UFO-chaser extradited for mother of all military hacks

LONDON – Some call it the biggest hack of military computers; perhaps it was just a big embarrassment.

Gary McKinnon – accused of breaking into military and Nasa computers in what he claims was a search for UFOs, allegedly causing nearly US$1 million in damage – has lost his appeal against extradition to the United States.

McKinnon, 42, an unemployed computer administrator, allegedly broke into 97 computers belonging to the US Army, Navy, Air Force, and Department of Defence from a bedroom in a north London home.

His attacks between 2001 and 2002 allegedly shut down the US Army district responsible for protecting Washington and cleared logs from computers at Naval Weapons Station Earle in New Jersey, a site responsible for tracking the location and battle-readiness of Navy ships.

Nasa and privately owned computers also were damaged, prosecutors said, putting the total cost of his online activities at US$900,000. At the time of his indictment, US prosecutor Paul McNulty said McKinnon pulled off “the biggest hack of military computers ever – at least ever detected.”

In his defence, McKinnon, known online as SOLO, said he was trying to expose security weaknesses and uncover evidence of UFOs. “I was a man obsessed,” McKinnon wrote on The Guardian newspaper’s website ast year, describing a year spent trying to break into US military systems: eight hours a day at a computer in his girlfriend’s aunt’s house while unkempt, drinking beer and smoking marijuana. In interviews, he claimed that his hacking uncovered photographic proof of alien spacecraft and the names and ranks of “non-terrestrial officers.”

Prosecutors accuse him of deliberately trying to intimidate the US government by tearing through their networks. They pointed to a note written by McKinnon – and left on an Army computer – attacking US foreign policy as “akin to government-sponsored terrorism.” “It was not a mistake that there was a huge security stand down on September 11 last year,” he wrote. “I am SOLO. I will continue to disrupt at the highest levels.”

McKinnon was caught in 2002 after some of the software used in the attacks was traced back to his girlfriend’s email account. The US sought his extradition, a move his lawyer Claire Anderson claimed was motivated by the government’s desire to “make an example” of a man who humbled officials in Washington by hacking into their systems using off-the-shelf office software and a dial-up modem.

Aspects of American cyber-security had been shown up as “really shameful,” with some computers not even password-protected, said Graham Cluley, a security consultant with Sophos PLC.

He said the United States appeared to be pursuing McKinnon in an effort to flex its legal muscle before the hacking community, which has watched the case with interest.

“The overriding message is: You shouldn’t mess with American government and military computers, particularly right after Sept. 11,” Cluley said. McKinnon’s lawyers had hoped to hold any trial in Britain, saying he could be dragged before a military tribunal or even end up at the Guantanamo Bay military prison camp in Cuba. In their appeals, they said McKinnon was warned by US officials that he would not be allowed to serve any part of his sentence in Britain unless he agreed to cooperate with his extradition. That, they argued, amounted to an unlawful threat and abuse of process. Not so, Britain’s House of Lords said yesterday. Lord Brown, writing for Britain’s highest court, said U.S.-style plea bargaining could only be called an abuse of process “in a wholly extreme case.”

“This is far from being such a case,” he said. While the decision exhausts McKinnon’s legal options in Britain, Anderson said she would appeal to the European Court of Human Rights in Strasbourg, France. She said authorities had agreed to keep McKinnon in Britain for at least two weeks to allow his lawyers to prepare their application. “If that fails, then it’s off to jail in America for 60 years,” McKinnon told the BBC. “Rapists and murderers and real terrorists get less.”

A 60-year sentence is “extraordinarily unlikely,” according to Scott Christie, who was the lead prosecutor in the case in New Jersey before going into private practice. McKinnon is charged in New Jersey and Virginia with eight counts of computer fraud. While each count potentially carries a sentence of up to 10 years in prison and US$250,000 in fines, Christie said US sentencing guidelines would likely recommend a much lighter penalty.

“His general exposure would be in the range of between three and five years,” he said.