Portuguese Diogo Santos Coelho created one of the biggest hacking forums in the world in 2015, when he was just 14 years old. The FBI chose not to intervene until he was old enough to stand trial as an adult.
In the coming months, a British judge will decide whether or not to grant the extradition request issued by the United States against a young man who in 2015, when he was only 14 years old, created one of the most popular hacking forums in the world, RaidForums.
Known online as Omnipotent, the teenager ran this Clearnet-accessible forum that started with pranks tricking Twitch users, but quickly evolved into life-threatening pranks and the sale of stolen data.
The FBI had long known the identity of Omnipotent, a Portuguese national, Diogo Santos Coelho. But he didn’t arrest him until he was old enough to stand trial as an adult, leading some to wonder whether the authorities should have intervened sooner.
RaidForums: Hoaxes, Bomb Threats and Data Leaks
“Omnipotent created RaidForums to be able to launch its own raiding platform, the idea was born out of the desire to prank people by hijacking Twitch’s live stream,” explains Waqas Ahmed, author specialized in cybersecurity within the media HackRead.
“Initially it was a good idea that turned into disastrous pranks, they were harassing people, issuing bomb threats,” he continues.
“RaidForums was the forum of reference for leaks and hacks, it was not only a huge forum, but also a platform for commerce, exchanges,” notes Marco Preuss, Director of GReAT at Kaspersky Europe.
“The intention behind the data leaks was initially to show how good users are at hacking,” adds Waqas Ahmed. “They were leaking data, they were being complimented, and they were going after bigger and bigger fish,” he describes.
Young hackers quickly realized the value of the data they were able to access and began selling it.
“That’s when Omnipotent started licensing everything, started providing middleman services to cybercriminals and hackers,” adds Waqas Ahmed.“RaidForums has generated millions of dollars,” he says. “The FBI knew the identity of Omnipotent for five years [au moment de son arrestation] when he was a teenager, points out the specialist.
“The Bait”
“The FBI knew about it because he had come on a trip to the United States and they immediately took him into custody, they seized his connected devices, but they didn’t arrest him,” says Waqas Ahmed.
“He was a minor, he would not have spent much time in prison; so they let him manage the platform,” he indicates. “They used it as bait to gather as much information as possible about buyers and sellers, then close the site,” he said.
On April 12, 2022, the US Attorney’s Office announced that the FBI had seized the RaidForums database and that the US had filed an extradition request to the UK for Diogo Santos Coelho after his arrest in this country, at the request of the American authorities.
As he now faces a lengthy prison sentence in the United States, experts are concerned about the suspect’s mental health and wonder if the judge will consider the fact that he was a minor when he created the site.
Responsibility and consequences
“Children absolutely should not be tried as adults for the crimes they have committed,” says Kelli Dunlap, clinical psychologist and video game designer.
She believes that they should be held accountable, that their actions should have consequences, but that these “must not be the same as for an adult whose prefrontal cortex is fully developed”.
“It is not uncommon for defendants to face de facto convictions in perpetuity in the United States,” recalls for his part, the lawyer specializing in extradition cases, Ben Cooper KC.
“US prosecutors will look into things from adulthood [de l’accusé] ignoring the fact that certain behaviors may have taken place when the accused was a minor,” he specifies.
autism spectrum
Following his arrest, Diogo Santos Coelho was diagnosed with autism spectrum disorder. Previous cases have shown that British authorities are reluctant to send vulnerable young defendants to the United States.
“Very often in cybercrime cases, defendants are not diagnosed with autism spectrum disorders,” points out Ben Cooper KC.
“The federal prison system in the United States has been underfunded for a long time,” he adds. “So prisons don’t account for autism-related vulnerabilities,” he said.
“I think we have to be lenient with these people,” recognizes Alexander Urbelis, cybersecurity lawyer at Crowell and Moring.
“We have an extraordinarily talented group of individuals, they are discovering how systems work, they can transgress a lot of boundaries in acquiring this knowledge and they can do great damage, but I think it would be unfair to impose sanctions extraordinarily severe or disproportionate criminal penalties to people who do not necessarily understand the consequences of their actions,” he concludes.
