Latvia Refuses To Extradite The Creator Of Gozi Trojan

Latvia has refused to extradite the man accused by the US authorities of creating the infamous Gozi Trojan, saying the punishment he is facing is too severe.

Deniss “Miami” Calovskis and his two accomplices allegedly wrote the virus that enabled cyber criminals to steal millions through an organisation described by one US attorney as a “modern-day bank robbery ring”.

He is now facing over 60 years in a US jail, a term which Latvia’s Foreign Minister Edgars Rinkevics has called “disproportionate”.

National interest

First discovered in early 2007, Gozi was reportedly created by Calovskis, Mihai Paunescu from Romania and Nikita Kuzmin from Russia. It has been used around the world to commit financial fraud, by some estimates infecting at least one million machines.

Once it found its way onto a computer, Gozi pilfered bank account login data, before sending it back to the hackers’ servers. The source code for the Trojan was put on sale in 2009 for around $50,000, with the malware sellers getting a cut of whatever the buyers subsequently made from their illicit activities.

In January, a global effort involving police from the UK, Latvia, Romania, Moldova, the Netherlands, Germany, Finland, Switzerland and the FBI saw the three charged with fraud and computer-related offences.

The arrests came after a two-and-a-half year investigation, which uncovered criminal activity going way back to 2005. It resulted in the seizure of 51 servers in Romania, as well as laptops, desktops and external hard drives, which contained a total of 250 terabytes of data ready for forensics.

Kuzmin, who was convinced to help with the investigation, is already doing time in a US jail, following his arrest in 2010 on separate hacking and fraud charges. With his help, officials arrested Paunescu in Romania in November 2012. Extradition proceedings against the Romanian are currently on hold pending an appeal.

According to the BBC, Latvian courts have rejected the bid to extradite Calovskis twice already, and now the country’s foreign minister Edgars Rinkevics has said he supports their ruling. In an open letter to the local news agency Apollo, he wrote that he cannot make a decision as to whether Calovskis has broken the law. However, he thinks 67 years in jail is a punishment that’s too severe for a 27-year-old hacker, possibly even anti-constitutional.

Additionally, the minister is not convinced that Cavlovskis broke the law while being under the jurisdiction of the US – a country which he has never visited. Rinkevics suggests that the suspected hacker should be put on trial in Latvia, with the US authorities assisting their Latvian counterparts.

He also mentions the case of Gary McKinnon, a British hacker who was accused of hacking into 97 US military and NASA computers. McKinnon’s extradition to the US was stopped by Home Secretary Theresa May in 2012, due to concerns about his health. He will now be trialled in the UK, where his alleged offences took place.

What do you know about crime and punishment in the digital age? Take our quiz!