If it goes ahead, it will be the first time a Cypriot has ever been extradited to the US.
Adding to the questions is that he has already been charged with two hacking offences in Cyprus and that the alleged offences in the US occurred when he was still a minor.
“No Cypriot has been extradited to the US. Ever. And they want to send a 19-year-old who was a minor when he allegedly committed the offences the FBI is investigating,” Pavlos Erotocritou, one of the teen’s defence lawyers told the Sunday Mail.
Joshua Epiphaniou has been held at the central prisons since May last year.
In Cyprus Epiphaniou has been charged with being behind a DDos attack (distributed denial of service) on Cablenet which rendered their telephony and internet services useless for around 12 hours. He is also facing charges in connection with extorting €2,000 from a Limassol company which buys and sells internet traffic. He denies all charges.
After his IP was traced by Cablenet techs who were trying to fix their systems, a slew of other suspect information came to light.
Following his arrest, the FBI said they suspected him of being behind hacking offences allegedly committed between 2014 and 2016. Epiphaniou is believed to have obtained thousands of US dollars from five US firms by accessing their systems and threatening to leak their data if they didn’t pay up.
Some €69,000 in cash was found in his home.
In one instance, US authorities believe he threatened one American company to pay €19,000 which was done in two instalments. In a second case, he apparently asked for €90,000 but managed to get €1,000.
Police found evidence – in the form a screenshot – leading them to believe he may also have obtained 38,000 in bitcoin – which at the time was roughly €400,000.
American authorities have since filed an extradition request to try him under US law.
The 19-year-old’s story is certainly unique. If true, the offences were committed when he was between the ages of 15 and 17. Self-taught in his computer skills and from a poor family, Epiphaniou dropped out of school for a year before graduation as his family couldn’t afford the tuition for his private education.
His Filipina mother, 54, worked at a supermarket. His father, a Cypriot police officer, was largely absent from his son’s life and paid child support only after a court-imposed decision. They could not afford to pay his €70,000 bail after his arrest in May last year. The amount was later dropped to €50,000 and eventually €1,000.
Defence lawyer Erotocritou says this was a deliberate ploy from the prosecution. “They tricked us. As soon as the bail was paid, he left prison and then they arrested him again for the extradition proceeding,” he told the Sunday Mail.
Even though the teen was held in prison, the warrant had to be executed to initiate the extradition hearing, Erotocritou specified. “If we knew, we wouldn’t have paid the bail.”
Why the justice ministry and attorney general’s office allowed the extradition process to begin is a question that remains unanswered from both parties.“They could have refused from the onset,” Erotocritou said.
The justice ministry confirmed to the Sunday Mail that while a cooperation between US and Cypriot authorities is in place to date, no Cypriot has been extradited to the US. Whether this teen will be the first remains to be seen but many questions remain unanswered.
For starters, even the state prosecutor on the case Marina Spiliotopoulou had outlined in court that the case is moving much faster than other cases.Additionally, what cannot be ignored is the fact that Epiphaniou was a minor when the offences the FBI is investigating allegedly took place.
“He is being tried in Cyprus for two cases. He should be tried for all offences (including the American ones) here,” Erotocritou said.For one, Epiphaniou could face up to 20-years in jail if found guilty in the United States – a far cry from up to five years in Cyprus.
Though he is showing clear signs of depression in jail, this will only get worse if he is extradited, his defence believes.
“It’s not the court’s fault. I believe the justice ministry and attorney general’s office have the responsibility to tell the Americans the case should be tried in Cyprus.”
Erotocritou cited the case of British hacker Lauri Love, where the court of appeal decided he would not be extradited to the US to face trial for hacking into computer systems including Nasa, the Federal Reserve and the US army.“The countries look after their own nationals,” he said.
“We shouldn’t be slaves to the Americans or the Russians. Whose justice do you want to serve?”According to Erotocritou however, the interest of the state is “to serve the interests of the Americans”.
A few months ago, leaked emails of senior state attorney Eleni Loizidou appeared to show she went above her call of duty when pursuing extradition requests from the Russian government against Russian nationals.
The emails revealed Loizidou would, for instance, offer to intervene in cases to buy Russians more time to produce documents or advise them on how to proceed so as to get favourable rulings from Cypriot courts.
“At least they were Russians being extradited to Russia. This is a Cypriot,” Erotocritou outlined.
Loizidou has since been suspended, while several journalists have been hauled in for questioning and daily Politis which broke the story was served an injunction barring it from publishing contents of the leaked emails.
Epiphaniou’s defence team is also arguing that the offences, if true, were committed from the 19-year-old’s room. He never left the country.The prosecution argues that they were American companies and thus the alleged offences should be treated as if they were committed on US soil. The nature of these offences do not require one to be physically present.
The two sides also do not see eye to eye on whether the offences are of similar nature.
Erotocritou argues that the offences in both the American and domestic cases are of similar nature and therefore all should be tried in Cyprus.
Meanwhile, the view from the other side is that it appears they are not.
More crucially, according to Erotocritou, accusations pertaining to the fact that the hacker was a minor when the offences were allegedly committed, are answered with vague answers outlining “these are internal matters”, and that there are “bilateral treaties with mutual obligations”.
The justice ministry would only confirm that no Cypriot had been extradited to the US and there was an ongoing case against the 19-year-old. Requests for comment from the Sunday Mail on why the case had been approved to go to court for an extradition remained unanswered.
Even Lycourgos Kyprianou, a businessman wanted for financial fraud that cost shareholders of American IT firm AremisSoft over $500,000, was never extradited.
As the chairman of the company, listed on the American stock exchange Nasdaq, Kyprianou was indicted in 2002 by the US on criminal charges including securities fraud and money laundering.
Although he was in Cyprus, he was never extradited even though a treaty on extraditing fugitives had come into effect in 1999.
A Reuters report on the case in 2007 quoted a US embassy spokesman in Nicosia as saying a request for extradition had not been filed – although sources now suggest that may have been the result of behind the scenes discussions where Cyprus may have made it clear they would not proceed with an extradition and not even allow it to proceed to court.
“It is a shame to want to send a 19-year-old to the US to be tried for offences he allegedly committed from his room in Cyprus,” Erotocritou said.
“There has never been a case like this in Cyprus.”