Ransomware or ransomware is a real scourge in cybercrime. A first case on the subject made headlines before the Paris Criminal Court. The latter sentenced, on December 7, 2020, Alexander V. for money laundering in an organized gang to 5 years in prison and a fine of 100,000 euros. This column by Me Eric A. Caprioli of the Caprioli & Associés law firm presents the court's decision.

Alexander V. was suspected to be one of the organizers and recipients of Locky ransomware. The ANSSI gives in its glossary (www.ssi.gouv.fr) the following definition: "The term 'ransomware' is a contraction of the words 'ransom' and 'software'. It is therefore by definition a program malware whose purpose is to obtain the payment of a ransom from the victim". This is malware embedded in an email attachment that encrypts recipient data.

Ransomware in the turmoil of anonymization

To recover said data, the victim has to pay a ransom in bitcoins. The payment site used corresponds to a domain name with the extension '.onion' accessible only through the Tor network. This type of domain name is not registered with an authority; passing through the Tor network, the IP address of the '.onion' service is not communicated. All this complicates the search for identification of the owner of the corresponding website. Finally, the funds obtained in payment of the victims are transferred to a cryptocurrency exchange platform Btc-e (site hosted in the United States and governed by Cypriot law until its closure in 2017).

According to the prosecution, Alexander V. would have received a large part of the ransoms resulting from these fraudulent maneuvers. On the contrary, the defendant acknowledges having simply worked as an operator on the cryptocurrency exchange platform, without knowing the identity of the administrator of this platform. More than a hundred victims (individuals, private companies, public persons) have been identified in France and several thousand abroad.

In 2016, a judicial investigation was opened in France resulting from complaints about the infection of computers by the Locky ransomware. Alexander V. was arrested in Greece in July 2017. He was handed over to the French authorities in January 2020, placed in preventive detention to be sent back to the Paris Criminal Court and tried in the 4th quarter of 2020.

A defendant under the blow of several offenses

The Paris public prosecutor's office prosecuted Alexander V. for several offenses in particular, extortion of funds via the Locky ransomware, fraudulent access to a STAD and money laundering in an organized gang. During the hearing, the defense raised procedural issues. It considered, among other things, that the defendant had not been able to access the original seals during his arrest in Greece, but copies of copies.

On the merits, the public prosecutor argued that a large part of the sums collected, from the ransomware, were in favor of two accounts belonging to the defendant. The prosecution also used the documents found in the computer and the mobile phone seized during the arrest of Alexander V. in Greece.

Regarding the collection of funds, the defendant defended himself on the grounds that he was a collateral victim of the ransomware fraud. And for the material seized, he replied that it did not belong to him. Finally, the defense argued that it was not proven that AlexanderV. was the creator of Locky ransomware.

In any event, the prosecution conceded that the defendant had certainly not acted alone, but the prosecutor considered that Alexander V. was one of the main instigators. The prosecutor therefore requested a fine of 750,000 euros and 10 years in prison against the defendant (324-2 of the penal code).

Conviction for a single offense retained

The court sentenced Alexander V. for money laundering in an organized gang to 5 years in prison, a fine of 100,000 euros and around 35,000 euros in damages for the civil parties. The conviction relates to the defendant's involvement in the transfer of funds from the Locky ransomware via the Btc-e cryptocurrency platform.

On the other hand, the defendant was acquitted of the 13 other offenses for which he was prosecuted. It is regrettable that the qualifications of the criminal offenses were not retained by the court for lack of evidence, in particular fraudulent entry into an information system (art. 323-1 of the criminal code) or extortion of funds ( 312-1 of the Penal Code). This no doubt explains why the sanction relating to money laundering by an organized gang is so heavy, even if the amount is lower than the maximum provided for.

This case reminds us that the handling of cybercrime litigation requires real technicality, from start to finish, in accordance with the procedural rules to provide proof of fraudulent acts, if the facts are really proven. Everything is often a matter of proof of the offence.

Eric A. Caprioli, associate lawyer, doctor of law

Caprioli & Associés, member of the Jurisdéfi network

The opinions of experts are published under the full responsibility of their authors and in no way engage the editorial staff of L'Usine Digitale