Pages

Sunday, 30 May 2010

A Skeptic Looks at the McKinnon Case: Part One

This is the first of a series of blogposts looking at the well-known and controversial case of Gary McKinnon.

What interests me about this particular case is the fundamental mismatch between, on one hand, the passionate campaign in his support and, on the other other, the continued upholding of the decision to extradite by the Home Office and the English court system.

This mismatch made me wonder whether either the campaign or the upholding of the decision is misconceived.

In other words, and in accordance with the subtitle of this blog (see above):

Is the legal position being misrepresented?

Or is there a misuse of law?


It would appear that the McKinnon campaign have succeeded in promoting a widely-held view that this case is a miscarriage of justice.

There may be those whose opinions on the McKinnon case are so strongly held (one way or the other) that they see no point for this blog to examine the case in a source-based and skeptical manner; if so, they are welcome to scroll down to the comments box to now type away and, subject to the comments moderation policy, their comment will be published.


However, for those who want to base their opinions - especially very strongly held opinions - on sources, then I set out below the first part of my examination of the McKinnon case.

This is culled from a far-longer piece I am writing, but it became too unwieldy for a single post.

This first part sets out the procedural history of the case and the actual allegations which the US government are making against Mr McKinnon.

(For your information, I personally oppose the extradition for reasons which will give in the last part of my examination of this case.)



The Procedural History

The alleged criminal activity of Mr McKinnon took place over thirteen months, from February 2001 to March 2002.

He was interviewed under caution and his computers seized on 19 March 2002, and he was again interviewed under caution on 8 August 2002.

In November 2002, the East Virginian US District Court charged this Indictment (which should be read in full by anyone interested in this case). The New Jersey US District Court also charged this Indictment

As to what happened next, until May 2006, para 21 of the first High Court judgment here sets out the US explanation.

(Of particular note here are the plea bargain negotiations of April 2003 to June 2003, on which more in the second part.)

On 10 May 2006 (after it appears a year of adjournments), Bow Street Magistrates' Court acceded to an application made on behalf of the Government of the US government and sent Mr McKinnon's case to the Home Secretary for a decision as to whether or not Mr McKinnon should be extradited. The decision to proceed with the extradition was made by the Home Secretary on 4 July 2006.

On 13 and 14 February 2007, the High Court heard Mr McKinnon's appeals of the decisions of the District Court and the Home Secretary on the basis of a wide range of human rights and abuse of process arguments.

On 3 April 2007, the High Court in a reasoned judgment dismissed the appeals: read the judgment here.

On 16 June 2008, the House of Lords heard Mr McKinnon's appeal of the High Court decision. In a unanimous and reasoned judgment given on 30 July 2008, the House of Lords dismissed the appeal: read the judgment here.

(On 28 August 2008, the European Court of Human Rights refused Mr McKinnon's application for "interim measures" so as to stay the extradition.)

Within four weeks of the House of Lords decision, Mr McKinnon was diagnosed as suffering from Asperger's syndrome. There is no reason to doubt this diagnosis, and such late diagnoses are not uncommon.

This diagnosis enabled Mr McKinnon to have a new legal basis to challenge the extradition decision.

The Home Secretary was asked to reconsider the extradition decision, but the decision was made to continue with the extradition on 13 October 2008.

Permission to apply for "judicial review" of this new extradition decision was granted on 23 January 2009, but the substantive application for judicial review was refused by the High Court on 31 July 2009, and an application to appeal that refusal was also refused on 8 October 2009.

So, in summary, other than obtaining permission to apply for judicial review, Mr McKinnon's case has not succeeded before the Magistrates' Court, the Secretary of State, the High Court, the House of Lords, the Secretary of State (again), and the High Court (again).

And, other than obtaining permission to apply for judicial review, each single judge has decided against Mr McKinnon's case.

If the McKinnon Campaign is correct in that Mr McKinnon's case represents a fundamental miscarriage of justice, then this uniform rejection of his case by each court and each judge is extraordinary, and it would be a matter for the gravest concern.


The Allegations

It is sometimes not clear from the reporting on the McKinnon case what are actually the allegations against him.

For example, Geoffrey Robertson states:

"In 2002, from a council flat and with a battered first-generation laptop, McKinnon hacked into US army computers with a gusto and brilliance attributable to his Asperger's. He left a polite message of political protest against the post-9/11 Bush administration: 'US foreign policy is akin to government-sponsored terrorism these days.'"

As we will see, this is not an altogether accurate description of the allegations; even the date he gives is perhaps misleading.

The allegations against Mr McKinnon have not essentially changed since the original charging by the East Virginian and New Jersey US District Courts in 2002.

In summary, taken from the April 2007 High Court judgment, the allegations can be described as follows:

- that for thirteen months, Mr McKinnon gained unauthorised access to 97 US Government computers, see para 3 here;

- that Mr McKinnon deleted critical operating system files from nine computers and this led to a 24 hour shutdown of 2000 computers in the Washington network of the US Military, see para 4(1) here;

- that Mr McKinnon deleted 2,455 user accounts on one particular US Army computer, see para 4(2) here;

- that Mr McKinnon deleted system files and logs from computers at the US Naval Weapons Station responsible for the identity, location, physical condition, staffing and battle readiness of US Navy ships, rendering the station's entire network of over 300 computers inoperable at a critical time immediately following 11 September 2001, see para 4(3) here; and

- that Mr McKinnon copied data, account files and passwords onto his own computer, see para 5 here.

Mr McKinnon also left the following message on one Army computer:

"US foreign policy is akin to Government-sponsored terrorism these days … It was not a mistake that there was a huge security stand down on September 11 last year … I am SOLO. I will continue to disrupt at the highest levels … "


These are, of course, only allegations; there has not yet been a trial.

However, it would appear that forensic analysis of the computers seized from Mr McKinnon confirms these allegations (see see para 7 here).

It also appears that the alleged activity, if not the damage caused, was admitted to by Mr McKinnon in his two interviews under caution, see para 8 here.


One wonders whether these allegations are more serious than many of those who have strong opinions about the case realise, especially those allegations which go beyond mere unauthorised access to extensive file deletion and the file copying.

Here one can note that the High Court said of the submissions of Mr McKinnon's barrister ( para 30):

"In our view Mr Lawson has tended to understate the gravity of the offences which Mr McKinnon is alleged to have committed. At the same time he has tended to overlook the fact that, if prosecuted and convicted, the equivalent domestic offences include the offence under section 12 of the Aviation and Maritime Security Act 1990 for which the maximum sentence is life imprisonment."

And this was repeated by the House of Lords at para 38 of their judgment:

"As the Divisional Court itself pointed out (at para 34), the gravity of the offences alleged against the appellant should not be understated: the equivalent domestic offences include an offence under section 12 of the Aviation and Maritime Security Act 1990 for which the maximum sentence is life imprisonment."


The starting point for any sense of injustice in this case must surely be the seriousness of the allegations.

But - in my view - the allegations are more serious than are commonly represented.

Indeed, the allegations appear - again in my view - to have been misrepresented by those campaigning against the extradition.

However, this does not make such allegations true, and certainly not proven.

And even it the allegations are serious, they are not determinative of any exercise of mercy.


In Part Two, later this week, the failed plea bargain and the relevance of the Extradition Act 2003.



COMMENTS MODERATION

No purely anonymous comments will be published; always use a name for ease of reference by other commenters. Flaming and venting comments are also unlikely to be published.

51 comments:

Chris Nicholson said...

I'll try to add this as a first comment (as a Gary McKinnon supporter and a friend of Janis Sharp, his mother) that will be moderate. Hopefully that will impact others who might leave more inflammatory posts.

I have two issues with Gary McKinnon's extradition itself. As a web developer, I find it near-impossible to believe the bits of the case which allege criminal damage. From the equipment he was using, it would be near-impossible for that amount of damage. Secondly, the fact that he hacked into US military machines *is* a crime and he should be appropriately tried in a Court of Law - I just don't see it as necessary as carting him thousands of miles away to do it. There's scope for having US officials come over here or (for goodness sake!) use teleconferencing!

As for the Extradition Act itself, I think it's terribly flawed and a worse miscarriage of justice via the Act can be better measured against it's use against Brian Howes family in Scotland. I thoroughly recommend you get up to speed on the Howes family's troubles with the Extradition Act, as it doesn't even look like him and his wife have committed a crime!

Daniel Rendall said...

Thanks for writing this. I'd sort of absorbed the received wisdom that McKinnon was merely a loner searching for evidence that the US were covering up UFO activity or whatever the story was. I wasn't aware of the severity of the allegations of damage to the US networks.

I'm against the extradition on the general (and very possibly spurious) grounds that I don't believe the US would be terribly forthcoming if we wanted to extradite a US citizen to face trial for an equivalent offence here. The US always strikes me as a nation which is all in favour of the rule of law when it's in their interest, but are rather snooty about the idea of anyone else (e.g. the International Criminal Court) having jurisdiction over them. I'm not a lawyer, so I could be completely wrong about this, of course.

But anyway, I'm now satisfied that McKinnon does have a serious case to answer and I'm looking forward to the subsequent posts...

Mark dj A said...

Interesting. Please be understanding of the family in the next bit - it's a hard fight for a son's life

Elaine said...

The allegations changed in the superseding indictment, in that the six american universities he accessed were dropped from the charges, because they refused to go along with the allegations of damage.

The allegations of the damage and of fraud (stealing passwords) have been refuted in court, and acknowledged as 'an embarrassment to the prosecution' by Lord Justice Stanley Burnton. Then head of the case, CPS laywer Russell Tyner agreed. Forensic IT expert Professor Peter Sommer showed that the $5000 per machine represents nothing more than the cost of installing the basic security which the US military were legally obliged to have on their machines in the first place. Please note also that $5000 per machine coincidentally is the exact threshhold amount of damage required in order to create an extraditable offence.

Regardless of the seriousness of the allegations, there is not only the lack of evidence to consider, but also the fact that the quality of the evidence presented demonstrates quite unequivocally that Gary McKinnon did not cause an ounce or a dollar of damage.

I could accuse you of murder, which would be a pretty serious allegation, but that wouldn't mean you automatically had a case to answer, especially if the person you're supposed to have killed is still alive.

Unsubstantiated allegations notwithstanding, the only evidence or admission (which incidentally was made without a lawyer or appropriate adult present) is to Computer Misuse Level1, which was not extraditable.

The fact that the extradition proceedings did not fail is indeed extraordinary and a matter of grave public concern - hence the scale of support for Gary among those who are in possession of the facts.

Jack of Kent said...

Dear Elaine

Thank you for your comment; please source the contentions you make.

Many thanks.

Aidan Skinner said...

@Chris
As a web developer, I expect you are used to logging into remote systems and know that once you have access you're essentially using the local computer as a screen and keyboard attached to the remote computer. The processing power, storage capacity etc. of the laptop are more or less irrelevant.

Therefore, causing damage to a machine that you have remote access too is pretty trivial regardless of the equipment you're using locally.

Jared said...

It's too easy to get caught up in the minutiae of the case and miss the big picture. First and foremost, this case highlights the uneven extradition treaty we have with the US.

Yes, he hacked into computers, but he did so from the UK. Yes, he could have easily damaged data, yet any damage he did would have been instantly reversible unless the US are trying to cover up obvious lax security and server administration on their part.

Jack of Kent said...

Dear "Anonymous" - please read comments moderation policy and re-submit comment.

Aidan Skinner said...

@Jared computer backup and restores are not instantaneous or perfect. With even the best systems in the world there will be data loss and disruption to current users.

By all means highlight the inequity of the extradition act (which, from my PoV, points to why we need a written constitution), but attempting to minimise the extent of damage with vague handwaves of "they should have better IT dept. then" is not helpful.

Jared said...

@Aidan I realise restores carry a risk (I manage servers for a living) but it appears to me that the language used by the US is precisely that of someone 'sexing up' a case to get the accused extradited.

Sure, McKinnon did it and, Aspergers or not, should face trial, but not extradited on the extreme charges laid out to a country that tortures accused terrorists.

He cocked up, but he deserves a fair trial, which I feel he will not get in the US.

Dr. Brian Blood said...

JoK, many thanks for the first element in this important survey.

When you are writing the second (?) part you might like, if you have access to relevant cases, to review the present state of play as regards Asperger's and criminal responsibility. So far I have found a few useful(?) links:

http://www.ncbi.nlm.nih.gov/pubmed/17294982

http://www.iafmhs.org/files/Murrie.pdf

http://www.informaworld.com/smpp/402019396-3585956/content~db=all~content=a910559190

http://www.hmcourts-service.gov.uk/cms/144_11488.htm

These suggest that there is case law on this although from the limited access I am unable to say quite where things stand at present.

As for those who suggest that the US was at fault for not having in place adequate security against such a cyber-attack, I must remember to mention this to my bank manager next time we discuss the current state of bank robbery. It would appear that this is entirely the fault of the banks.

Aidan Skinner said...

@jared which words are "sexing up"? 4.1-4.3 are all pretty bland statements of fact providing you read "critical operating system files" as "files which are necessary to the operating system" and I'm not really sure you're arguing that "just after 11 september 2001" wasn't a critical time for the DoD.

As I said, I think there's an argument to be made about the extradition act, but trying to downplay the seriousness of the offence or blaming the victim is not helpful.

chango said...

@Aidan. This is a bit crude, but:
"it appears to me that the language used by the defence is precisely that of someone 'sexing down' a case to assure the accused isn't extradited."

could work just as well from a neutral's perspective.

chango said...

Think I meant @jared

Dr. Brian Blood said...

A few more Asperger's and criminal responsibility links:

1. http://www.psychologytoday.com/blog/radical-behaviorist/201004/aspergers-syndrome-trial

2. http://www.jaapl.org/cgi/content/full/33/3/390

3. R v Jama (CCC) (Homicide) - Asperger's Syndrome as a basis for diminished responsibility
a case reference taken from: http://www.doughtystreet.co.uk/barristers/edward_rees_qc.cfm

4. http://www.hmcourts-service.gov.uk/cms/144_14197.htm

5. Letters taken from LRB Vol. 30 No. 18 · 25 September 2008

Proper Worksop

‘There is no “why”,’ Jonathan Raban writes of the Neil Entwistle case (LRB, 14 August). No explanation is going to be complete, but the details of Entwistle’s personal and family life, the extreme impoverishment of his emotional capacity and imagination, and his inability to plan ahead and solve problems, lead me strongly to suspect that he suffers from Asperger’s syndrome.

This is a type of autism, and more generally a form of enduring personality disorder. Serious, unpredicted and largely unpredictable violence has in recent years been recognised as an
infrequent feature of Asperger’s cases. Sufferers lack the emotional wherewithal to establish a secure identity: they are extreme conformists, but also copycats – they can switch on and off

according to their needs. The internet offers an obvious place of refuge for them.

It is difficult to talk of ‘motive’ in such circumstances. The sufferer’s powers of discrimination and judgment, and therefore of problem solving, are so reduced that even the mildest
challenge can seem insuperable and overwhelming. We have evidence in Entwistle’s case of a characteristic inability to plan even small matters of domestic finances. He appears to have felt
increasingly isolated, without family or institutional support (his wife seems not to have been taken into his confidence) possibly for the first time.

In Britain, Asperger’s syndrome fulfils the criteria for a legal defence of mitigation on psychiatric grounds; in the case of homicide, it allows for a plea of ‘diminished responsibility’ under the Homicide Act (1957). Several such cases have been heard in recent years.

Christopher Cordess
Emeritus Professor of Forensic Psychiatry University of Sheffield

6. http://www.scriptphd.com/?p=580
From the Annals of Psychology: 'A' is for Adam (and Asperger's)

7. http://www.bloggerheads.com/guido_fawkes/2007/04/honest-john.html

I hope these might be useful.

A general comment though. Should 'mental incapacity' be something considered by the prosecuting authorities when deciding whether or not to prosecute or a matter to be considered by the trial judge. In matters relating to extradition, does this mean the judge allowing extradition, or the final trial judge, in this case in the US.

David Colquhoun said...

You asked for an opinion but it's hard to give one in the light of such conflicting reports about the seriousness of the damage that was done. Someone is lying but I don't know who.

I do know, though, that the extradition act was a grossly uneven it of legislation that was a consequence of Blair's obsequious obedience to Bush's every wish. it should be repealed as a matter of urgency.

I also believe that penalties like life imprisonment would be grossly disproportionate, even if operating system files were deleted. Nobody should be extradited to countries that impose cruel and unusual punishments like that.

I'll admit to a slight bias, in that I'd rather like it if all military computers in the world could be inactivated, but that isn't a legal question.

raincoatoptimism said...

So far so good JoK.

It's most interesting that you felt the need to mention that reporting on the case has often left us confused as to what the allegations consist of.

I think this is probably true, and has often stung people who, we must admit, only have the best intentions at heart. The mess of artists and musicians, like Pink Floyd, who came out in support can be forgiven for their slapdash reasoning, but the following is the reasoning of Jane Asher, president for the National Autistic Society. She was:

'“horrified” at the way Gary was being treated by the criminal justice system. People with Asperger Syndrome, a form of autism, might appear normal but are often “extremely vulnerable"'

Views such as the above, and other examples, have often been the cover with which critics use to suggest McKinnon couldn't have any idea what he was doing. One wonders how far this view could be taken; could this view be used to justify McKinnon being let off altogether?

JoK will spell out the legalities here in the next 3 parts, and hopefully put forward a convincing case for why McKinnon should not be extradited, but this is just one part of the argument. The other part of the argument is the one spelt out in the 2002 indictment, namely that 'Gary McKinnon knowingly and wilfully caused the transmission of commands via the Internet'.

How do critics, like the one I exemplified above, go about squaring the circle of knowledge and willing on McKinnon's part in light of the accusations made against him (I shall bear in mind that at the moment these are just allegations)? Particularly the allegation that McKinnon posted on an army website:

"US foreign policy is akin to Government-sponsored terrorism these days … It was not a mistake that there was a huge security stand down on September 11 last year … I am SOLO. I will continue to disrupt at the highest levels … "

-Are these the words of someone who isn't aware of what he is doing (naive I'll concede, dangerous for sure, but unknowing?)? I know that these critics are good-hearted, but is it not at best slightly patronising, at worst dangerously deceptive?

The bulk of the criticism is for the exradition, which gives me little reason for concern, but it is a little disconcerting what lies beneath using McKinnon's apparent Asperger's as a reason not to criminalise him.

I look forward to the debate. Cheers. Carl

Nick Gordon said...

Thanks for starting with a summary of the facts. I know it's a bit 20th century to have some actual data, but I find it helpful.

To those who've already made up their minds I say "allow the rest of us the same privilege"

Way to go JoK

John Collins said...

Personally I think the alleged damage which McKinnon is supposed to have perpetrated is an obscene and monstrous exaggeration. I just do not believe it.

But if the US DoD has such lax security, lack of passwords, insecure OSes (i.e. Microsoft) and firewalls that a single person can crack it with an ancient laptop, frankly they deserve all they get and it should be DoD personnel on trial not McKinnon.

MattJ said...

I'm confused by the nature of some of the charges, particularly the part about deleting essential OS files but that's besides the point really, my personal view is that the US military were deeply embarrassed by laughable security of their systems so they went all out with these charges.

Like most people I only have hearsay and 'reporting' to go on, and even though I've been following the case since it began I am shamed to discover that anything I 'know' about it is merely received opinion or 'something I read' over 5 years ago.

The thing that sticks in my head the most, and I really need to find the source before anyone takes my word on this, is that the '....that damage caused loss aggregating more than $5,000 in value
during a one-year period...' is a particularly important phrase, and it appears in everyone of the charges.

I believe its the threshold required to 'up the severity' of the charge? I am going to go away and look it up now, but I suspect you will be addressing that particular point in future posts.

I think I'm with the majority, try him for the crimes he committed, not for the egg on the face of the US Defence Department.

Chris Nicholson said...

@Aidan I wrote that in a hurry, I actually meant the software he was using too, not just the hardware. It would be very difficult to cause that amount of damage.

Kevin said...

Couple of points:

As a Sysadmin it's shocking to me that these vital military systems were not almost instantly reinstated. Even without hot spare machines standing by (which I would have thought was a minimum) almost any server operating system allows for regular snapshots allowing you to instantly revert to a pre-hacked state (eg Shadow Files, ZFS snapshots, LVM snapshots - even any desktop Mac has Time Machine, not instant but quick). That's before we look at the lax security that allows an amateur hacker access.

As an aspie I'd say I find it difficult to identify with many of the characterisations and descriptions of Mckinnon. Remember the S in ASD stands for "spectrum" so there is a huge range from barely functioning individuals to many of the geniuses, musicians, actors, authors who have made the modern world what it is today. I'd recommend reading Tony Atwood's book to learn more. Or Kamran Nazeer's "Send in the Idiots". Asperger's means that many social skills that neurotypicals find natural have to be learnt (or copied - lots of aspies go into acting) and can lead to obsessive behaviour - Mckinnon's special interest in UFOs.

TBH his asperger's is a little bit of a red herring - it is the extradition that I have a problem with. He should be tried and sentenced here. The US have been publically embarrassed by a foreigner and instead of admitting they were caught with their pants downneed to make an example of somebody else.

Murray said...

I'll need to read all three parts before I can make any valid critique of your blogposts, but so far I'm intrigued.

I first heard about Gary McKinnon on the BBC World Service back in 2005. Here's that interview in full, in case anyone's interested:

LISTEN HERE

Charles Barry said...

As a person who has a moderately good understanding of being a sysadmin, I am shocked at the reports of the inadequate setup of the DoD computers. It's just incompetence.

It seems to me that because this is all to do with computers, people have a difficulty understanding how serious those allegations above are. To many people, computers are all about word documents and boring emails.

So let's transpose things into the physical world.

Imagine if Mr McKinnon had broken into your home, and stolen your tax documents, your will and your pay-slips. Imagine that while in your house he had taken a chainsaw to your bed, a hammer to your tv and a match to your family photos. Imagine that at the same time he had ripped out your electrical wiring, destroyed your boiler and spiked your milk in your fridge. And then imagine that to top it off, before leaving, he had left a death threat on your kitchen table.

Because that is the exact parallel of the allegations detailed above, and if they are true, detracting from them on the grounds that because it was using a keyboard, and not a stanley knife, or because all he broke was a password rather than a patio door, it was somehow not the same sort of crime.

And saying that the US passwords were too weak or that "they were asking for it" is no defence either. Even if the door was a little loose on its hinges, it's still breaking and entering to enter without lawful authority. If a fence has fallen over, it's still trespass to cross over it.

(Although JoK may spring up to refute that with some case law I've never heard of before)

I'd just also like to go out on a limb and say that I think that the extradition was probably the right thing to do.

I think that ultimately you should be tried for your crimes closest to where you have committed them. If you break the law in Rome, you should be tried there.

Of course, if the British government, and by extension its people, believe that the allegation is totally wrong (eg Malaysia indicting David Laws for sodomy) or the case is not proven, or alternatley if we think the right to freedom from torture or the right to a free trial will be breached, the extradition should not occur.

But in Britain, we think the law on illegal hacking is right (that's why we have equivalents), and if I recall correctly, the British courts found that there was a prima facie case to answer.

Of course, political views seep into this particular section, but I don't believe that extradition to the US is "carting" anyone anywhere. The US has an excellent criminal justice system. (Of course if you think the US is an imperialist neo-con neo-liberal fascist totalitarian state then of course you won't agree with that last point)

And with all due respect to Asberger's syndrome sufferers, as I understand it, using this disorder as a defence (eg diminished responsbility) or as a mitigating factor at a sentencing has never been a reason not to hold the trial in the first place.

Anyhow, rant over. I am sure many others will demolish my case, especially JoK in subsequent posts. But I think it's important to challenge "the conventional wisdom" that this is all a massive miscarriage of justice.

When the Daily Mail goes on a rant about why alleged Muslim Terrorists aren't being deported to Pakistan but runs a campaign to prevent an alleged computer hacker from being - deported - to the US, I think it's worth being consistent.

Gordon Banner said...

Jack,
In your preamble you focus on the mismatch between the success of the popular campaign and resulting popular perception that McKinnon is being mistreated, versus the many official decisions against him.

But surely the two are not inconsistent? If there is clear (albeit bad) law, then I'd assume courts must follow that.

My non-lawyer's understanding is that many of the recent decisions that broke new ground on human rights etc were using ambiguities and "wriggle room" in interpretation. Is this case different simply because the law is clear and there's no scope for a judge to use discretion?

If so, then any resultant unfairness is not due to a technical failure of the courts to apply the law correctly but to a failure of Parliament to pass a law that achieves what it intended and/or what the public intuitively feel to be "right".

It would not be the only piece of legislation to have been passed in recent years which seems to have been inadequately scrutinised for unintended effects.

Machine.Elves said...

Charles Barry wrote:

"Imagine if Mr McKinnon had broken into your home, and stolen your tax documents, your will and your pay-slips. Imagine that while in your house he had taken a chainsaw to your bed, a hammer to your tv and a match to your family photos. Imagine that at the same time he had ripped out your electrical wiring, destroyed your boiler and spiked your milk in your fridge. And then imagine that to top it off, before leaving, he had left a death threat on your kitchen table.

Because that is the exact parallel of the allegations detailed above"

Really? The DoD folk got to work and found a death threat against them personally? Then went to make a coffee and found their milk was spiked?

Forgive me if I consider your "exact parallel" simply hyperbole.

john b said...

Imagine if Mr McKinnon had broken into your home, and stolen your tax documents, your will and your pay-slips. Imagine that while in your house he had taken a chainsaw to your bed, a hammer to your tv and a match to your family photos. Imagine that at the same time he had ripped out your electrical wiring, destroyed your boiler and spiked your milk in your fridge. And then imagine that to top it off, before leaving, he had left a death threat on your kitchen table.

No, doesn't work. My house doesn't have instantly recoverable backups of it stored, which would allow me to reinstate my bed, TV, photos, wiring, boiler and milk in seconds. If it did, then the offence above wouldn't be particularly serious.

carolinepanico said...

I apologise to the many intelligent and complicated replies here. I have only read a few and I can't read all the links you gave in your article JoK because I have some sort of issue reading large blocks of writing that are constructed in an unfamiliar way. However from what I can see, Extradition is probably not the best route for the reasons outlined above, and yes, I believe he should answer the alligations which have been prooven to exist.
Although I feel generally people should be made more responsible for their actions and I take a previous commenters and particularly one note on how anyone saying that he shouldnt have been able to hack in should consider an armed robbery of a bank situation; however it is still unerving and almost inconceivable that in this day and age high level security is not better protected and that it took so long for the hack to be discovered and acted upon. As a mother having lived with a Child who has Aspergers who is now 17. I believe that although impulsivity can re occur time and time again, to maintain a high functioning focus which (seems) to evolve over time requires something beyond the confines of this disorder. For example, my son has been in trouble with the police, he got caught stealing a can of coke and some after eights from a high street store. When asked why he stole them, he recounted how no one was in at home and he was hungry and thirsty. It is exactly this type of impulsivity which is often linked with disorders on the Autistic spectrum. I asked him why he stole the after eight mints, and he said they were the closest thing to him at the time. Of course the alligations shown here are way more serious but just a final small note, it has been reported that Mr McKinnon is experiencing suicidal thoughts or behaviours. This is common in people with Aspergers suffering a trauma of some sort (but also lots of other unaffected people too). I hope that sufficient care is being offered him, and also his mother. Because if she has brought him up and he has Aspergers then she deserves the same medal I'm hoping to get in about 20 years!

Nick Sharratt said...

@Charles Barry two points:

You suggest a person should be tried where the crime was committed - well, as the person was in the UK when they committed the acts alleged, he should be tried here and under UK law. The _consequences_ of the acts happening elsewhere should not distract from where the act was committed.

Second, your analogy to the physical world is seriously flawed as others have pointed out. I suggest a closer analogy would be:

He found a flaw in a make of door which had been recalled by the manufacturer and which most people with any sense or care for their property had therefore had fixed. He decided to see if some people hadn't had their doors fixed and as a result found he was able to walk into a house without causing any damage or leaving more than the slightest trace he'd been there.

Once inside, he tampered with the door so he'd be able to get in again even if the door were later fixed and proceeded to wander around from room to room snooping for anything interesting.

He then repeatedly revisited the house right under the noses of the occupants for many months without causing any significant disturbance that was noticed by anyone (creepy yes in this context)

Some time later he got bored (speculation as to motive) and decided to mess up the locks so no one could get in (deleted user accounts), tried to remove the slight trace he'd left of being there (deleted log files) and in the process it seems accidentally also trashed the system used to maintain the doors.

At the same time, the occupants of the house were particularly sensitive to this as they'd had their other homes smashed into by 3 planes and completely destroyed so were very paranoid and suspicious of the whole world. They then noticed all the flawed doors they had and paid people a load of money to fix them and generally address their appalling lack of attention to security previously, getting alarms for the whole house etc, costing a fair bit but which everyone else had assumed they'd have had in place long before since they looked after so many important things on behalf of lots of other people.

They also suspected the worst and decided to get all their mates to help them track down the person who'd done this damage and punish them. When they found he lived at their the house of an obsequious acquaintance of theirs (who always tried to be their best mate) they asked for them to hand him over.

There is no clear case presented in the accusations that convinces me of prolonged malice. In fact, the assertion that these acts took place undetected for a long period indicates the opposite, and that only a single act of deliberate sabotage was conducted and in such a way which should have been trivial to address - perhaps like a kid daubing graffiti on a bill board which could be easily white washed or just posted over.

However, that is based on reading between the lines rather than specific evidence - but so was your analogy. You just choose to interpret it with damage that was personal, expensive and wide spread.

Mark T said...

Interesting post; I hadn't realised how substantial the damage is that is alleged to have been done, which is causing me to question my original attitude to whether he should be extradited.

As for the issue of where the crime was committed, in my view it's the US and for the following reason: the account and file deletions (i.e. damage) occurred there. I say this as a person without any legal training, simply as what I think is sensible and fair.

If I take remote control of a computer, any actions I take, whilst initiated from my location, actually occur at the remote one. My local computer is merely a window onto the remote machine - it's the remote machine's CPU, HDD, etc. that are actually carrying out the task. My local computer is merely issuing commands to it, just as if I was sitting at the remote machine and issuing them directly myself using its keyboard and mouse.

I look forward to the subsequent posts in this series.

JuliaM said...

John B seems to believe that as long as you can instantly put right any damage, no real crime has occurred...

It's an interesting theory. But I think I prefer the laws here on Planet Earth.

SimonC said...

@Nick Sharratt:
"You suggest a person should be tried where the crime was committed - well, as the person was in the UK when they committed the acts alleged, he should be tried here and under UK law. The _consequences_ of the acts happening elsewhere should not distract from where the act was committed."

But you've only asserted that the location of the alleged criminal is where the crime is committed; there's no real justification for this that I can see, and I don't think it stands up when talking about acts performed on distributed systems. While McKinnon was undoubtedly sat in the UK, any commands he sent while logged on to the DoD's computers would have been executed in the States.

So no, it's not the case that the act took place solely in the UK, and it seems that transnational cybercrime jurisdiction does indeed take such details into account. Both the UK and USA have a jurisdictional claim here; either the UK have chosen not to assert theirs, or the courts have found the USA's to take precedence (I don't know, presumably someone else can clear it up).

Mark T said...

@JuliaM To be fair to John M, I think he is saying that it makes the offence less serious, not that it stops it being an offence.

The issue of the extent of intended damage is an interesting - and potentially complex - one. If two people carry out the same act, one of whom expects little or no damage to be done and another who realises the full repercussions, should they be treated differently? From the victims' perspective the same amount of damage has occurred and so they might expect them to be treated the same. From the neutral's perspective though, does that seem fair? As part of this, I think consideration needs giving to what it is reasonable for the person carrying out the act to think (which would possibly be where, in this case, the defendant's Asperger's syndrome would be taken into account).

English Pensioner said...

I have no view on the legal aspects of the case, but being a cynic, I can't help asking why it is being pursued with such enthusiasm by the US. The only conclusion that I have reached is that, by making a fuss about this, it perhaps stops the US media from asking more searching questions.
Such as
If computer security was so poor, have the Russians and Chinese already been there without leaving any traces?
What would have happened if we had been at war and an enemy had deleted these files?
Why hasn't anyone been fired because of the poor security?
They are the sort of things I'd be worrying about, not locking up an indvidual.

Lloyd Jenkins said...

@Nick Sharratt

I'm really not happy with the idea that where a crime took place is to be decided by where the criminal was at the time. By that logic, if Britain were to have no anti-hacking laws then McKinnon would have no case to answer, in spite of having caused physical damage* in the US.
Presumably he would have a legitimate complaint against any arrest should he chose to travel to the US at a later date as he committed no crime there.
That cannot be the case, surely.

Great blog JoK, I'm looking forward to the next ones.

*(i.e. altering the physical make-up of hard drives)

Elaine said...

Dear JoK
Yes, it was High Court, July 09, LJ Burnton, as I mentioned. Place was packed with journalists, inc Michael Seamark (DMail), Duncan Campbell(Guardian). Mark Ballard (Inquirer) & Tom Espiner (ZDNet) reported it in their publications at the time. I am surprised in your thorough investigations that you did not come across any of this. All readily available for those who care to look in a dispassionate way at the facts.

NB I am using the word 'facts' in the traditional way, to mean things that are demonstrably true, as opposed to the way that the Extradition Act 2003 requires judges to refer to suspicions and unsubstantiated allegations as 'facts' - which might go some way towards explaining why the extradition proceedings did not fail, in spite of the absence of admission or evidence for any extraditable offence. But I guess you're already aware of that little aspect of the Act :-)

Kimpatsu said...

Surely the only real question here is whether a British national should be extradited? Russia won't extradite, Japan won't extradite, and you would never have won an extradition from the Bush government. Further, the extradition agreement between Britain and the US is fundamentally unbalanced, so the message that Britain sends to the world is that the British government won't protect its own people, particularly under Zanu-Labour, when Tony B. Liar instructed the British ambassador in Washington to "crawl up the White House's arse and stay there". The McKinnon case has never been about justice for Gary; it's always been about kowtowing to the US administration in the hope of winning some leverage in return. The message internationally, however, is clear: the UK is a pushover that doesn't protect its own people.
In addition, Gary McKinnon is unlikely to receive a fair trail in the US, but I'll leave my explanation as to why as comment for Part II of jack's post.

Mike from Ottawa said...

"You suggest a person should be tried where the crime was committed - well, as the person was in the UK when they committed the acts alleged, he should be tried here and under UK law."

Why? Though the acts were carried out in the UK, their target was in the USA. Why should the person who chooses the victim also get to choose the jurisdiction he is subject to?

If you don't want to be tried in the USA, under US law, don't choose to do damage in the USA.

That doesn't dispose of all issues relating to McKinnon's extradition proceedings, of course.

Dr. Brian Blood said...

I wonder whether Elaine is being rather 'free' in her use of the word 'facts'.

There are allegations, there is evidence, there is an identification of the 'issue(s)', there are helpful references to what other judges have ruled in similar cases and comment as to whether these are binding or not, and there is the judgment which summarises all of this, sets out the 'facts' of the case, and the final decision of the court.

I would have thought that everything else, including passing commentary between the judge(s) and others, is really not germane to an understanding of the case.

The assertions reported by Elaine seem not to have weighed particularly heavily with the court for there is no reference to them in the judgments listed by JoK.

There is, however, an admission by McKinnon to various offences which are reported in the judgments.

If Elaine is raising matters that were not presented in Court by McKinnon's legal team then I would have thought the performance of his lawyers could be open to critical examination and indeed she may have something to say about that.

Alternatively if these points have been raised by the lawyers then the judges (of which there have been a great number) have clearly failed, so far, to be convinced by them.

Certainly, from where I sit, the turning down of a plea bargain that would have led to a relatively short sentence, most of it spent here in the UK, begs two questions: was McKinnon properly advised, and have others hijacked his case as part of the crusade against the Extradition Act 2003.

Alex said...

"I do know, though, that the extradition act was a grossly uneven it of legislation that was a consequence of Blair's obsequious obedience to Bush's every wish."

Actually, it came about because of the Pinochet affair. Blair's pandering to Bush was bad enough without making examples up.

"I also believe that penalties like life imprisonment would be grossly disproportionate, even if operating system files were deleted. Nobody should be extradited to countries that impose cruel and unusual punishments like that."

The country that has life imprisonment for this crime is this one, the United Kingdom, not the United States. Extraditing him would likely see him face a much less harsh sentence than if tried here. And if he'd taken the plea bargain, he'd already be free.

Alex said...

"No, doesn't work. My house doesn't have instantly recoverable backups of it stored, which would allow me to reinstate my bed, TV, photos, wiring, boiler and milk in seconds. If it did, then the offence above wouldn't be particularly serious."

Two points:

1. Your house isn't insured? If it is, then there's your backup for your TV and so on right there.

2. Was everything backed up? Certainly it would be relatively easy to reload the OS and so on, but what about important military files? If they weren't backed up, then that is exactly like a burglar destroying/stealing your family photos.

Nick Sharratt said...

To Clarify why I feel the law should deem the crime to have been committed in the UK (where the act was committed) rather than the USA (where the impact was) I describe the following hypothetical circumstance:

imagine a country who passes a law that it illegal to transmit or cause to be transmitted the word "spoon" through any electronic means. (it's an odd country but bear with me).

Imagine Mr. Innocent sat at home in another country completely unaware of this bizarre law who decides he needs a new set of cuttlery and decides to Google "Knifes forks and spoons" and clicks on the first link

Mr Innocent has no idea where the server he's just instructed to send him a web page is hosted, but is unlucky enough that it's just besides the spoon adverse one, and the Internet routing which may usually have bypassed that country is unavailable so his request goes through the spoon phobic country and has breached their odd law.

The next thing Mr Innocent knows, there's a knock at his door with the police there to extredite him to Someoddcountry for breaking their laws.

It's clearly ridiculous to expect people to know the laws of every country Internet traffic may pass through, or even the laws of every country a server they access may be in. But it is entirely reasonable to expect them to know the laws of the country they're in and hence answer to them.

Now, I don't claim the accused in this case would be entirely ignorant of the laws of the USA pertaining to this case, but I doubt they had more than a passing awareness. They have no such defence for this country (ignorance defense etc).

Any interpretation which seeks to enforce the jurisdiction of the virtual act location is fraught with issues.

I don't doubt current international agreements/laws reflect this flawed approach, but I'm saying it shouldn't and that this case brings the issue forward.

SimonC said...

How does McKinnon's case bring the issue you describe forward, Nick? Both countries involved agree that hacking into other people's computers is an offence.

Moreover, whether the alleged offence is an offence under UK law is already a consideration in consent hearings, be they for computer-related offences or otherwise. The text of the Extradition Act 2003 is available here - with respect to Category 2 countries, which I believe includes the USA, the relevant section is 137. In all cases it appears that the alleged offence must be an offence under UK law punishable with at least 12 months imprisonment.

Gordon Rae said...

JoK, thank you for assembling a comprehensive list of sources. The comment thread is pretty much what I'd expect to hear in a jury room, so I'll respond to several points and then add a new one of my own.

First, we are talking about computer networks. The alleged crime is that Gary, sitting at home, used his computer in the UK to access computers in the USA, without permission, where he installed some software called RemoteAnywhere and set about deleteng files, obtaining passwords, and so on. So it's clear to me that the crimes were committed on those hacked machines, against the owners of those machines.

Gary did not commit crimes in the UK, but if he had, he would be facing a maximum sentence of life imprisonment. The maximum sentence set by 18 U.S.C. § 1030 is ten years.

Concerning the financial assessment of the damage he is said to have caused - I've worked in big companies where IT costs were charged out to business units. You don't need to do anything except apply normal accounting procedures for the time spent by the sysadmins to recover from the mess.

This is not a civil case like Singh vs BCA where the court tries to quanitfy damage. The figure of $5,000 is there as a threshold to establish whether Gary's crime is covered by 18 U.S.C. § 1030. And since the estimate is $700,000 it's not a close run thing.

People have mentioned that if the computers had been backed up, then recovery would be easy, and if they had been better configured, Gary would not have been able to been able to get Administrator access. And various colourful analogies have been employed. True. But the law is not there to try what might have happened; it's there to assess what did actually happen.

Nobody made Gary McKinnon access those computers; he wanted to. He used his skills to look for vulnerabilities, and when he found them, he exploited them. End of story. As Matt J said, he is on trial for the crimes he committed.

Several commenters have mentioned Gary's Aspergers. AFAIK, Asperger's does not stop you being intelligent. Gary seems to have been motivated to have break into lots of US miltary computers over a period of months, because of what he believed about the Bush administration. It wasn't a single impulsive act.

The main influence of Gary's Asperger's on the case seems to have been that he confessed everything to the police when they interviewed him, and he refused a plea bargain, both because he didn't understand why he ought not to tell the truth. I don't feel he deseves the same protection we would offer someone with Down's Syndrome, say, for being truthful.

This brings me to a point nobody seems to have raised, which is Gary McKinnon's mens rea. What did he think he was trying to do, and what did he intend to do? Was he intent on causing damage, or did he have other aims? And was he reckless or indifferent to the damage he did cause? I think these things matter.

Kimpatsu said...

@Gordon:
From what I understand, Gary's intent was to find evidence that the aliens are visiting Earth in UFOs, and that the US military knows about it and is covering it up. Such obsession with conspiracy theories is par for the cause with autism sufferers, of whom Gary is one. He had no intention to trash the US government's capability to operate in cyberspace.

Dr. Brian Blood said...

Having looked at 18 U.S.C. § 1030

http://www.panix.com/~eck/computer-fraud-act.html

I would have thought 'mens rea' was irrelevant to the prosecution itself.

I think we are talking 'strict liability' here.

There is something about this here:

http://en.wikipedia.org/wiki/Mens_rea

Ther is a good example under 'relevance of motive' that should help understand McKinnon's position.

"One of the mental components often raised in issue is that of motive. If the accused admits to having a motive consistent with the elements of foresight and desire, this will add to the level of probability that the actual outcome was intended (it makes the prosecution case more credible). But if there is clear evidence that the accused had a different motive, this may decrease the probability that he or she desired the actual outcome. In such a situation, the motive may become subjective evidence that the accused did not intend, but was reckless or willfully blind.

Motive cannot be a defence. If, for example, a person breaks into a laboratory used for the testing of pharmaceuticals on animals, the question of guilt is determined by the presence of an actus reus, i.e. entry without consent and damage to property, and a mens rea, i.e. intention to enter and cause the damage. That the person might have had a clearly articulated political motive to protest such testing does not affect liability. If motive has any relevance, this may be addressed in the sentencing part of the trial, when the court considers what punishment, if any, is appropriate."

Lloyd Jenkins said...

@NickSharratt
I think your objection doesn't work in the McKinnon case for two reasons:

(1) McKinnon must have known that deleting files, etc. would cause physical and financial damage in the US. I do think that the law is justified in saying that is you choose to cause damage in another country you must inform yourself of the legality of that action there.

(2) The courts stressed that what McKinnon did would have been illegal here (Aviation and Maritime Security Act 1990 s. 12).

Dr. Brian Blood said...

In an earlier post I questioned whether McKinnon had been properly advised when the US authorities put a plea bargain. Others have suggested that this bargaining was undertaken witout McKinnon having the benefit of legal advice.

Since then I have read this article (dated 9 July 2005):

http://www.guardian.co.uk/theguardian/2005/jul/09/weekend7.weekend2

entitled 'Game over' and written by Jon Ronson

In it you will find the following material relating to the period immediately after his arrest by the British Authorities:

"Then the Americans offered him a deal, via his British solicitor. "They said, 'If you incur the cost of the whole extradition process, be a good boy, come over here, we'll give you three or four years, rather than the whole sentence.' I said, 'OK, give me that in writing.' They said, 'Oh no, we can't do that.' So they were offering a secret trial, no right of appeal on the outcome, no comment to the newspapers, and nothing in writing. My solicitor, doing her job, advised me to take it, and when I said no, she was very, 'Ooh, they're going to come down heavy.' "

Obviously, this is a journalist repeating commentary provided by Gary McKinnon so the details could be incomplete or misleading.

But the general gist is clear.

An offer was made and his solicitor recommended he take it.

CuriousGuru said...

Interesting post - thank you, for this and the later ones.

I am not even close to having the necessary knowledge to know if there is solid legal grounds for the extradition.

However, I do think that if it feels wrong it probably is. Even leaving the inequality of the extradition treaty aside, this seems like a massively disproportionate situation.

He faces significant jail time for his actions, more than if he had killed someone as a drunk driver or brought the world economy to its knees as an out of control trader. This strikes me as something that is neither "right" nor is it just. If an American was caught scrumping for apples would we demand extradition to try him/her with a possible extensive jail sentence?

For some reason, digital crimes are subject to massively erratic punishments - some offences are never punished and others see people in jail for longer than if they actually physically broke into a facility.

Speaking as a layman, I cant comment on the legal validity of the demands to send him overseas but if the law does indeed allow it, then the law needs changing.
Urgently.

Salil said...

Those who are blaming lax security systems at the US DoD are missing a point. Charles's analogy, though it sounds like a hyperbole, is closer to the point. Blaming the DoD is a bit like blaming a victim of crime. SysAdmins responding to this may think that what DoD did was unforgivable, but most people in the world can't guess someone's password, nor how to crack a home or a system. Most reasonable people, if they see a creaking door, would tell the neighbours to keep a watch on the house of their neighbours. Telling DoD to be better-protected in future is nice; it is necessary; but its reported laxity is not the reason to let the intruder go lightly. The presence of thugs on the street should not mean we should not be pedestrians; knifing incidents on London's streets doesn't mean teenagers should stop walking on the streets; presence of dakwas on the streets doesn't mean women should not wear miniskirts if they want to. If something happens to the teenagers or the women, the fault lies with the perpetrator, never the victim.

That's the principle: instead, we're now told that Mr MacKinnon should be treated differently because the US should have known better; that the DoD's computers should always be attacked; that the US has an unfair judicial system; that no real harm was done. (Someone threatening violence of some sort - to that teenager or that woman in miniskirt - needs restraining, and face a fair trial in the victim's forum).

Mark said...

You say:
"The allegations against Mr McKinnon have not essentially changed since the original charging by the East Virginian and New Jersey US District Courts in 2002."

However, - and unfortunately I don't have the source to hand - I've read that the US originally indicted Gary on a certain set of charges and then applied for extradition. When they were told the charges were not serious enough to grant an extradition request, they 'trumped up' the charges to include the damage.