In October 2020, Yevgeniy Aleksandrovich Nikulin, a Russian national, was sentenced to 88 months’ imprisonment in the United States for hacking into LinkedIn, Dropbox, Formspring, and Automattic, selling the information stolen from the unauthorized access of these companies’ systems (with the exception of Automattic). He was arrested in Prague, Czechia, following an Interpol Red notice, and extradited to the U.S. from Czechia.  He had challenged the Municipal Court of Prague’s decision, as well as the High Court’s rejection of his appeal of the decision, to extradite him to the U.S. in the Czech Constitutional Court. Specially, he filed a constitutional complaint pursuant to the Constitution of Czechia, as well as the Charter of Fundamental Rights and Freedoms and the European Convention for the Protection of Human Rights and Fundamental Freedoms (i.e., the European Convention on Human Rights).

A lower court, the Municipal Court in Prague, ruled on the Public Prosecutor Office’s proposal regarding the extradition of the complainant abroad for two criminal prosecutions in different countries pursuant to Section 95 of Act on International Judicial Cooperation in Criminal Matters (Czechia), as amended.  The Municipal Court ruled that the extradition for both prosecutions was allowed and that the complainant could, therefore, be extradited to the United States (to be prosecuted for unauthorized access to systems and data) and to the Russian Federation (to be prosecuted for the theft of property over the Internet within an organized group). The Municipal Court held that the alleged acts that are the subject of the U.S. and Russian prosecutions were considered crimes under Czech law. The Municipal Court also concluded that the due process rights of the complainant would be respected in both countries. From the materials provided by the foreign authorities, the Municipal Court held that the extradition was not prohibited under Section 91 of the Act on International Judicial Cooperation. Additionally, according to the Municipal Court, the complainant was a young, healthy man, and it could not be assumed that his extradition would cause him disproportionate harm.

It is important to note that the complainant did not object to his extradition to the Russian Federation. The complainant objected his extradition to the United States. The Municipal Court did not find any reason to object to the extradition of the complainant to the United States. Furthermore, the Municipal Court held that the complainant’s objection to the extradition to the United States, specifically, on the grounds that he would be subjected to a disproportionate penalty were unfounded, especially since in the U.S. sentences for several crimes could be served concurrently.

The complainant appealed the decision of the Municipal Court to the High Court in Prague. After reviewing the decision of the Municipal Court and the evidence presented by the complainant, the High Court rejected the appeal and similarly found that there were no grounds for prohibiting the extradition of the complainant. The High Court echoed many of the conclusions of the Municipal Court, concluding that there were no facts presented that illustrated the risk of ​​human rights violations and disproportionate sentencing of the complainant if he was to be extradited to the United States. In fact, in regard to the latter, the High Court rejected the complainant’s argument that he was at risk of receiving a penalty of up to 54 years’ imprisonment in the United States. In rejecting this claim, the High Court noted that the penalty he could receive for the alleged crimes ranged between 12 to 14 years’ imprisonment.

The Constitutional Court held that the decisions of the Municipal Court and High Court met constitutional requirements and rejected the complaint of the applicant as manifestly unfounded. Ultimately, when Mr. Nikulin was extradited to the United States and tried by a jury, he received a sentence of 7 years and 4 months’ imprisonment for his cybercrimes. He was sentenced for selling stolen usernames and passwords, in violation of 18 U.S.C. § 1029(a)(2); installing malware on protected computers, in violation of 18 U.S.C. § 1030(a)(5); conspiracy, in violation of 18 U.S.C. § 371; computer intrusion, in violation of 18 U.S.C. § 1030(a)(2)(C); and aggravated identity theft, in violation of 18 U.S.C. § 1028A(1).