Last week the chair of the Home Affairs Select Committee Keith Vaz wrote to the Home Secretary over the case of Sheffield student Richard O'Dwyer, currently facing extradition to the US on copyright charges relating to a website he ran from the UK.
"I was delighted to hear of your
decision [on Gary McKinnon]. On behalf of the Committee I would like to thank you for your
decision on Mr McKinnon and to introduce a forum bar.
In your statement you told the
House you would bring forward a new forum bar as soon as Parliamentary time
allows. It would be very useful to know when you expect this legislation to
come before the House, and how will it affect those currently facing
extradition to the United States. It would also be helpful to know how you
intend to design the forum bar to minimise delays.
I would be grateful if you would
let me know the current thinking concerning the extradition of Mr Richard
O’Dwyer, whose appeal is due to be heard within 6 months. This seems very
similar to the case of Mr McKinnon."
I beg to disagree with Keith Vaz in that there are few parallels between McKinnon and O'Dwyer -save for the fact they both are alleged to have committed crimes over the internet whilst sitting at a computer in England.
That said, the case against extraditing O'Dwyer is far weaker even than the case to extradite McKinnon; it raises crucial questions of territorial sovereignty and should send a shiver through the spine of every UK-based website operator.
Quick summary of the McKinnon position
McKinnon was alleged to have hacked computers physically located on US soil belonging to the Pentagon and NASA. Whilst McKinnon didn't leave the UK to commit his alleged crime, there was by all accounts a crime committed on US soil caused directly by McKinnon's actions in the UK.
Putting aside for a minute questions over Gary McKinnon's mental health there are clearly competing rights of the victim and the defendant. The defendant has an expectation to be governed (and, when found guilty, punished) according to the law of where he or she resided at the time of the alleged crime. The victim has a right to see transgressions punished despite the fact the alleged crime was commissioned from abroad.
Because the allegations against McKinnon constituted a crime in both the UK and the US, the key question became whether it would be better in the interests of justice to mount a prosecution in the UK or the US.
Since US authorities conducted the initial investigation according US rules e.g. covering how evidence is gathered and stored, it seems to make some sense for a prosecution to take place in the US.
However this still leaves open questions as to sentencing (should it be guided by UK law or US law) and where any jail sentence should be served. It seems wholly wrong for a UK citizen who has never travelled to the US to serve time in a US prison thousands of miles from his friends and family.
The allegations against Richard O'Dywer centre around him hosting a website TVShack.net.
According to a ruling at Westminster Magistrate's Court (pdf
), Richard ran the website from the UK and its severs were based in Holland.
The basic facts of the O'Dwyer case raise two very important questions affecting all UK-based webmasters:
- Where is the US claim of sovereignty for a website run from the UK and hosted in the EU?
- Copyright law is inherently territorial, laws vary from country to country. If we allow copyright extradition, which country's law applies?
Further questions are raised by the fact that Richard O'Dwyer's website hosted no pirated content itself. Instead it provided links to pirated content elsewhere.
Whilst there have since been high profile rulings indicating that a link to pirated content can itself be infringing under certain circumstances (e.g High Court rulings against Newzbin II and a successful private criminal prosecution
against surfethechannel.com resulting in a 4-year jail term) it is reasonable for Richard O'Dywer to have believed that, in not hosting copyrighted content himself, he was not in breach of UK law.
The US claim of jurisdiction in the O'Dwyer case at first seemed to stem from a claim over the whole of the .net and .com domains when the Guardian reported an interview
with Erik Barnett, then deputy director of US Immigrations and Customs Enforcement.
Also flawed is the reasoning that some US companies are alleged to have lost out on revenue due to O'Dwyer's actions - because extradition law is not couched in terms of victims but conduct. In which territory is the conduct alleged to have taken place?
I have since uncovered claims that the extradition of O'Dwyer is based on wider charges not limited to the claimed sovereignty over .com and .net.
My sources claim Richard O'Dywer is alleged to have conspired to incite US citizens to commit copyright infringement and conspire to defraud studios of lawful revenue through his earning advertising revenue from TVShack.net.
These grounds sound ever so similar to extradition action against New Zealand-based Kim Dotcom.
The Extradition Act 2003
To cut a long story short there should, in my mind at least, be no need for any reform of the Extradition Act to prevent the extradition of Richard O'Dwyer.
There has been a lot of nonsense written about the Extradition Act but the Act itself is clear as regards subsection 137(2)
quoted in court documents
as the applicable section in the extradition proceedings against Richard:
137 (2) The conduct constitutes an extradition offence in relation to the category 2 territory if these conditions are satisfied—
(a) the conduct occurs in the category 2 territory;
(b) the conduct would constitute an offence under the law of the relevant part of the United Kingdom punishable with imprisonment or another form of detention for a term of 12 months or a greater punishment if it occurred in that part of the United Kingdom;
(c) the conduct is so punishable under the law of the category 2 territory (however it is described in that law).
From (a) it is clear that this section only applies if the alleged conduct occurred in the category 2 territory, i.e. the United States.
None of the called-for reforms of the Extradition Act should change the situation for Richard O'Dwyer because his alleged crime, conducted from a Sheffield flat using servers located in Holland, should not fall under the terms of the Act.
'Lopsided' extradition and need for reform
So why, with a complete lack of evidence in the public domain that a crime falling under the terms of the Extradition Act was committed, wasn't this extradition request quashed?
The extradition agreement itself seems to have been written with the aim of avoiding the burden of holding what amounts to a duplicate trial for each person facing extradition. That is, there should be no need to try a suspect in the UK just to see if he or she should be extradited when a full, fair trial awaits them in the US.
(This might be an idealistic stance, however, since the legal avenues that are open to those facing extradition still take many years and hours of court time to exhaust.)
Therefore UK courts currently claim to have few powers to test evidence prior to extradition, meaning they effectively take the word of US prosecutors that evidence exists. This has lead to claims that the extradition agreement is one-sided, since US authorities demand to see "probable cause" before agreeing to an extradition warrant.
But all this is a smokescreen in the O'Dwyer case because what UK courts should demand is not evidence related to the crime itself but evidence of the sovereignty claim.
UK courts do have the power to rule on the applicability of UK law, in this case they should demand proof that the requirements of subsection 137(2)(a) of the Extradition Act 2003 have been met before agreeing to the extradition.
The public interest is immense; we need clear guidance from the courts on when national laws apply and when US laws apply in cyberspace.
Find your next job with computerworld UK jobs