An accused hacker who became the first Cypriot national extradited by Nicosia to the US could see his prison ordeal end soon.
Joshua Epifaniou, 21, was flown to the US to face charges including several counts of wire and computer fraud, identity theft and extortion carried out from his Nicosia bedroom when a teenager.
His lawyers are awaiting a new court date, but they are confident of securing a minimum sentence that could cover time served.
“The legal team in the US is hoping to secure a time-served sentence from the Court in Atlanta and a dismissal of the charges in Arizona,” his Cyprus-based lawyer Michael Chambers told the Financial Mirror.
He said restitution has been provided to the injured parties while Epifaniou is in good health.
“We believe that the fact that restitution has been provided and the fact that Joshua has served over three years in prison will be taken into consideration during sentencing.”
Epifaniou, wanted in the US states of Georgia and Arizona, is the first Cypriot citizen to be shipped to America under a 1999 extradition treaty.
Arrested in Nicosia in May 2017 at the age of 17, he spent more than three years in Cypriot jail on trial in a local hacking case, without being convicted, and fighting extradition.
The FBI accused Epifaniou of extorting tens of thousands of bitcoin from US firms while still a teenager by breaking into their IT systems and threatening to leak their data.
His defence team tried to block the extradition, arguing that Epifaniou was aged 15 to 17 at the time and suffers from Asperger’s syndrome, a developmental disorder.
He faces 20 years in a US prison under the charges, but his lawyers have done a deal with the authorities.
“We hope that Joshua will receive a much lower sentence due to the factors mentioned,” said Chambers.
Epifanou arrived in New York on July 17 after being extradited from Cyprus. He was arraigned on July 20 before U.S. Magistrate Judge Alan J. Baverman in the Northern District of Georgia.
He was initially arrested in 2017 on suspicion of carrying out a DDoS attack (distributed denial of service) on Cypriot telecoms firm Cablenet which crashed their servers for 12 hours.
Police again detained him, when the U.S. filed an extradition request in January 2018, as the FBI suspected him of orchestrating hacking attacks committed between 2014 and 2016 when Epifaniou was a minor.
He is accused of obtaining thousands of dollars from at least five U.S. firms by accessing their systems and threatening to leak their data if they didn’t pay, causing more than $550,000 in losses to the victim websites.
According to the five-count indictment filed in the Northern District of Georgia, the victim companies include a free online game publisher based in Irvine, California; a hardware company in New York; an online employment website headquartered in Innsbrook, Virginia; and an online sports news site owned by Turner Broadcasting System Inc. in Atlanta, Georgia.
Epifaniou allegedly used proxy servers located in foreign countries to log into online email accounts and send messages to the victim websites threatening to leak the sensitive data unless a ransom was paid.
He is charged in the District of Arizona in a 24-count indictment with conspiracy to commit computer hacking, obtaining information from a protected computer, intentional damage to a protected computer, and threatening to damage a protected computer.
According to the indictment, Epifaniou “and co-conspirators” obtained unauthorised access to the database of Ripoff Report (ROR), a company located in Phoenix, Arizona, through a brute force attack, a trial-and-error method used to obtain information, such as a user password or personal identification number.
