Ahzaz v The United States of America

For double criminality in extradition proceedings, the court asks whether the conduct alleged would, if proved, constitute an offence under the law of the relevant part of the United Kingdom. It need not determine guilt under domestic law. The court may draw proper inferences from the conduct particularised in the extradition request. Unauthorised installation of software believed to be malicious may constitute an offence under the Computer Misuse Act 1990, even where the request does not provide further technical detail about the software. The relevant conduct may amount to an attempt to cause damage rather than completed damage, and the scope of extradition should be understood accordingly.

The appellant appealed under section 103 of the Extradition Act 2003 against a Westminster Magistrates’ Court decision sending the case to the Secretary of State for consideration of extradition to the United States. The Secretary of State subsequently ordered extradition. The allegations concerned the appellant’s control of approximately 800 computers physically located in the United States and his unauthorised installation of software believed to be malicious on those computers. The central issue was whether the conduct, if proved and if it had occurred in England and Wales, would constitute offences under sections 1 and/or 3 of the Computer Misuse Act 1990.

1. The appeal was dismissed. The conduct alleged satisfied the double-criminality requirement in section 137(2)(b) of the Extradition Act 2003. The court was not required to determine whether the appellant was guilty under English law. The question was whether the conduct would, if proved, constitute an English offence, as explained in Mauro v Government of the United States of America [2009] EWHC 150 (Admin).

2. The court could draw proper inferences from the conduct set out in the request, following Zak v Regional Court of Bydgoszcz Poland [2008] EWHC 470 (Admin). On the alleged facts, the appellant controlled the computers without their owners’ authorisation and agreed, for reward, to install software he believed to be malicious.

3. That conduct would, if proved, constitute an offence under section 3 of the Computer Misuse Act 1990. The unauthorised installation was intended to impair the operation of the computers, or of programs or data within them, within section 3(2)(a) and/or (c). The necessary intention could be inferred from the circumstances. No further technical particularisation of the request was required.

4. The conduct would also constitute an offence under section 1, read with section 17(2)(a), of the Computer Misuse Act 1990. Knowingly and unauthorisedly installing the software amounted to altering data on the computers. This conclusion independently supported dismissal of the appeal.

5. For clarity, the gravamen of the request concerned attempts to cause damage rather than actual damage, because the software supplied in the undercover operation was naturally inferred to have been innocuous although believed by the appellant to be malicious. Count One of the indictment was to be understood on that basis. The appellant’s prior unauthorised control of the 800 computers provided the relevant context.

• High Court (Administrative Court): Appeal dismissed from the decision of DSDJ Wickham at Westminster Magistrates’ Court dated 16 March 2012. The court had sent the matter to the Secretary of State for consideration of extradition.
• Secretary of State: An extradition order was made on 1 May 2012.