been caught in a sting operation when
undercover officers bought the code. They claimed the
software was sold for $2,000 in digital currency in
June 2015. [1]
So he was caught in a sting involving beer money at age 21. As the parent of a young man who recently managed to puncture a hole in the gas tank of a Buick without a clear explanation, my general take is that like many if not most young men, Hutchins has done one or more stupid things prior to the full onset of adulthood (not to suggest that the full onset of adulthood is necessarily entirely effective).
Hutchins could have been arrested any time between June of 2015 and August of 2017. This includes:
1. Arrest in the UK. However, this would have required extradition and the expenditure of diplomatic capital given the relatively insubstantial ill gotten gains Hutchins is alleged to have received. The quid pro quo for $2000 in potentially illicit sales would expose a lot of very average people for a lot of very trifling offenses on both sides of the Atlantic.
2. Arrest when Hutchins first entered the US in association with Defcon. He could have been picked up at the airport upon arrival. Arrest in the US at the first opportunity seems the ordinary first alternative to extradition.
3. Arrest while Defcon was going on. Prosecutors argued at the bail hearing the Hutchins was a flight risk. Yet he was allowed to get all the way to the gate for his flight before he was detained.
Ok, extradition is a mess. But picking him up earliest opportunity is pretty standard. Waiting until he is about to board a flight suggests either ineptitude or surveillance or the grand jury passing down an indictment during Defcon. I don't really buy ineptitude due to it requiring multiple Federal agencies falling down in routine police work.
In a surveillance scenario, publicly arresting Hutchins puts any and all other targets of surveillance on notice. Without other arrests, that seems rather inept policing.
Late execution of the warrant suggests a high level agenda to prevent him from being arrested (or questioned) in the UK or detained at the port of entry in the normal manner. Another possibility is the grand jury did not issue a indictment until just prior to Hutchins arrest. This points to a high level agenda as well since presenting evidence to the grand jury between the time Hutchins arrived and attempted to depart would involve significant logistical effort...on a two year old sting operation.
To the degree that Hutchins is an attractive intelligence asset, a high level agenda is not implausible. Digging up a skeleton from his closet is not extraordinary spycraft. Letting him get to the airport before the arrest catches him at his most vulnerable and the transition from vacationing Los Vegas luxury to a concrete and stainless Clarke County jail cell is not going to strengthen most people's will.
Of course, I am just speculating. But the fundamental premise is that the people of the state level intelligence communities tend to be professionals and good at what they do.
Because that indictment was bare-bones and bullshit. I may be wrong here (and part of me hopes that I am), but this entire thing smells like the US flexing its power. Marcus gets picked up by the Feds, disappears without anybody knowing where he is for several days, and then suddenly we get an indictment with almost nothing in it claiming he wrote and sold Khronos based on some IRC logs? That just smells fishy to me.
I'd say the UK legal system (well, the legislation) isn't in great condition either. Currently you can be imprisoned for possessing certain pornographic drawings of fictional characters in England, Wales and NI. The Republic of Ireland has similar silly laws, such as how one can be convicted of possessing child pornography if the actors/acresses in the pornography are made to look as though they are underage (e.g through roleplaying or makeup).
Because he's not just a 'someone', he's a hero for stopping the disgusting attack on the NHS and letting doctors and nurses get on with their job of saving lives.
I know this probably isn't what you meant, but it's actually often the case that doing useful things helps people get over the other things you did, see Francis Drake, any number of founders of post-colonial and early 20th century countries, conquistadors/founding fathers/revolutionaries, etc.
In short, justice is what most other influential people deem just, not some universal measure of conduct.
Those responsible for the firebombing of Dresden never stood trial, because the victims belonged to the losing side. The "scientists" of Unit 731 never stood trial.[1] Only 13 out of 24 directors of IG Farben were found guilty and all were released early.[2]
The church effectively killed hundreds of thousands (very conservative guess) by telling people not to use condoms. No one was tried.
Occasionally it does in the UK. A man who was videoed appealingly for calm during the London riots was let off I believe an assault charge. The magistrate told him something like 'we're even now '. However this was mitigation at sentencing following a trial.
Ok, so where is the arrests and trials for the people from the NSA, who designed the exploit that was stolen and became a key part of the WannaCry virus? The very same exploit that was used in a bunch of other viruses too, which has stolen tens of thousands of dollars to date?
Hero is a bit strong. He rashly decided to register a domain name without knowing how the malware would respond to that. By luck it de-activated itself when the domain became active. The malware could just as easily have decided to encrypt the victim's hdd and destroy the key.
No, he should skip the trial because of the chilling effect prosecuting a security researcher who allegedly wrote a banking trojan would have on legitimate security researchers.
What chilling effect would that be? I'm a security researcher, many of my friends are security researchers, none of us sell banking trojans (or write them; they're extremely boring as computer science projects) and none of us have changed what we're working on even a little bit as a result of this case.
Frankly, this sounds a lot like what people said during the advent of the Hans Reiser trial.
Believe it or not, "security researchers" are just as capable of committing crimes as everyone else is.
Comments
You think the UK government would intervene to stop the trial of someone accused of operating a conspiracy to spread banking trojans? Why?
In the US prosecutorial system, conspiracy charges are regularly used as a tool to leverage and encourage plea negotiations because conspiracy is so broad and allows for broad interpretations of seemingly innocuous actions and trifling intents. As I've said elsewhere, this smells more like an intelligence operation than a criminal investigation.
Reading through the indictment [1], the conspiracy charge does not allege anything that isn't in the other charges. For the most part, the other charges allege "knowledge" that the software can be used for some purpose rather than actual use.
[1]: https://www.justice.gov/opa/press-release/file/986606/downlo...
I'm using "conspiracy" in the colloquial sense, not the legal sense. Obviously, he's charged with more than simply being a member of a conspiracy.
I don't know what you think the prosecution of an actual banking trojan operation would look like and so can't evaluate the implication of something seeming "more like an intelligence operation than a criminal operation". Maybe you could clarify. This isn't the first malware conspiracy case the DOJ has gone after.
From the bail hearing:
So he was caught in a sting involving beer money at age 21. As the parent of a young man who recently managed to puncture a hole in the gas tank of a Buick without a clear explanation, my general take is that like many if not most young men, Hutchins has done one or more stupid things prior to the full onset of adulthood (not to suggest that the full onset of adulthood is necessarily entirely effective).Hutchins could have been arrested any time between June of 2015 and August of 2017. This includes:
1. Arrest in the UK. However, this would have required extradition and the expenditure of diplomatic capital given the relatively insubstantial ill gotten gains Hutchins is alleged to have received. The quid pro quo for $2000 in potentially illicit sales would expose a lot of very average people for a lot of very trifling offenses on both sides of the Atlantic.
2. Arrest when Hutchins first entered the US in association with Defcon. He could have been picked up at the airport upon arrival. Arrest in the US at the first opportunity seems the ordinary first alternative to extradition.
3. Arrest while Defcon was going on. Prosecutors argued at the bail hearing the Hutchins was a flight risk. Yet he was allowed to get all the way to the gate for his flight before he was detained.
Ok, extradition is a mess. But picking him up earliest opportunity is pretty standard. Waiting until he is about to board a flight suggests either ineptitude or surveillance or the grand jury passing down an indictment during Defcon. I don't really buy ineptitude due to it requiring multiple Federal agencies falling down in routine police work.
In a surveillance scenario, publicly arresting Hutchins puts any and all other targets of surveillance on notice. Without other arrests, that seems rather inept policing.
Late execution of the warrant suggests a high level agenda to prevent him from being arrested (or questioned) in the UK or detained at the port of entry in the normal manner. Another possibility is the grand jury did not issue a indictment until just prior to Hutchins arrest. This points to a high level agenda as well since presenting evidence to the grand jury between the time Hutchins arrived and attempted to depart would involve significant logistical effort...on a two year old sting operation.
To the degree that Hutchins is an attractive intelligence asset, a high level agenda is not implausible. Digging up a skeleton from his closet is not extraordinary spycraft. Letting him get to the airport before the arrest catches him at his most vulnerable and the transition from vacationing Los Vegas luxury to a concrete and stainless Clarke County jail cell is not going to strengthen most people's will.
Of course, I am just speculating. But the fundamental premise is that the people of the state level intelligence communities tend to be professionals and good at what they do.
[1]: http://www.bbc.com/news/technology-40833951
Because that indictment was bare-bones and bullshit. I may be wrong here (and part of me hopes that I am), but this entire thing smells like the US flexing its power. Marcus gets picked up by the Feds, disappears without anybody knowing where he is for several days, and then suddenly we get an indictment with almost nothing in it claiming he wrote and sold Khronos based on some IRC logs? That just smells fishy to me.
Because he is a UK citizen, and the US Legal system corrupt, twisted and self aggrandizing.
I'd say the UK legal system (well, the legislation) isn't in great condition either. Currently you can be imprisoned for possessing certain pornographic drawings of fictional characters in England, Wales and NI. The Republic of Ireland has similar silly laws, such as how one can be convicted of possessing child pornography if the actors/acresses in the pornography are made to look as though they are underage (e.g through roleplaying or makeup).
Because he's not just a 'someone', he's a hero for stopping the disgusting attack on the NHS and letting doctors and nurses get on with their job of saving lives.
This doesn't make any sense. It's not how justice works. You can't do one useful thing to excuse a series of grave crimes.
I know this probably isn't what you meant, but it's actually often the case that doing useful things helps people get over the other things you did, see Francis Drake, any number of founders of post-colonial and early 20th century countries, conquistadors/founding fathers/revolutionaries, etc.
In short, justice is what most other influential people deem just, not some universal measure of conduct.
Those responsible for the firebombing of Dresden never stood trial, because the victims belonged to the losing side. The "scientists" of Unit 731 never stood trial.[1] Only 13 out of 24 directors of IG Farben were found guilty and all were released early.[2]
The church effectively killed hundreds of thousands (very conservative guess) by telling people not to use condoms. No one was tried.
1 - https://en.wikipedia.org/wiki/Unit_731#Surrender_and_immunit...
2 - https://en.wikipedia.org/wiki/IG_Farben#IG_Farben_Trial
Occasionally it does in the UK. A man who was videoed appealingly for calm during the London riots was let off I believe an assault charge. The magistrate told him something like 'we're even now '. However this was mitigation at sentencing following a trial.
Ok, so where is the arrests and trials for the people from the NSA, who designed the exploit that was stolen and became a key part of the WannaCry virus? The very same exploit that was used in a bunch of other viruses too, which has stolen tens of thousands of dollars to date?
Hero is a bit strong. He rashly decided to register a domain name without knowing how the malware would respond to that. By luck it de-activated itself when the domain became active. The malware could just as easily have decided to encrypt the victim's hdd and destroy the key.
And he was so effective at stopping the malware because he is himself a malware creator distributing competing malware.
Allegedly. Innocent until proven guilty.
Which we will find out if he gets a fair trial, but that doesn't mean he should be able to skip the trial because he helped the NHS.
No, he should skip the trial because of the chilling effect prosecuting a security researcher who allegedly wrote a banking trojan would have on legitimate security researchers.
What chilling effect would that be? I'm a security researcher, many of my friends are security researchers, none of us sell banking trojans (or write them; they're extremely boring as computer science projects) and none of us have changed what we're working on even a little bit as a result of this case.
Frankly, this sounds a lot like what people said during the advent of the Hans Reiser trial.
Believe it or not, "security researchers" are just as capable of committing crimes as everyone else is.
What? So if I am a security researcher, I am allowed to write and sell as much malware as I want, with no consequences? That is absurd.
The trial is necessary before you can deem him a legitimate security researcher and trojan authors should feel a chilling effect.
Or he saw a URL in the malware code, and decided to register it to see what would happen and isn't a malware selling mastermind.