Last summer, Marcus Hutchins, the security researcher who stopped the “WannaCry” malware attack, was arrested and charged for his role in allegedly creating and conspiring to sell a different piece of malware, known as Kronos.  The indictment was notable for its lack of allegations connecting Hutchins to the United States, which raises constitutional due process issues, and Hutchins subsequently moved to dismiss the indictment on this basis.

The government has now responded to Hutchins’ motion.  It makes two main arguments.  First, the government maintains—as a factual matter—that the allegations in the indictment do allege a sufficient nexus between Hutchins and the United States.  Second, the government argues, as a legal matter, that if Hutchins’ indictment is defective because it fails to allege conduct specifically directed at the United States, then there is no country on Earth where Hutchins could be prosecuted.  Both arguments appear to fall short.

With respect to the government’s factual argument, it references allegations that “Hutchins and his codefendant posted a promotional video for Kronos on Youtube, and they sold and transmitted Kronos to an individual located in the Eastern District of Washington.”  But these allegations in the indictment pertain to Hutchins’ co-defendant, not to Hutchins himself.  And since due process is a standard specific to the individual, it is problematic for the government to bootstrap one co-defendant’s contacts with the United States to establish a nexus for another co-defendant.

As for its legal argument, the government criticizes Hutchins’ position that foreign defendants do not establish a sufficient nexus with the United States based on the effects of their foreign conduct when it is directed at the world as a whole, rather than the United States.  Notwithstanding that this principle is black-letter law in the context of civil personal jurisdiction, the government argues that “Hutchins’ theory of jurisdiction and venue would make him immune from prosecution everywhere.”  Yet the government disregards the fact that the effects of a defendant’s transnational conduct is just one of several bases for jurisdiction over that defendant.  Under general jurisdictional principles (both in the United States and in other countries), defendants may also be subject to jurisdiction in a range of other circumstances, including based on the country in which their conduct occurs.  On this basis, Hutchins could likely be subject to jurisdiction in the U.K., where he apparently lived during the time period at issue.  Thus, contrary to the government’s argument, accepting Hutchins’ due process claim would not make him immune from prosecution worldwide.