Lawyer for extradited hacker hopeful his client will walk free

The lawyer of a young hacker who became the first ever Cypriot citizen to be extradited to the US and who has been found guilty of committing cyber-crimes by a court in the state of Georgia on Monday, still expects him to walk free after the announcement of his sentence scheduled for March 3.

Joshua Epiphaniou, 21, was extradited to the US on July 16, 2020, where he faced charges in both Arizona and Georgia for felonies committed from his bedroom in Nicosia when he was still a minor.

Michael Chambers, one of the lawyers representing Epiphaniou, based in Limassol, is confident that the prosecution will take into account a number of mitigating circumstances.

Prior to his extradition, Epiphaniou had been held in custody for three years without a trial and without a conviction for any offence, for which his lawyer in Cyprus tried to plead time served as a mitigating circumstance with the US prosecution. Epiphaniou has also been diagnosed with Asperger’s syndrome.

“We are positive that the judge will consider the time that Epiphaniou already spent in jail, both in Cyprus and in the US, as time served,” he told Cyprus Mail on Wednesday.

“He was found guilty only because he pleaded guilty during his last time in court. This is the reason behind the judge’s decision.”

Chambers added that the young hacker’s lawyer in the US told him he is expecting the judge to consider the time served in jail as the most important mitigating factor, one that will eventually see him leave the US.

“The judge asked his lawyer to provide him with Epiphaniou’s psychiatric evaluation, which was carried out in Cyprus and which proves that his condition impacts his live and his relationships with the outside world,” Chambers said.

“The evaluation is currently being translated and will be sent to the US before the judge pronounces his sentence in March.”

Epiphaniou’s lawyers have been trying to reach a deal with FBI to reduce his sentence since October. He could be facing 20 years.

“The accused gained access to US-based websites and threatened to reveal stolen personal information belonging to users unless they agreed to pay a ransom,” US prosecutor Bobby L. Christine said in his remarks during the last hearing.

“His arrest, extradition and conviction demonstrate our determination to bring to justice any hacker, no matter where he is.”

According to the indictment, between October 2014 and November 2016, when he was aged between 14 and 16, Epiphaniou worked with associates to steal personal data from user and customer databases at victim websites in order to extort the websites into paying ransoms under threat of public disclosure.

He allegedly used proxy servers located in foreign countries to log into online email accounts and send messages to the victim’s websites threatening to leak the sensitive data unless a ransom was paid.

He is alleged to have defrauded the entities of $56,850 in bitcoin and two victims incurred losses of over $530,000 from remediation costs associated with the incident.