LONDON (AP) \u2014 A computer law expert on Friday described the evidence behind the U.S. arrest of a notorious British cybersecurity researcher as being problematic \u2014 an indictment so flimsy that it could create a climate of distrust between the U.S. government and the community of software experts.<\/p>\n\n\n\n
News of Marcus Hutchins\u2019 arrest in the United States for allegedly creating and selling malicious software able to collect bank account passwords has shocked the cybersecurity community. Many had rallied behind the British hacker, whose quick thinking helped control the spread of the WannaCry ransomware attack that crippled thousands of computers in May.<\/p>\n\n\n\n
Attorney Tor Ekeland told The Associated Press that the facts in the indictment fail to show intent.<\/p>\n\n\n\n
\u201cThis is a very, very problematic prosecution to my mind, and I think it\u2019s bizarre that the United States government has chosen to prosecute somebody who\u2019s arguably their hero in the WannaCry malware attack and potentially saved lives and thousands, hundreds of thousands, if not millions, of dollars over the sale of alleged malware,\u201d Ekeland said. \u201cThis is just bizarre, it creates a disincentive for anybody in the information security industry to cooperate with the government.\u201d<\/p>\n\n\n\n
Hutchins was detained in Las Vegas as he was returning to his home in southwest Britain from an annual gathering of hackers and information security gurus. A grand jury indictment charged Hutchins with creating and distributing malware known as the Kronos banking Trojan.<\/p>\n\n\n\n
Such malware infects web browsers, then captures usernames and passwords when an unsuspecting user visits a bank or other trusted location, enabling cybertheft.<\/p>\n\n\n\n
The indictment, filed in a Wisconsin federal court last month, alleges that Hutchins and another defendant \u2014 whose name was redacted \u2014 conspired between July 2014 and July 2015 to advertise the availability of the Kronos malware on internet forums, sell the malware and profit from it. The indictment also accuses Hutchins of creating the malware.<\/p>\n\n\n\n
The problem with software creation, however, is that often a program can include code written by multiple programmers. Prosecutors might need to prove that Hutchins wrote code with specific targets.<\/p>\n\n\n\n
Ekeland said that what is notable to him from the indictment is that it doesn\u2019t allege any financial loss to any victims \u2014 or in any way identify them. Besides that, laws covering aspects of computer crime are unclear, often giving prosecutors broad discretion.<\/p>\n\n\n\n
\u201cThe only money mentioned in this indictment is … for the sale of the software,\u201d he said. \u201cWhich again is problematic because in my opinion of this, if the legal theory behind this indictment is correct, well then half of the United States software industry is potentially a bunch of felons.\u201d<\/p>\n\n\n\n
Another expert in computer crime, Orin Kerr from George Washington University law school, also took aim at the charges. Kerr said it\u2019s unusual, and problematic, for prosecutors to go after someone simply for writing or selling malware \u2014 as opposed to using it to further a crime.<\/p>\n\n\n\n
\u201cThe indictment is pretty bare bones, and we don\u2019t have all the facts or even what the government thinks are the facts,\u201d Kerr wrote in an opinion piece in the Washington Post. \u201cSo while we can\u2019t say that this indictment is clearly an overreach, we can say that the government is pushing the envelope in some ways and may or may not have the facts it needs to make its case.\u201d<\/p>\n\n\n\n
Jake Williams, a respected cybersecurity researcher, said he found it difficult to believe Hutchins is guilty. The two men have worked on various projects, including training material for higher education for which the Briton declined payment.<\/p>\n\n\n\n
\u201cHe\u2019s a stand-up guy,\u201d Williams said in a text chat. \u201cI can\u2019t reconcile the charges with what I know about him.\u201d<\/p>\n\n\n\n
Hutchins, who lives with his family in the town of Ilfracombe, England, and worked out of his bedroom, has until Friday afternoon to determine if he wants to hire his own lawyer.<\/p>\n\n\n\n
The curly-haired computer whiz and surfing enthusiast discovered a so-called \u201ckill switch\u201d that slowed the unprecedented WannaCry outbreak. He then spent the next three days fighting the worm that crippled Britain\u2019s hospital network as well as factories, government agencies, banks and other businesses around the world.<\/p>\n\n\n\n
Though he had always worked under the moniker of MalwareTech, cracking WannaCry led to the loss of his anonymity and propelled him to cyber stardom. There were appearances and a $10,000 prize for cracking WannaCry. He planned to donate the money to charity.<\/p>\n\n\n\n
\u201cI don\u2019t think I\u2019m ever going back to the MalwareTech that everyone knew,\u201d he told The Associated Press at the time.<\/p>\n\n\n\n
Matt O\u2019Brien reported from Providence, Rhode Island. Associated Press writers Raphael Satter in Paris and Frank Bajak in Houston contributed to this report.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
A computer law expert on Friday described the evidence behind the U.S. arrest of a notorious British cybersecurity researcher as being problematic \u2014 an indictment so flimsy that it could create a climate of distrust between the U.S. government and the community of software experts.<\/p>\n","protected":false},"author":7,"featured_media":25536,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[3574],"tags":[],"coauthors":[2279,661],"class_list":["post-9311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"3XJK2IUGYNGS3AIH7ENU6JK6OI","arc_canonical_url":"\/civilian\/fbi-doj\/2017\/08\/04\/computer-law-expert-says-british-hacker-arrest-problematic\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n