Hacker News Reader

Comment by chasil | Hacker News Reader

If our justice system behaves dishonorably, then the world's information security industry should certainly abandon the U.S. We can have our solo conferences, but we can't ask foreigners to risk incarceration for our convenience.

The Bahamas might also be a reasonable choice, as they only declared independence from Britain in 1973.

View on HN

I might be misunderstanding your point but I don't understand what they did that was so dishonorable? I thought that this guy produced malware

We don't know whether he did or not. But if they have evidence to support arresting him, the US has an extradition treaty with Britain; they should have shared it and asked British authorities to make the arrest. And there very well may be evidence, especially if the timing is related to something new obtained from the Alpha Bay takedown and it happening when he happened to visit the US for DEFCON was a coincidence.

But running a snatch and grab at a security research conference looks really bad, and is bound to have a much wider chilling effect on people's willingness to attend US conferences.

> But if they have evidence to support arresting him, the US has an extradition treaty with Britain; they should have shared it and asked British authorities to make the arrest.

Is this just for alleged computer crimes, or would you apply that to all alleged crimes?

For example, suppose I run a fraudulent mail order business targeting people in, say, France, and this is a crime in France. Would you argue that if I visit France, and the French authorities want to arrest me and bring me to trial, they should let me go home and use extradition to try to force me back, rather than arrest me while I am in France?

I think that a Black Hat convention that attracts many federal employees who work in computer security should be especially sensitive to "snatch and grab" operations.

The pall which is descending over foreign attendees is a harbinger of either relocation or vastly reduced attendance.

What kind of an arrest isn't a "snatch and grab", in your mind?

I think we can all rest assured, unfortunately, that Black Hat isn't going anywhere.

Obviously, the polite thing to do would be to send a letter. "You have been charged with a crime. Please report to the local police station at your earliest convenience."

Somewhat. The distinction I would make is not computer crimes vs other crimes, but rather the timeliness of the situation. For an emergency situation, or a case where a wanted individual enters the country anyway, I agree they'd be foolish to let them return home and only then try to have an arrest made. But there's also no reason prosecutors should lie in wait until you visit the US to even bring charges. They should decide you're being charged, issue a warrant, and try have the arrest made, including asking other countries for cooperation.

But the alleged crime here is years old, and I have don't remember anything (or find anything in a google news search-by-date) to suggest there were charges or an arrest warrant before July 2017. That makes it seem like they didn't think the evidence was strong enough to get British cooperation, and waited to even mention it until they'd have have a chance to act alone.

Either that, or they really had nothing linking Hutchins to Kronos until very recently. If it turns this really was based on new information, and the timing really was coincidental, I'll be a lot more comfortable with how it was handled. But that's sure not what it looks like right now...

In what universe does a country not arrest a criminal suspect when they set foot on that country's soil?

Sure, so he was a suspect in a criminal investigation before attending DEF CON. The US doesn't try to extradite literally everyone suspected of a crime from every other country we have an extradition treaty with. Extradition is a pain in the ass so the DOJ decided that it probably wasn't worth their time. Then he comes to the US, he's flagged at immigration, and the DOJ is like "OK, now it's worth our time".

Seems completely acceptable to me.

There is already a similar huge convention held annually in Germany, the Chaos Communication Congress. It's quite well attended.

Except BlackHat happens annually on multiple continents. Sure, DEF CON doesn't, but there are comparable conferences elsewhere (CCC for example).

Reply on news.ycombinator.com