202303262 B1 - [2025] EWCA Crim 1163

The criminal proceedings:

The applicant was charged with the following offences:

Counts 1, 3, 8 and 9: unauthorised act to impair the operation of a computer (s3(1) of the Computer Misuse Act 1990)

Counts 2, 7 and 11: blackmail (s21(1) of the Theft Act 1968)

Counts 4 and 6: fraud (s1 of the Fraud Act 2006)

Count 5: unauthorised modification of computer material (s3(1) of the Computer Misuse Act 1990)

Count 10: securing unauthorised access to computer material with intent (s2(1)(b) of the Computer Misuse Act 1990)

Count 12: failing to comply with a s49 notice to disclose a key (s53 of the Regulation of Investigatory Powers Act 2000).

On counts 1, 2, 6, 7 the applicant was jointly charged with Thalha Jubair, a youth about a year younger than himself. Jubair is now an adult, and so is not entitled to anonymity. With the exception of count 12, all the other charges in the indictment alleged that the applicant had committed the offences together with Jubair or with others unknown.

On 22 June 2023, in the Crown Court at Southwark, HH Judge Patricia Lees heard evidence from three psychiatrists who had assessed the applicant. One of them, Dr Hindley, had previously prepared a report for sentencing purposes in relation to the March 2021 convictions. The psychiatrists were agreed on a diagnosis of autism and Attention Deficit Hyperactivity Disorder (“ADHD”). The judge found the applicant to be unfit to plead.

The proceedings against the applicant under s4A of the 1964 Act were heard together with the trial of Jubair.

The prosecution evidence comprised, in summary, the following:

Evidence from “the company witnesses”: a spokesperson on behalf of each of the five companies which had been directly targeted by the cyber attacks. In the case of NVIDIA, the company’s Senior Director for Software Product Security, Mr Reber, gave evidence of his own knowledge and experience of the cyber attack, and produced exhibits including DR/15, a Threat Intelligence Report which contained details of the attack and material linking the attack to the Lapsus$ group.

Evidence from customers of BT/EE whose phones and online accounts had been hacked and from whose bank accounts money and cryptocurrency had been taken.

Evidence from computer servers located in the USA.

Evidence of online chats which the prosecution contended showed the applicant and others planning and executing their crimes.

Evidence of the seizing from the applicant of devices said to have been used in the offending.

Evidence (in the form of agreed facts) of the March 2021 convictions.

Evidence that between March and September 2022 the applicant had been granted bail subject to conditions which included a prohibition on his possessing a smart phone, and that he had nonetheless been in possession of the iPhone 13 on 22 September 2022.

There were agreed facts as to the applicant’s diagnosis of autism and ADHD. They included the following:

“Autism is lifelong and immutable, and therefore Arion continues to experience the core difficulties associated with a diagnosis of autism. Many (in fact most) people with autism learn to understand and manage their neurodiversity, however Arion’s additional disabilities have hampered his abilities to do so. He therefore has almost no understanding of his own needs and therefore is incapable of making adjustments for them.”

The applicant, being unfit to plead, did not give evidence.

The jury found that the applicant had done all the relevant acts and made the relevant omission.

The applicant was made subject to a hospital order pursuant to s37 of the Mental Health Act 1983, with a restriction order pursuant to s41 of that Act.