Gary McKinnon and the next 24 hours

2011-05-24

Before I start, I should say I’m all for justice. Find the bad guys, get the evidence, have a trial before jury, and if they’re found guilty, bang them to rights. Justice isn’t always such a simple, binary thing however – and our ancient legal system has evolved over the centuries to take into account not everything can be as clear cut as people would like.

And so to the case of Gary McKinnon, the erstwhile hacker who has spent the past ten years on extradition row since he dared to break into a number of US military and NASA computers in 2001 and 2002. A few elements of Gary’s case are pretty clear cut: he openly admits that he accessed US military systems and had a good look around.

Where things are less clear are whether he undertook “the biggest military hack of all time” as the US authorities would have it. The whole area is subject to debate – which is why we have courts of law, evidence, juries and all that very important stuff.

So, why not just get Gary on a plane and in front of Judge Judy at the first opportunity? Things aren’t quite as simple in this context either. For a start, Gary has been diagnosed with Asperges Syndrome, a very real condition which could explain both why he didn’t fully appreciate the impact of his actions, and why he would not come through the court process psychologically unscathed.

There’s also the very real potential for mistreatment. Guantanamo and Bradley Manning’s current conditions both illustrate how US incarceration can stoop way below the level that what our own government and people would consider humane. Our historical record may have dark spots as well, but that doesn't mean we should just go along with others.

The point is not whether or not he did access US computer systems – it’s whether someone with a medical condition should be handed over to a foreign authority with such a reputation. I would say no, and a number of far older, wiser and more legally astute people have said the same – such as Justice Mitting, who granted a Judicial Review into the lawfulness of Gary’s extradition.

Gary should be tried for his actions, but he deserves a fair trial in the UK that takes into account the complexities of computer hacking, and how thinking has evolved over the past ten years since he was spotted. When Gary accessed US systems, he did so by running a simple script that looked for blank passwords – and he found plenty. It is unlikely that such weaknesses would still exist today.

Meanwhile, plenty of examples of far more malicious hacking, for financial or other gain, have emerged which put Gary’s own actions into perspective. From TK-Max to the PlayStation Network, these are cases which deserve weighty sentences should the perpetrators be caught. The fact that Gary has spent the past decade with a dark shadow hanging over his head should also be taken into account.

I met Gary in London in 2006, when we both took part in the Infosec Hackers’ Panel. Now as then, I thought to myself, he’s just a bloke who happened to be caught at a time when computer defences were weak and his curiosity got the better of him. Five years later, with Barack Obama in town we have an opportunity to put a full stop on the extradition and end this lengthy saga.

Along with the large numbers of people who have already voiced their support, I appeal to anybody who has ever opened a drawer to see what was inside to flag Gary’s case over the next 24 hours. It might make all the difference.