In the UK Court's ruling on December 21, 2023, an 18-year-old hacker named Arion Kurtaj, associated with the international hacking group Lapsus$, has been sentenced to an indefinite hospital order by the Southwark Crown Court. Read on to know more.
GTA 6 Hacker Deemed Public Threat by UK Court
Arion Kurtaj Found to Have Committed 12 Offenses
This decision comes as a result of Kurtaj's involvement in leaking GTA 6 footage, with the judge deeming him a high risk to the public due to his cybercrime skills and intent. Kurtaj faced 12 offenses, including blackmail, fraud, and multiple violations of the UK's Computer Misuse Act.
The charges also encompassed his participation in leaking GTA 6 footage, which led to real harm and financial losses for Rockstar Games. The attack cost the company $5 million for recovery and thousands of staff hours, according to a BBC report.
Kurtaj managed to steal 90 unreleased clips of GTA 6. Subsequently, he exploited Rockstar's internal Slack messaging system and issued an ultimatum: "if Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code."
True to his threat, Kurtaj proceeded to spread the stolen clips and source code on an online forum, using the username "TeaPotUberHacker."
Legal Overview of Arion Kurtaj's Sentence
Rehabilitation of Re-Offender and Protection of General Welfare Interest
Doctors deemed Kurtaj unfit to stand trial due to his acute autism, leading the jury to focus on determining whether he committed the alleged acts rather than assessing criminal intent.
The mental health assessment during the sentencing hearing highlighted Kurtaj's expressed intent to return to cybercrime, indicating his high level of motivation.
Likewise, it was reported that during the period when Arion Kurtaj was on bail for hacking Nvidia and BT/EE, and even while under police protection at a Travelodge hotel, he persisted in his illicit activities. He then carried on with the infamous GTA 6 hack.
Despite authorities confiscating his laptop, Kurtaj breached Rockstar. The 18-year-old hacker was found to use tools such as an Amazon Firestick, his hotel TV, and a mobile phone to infiltrate Rockstar's security measures.
The UK Sentencing Council's guidelines for sentencing offenders with mental disorders read:
"In assessing whether the impairment or disorder has any impact on sentencing, the approach to sentencing should be individualistic and focused on the issues in the case.
Culpability, which is a key factor in deciding how to punish offenders, will not automatically be reduced because a person’s mental health may have 'no relevance' to the crime committed."
Furthermore: "For serious offences, the court must also bear in mind the protection of the public."
The court, in this case, prioritized two key aspects: rehabilitation of the offender and protection of the public and general welfare interest, considering the risk of the offender willingly re-offending.
UK Sentencing Council guidelines for offenders with mental disorders, developmental disorders, or neurological impairments
The judge opted for an indeterminate hospital order aligned with the UK’s Hospital Order (s. 37 MHA 1983). Under this order, Kurtaj will remain in a secure hospital, and his release will be contingent on doctors deeming him no longer a danger to the public.
The guideline reads:
On the written or oral evidence of two doctors, at least one of whom must be approved under section 12, that:
● the offender is suffering from mental disorder of a nature or degree which makes it appropriate for the offender to be detained in a hospital for medical treatment, and;
● appropriate medical treatment is available.
"Having regard to all the circumstances, including the nature of the offence and the character and antecedents of the offender, and to the other available methods of dealing with the offender," the Court is of the opinion that a hospital order is the most suitable method of dealing with the case.
A hospital order or guardianship order can only be made where the criteria are met at the time of sentence, irrespective of the condition at the date of the offense.
Lapsus$ Hacking Group Thought to Still be At Large
An underaged 17-year-old member of the Lapsus$ group was found guilty in the same trial that spanned six weeks at Southwark Crown Court. Collaborating with Arion Kurtaj and others within Lapsus$, the 17-year-old participated in hacks targeting tech giant Nvidia and telecommunications company BT/EE.
Their modus operandi involved stealing sensitive data, after which they demanded a $4M ransom. The criminal activities extended beyond these corporate entities, as the group also stole from individuals through the compromise of their cryptocurrency wallets.
The 17-year-old received an 18-month-long Youth Rehabilitation Order, stringent supervision and a prohibition on using Virtual Private Networks (VPNs) online. Additionally, he faced sentencing for what the judge described as an "unpleasant and frightening pattern of stalking and harassment" directed at two young women.
Described as "digital bandits" in court, the Lapsus$ group are believed to comprise mostly teenagers from the UK and Brazil. They have been found to use a combination of con-man tactics and computer hacking to infiltrate corporations like Microsoft and the digital banking group Revolut. While Kurtaj and the 17-year-old are the first members of the Lapsus$ group to be convicted, it is suspected that others may still be at large.
Source:
Lapsus$: GTA 6 hacker handed indefinite hospital order
UK Sentencing Council: Sentencing offenders with mental disorders, developmental disorders, or neurological impairments
UK Sentencing Council: Guideline for sentencing offenders with mental disorders published
UK Publlic General Acts: Sentencing Act 2020
