Policy —

Pirate Bay co-founder faces major new hacking charges in Denmark

Danish IT expert calls it "largest hacking case ever seen in Scandinavia."

Gottfrid Svartholm Warg, as seen in 2009.
Gottfrid Svartholm Warg, as seen in 2009.

After several weeks in court, the criminal trial of Pirate Bay co-founder Gottfrid “anakata” Svartholm Warg concluded earlier this week in Stockholm. But on Thursday, as he awaits a decision and sentencing, Svartholm Warg landed in more hot water with new accusations coming from neighboring Denmark.

Svartholm Warg and a second (as-yet unnamed) co-defendant (Google Translate)—a 20-year-old Danish man taken into custody in Copenhagen (Google Translate)—are accused of illegally accessing the country’s driver’s license database (Google Translate), social security database, the shared IT system across the Schengen zone, and the e-mail accounts and passwords of 10,000 police officers and tax officials. Apparently, all of that data was managed by CSC, a major American IT contractor. If convicted (Danish), the two men could face up to six years in prison. (CSC did not immediately respond to our request for comment.)

Svartholm Warg’s extradition to Denmark depends on the forthcoming decision and potential sentencing in Sweden. Should he be ordered to prison there, it’s unlikely he will be sent to Denmark until that sentence is first completed (Google Translate).

In Sweden, Svartholm Warg was accused of hacking Logica, an IT firm that contracts with the Swedish tax authority. In 2012, Logica was hit by an online attack that resulted in about 9,000 Swedes (Google Translate) having their personal identity numbers released to the public. (However, in Sweden, most people's identity numbers are public information, but some can be kept private.) Svartholm Warg was also charged with fraud in the country. According to ComputerSweden’s account of the indictment (Swedish) as published by the Swedish prosecutor, Svartholm Warg allegedly tried to transfer 5.7 million Swedish kronor ($900,000) to various accounts. However, only 27,000 kronor (roughly $4,200) belonging to a Danish trade union was actually transferred out.

The alleged Denmark hack—particularly of the Danish social security numbers (CPR)—has become a major scandal in the country. It could have significant implications for every Dane (Google Translate), as social security numbers include each person’s birthday within the number itself. Thus, they cannot be easily and substantially changed.

Peter Kruse, the CEO of Danish IT security firm CSIS, told the Danish newspaper Politiken (Google Translate) that this hacking scandal was "without comparison the largest hacking case ever seen in Scandinavia.”

The case came to light as a Danish IP address turned up as part of the Swedish investigation earlier this year. It was at that moment, Danish police say, that they learned their own databases had been compromised during five months in 2012.

Svartholm Warg’s lawyer says risk for losing the Swedish case is “huge”

Svartholm Warg and his co-defendant have been accused of (and not yet formally charged with) trespassing of public information systems, disrupting public information systems, and vandalizing public information systems, according to the Danish national police (Google Translate), as reported by the Danish newspaper BT (Google Translate).

Svartholm Warg’s Swedish attorney, Ola Salomonsson, told Ars that his client currently does not have Danish counsel and has not yet made a plea. The co-defendant’s Danish attorney, Michael Juul Eriksen, told Ars that his client has pleaded not guilty.

“The next step is that [my client] is incarcerated for four weeks and there will be a hearing at that time,” Eriksen said. “The police will have to view a lot of material today; they searched different places. They said that they got a lot of material from the searches today and that they will be viewing that in the coming time.”

Last month, WikiLeaks released a substantial trove of documents in English and Swedish concerning Svartholm Warg’s Swedish case. (Svartholm Warg is a well-known active supporter of the celebrated leaking site.) In recent weeks, a friend of Svartholm Warg’s, Niklas Femerstrand, has been publishing and translating accounts from the various hearings during the trial. According to those, Svartholm Warg provided very little information to Swedish investigators during his questioning in September 2012

Salomonsson did tell Ars, though, that the Swedish court’s decision could come as soon as June 14. If that schedule holds, Swedish authorities will decide whether to extradite Svartholm Warg on June 17. (He wasn’t very optimistic for his client.)

“It's hard to say [what will happen],” he said. “It's a tricky case. There are lots of problems for Mr. Svartholm Warg. There are a number of problems in the investigation suggesting that he is the one who has committed the crimes. There is a risk that the court will accept what the prosecutor says. I believe the risk is huge. In Sweden, the prosecutor asked... for four years. I don't think he will get it. [He’ll probably get] two or two-and-a-half years, most likely. I don't believe less than two-and-a-half years. If we're lucky it's two years.”

Svartholm Warg's detention since late 2012 will count as part of the sentence (he still owes his share of the fines) from the infamous Pirate Bay copyright case. In 2010, a Swedish appellate court reduced sentences the other co-defendants (not including Svartholm Warg) to between four and 10 months each while increasing their collective fine to 46 million Swedish kronor ($6.8 million). In February 2012, the Supreme Court of Sweden declined to hear the case. In March 2013, the European Court of Human rights rejected the appeal of two other Pirate Bay defendants in a unanimous decision, finding that the existing Swedish conviction did not violate their human rights.

Channel Ars Technica