He's coming home, he's coming... Hutchins' coming home: British Wannacry killer held in US on malware dev rap set free by judge Marcus Hutchins is on his way home to England after a judge spared him a stretch behind bars in America for developing the Kronos banking trojan. Hutchins, the British malware reverse-engineer who shot to fame in May 2017 for thwarting a global Wannacry epidemic by discovering and activating its kill switch, was facing up to …
Too often people are judged on their actions done when they were young and naïve. If the law is involved, often their potential is shut down and they never move forward. In this case, the judge was truly an impartial judge and not a political hack in that position. I wish both Hutchin's and the judge well as we need more like them.
Very refreshing to see a high profile case go well instead of being influenced by politics.
Today’s verdict is a rare sign of sense from an American legal system that all too often seems more focused on hard punishment rather than perspicacity. There is little sense in locking away a talented researcher, who has much to offer the world, over youthful indiscretions.
I think all the comments in past stories about Hutch have been about the illegalities and abuses by the FBI et al. After all they are also part of the justice system. Thank <your chosen deity> for a sensible judge who is not swayed by arguments put forward by "law and order" and those with a political axe to grind.
The complaints are right there in the article, and still valid.
Why was he prosecuted in the US? What damage had he done against US citizens or the USA itself? Is it acceptable to imprison someone for two years on this basis, until eventually you get to see judge? Is seeking prosecutions for this going to help or hinder legal assistance from security researchers?
" the FBI et al. After all they are also part of the justice system. "
Not according to my understanding of civics. The courts and judges are under justice, so the prosecutor and AG are part of justice, but feds are under the executive branch, and the state cops under the state executive*.
Formally the police investigate crimes, and then pass the evidence to the prosecutors, who make the decision.
*feel free to correct me. I believe sheriff's departments are under executive rather than judicial authority.
"so the prosecutor and AG are part of justice"
In the USA, the AG is a member of the Cabinet as the head of the US Department of Justice and as such, part of the Executive branch. One of the AG's duties is as prosecutor, representing 'the people' in court cases.
"The courts and judges are under justice"
Nope. Under the Federal Judiciary. A separate branch of the government from the DoJ.
"Formally the police investigate crimes, and then pass the evidence to the prosecutors, who make the decision."
The prosecutor files cases and tries them on behalf of the people (the government). The courts (judiciary) make decisions. In the USA, courts have little or no investigative (police) powers of their own. They hear cases as presented by prosecutors and defense (or two parties in civil cases).
As for why the prosecution occurred in the U.S., I believe the reasoning was that some of the banks affected were American ones, and at least some victims were American. From that basis, the FBI felt the crime was at least partially under their jurisdiction. From a legal standpoint, the crime could also be investigated and tried in other countries where victims, either banks or users, were located. It's not all that illogical--cybercrime makes it harder to decide where trial should occur, but if victims are in a country, it is within most agreements on international prosecution that the crime can be tried there.
I don't mean by saying this that I support the actions of the FBI in this case. Although I do think they had the right and even the responsibility to investigate the malware, I would have chosen not to pursue the investigation of this small component in the malware given the circumstances, and I don't think his treatment was particularly justified. My statements above are just intended to explain the rationale for the location of investigations and trials.
If you wrote software and then the guys that use target the US without you knowing. Has the software _author_ comited a crime against the US?
If you illegally sell arms you dont get tried for a list of murders.
I agree they should pass info to local law enforcement.
I think lost of people involved believe they have a right to police the world.
"If you illegally sell arms you dont get tried for a list of murders."
Actually that sounds like a pretty good idea, for legal sellers too.
Make creators and sellers of (cyber) weapons at least partially accountable for how they are used. Then they might apply a bit more scrutiny to the people buying them.
Why was he prosecuted in the US? What damage had he done against US citizens or the USA itself? Is it acceptable to imprison someone for two years on this basis, until eventually you get to see judge?
(1) Why was he prosecuted in the US? Because some of his victims were in the US. Most may have been from other countries, but certainly not all.
(2) The victims of his malware were certainly damaged, and as US citizens they deserve some sort of justice -- even is it is only the token $100.
(3) He hasn't been incarcerated for 2 years. He has been free to roam around the US but had his passport held and so couldn't leave until the outcome of the trial.
What you seem to forget is that he was GUILTY, and even admitted so after being shown the evidence against him. This isn't a matter of a baseless accusation.
Yes, his offenses may have been committed when he was only 18, but that doesn't mean that he gets to walk free from them without repercussions. All and all, I think he got a rather fair judgement.
> and that "statute of limitations" bullshit that your rich rapist use
FIFY. Murder generally doesn't have a statute of limitations. Many states are also getting rid of statue of limitations for sex crimes as well since that POS Bill Cosby almost got off. I dare say the rules of game are a little different today as I am sure Mr. Epstein might vouch for. Been around the world and hate to break it to you the rich get away with crimes everywhere. How many people went to jail in the UK for the fraud the banks committed a decade or so ago? Will admit the US justice system is regressive though.
The point seems to be that he didn't use the software nasty against anybody, others did that. He should have been prosecuted in the UK for making and selling this software nasty in the UK. If they can prove he sold it to people in the US, they might have jurisdiction the same way they would with an illegal arms dealer selling weapons into the US.
(3) He hasn't been incarcerated for 2 years. He has been free to roam around the US but had his passport held and so couldn't leave until the outcome of the trial.
Dunno, not being allowed to leave somewhere to go home seems like a form of incarceration, even if the area you are allowed to roam in is large.
Not really - Hutchins pleaded "guilty" to past misdemeanours, so the verdict was "guilty" and he now has a criminal record. The judge took everything into account (as they should) and passed a minimum sentence.
An instant trial or a plea of "not guilty" might have led to the same verdict but a harsher sentence. Swings and roundabouts.
Anyway, I'm happy he's free now.
Its not really pleading guilty if the only reason you do it is to avoid a potential life changing punishment. Once someone says to you "Plead guilty, we'll give you time served, otherwise we'll try for 20 years", everyone will take the deal.
In a country with a fair justice system, he might not have pleaded guilty, he might have pleaded not guilty, and argued that he didn't create malware, just a component that was used in malware.
Plea bargaining is seriously wrong, and I think it is symptomatic of the failure of purpose of America's justice system. People should be sentenced to prison for a period necessary to protect other citizens, and to rehabilitate the offender. It makes no sense to say that if you plead guilty before trial you require less rehabilitation. The American system is solely built around punishment and political engineering, which is why it doesn't work.
What about the plea-bargain offers to low-ranking organised crime criminals who are then expected to give evidence about their bosses?
Not arguing the rights and wrongs, just observing that there are sometimes practical considerations to take into account which might result in a more serious criminal being brought down.
Just give them cash then. If you are desiring them to give you something, why not just at that point offer the hard cold cash it would have cost to put them up in prison or get the conviction by any other means?
Any answer for "but cash would not work" or "would be wrong", then also applies to the plea bargain... it's a payment either way.
A lot of the bad stuff that was said in Register forums about the USA justice
You mean the obvious comments about incredibly long sentences handed out for what would be perceived in the UK as a misdemeanour or the seemingly one way extradition process between the UK and the USA? This is but one case that we have seen where "justice", insofar as it applies in the USA, has been seen to be done.
The US 'justice' system has form.
To take just one techie example, they arrested Sklyarov and held him for some time, before allowing him home and eventually dropping the case. A massive violation of basic rights for someone whose life, home, family and job are elsewhere, in their own country.
A lot of the bad stuff that was said in Register forums about the USA justice has turned out to be unfounded in this case. The wheels of the system have turned and the outcome is not at all draconian or arbitrary.
Oh, I don't know. This is literally a plea deal to get his life back. It's been two years and if he'd insisted on pleading guilty the FBI could likely have stretched out a court case to last much longer whilst they went foraging for more evidence. Plea bargains are an affront to justice (plead guilty or we will tie up your life for the next 5+ years).
We can infer this given some of the vexatious charges initially levelled against his bail (went to a shooting range in Vegas, just like every other tourist FFS) and the throwaway sentence that the Judge has delivered and the suggestion that a pardon or waiver may be in order to allow him to re-enter the US indicates the FBI hadn't really got anything of substance. But they can afford to string their suspects along indefinitely if it pleases them. Given their exceptionally weak showing to date, it seems like Hutchins may well have been found not-guilty had it actually gone to trial. But the FBI would have made sure that verdict wasn't reached this decade.
The judge is quite clearly of the view that this is a non-case, and he's giving Hutchins the minimum he can be seen to get away with given that he has technically pleaded guilty. So yes, the Judge has delivered, but a judge can only judge the case in front of them and often do not have the jurisdiction to reach out and stop the FBI playing procedural silly buggers.
"Possession of burglary tools" is illegal in most jurisdictions in the US, and if you make them you have to possess them at some point, so the answer to your question is yes. There are exceptions for people making e.g. lock picks to sell to locksmiths, but I imagine they have to be licensed.
The republicans pushed through laws granting immunity for gunmakers from lawsuits stemming from their use, so they're spared from that concern.
It's a little different in the UK, because possessing tolls that can be used in a burglary is not a crime. They are after all 99% of the time regular household/work tools.
But there is a piece of legislation regarding 'going equipped to commit' so if you are caught out and about with tools that are used in breaking and entering... You can be charged with an offence.
"Possession of burglary tools" is illegal in most jurisdictions in the US, and if you make them you have to possess them at some point, so the answer to your question is yes. There are exceptions for people making e.g. lock picks to sell to locksmiths, but I imagine they have to be licensed.
That word there - "imagine" - means you couldn't be bothered to google your nonsense before typing.
And it is absolute nonsense. "Locksport" is a growing thing across the world, including the US.
It is absolutely not an offence to possess lockpicks, any more than it is an offence to possess bolt cutters or a hammer (though I do not discount that some local city/district or even a state may have passed well-meaning but over-reaching legislation in this area, but you certainly can't generalise).
Now if you're poking round the back of someone else's house at 10pm with a set of picks, then yes, questions will be asked - but that is the offence of "Going equipped to burgle". It is a combination of both possession and circumstance/intent. Simple possession on it's own is not an offence, nor even possession in a public place ("I'm going to my local Maker Space/Locksport meeting guv'nor").
That's why in decent countries weapons are highly regulated. Should they regulate software too? If you write malware to be used in a banking trojan you're not writing a regular piece of code, and you know what it will be used for - especially if get paid for it by crooks.
I'm happy he outgrown it and prefer to help against that now, but he made a big stupid mistake and people suffered from it. Maybe if you had your share of troubles because of it you would think differently.
The judge took the right decision, but it doesn't mean his past behaviour was good, right and legal.
> "Nothing in the judgment requires he stay in US. I'm seeking to avoid him being taken into custody by ICE. We don't need any more publicity or another statistic," he said.
It comes to something when a judge has to play the system to stop another government department from behaving badly
In legal terms in American (and others') immigration systems, everyone who comes to the country and isn't a citizen is an immigrant. When they leave again, they're no longer an immigrant. I think they started doing that after science fiction made the term "alien" applied to a person sound really strange. Current American anti-immigration policy has been enforced strongly against, well, almost everybody, but definitely if a criminal record is involved. Since he wasn't planning to move to the country, only visit for a while, he wouldn't have the required paperwork and could be held up unnecessarily because the program that has a big list of names doesn't include much complexity in its algorithms. So the judge just wanted to send a message that this is under control, and there is no need for more chaos than they already have. We'll see if that goes anywhere.
Tsk, tsk, failing to keep up with modern British usage, as used by Our illustrious leadership, the engorged organs of government and the willing mouthpieces that are the Mail, Telegraph et al.
He's white and from a first world country, so the proper term is "visitor", "tourist" or, was he planning on staying, "expat". The term "immigrant" is reserved for black people, asians or eastern-europeans.
Ingsoc expects your correction.
Ah, welcome to my ethics class :)
One take home questions I'd give students is: "How many patient's lives should a doctor save before they are allowed to murder someone?" with the follow up of "How many patient's lives should a doctor save before they are a pardon for murder?" and contrasting the two.
It's an indirect way of thinking about how we weight intent versus action. It's the same question, but set in different time.
I do like the answers I get. Young people are very anti-murder :D The catch-22 answer was quite good "One more than currently have" or the "A doctor could be allowed to murder someone, and still would not. Because doctor."
And therein lies the problem.
You are giving someone permission to forgive/pardon. Therefore they have permission to.
The better question is "does saving a life undo a murder". The answer is no. But we can still forgive if someone honestly changes. Unlike the opposite, "does saving a life allow murder", in which case we generally do not see that as correct!!!
Actually, you are able to kill someone in order to save a life (your own or a loved one/dependent - not sure about the definition here) in self-defence.
I mean, you aren't allowed to *deliberately* kill someone in self-defence, but if it happens as a result of you defending yourself then it's more likely you'll get off.
My warped brain came up with this:
So, if I murder someone and then go on to sire 100 or so babies, does that cancel out my misdeeds????
Only if you can prove that EVERY SINGLE ONE OF THEM were living saints. One traffic offense, and you are in for it
They don’t have appeared to have proved US harm or jurisdiction.
America World Police indeed.
More and more America appears indistinguishable from a banana republic. Was any evidence even entered other than his forced confession that he engineered Kronos?
No downvote because I agree the system is pretty jacked up, but where is your evidence the confession is coerced?
We have to be careful with hyperbole. It doesn't help ones cause.
I know coercion is used but I've not read anything in the Hutchins defense suggesting his counsel expressed concern about the plea... We all do stupid things when we are kids. Some of its actionable. Sometimes (usually?) a guilty plea means ... Guilty. In this case the good outweighed the bad when he had his day in court. Other than the two years he pissed away waiting, I'm rather glad with the outcome
I've never seen a hacker using a touch screen to write some code, nor have I have I heard of an attack being launched by touch device operating.
However.. What if we think of the mouse?.... Do hackers also use mice or are the eponymous rodents like wearing seat belts in cars and keep people being naughty in sight of the law?
Paris because duh..
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
