Arion Kurtaj of Oxford, UK, will always be infamous as the LAPSUS$ hacker gang member who so infuriated other hackers that they broke their code of silence by publicly revealing his name and address. Now Kurtaj (pictured) faces the prospect of never being allowed to live free again after a court ordered he be held in a secure hospital facility indefinitely. Kurtaj is currently 18 years old but he amassed a fortune worth approximately USD14mn from a series of crimes committed since he turned 16. These crimes include SIM swapping customers of British mobile operator EE in order to drain their cryptocurrency wallets and infiltrating the Slack platform of Rockstar Games in order to steal code and footage from Grand Theft Auto 6 prior to its release.
Kurtaj was one of the leaders of LAPSUS$. He attained this status despite exhibiting anti-social behavioral problems. His arrogance and immaturity prompted rancor amongst fellow hackers, leading to his downfall. Kurtaj’s behavior has not improved since his arrest; he has repeatedly been violent since being taken into custody. The court proceedings also confirmed that Kurtaj lacked the mental capacity to fully understand the significance of his crimes. Doctors decided that Kurtaj’s severe autism meant he was unfit to stand trial, so the jury was only tasked with determining if Kurtaj did or did not commit the crimes he was accused of. Kurtaj’s pronounced mental impairment meant the jury were not asked to form an opinion about whether his intentions were criminal in nature.
Kurtaj’s indefinite detention in a psychiatric facility also reflects the fact that he is a threat to the rest of society. The judge concluded that Kurtaj remained a risk to the public and a mental health assessment referenced during the sentencing proceeding stated Kurtaj…
…continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated.
An accomplice who cannot be named because he is only 17 years old was sentenced to 18 months of intense supervised rehabilitation including a ban on using VPNs. One of the crimes committed by the accomplice involved helping Kurtaj and other members of LAPSUS$ to steal information from BT, leading to a demand that the British telco pay a USD4mn ransom, which BT refused. The judge’s sentence also covered the unnamed boy’s “unpleasant and frightening pattern of stalking and harassment” of two women. Kurtaj and the unnamed boy are the first members of LAPSUS$ to be convicted.
It is vital that young men are deterred from engaging in cybercrimes that rely on well-known but effective techniques like SIM swaps and social engineering. Unfortunately, some sections of the press still chose to glamorize these crimes by referring to Kurtaj as a ‘genius’ hacker. This conflicts with the dismissive assessment of Kurtaj’s skills by his hacker peers. One of them described Kurtaj as having “the brain of a [sic] 8 year old”.
It is troubling that the response to Kurtaj’s sentence has seen many members of the public praising his abilities because he gained unauthorized access to Rockstar’s Slack channel after he had been arrested and relocated to a hotel for fear of violent reprisals from other hackers. Some simplistic news reports state Kurtaj ‘hacked’ Rockstar from his hotel room using only an Amazon Firestick and a mobile phone, implying that he has a preternatural gift for exploiting technology. Nothing could be further from the truth.
Kurtaj’s crimes primarily relied upon bribery and social engineering in order to compromise user credentials. It takes no great technological sophistication to use a phone to lie to somebody. No deep understanding is required to plug an internet-connected Firestick into a television, and then to download a freely-available web browser in order to remotely log on to systems using compromised passwords. Instead of exaggerating Kurtaj’s capabilities we should instead be focusing on the inept handling of Kurtaj by the police. They left an obsessive recidivist criminal unsupervised in a hotel next to a shopping mall where he could easily purchase the equipment needed to commit more of the same crimes. Kurtaj had amassed millions in his online accounts; did the police really believe he would not buy himself a new mobile phone or other devices that can connect to the internet just because they told him not to?
Locking up Kurtaj is a step in the right direction. Britain’s legal system failed to address the seriousness of crimes like these in the past. This encouraged habitual criminals to repeatedly commit the same offenses after they were first caught. Kurtaj was deemed sick rather than guilty, but his sentence does acknowledge an essential truth that courts have previously chosen to ignore: the public will remain at serious risk unless individuals like Kurtaj are literally prevented from going online. If that means they must remain in detention, then so be it. The other good news is that British police and prosecutors are now seemingly pursuing cases like these when previously they would have made excuses for ignoring crimes committed over networks.
LAPSUS$ is an international gang whose other members remain at large. None of us will be safe until they are also punished. The severity of these crimes means societies must be prepared to take the criminals out of circulation, so they cannot continue to cause harm. The legal system must also be prepared to enact punishments that will deter other young men and boys from emulating the so-called ‘geniuses’ they read about in newspapers and online forums.
