On January 31, the Swedish free software developer and computer security expert Ola Bini was declared innocent in a unanimous verdict by a three-judge tribunal in Ecuador—the Court of Criminal Guarantees of Pichincha. After almost four years of a criminal prosecution plagued with irregularities, delays, and due process violations, his right to a fair trial has finally prevailed. EFF, Access Now, APC, Fundación Karisma, and other digital and human rights groups that have been monitoring the case celebrate the ruling.

But more than a month after the ruling, we continue to see the pattern of delays surrounding the case again. The oral sentence stated in January’s hearing has yet to be published in written form, and the precautionary measures against Bini remain in force. Despite his acquittal, the security expert still can’t leave Ecuador, use his bank accounts, or get back any of several of his devices seized in 2019. In the meantime, the Prosecutor’s Office and Ecuador's National Telecommunications Corporation (CNT) have already shown their intention to appeal once they receive the formal notification of the sentence.

Bini himself has stressed the pioneering nature of the ruling. He said it was the first time an Ecuadorian court had analyzed the issue of access to a computer system and, more importantly, resisted setting a broad interpretation of unauthorized access that would seriously endanger the beneficial work of security researchers and the vital role they play for our privacy and security across information systems.

The court didn’t fall for the prosecutor’s flawed claims that merely connecting to a server that asks for a username could entail an access without authorization to such a system. Conversely, the three-judge tribunal unanimously agreed that there was no evidence that Ola Bini had committed any crime.

Highlights of the Hearing that Recognized Ola Bini’s Innocence

When the trial hearing started on January 31, the defense still had evidence to present, and the court still had to hear Bini’s testimony and the parties' closing arguments. There was concern that one day would not be enough to conclude the trial proceedings. Centro de Autonomía Digital, the NGO Ola Bini co-founded, had to bear the costs of bringing a Swedish-Spanish translator from Sweden to Ecuador since there wasn’t an expert translator the court could assign despite this being a right ensured by Ecuadorian Law for foreign defendants.

Ola Bini’s testimony lasted for five hours. He recalled his dread during the day of his arrest at Quito’s airport. After hours detained without actual explanations of the accusations against him, he could only learn what was going on when he had the chance to watch the news on a TV channel depicting him as a criminal trying to destabilize the country. This arrest was later declared unlawful and arbitrary in a habeas corpus decision that released Bini after 70 days in jail.

INREDH and ODJE, Ecuadorian human rights organizations that join the civil society mission monitoring Ola Bini’s case, followed the hearing in situ and reported about its developments. INREDH highlighted that the prosecutor, Fabián Chavez, claimed the security expert accessed a system that held data from Ecuador's Presidency, arguing it constituted the crime of unauthorized access as per Ecuador’s Penal Code. In turn, “Ola Bini's defense emphasized this is a political case and an abuse of the State’s punitive power evidenced by the track record of violations of Bini’s fundamental rights during the entire criminal process.”

The core evidence the Prosecutor’s Office and the CNT's lawyer presented to support the accusation of unauthorized access to a computer system was a printed image of a telnet session allegedly taken from Bini’s mobile phone. The image shows the user requesting a telnet connection to an open server using their computer’s command line. The open server warns that unauthorized access is prohibited and asks for a username. No username is entered. The connection then times out and closes.

Expert witnesses on both sides (prosecution and defense) agreed in the previous hearing that such an image didn’t prove the accusation of unauthorized access. While, in general, an image should not count as technical evidence of an intrusion into a computer system, the image presented in Bini's case actually demonstrates that no illicit action has happened.

By assessing the evidence presented, the court concluded that both the Prosecutor’s Office and CNT failed to demonstrate a crime had occurred. There was no evidence that unauthorized access had ever happened, nor anything to sustain the malicious intent that article 234 of Ecuador’s Penal Code requires to characterize the offense of unauthorized access. According to INREDH, the tribunal stressed the lack of relevance of what the prosecutor and CNT presented as evidence. In his closing arguments, the prosecutor tried to reframe the accusation as unauthorized access to a telecommunication system (instead of a computer system), but this didn't change the court's conclusion.

The judges have also dismissed many circumstantial and unrelated elements, such as Ola Bini’s internet bills and visits to Julian Assange in Ecuador’s London Embassy. They equally disregarded the outrageous claim that using Tor is in itself an indication of criminal conduct—although the court missed the opportunity to recognize the vital role of encrypted applications to safeguard privacy, security, and a myriad of human rights, as the UN Special Rapporteur for Freedom of Expression underscored in a 2015 report on encryption and anonymity.

A Sentence to Enforce

"Hacker panic" and misunderstandings of technology have often led authorities to broadly interpret cybercrime legislation to persecute and punish security experts and activists unfairly. These were the main pillars underpinning the case Ecuador’s Prosecutor’s Office and CNT built against Ola Bini in a prosecution marked by political interests and influence. But the Pichincha’s Court of Criminal Guarantees didn’t let it pass, and affirmed its role in ensuring justice and due process.

We now hope the court doesn’t take longer to publish the sentence and lifts the precautionary measures still limiting Bini’s fundamental rights. We also hope that Ecuador’s judicial system, in the face of an appeal, reinforces Pichincha Court’s ruling and Ola Bini’s innocence.