A Saskatchewan King’s Bench judge has ordered Ryan James Roach’s extradition to the United States, where he faces charges related to hacking into American university supercomputers to mine cryptocurrency. 

The day after that decision, the province’s Court of Appeal granted Roach an interim release pending a final decision by the federal justice minister. 

Roach is accused of conspiring to commit unauthorized use of a computer, an offence that can carry up to 10 years in prison in Canada.

King’s Bench Justice Grant Currie issued the committal order, finding that the evidence against Roach in the U.S. meets Canada’s legal threshold for extradition.

The ruling does not determine whether Roach is innocent or guilty.

Sask. man is accused of breaking into U.S. university systems for crypto mining

The U.S wants to extradite a Saskatoon man who is accused of hacking into universities for cryptocurrency mining.

FBI investigation

According to court documents reviewed by CBC, U.S. prosecutors allege Roach conspired with another Canadian man to hack into at least one New York state educational institution in 2017, steal more than 1,900 login credentials, install malware and use the institution’s supercomputer to mine a cryptocurrency called Electroneum. 

The breach cost the institution roughly $337,000 US in damages due to the breach, including the cost of shutting down systems, conducting forensic analysis and rebuilding compromised infrastructure.

According to court filings, investigators with the Federal Bureau of Investigation traced what they called a digital trail linking the alleged hack to Roach.

The documents say investigators analyzed IP addresses, server logs, email accounts and hosting records, alleging stolen credentials and malware were used to access university supercomputers remotely.

Judge’s decision

Currie noted in his decision that the evidence also includes the possibility that Roach may have been unaware of his alleged co-conspirator Mathiew James Stubbings’s plans to attack. 

“Mr. Roach conducted his research specific to high-performance computing at Institution 1 during that attack, not prior to that attack,” Currie wrote, acknowledging the defence’s argument that the timing of the searches suggests Roach was learning what Stubbings was doing, not planning it.

However, Currie also found the relationship between the two men, combined with Roach’s payment for servers and Stubbings referring to Roach as his “partner,” supported the inference of an agreement. 

“Mr. Roach and Mr. Stubbings intended to agree, and did agree, to hack into educational institutions, install malware, steal login credentials, and mine cryptocurrency, all without authorization,” Currie wrote.

“Since these inferences reasonably may be drawn from the evidence … I conclude that a reasonable jury, properly instructed, could convict Mr. Roach of having conspired to commit unauthorized use of a computer.”

Roach will not be appealing the committal order, according to his lawyer, Patricia Farnese. The decision doesn’t meet the threshold for an appeal and Roach doesn’t want to cause unnecessary delays and waste the court’s time, she said. 

“The judge gave his decision, we’re following due process,” she said. 

Farnese said she’s made submissions to the federal justice minister, who holds the power to make the final decision to surrender Roach. The minister has 90 days to decide; after that, Roach will have another right to appeal.

The case is being prosecuted by the U.S. Attorney for the Western District of New York. The U.S. Justice Department has declined to comment.