22-year-old Brit avoids US extradition over SIM-swapping conspiracy after judge deems him to be high suicide risk

Accused said to have suffered mental health problems from childhood


A Brit accused of taking part in a $8.5m SIM-swapping conspiracy has escaped extradition to the US after a judge agreed he was at high risk of suicide.

Corey De Rose walked free from Westminster Magistrates' Court after experts said long-standing mental health disorders and a history of self-harm and suicide attempts meant De Rose was likely to kill himself if extradited.

"This was not a case where the [requested person's] mental condition had only arisen after his arrest on the extradition request, as is often the case," observed District Judge Sarah-Jane Griffiths, handing down judgment [PDF] on Monday.

De Rose, 22, was accused by US prosecutors of being part of The Community, a self-titled cryptocurrency theft conspiracy.

What's he allegedly done?

The Community is said by the US to have been a SIM-swapping gang operating between 2017 and 2018. Members targeted "individual victims that the co-conspirators suspected possessed large amounts of cryptocurrency". They tricked telcos into transferring control of phone numbers to SIM cards they controlled.

One victim, named only as RM by Westminster Magistrates' Court, was allegedly targeted by De Rose in July 2017. T-Mobile US was deceived into porting RM's phone number to a new SIM controlled by The Community. After resetting RM's passwords using authentication codes sent to his phone number, The Community allegedly transferred $8.5m worth of "ether" and "the Ethereum-based crypto-currency tokens" to themselves.

De Rose was allegedly using the Skype handle live:cr00k000 to talk to his co-conspirators, during which he gave his name, postal address and Gmail address to the seller of something he'd bought. According to court papers, a US probe of his Gmail account confirmed those details and revealed invoices, insurance policies and an application for a Citizencard (teens' proof-of-age document) in De Rose's name.

The Gmail account's linked search history showed De Rose allegedly "ran a search the day after the attack for the type of Ethereum-based token stolen from R.M." as well as searches on RM's full name, made after the theft.

Finally, cr00k000 gave a co-conspirator from The Community a Bitcoin address over Skype, instantly receiving 108.18 Bitcoins.

De Rose was arrested in the UK on 9 February 2021 by the National Crime Agency, being released on bail in May. The US wanted him sent across the Atlantic to stand trial with three other alleged members of The Community.

Refusing to order his extradition, District Judge Griffiths ruled that De Rose's pre-existing and severe mental health problems meant (just like Lauri Love) there was a risk he would kill himself before being brought to trial in that country.

Medical experts for both sides "agreed that the [requested person] was a risk of suicide which was more than fanciful should extradition be ordered," said the judge, adding: "Indeed, [De Rose] is a high or substantial risk of suicide should extradition be ordered."

The Briton suffers from autism spectrum disorder as well as ADHD and also has "a recurrent depressive disorder." The court heard that US prison mental health facilities would be unable to provide suitable care to prevent him deteriorating.

De Rose's mother, Claire De Rose, testified that Corey had lived with her until his arrest, "required contact with mental health professionals from an early age" and was committed to a psychiatric clinic in 2011. In one incident her son threatened to throw himself off a balcony and cut his wrists following an argument about school homework. He had, so she said, needed specialist mental healthcare since childhood.

Mrs De Rose also told the court that Corey "has a partner now who is expecting his child", with the birth being due in February. The partner, Denise Canavan, told Judge Griffiths that De Rose was earning £6,000 a month, though the judgment did not say how. Canavan also testified that De Rose had cut his neck during an argument in October 2021, after she hit him and walked out having called an ambulance. Nonetheless, Canavan and De Rose moved in together "around two months ago" in the judge's words.

"I accept that there are cases where people start a family after extradition proceedings have begun, to try to avoid extradition. I do not find that this is the case here," ruled Judge Griffiths, explaining that Canavan first discovered she was pregnant by De Rose three days after his February 2021 arrest, miscarrying a month later.

Discharging De Rose, the judge said that if extradited, the accused hacker "would feel that he had nothing to live for and that his mental health would deteriorate and that he would look for an opportunity to take his own life… [his] mental condition is such that it removes his capacity to resist the impulse to commit suicide."

Nothing about the case prevents De Rose from being charged and tried in the UK, added Judge Griffiths.

The US has two weeks to file an appeal if it wishes. ®

Broader topics


Other stories you might like

  • Lenovo halves its ThinkPad workstation range
    Two becomes one as ThinkPad P16 stands alone and HX replaces mobile Xeon

    Lenovo has halved its range of portable workstations.

    The Chinese PC giant this week announced the ThinkPad P16. The loved-by-some ThinkPad P15 and P17 are to be retired, The Register has confirmed.

    The P16 machine runs Intel 12th Gen HX CPUs, but only up to the i7 models – so maxes out at 14 cores and 4.8GHz clock speed. The laptop is certified to run Red Hat Enterprise Linux, and can ship with that, Ubuntu, and Windows 11 or 10. The latter is pre-installed as a downgrade right under Windows 11.

    Continue reading
  • US won’t prosecute ‘good faith’ security researchers under CFAA
    Well, that clears things up? Maybe not.

    The US Justice Department has directed prosecutors not to charge "good-faith security researchers" with violating the Computer Fraud and Abuse Act (CFAA) if their reasons for hacking are ethical — things like bug hunting, responsible vulnerability disclosure, or above-board penetration testing.

    Good-faith, according to the policy [PDF], means using a computer "solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability."

    Additionally, this activity must be "carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services."

    Continue reading
  • Intel plans immersion lab to chill its power-hungry chips
    AI chips are sucking down 600W+ and the solution could be to drown them.

    Intel this week unveiled a $700 million sustainability initiative to try innovative liquid and immersion cooling technologies to the datacenter.

    The project will see Intel construct a 200,000-square-foot "mega lab" approximately 20 miles west of Portland at its Hillsboro campus, where the chipmaker will qualify, test, and demo its expansive — and power hungry — datacenter portfolio using a variety of cooling tech.

    Alongside the lab, the x86 giant unveiled an open reference design for immersion cooling systems for its chips that is being developed by Intel Taiwan. The chip giant is hoping to bring other Taiwanese manufacturers into the fold and it'll then be rolled out globally.

    Continue reading

Biting the hand that feeds IT © 1998–2022