202303262 B1 - [2025] EWCA Crim 1163

Summary of the facts:

The prosecution alleged that the applicant was a leading figure in cyber offending carried out by a computer hacking group called Lapsus$.

The charges in the indictment alleged that, between July 2021 and February 2022, the group hacked into the computer systems of a number of large companies, including BT/EE and NVIDIA, blackmailed their victims by threatening to publish confidential material online, and made fraudulent use of the data which they had acquired (counts 1-7). In September 2022 the group hacked into the systems of Revolut, Uber and Rockstar Games (counts 8-11).

The applicant was first arrested on 24 January 2022. His mobile phones, laptops, USB sticks and SIM cards were seized from his home.

The applicant was again arrested on 30 March 2022. Items seized on this occasion included a new Samsung phone and laptop, and two more SIM cards.

The applicant was arrested for a third time on 22 September 2022, when an iPhone 13 Max Pro (“the iPhone 13”) was seized from him. It was the prosecution case that, moments before the police entered his room, he had been committing offences against Rockstar Games. He was later served with a notice under s49 of the Regulation of Investigatory Powers Act 2000 requiring him to disclose the PIN of the iPhone 13, but did not do so.

The applicant made no reply when interviewed under caution.