Once it entered the federal court system, the case against Vasiliy Gorshkov moved quickly to conclusion. Gorshkov was tried in Washington state, where U.S. District Judge John C. Coughenour was unreceptive to arguments that the FBI overstepped its search and seizure authority. In Coughenour's opinion, the data on computer drives in Chelyabinsk was not protected by the Fourth Amendment. The decision meant that federal agents had the right to break into computers in other national jurisdictions, as long as it was for purposes of law enforcement. It also meant that Gorshkov had little hope of beating the rap. And he didn't.
Ivanov's legal journey would follow a different path. Because one of the companies he offered to "help" was based in Connecticut, his case was moved to Hartford. A veteran defense attorney named C. Thomas Furniss was appointed to represent Ivanov. Furniss brought on board a young lawyer and former technology worker named Morgan Rueckert. Rueckert was intrigued by the case, which he suspected would test some of the nascent limits of cyberlaw.
"This was the first case in which the government used methods like these," explains Rueckert. "They set up a fake company and then solicited a job application. They used that method to bypass what you could call a deficiency in extradition agreements."
Rueckert believes that the warrantless search of Ivanov's computer in Russia was also a first. In defending that search, prosecutors claimed that if they had not acted swiftly
"In that instance," says Rueckert, "the government may have violated the Electronic Communications Privacy Act."
While Rueckert examined the privacy issues, defense lawyer Furniss fixed on a larger target. His first motion was to dismiss on the grounds that the government lacked jurisdiction. The question is, says Furniss, "Does Congress intend the criminal statute...to be applied extraterritorially? It's an interesting question and some of the law in this area goes back to the 1700s, when pirates were attacking U.S. ships. In fact, as I read them, the Computer Crime statutes before 1996 really could not be said to reflect that intent, but there have been some amendments."
Curtis Karnow, a partner at the law firm of Sonnenschein Nath & Rosenthal and an expert on extraterritorial jurisdiction, says Furniss's motion was a good one, a sensible tactic that is often tried but never works. As it turned out, it didn't work with U.S. District Judge Alvin Thompson either. And it didn't much matter, once the prosecution pointed out that Ivanov had, for some of his exploits, used at least one proxy server located in the United States. It was all Judge Thompson needed to hear. For this case at least, the defendant had effectively perpetrated criminal acts within the United States. That ruling, along with several other issues (such as the prospect of four more trials in other jurisdictions), persuaded Ivanov and his legal team that a guilty plea would be the best way out.
Rueckert agrees that a plea was a good choice for his client, even if it did leave unresolved some important issues of privacy, cyberlaw and the modus operandi of law enforcement. "Number one," he says, "is about the way the government got data from CTS. The issue there is the individual's expectation of privacy concerning data that is stored remotely. What process should the government have to obtain access to this kind of data? Secondly, should the government be required to obtain a search warrant, and should the defendant be given legal protections? What kind of notice should the government give? There is also the issue of the method the government used to [ensnare Ivanov]. I think that the method they used offended a lot of people outside the United States. All of these issues are important."
As significant as those legal issues are, Rueckert admits that for him, the most captivating aspects of cybercrime are psychological. "The thing that fascinated me here," he says, "was that in Internet crimes you can have a kid, basically, sitting in his basement halfway around the world, and with the click of a mouse, he can cause incredible concern, fear and economic damage all across the country. And the person who is doing it doesn't really see the results. It can be very easy for someone like that to view what they're doing as a game."
Alexey Ivanov doesn't disagree. Hacking was a challenge, and challenges are always fun. It was also, in a strange and roundabout way, a means to what Ivanov says is a happy ending.