British judges rejected a US request for the extradition of a man accused of hacking into thousands of US government computers based on the lack of mental healthcare in US Prisons because he suffers from Asperger’s syndrome. He had appealed against a 2016 British court ruling that he could be extradited to the United States to face the charges.
Lauri Love faces charges in the United States for allegedly hacking into the networks of the US Federal Reserve, US Army and NASA, among others, in 2012 and 2013.
The federal indictment charges Love, 28, of Stradishall, England, with one count of accessing a U.S. department or agency computer without authorization and one count of conspiring to do the same. An investigation led by the U.S. Army Criminal Investigation Command-Computer Crime Investigative Unit and the FBI in Newark revealed that Love allegedly illegally infiltrated U.S. government computer systems – including those of the U.S. Army, U.S. Missile Defense Agency, Environmental Protection Agency and National Aeronautics and Space Administration – resulting in millions of dollars in losses.
Law enforcement authorities in the United Kingdom, including investigators with the Cyber Crime Unit of the National Crime Agency (NCA) they arrested Love at his residence Friday, Oct. 25, 2013, in connection with an ongoing investigation by the NCA. Love was previously charged in New Jersey by federal complaint, also unsealed in connection with his arrest. He also is charged in a criminal complaint in the Eastern District of Virginia with alleged conduct related to other intrusions.
“According to the indictment, Lauri Love and conspirators hacked into thousands of networks, including many belonging to the United States military and other government agencies,” according to then U.S. Attorney Paul Fishman. “As part of their alleged scheme, they stole military data and personal identifying information belonging to servicemen and women. Such conduct endangers the security of our country and is an affront to those who serve.”
According to the indictment, between October 2012 and October 2013, Love and fellow conspirators sought out and hacked into thousands of computer systems. Once inside the compromised networks, Love and his conspirators placed hidden “shells” or “back doors” within the networks, which allowed them to return to the compromised computer systems at a later date and steal confidential data. The stolen data included the personally identifying information (PII) of thousands of individuals, some of whom were military servicemen and servicewomen, as well as other nonpublic material.
Love and his conspirators planned and executed the attacks in secure online chat forums known as internet relay chats, or “IRC.” They communicated in these chats about identifying and locating computer networks vulnerable to cyber-attacks and gaining access to and stealing massive amounts of data from those networks. They also discussed the object of the conspiracy, which was to hack into the computer networks of the government victims and steal large quantities of non-public data, including PII, to disrupt the operations and infrastructure of the United States government.
To gain entry to the government victims’ computer servers, Love and conspirators often deployed what is known as a “SQL injection attack.” Structured Query Language is a type of programing language designed to manage data held in particular types of databases; the hackers identified vulnerabilities in SQL databases and used those vulnerabilities to infiltrate a computer network. They also exploited vulnerabilities in a web application platform that some of the targeted agencies used known as “ColdFusion.” Like SQL Injection attacks, this method of hacking allowed the conspirators to gain unauthorized access to secure databases of the victims. Once the network was infiltrated, Love and his conspirators placed malicious code, or malware, on the system. This malware created a “back door” or “shell,” leaving the system vulnerable and helping Love and the conspirators maintain access to the network.
0