A 21-year-old accused of hacking offences and the first Cypriot to be extradited to America in July will receive a fair trial, US Ambassador Judith Garber said.
After two years of deliberations, a Nicosia district court ruled in November 2019 to extradite Cypriot Joshua Epifaniou to the U.S. where he was wanted for extortion through hacking offences while still a minor.
“He is the first Cypriot to be extradited to the U.S. and the first to be extradited since a change in the constitution in 2013 after Cyprus joined the EU,” his lawyer Michael Chambers had said at the time.
“We are confident there will be a fair trial in the US,” Garber said during a press briefing at the American embassy in Nicosia on Wednesday.
“I’m not aware of a trial date at this time,” she added.
Epifanou arrived at John F. Kennedy Airport in New York on July 17 after being extradited from Cyprus. He was arraigned on July 20 before U.S. Magistrate Judge Alan J. Baverman in the Northern District of Georgia.
Defence lawyers tried to block Epifaniou’s extradition based on the fact that he was a minor at the time and suffers from Asperger’s syndrome, a developmental disorder characterised by significant difficulties in social interaction and communication.
“We argued that as he suffers from Asperger’s it would be against his human rights to be extradited and because of his age at the time but the [Nicosia court] judge didn’t accept this,” said Chambers.
He said medical evidence and expert witnesses were presented before the court to prove the suspect suffered from Asperger’s, while his mental health would deteriorate if sent to the US, but the judge was not convinced.
The young Cypriot faces 20 years in prison in two US states – Georgia and Arizona — where he faces several counts of wire and computer fraud, identity theft and extortion, according to legal documents.
“When you are 16, doing something like this from a bedroom in Nicosia, you can’t fathom the seriousness of your actions, there is no understanding of the consequences.”
Epifaniou was initially arrested in May 2017 on suspicion of carrying out a DDoS attack (distributed denial of service) on Cypriot telecoms firm Cablenet which crashed their servers for 12 hours.
Police again detained him, when the U.S. filed an extradition request in January 2018, as the FBI suspected him of orchestrating hacking attacks committed between 2014 and 2016 when Epifaniou was aged 15-17.
He is accused of obtaining thousands of dollars from at least five U.S. firms by accessing their systems and threatening to leak their data if they didn’t pay, causing more than $550,000 in losses to the victim websites.
According to the five-count indictment filed in the Northern District of Georgia, the victim companies include a free online game publisher based in Irvine, California; a hardware company in New York; an online employment website headquartered in Innsbrook, Virginia; and an online sports news site owned by Turner Broadcasting System Inc. in Atlanta, Georgia.
Epifaniou allegedly used proxy servers located in foreign countries to log into online email accounts and send messages to the victim websites threatening to leak the sensitive data unless a ransom was paid.
He is charged in the District of Arizona in a 24-count indictment with conspiracy to commit computer hacking, obtaining information from a protected computer, intentional damage to a protected computer, and threatening to damage a protected computer.
According to the indictment, Epifaniou “and co-conspirators” obtained unauthorised access to the database of Ripoff Report (ROR), a company located in Phoenix, Arizona, through a brute force attack, a trial-and-error method used to obtain information, such as a user password or personal identification number. Epifaniou allegedly extorted $90,000 from the company and charged a further $3-5,000 for the removal of each of about 100 complaints posted on ROR’s website.
“The charges contained in the indictment are merely accusations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law,” the Justice Department concluded.
Epifaniou is described as a bright student who comes from a broken home with his Cypriot father absent and Filipina mother, 54, finding it hard to make ends meet.
“I managed to see my son for the last time for only two or three minutes,” said his mother Vivina Polloso, before being flown out of Cyprus.
“I managed to hug him and kiss him goodbye. This was devastating, heartbreaking!”
Polloso said the last time she saw her son, before their tearful parting at Larnaca airport, was on July 1 in court. The island’s coronavirus lockdown had limited prison visits.
