Last August, the Department of Justice arrested and indicted Marcus Hutchins, the security researcher who accidentally discovered the “kill switch” that stopped the “WannaCry” malware attack.  Hutchins was not charged for anything to do with WannaCry, but rather for creating and conspiring to sell a different piece of malware, the “Kronos Banking trojan.”  Apart from the dramatic circumstances surrounding his arrest, Hutchins’ indictment was notable for its lack of allegations connecting him to the United States.  As previously discussed on this blog, the indictment raised the question whether it would violate Hutchins’ constitutional rights to charge him in this country.

Last week, Hutchins’ legal team filed a motion formally challenging the constitutionality of the indictment.  The motion relies on the “sufficient nexus” doctrine — the principle that there must be a meaningful connection between a foreign defendant and the United States to satisfy due process.  Since the government has not alleged that Hutchins aimed his conduct at the United States, he argues, no “sufficient nexus” has been shown.

The government has until April 18 to respond to Hutchins’ motion.  Now that the sufficient nexus issue has been raised, one option for them would be to file a superseding indictment with additional allegations connecting Hutchins to the United States.  Indeed, Hutchins has also filed a motion for a bill of particulars — a request for additional information on the government’s charges — which might invite the government to supplement its charges.

If the government does not address the motion factually, they will likely need to join issue legally.  In that circumstance, the government is likely to argue that the alleged effects of Hutchins’ conduct on the United States satisfy the “sufficient nexus” test.  This argument has some issues and remains largely untested.  Most fundamentally, it requires the court to disregard caselaw from the analogous context of civil personal jurisdiction, where diffuse effects of conduct aimed “worldwide” are insufficient to satisfy due process.  The government will be hardpressed to explain why the due process standard in the criminal context should be any less demanding.