Dual British/Finnish national and famed hacker Lauri Love has today had his appeal against extradition to the USA upheld in the High Court, following the conclusion of a case that has run for the last 5 years. The US government were seeking to charge Love with several counts of hacking with a possibility of Love receiving up to 99 years in a US jail.

In 2012 and 2013 it is alleged that Love was the architect of a sophisticated and targeted campaign against the US government by hacktivist group Anonymous. Nicknamed #OpLastResort, this campaign sought retribution against the US for the perceived persecution of computer specialist and Reddit creator Aaron Swartz, which ultimately led to Swartz taking his own life in 2013.

Love is accused of stealing personal details of over 100,000 US employees with staff in the Federal Reserve, Nasa, the US Army, the Department of Defence, and the FBI affected. Love is renowned for his coding ability and, whilst not confirmed, the hacking community believe he used an exploit from a known vulnerability in Adobe’s Cold Fusion software to break into US government servers.  All of this was conducted from his laptop in his parents’ house in Suffolk. Indeed, coverage when Love was arrested initially identified his father Alex, a prison chaplain at HMP Highpoint North, as the culprit.

Love’s defence team did not focus on his innocence, but instead sought to argue (ultimately successfully) that he would have his human rights infringed by deportation to the US, given the possibility of a 99-year sentence under the US Computer Fraud and Abuse Act. Love is autistic, and his team argued that he would present a serious suicide risk should he be deported and taken into the American penal system.

So, has the US shot itself in the foot? The controversial Computer Fraud and Abuse Act has been in place in various guises since 1986. Yet it remains controversial and has led to accusations of exploitation by the US Government. The irony is that the alleged persecution of Swartz under the law that motivated Love into hacking the US government, has now saved him from deportation to the US to face charges for a crime he does not dispute.

What does this mean for the fight against hacking? On the one hand, the inability of the US government to successfully extradite an individual who confesses to hacking US government information is a huge blow. However, this will potentially speed up the process to modernise and change the law to make it more relevant and effective in dealing with modern cyber investigations – and not just in the US. Greater focus needs to be given to classifying cybercrime within the criminal framework, which will help generate proportional sentencing instead of the uncertainty that exists currently. It will be interesting to see how the case now proceeds in the UK and if Love is prosecuted under UK law.

The Lauri Love appeal has, once again, put hacking under the spotlight. But this time a case has been won on human rights grounds rather than a lack of evidence, which is often the case as hacking crimes are notoriously difficult to prove. Hacking is an international crime with no borders, but as the US has found even if you do find the hacker locking them up and throwing away the key is no longer an option. Now they must wait and see if Love faces justice in his own country.