His actions were particularly reprehensible and ruthless, according to the court.
“Kivimäki was imputed of offences that were extremely harmful because sensitive information on the victims was shared on the internet with complete disregard for the vulnerability of the victims,” the ruling reads according to Helsingin Sanomat.
The District Court of Western Uusimaa viewed that the offences as such warranted a prison sentence of six years and seven months, given their serious nature, the manner in which they were carried out and the disregard demonstrated by the defendant. Prosecutors were calling for the maximum punishment of seven years in prison.
The court showed some leniency at sentencing, though, on grounds that the defendant began discussing compensation with the thousands of victims who have submitted compensation claims during the trial proceedings.
Kivimäki also called for leniency on grounds of the publicity received by the trial, but the calls were rejected by the court.
He unlawfully accessed and copied the patient database of Psychotherapy Centre Vastaamo in November 2018. Both the service provider and its patients began to receive extortion messages in the second half of 2020, with bits of the sensitive patient information popping up online.
The district court viewed that no single piece of evidence showed either the culpability or innocence of Kivimäki. It therefore examined the entire body of evidence, finding several elements that pointed to his culpability.
The defendant, for example, was shown to have used the server used in the offences more frequently than he admitted, and used a pertinent encryption key and IP address in a way he denied in court. He also commented on the hacking and extortion on an online message board in a way that was deliberate, purposeful and temporally aligned with the extortion attempts, suggesting a degree of involvement in the offences.
Another piece of evidence cited by the court was a payment made to the extortioner by the National Bureau of Investigation (KRP) in 2020. The 0.1-bitcoin payment was traced through several intermediaries to Kivimäki and an Estonian man.
Kivimäki himself denied all charges in court.
The District Court of Eastern Uusimaa, though, estimated that his protestations were not particularly credible because their justification and narrative changed as prosecutors brought forward more evidence.
“Kivimäki clearly tried to align his accounts and presentation with the presented evidence and with the factors that emerged as significant for ruling on the case,” it remarked.
In terms of the number of victims, the case is the largest in the history of Finland.
The court did not mull over the compensation claims of the victims, which presently add up to over 5,000. A decision on the claims will be made following a separate trial.
Aleksi Teivainen – HT
