Members of the cybersecurity sector rallied to support Marcus Hutchins, the cyber researcher credited with stopping the WannaCry ransomware attack in May, after he was arrested earlier this month for allegedly creating and distributing a banking malware called Kronos.
Mr. Hutchins, who pleaded not guilty Aug. 14, was indicted under charges against the Computer Fraud and Abuse Act and the Wiretap Act. Some cyber experts and lawyers set up a legal defense fundraiser for Mr. Hutchins. One lawyer, Alex Berengaut, a partner at Covington and Burling, questioned the constitutionality of the indictment in an Aug. 17 blog post for the law firm.
Mr. Hutchins, a citizen and resident of the United Kingdom, allegedly created Kronos, a banking malware that steals information from "protected computers," according to the blog post. Under the indictment, a "protected computer" is defined as a "computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communications of the United States," Mr. Beregaut wrote.
Mr. Berengaut added the indictment "does not articulate a clear nexus between [Mr.] Hutchins and the United States." With this concern in mind, Mr. Berengaut said he does not think the indictment will hold up in federal court, because it does not allege Mr. Hutchins created the virus in the U.S. or for the purpose of affecting a particular U.S. person.
"Yet while the indictment refers in conclusory terms to effects on interstate and foreign commerce, there are no factual allegations of specific losses caused by the Kronos malware inside the United States. Indeed, commentators have questioned whether there were any U.S. victims associated with the malware," Mr. Berengaut wrote.
Click here to read the full blog post.
More articles on cybersecurity:
Labor Department closes injury reporting system after potential breach
Google pays Uruguayan high student $10k for discovering security flaw
State Department faces systemwide email outage