What Happened When 33,000 People’s Therapy Notes Were Released Onto the Internet

Imagine receiving an email from a stranger that said your therapist’s notes about you would be released onto the internet for all to see — unless you paid a ransom. That’s exactly what happened to 33,000 people in Finland in 2020, and it became the biggest criminal case in the country’s history. You can read Jenny Kleeman's reporting on this case here, and listen to her BBC podcast, called Ransom Man, here. You can also watch this interview at ⁠youtube.com/criminalpodcast⁠. Say hello on ⁠⁠⁠⁠Facebook⁠⁠⁠⁠, ⁠⁠⁠⁠Instagram⁠⁠⁠⁠ and ⁠⁠⁠⁠TikTok⁠⁠⁠⁠. Sign up for our ⁠⁠⁠⁠occasional newsletter⁠⁠⁠⁠. Follow the show and review us on ⁠⁠⁠⁠Apple Podcasts⁠⁠⁠⁠. ⁠⁠⁠⁠Sign up for Criminal Plus⁠⁠⁠⁠ to get behind-the-scenes bonus episodes of Criminal, ad-free listening of all of our shows, invitations to virtual events, special merch deals, and more. We also make ⁠⁠⁠⁠This is Love⁠⁠⁠⁠ and ⁠⁠⁠⁠Phoebe Reads a Mystery⁠⁠⁠⁠. Check out ⁠⁠⁠⁠our online shop⁠⁠⁠⁠. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:02Speaker 00

  I'm Ina Garten and each week on Happy Hour, I invite new and old friends for a drink and a fun conversation at my kitchen table in New York City. On this week's episode, I'm joined by Julia Louis-Dreyfus. We talk all about attending a fashion show in Paris together, throwing dinner parties, and making her Broadway debut in other desert cities. New episodes of Happy Hour are available every Wednesday. You can watch on YouTube or listen wherever you get your podcasts. Cheers.

• 0:40Speaker 01

  How far would you go to have a healthy baby?

• 0:42Speaker 02

  Embryo editing is very much illegal in the United States. It is illegal in most countries. But there is growing interest as the technology has gotten better.

• 0:54Speaker 01

  This week on Explain It To Me, the ethics of embryo maxing. Listen to new episodes Sundays wherever you get your podcasts.

• 1:10Phoebe Judge?

  This episode contains mentions of suicide and sexual violence. Please use discretion.

• 1:17Speaker 04

  He was posting on Reddit and also the Finnish equivalent of 4chan. It's called Ulla Lauter. And he wrote, "Hello Finnish colleagues. We have hacked the psychotherapy clinic Vastamo.fi and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a small payment of 40 bitcoins, nothing for a company with yearly revenues of close to 20 million euros. But the CEO has stopped responding to our emails. We are now starting to gradually release the patient records, 100 entries every day." And he signed off the posts with a single word, "Enjoy."

• 2:00Phoebe Judge?

  This is Criminal. I'm Phoebe Judge. And before we start today's episode, I want to remind you that you can also watch this entire conversation on YouTube at youtube.com/criminalpodcast.

• 2:14Phoebe Judge?

  Today, I'm talking with journalist Jenny Kleeman about the biggest criminal case in Finland's history. Jenny covered this story for the BBC in her podcast, Ransom Man. Thanks Jenny for being here.

• 2:26Speaker 04

  Thank you so much for having me, Phoebe.

• 2:29Phoebe Judge?

  In October of 2020, people all over Finland started getting strange emails. What started happening?

• 2:37Speaker 04

  They received emails that contained details that nobody else should know. At first, they looked like spam. But when the people receiving the emails had a proper look at them, they realized that this was no ordinary junk mail. It had their name, their full contact details, and their social security number. And whoever had sent these emails knew that the person receiving them had been having psychotherapy through a service called Vastamo. The person who sent the emails said that they had accessed their therapy notes. And if they didn't pay a ransom, those therapy notes would be released online for the whole world to see.

• 3:19Phoebe Judge?

  One of the women victims you spoke to, her name was Tina. Will you tell me a little bit about how she realized she was part of this?

• 3:29Speaker 04

  Tina received the email on a Saturday. She was a head teacher. It was right in the middle of COVID and there had been a COVID burst at her school. So it was a really frantic time for her. And she was unwinding, like a lot of Finnish people do, by taking a sauna. She got out of the sauna. She was just dressed in a towel. And she picked up her phone. She was idly looking through her phone. And there, she saw the email.

• 3:54Phoebe Judge?

  What role had therapy played in her life? How, what relationship did she have with therapy?

• 4:03Speaker 04

  Therapy had been a lifeline for her. She was someone who was used to always being competent, always being in charge. She was a head teacher. She was a mother of three. And two of her children had been born extremely prematurely in the 1980s, when the chances of having a premature baby survive are very low. Those children had really serious disabilities. One of the children had cerebral palsy. The other one was blind. And for years, Tina had been juggling the care of her children, a demanding job, and a marriage that was in crisis.

• 4:46Speaker 04

  And she had been surviving. But then, once she got a divorce and her children were independent adults with their own lives, she had expected she would be able to exhale. But instead, she had a breakdown and she found herself having very, very bleak, very dark thoughts. I think she would probably say, she wouldn't use the word, she didn't use the word suicidal when she was talking to me. But she did say to me, there was a time when she was driving on the motorway at great speed and she was thinking, I really wouldn't mind if this car crashed. So she was, she was in a really serious situation when she sought therapy.

• 5:28Phoebe Judge?

  So what did she do when she saw this email?

• 5:32Speaker 04

  She was terrified. She told me she thought she was going to have a heart attack and she didn't know what to do. She thought she was the only person to have received this email. She hadn't, she was completely unaware that 33,000 people across Finland were having the same experience. The first thing she did was she called the police. That's what people do when they're in an emergency. And the police told her that she shouldn't be taking up the phone line. The phone line was for real emergencies. They couldn't help. So she felt utterly alone.

• 6:03Phoebe Judge?

  And as you said, she was not the same person, the only person who had received that email that morning?

• 6:11Speaker 04

  No, she was not. She was far from alone. She was one of 33,000 people who had all received the same email from this hacker demanding money. And also, the demands were time pressured. The hacker had said, "You need to pay me the bitcoin equivalent of 200 euros. Otherwise, the price will go up to 500 euros within 48 hours." So he wanted 200 euros within 24 hours. Otherwise, it would be 500 euros within 48 hours. And if he didn't receive payment by then, then the notes would be released for all to see.

• 6:47Phoebe Judge?

  Were any of the notes being released?

• 6:51Speaker 04

  At the time that the ransom demands were sent, the hacker had been drip-feeding the notes of 100 people a day. He had cherry-picked them and he had been putting them online in order to try and put pressure on Vastamo, the therapy service through which they'd all accessed therapy. And so every day for three days, the hacker had been posting the most intimate, difficult, private thoughts. He had been deliberately choosing famous people, politicians, policemen, celebrities in Finland. And he'd also been trying to find the most extreme kinds of things in the therapy notes that could be leaked.

• 7:35Speaker 04

  Details of child sexual abuse, affairs, secret homosexuality. And he had been dropping them every 24 hours for three days. And then on the third day, a much larger file was uploaded and it contained all the patient files. Everybody's therapy notes were just dumped on the dark web for all to see.

• 8:02Phoebe Judge?

  What was he saying in his online posts as he put these therapy notes out there?

• 8:08Speaker 04

  He was posting on Reddit and also the Finnish equivalent of 4chan. It's called Ulla Lauter. And he wrote, "Hello Finnish colleagues. We have hacked the psychotherapy clinic Vastamo.fi and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a small payment of 40 bitcoins, nothing for a company with yearly revenues of close to 20 million euros. But the CEO has stopped responding to our emails. We are now starting to gradually release the patient records, 100 entries every day." And he signed off the posts with a single word, "Enjoy." Somebody alerted the hacker to the fact

• 8:53Speaker 04

  that he had accidentally dumped not only all of the patient therapy files, but the contents of his home folder on his computer onto the dark web. And when he realized that this had happened, he went online, wrote the word "whoopsie," and then logged off forever.

• 9:12Phoebe Judge?

  How did the victims react?

• 9:15Speaker 04

  Many of the people who received the ransom email were not aware that their therapy notes had already been dumped on the dark web for all to see. No two victims reacted in the same way to learning that their therapy notes had been hacked. Some people were distraught and called the police. Some people went online and tried to seek help in communities of other victims. Some people tried to contact Vastamo to get an answer from them. And we know that at least two people took their own lives after discovering that they had been hacked.

• 9:54Phoebe Judge?

  We think that the worst breach you can imagine is, we do everything we can to protect our social security numbers, right? Don't let anyone ever have your social security number. That is going to be the most personal intimate thing, until you think about someone reading the notes you say to your therapist.

• 10:12Speaker 04

  I can't imagine a greater invasion of privacy. As Tina herself said to me when I interviewed her, "We all have thoughts that we would never write down. We might not even write it down in a journal because we wouldn't want someone to read them. We might not even say those thoughts to our closest loved ones for fear of shocking them or upsetting them. But we would say them to a therapist if we thought we needed to for the sake of our mental health." That trust you have in your therapist is sacred. It's a vital part of the therapeutic process. And therapy doesn't work if you think you're speaking to the entire world when you're talking to your therapist. So it's hard to imagine a greater violation.

• 10:55Speaker 04

  And when I spoke to Tina, she said to me, "It felt like a public rape to her."

• 11:00Phoebe Judge?

  Did anyone initially know who did this or were they stumped?

• 11:08Speaker 04

  At first, nobody had any idea it could be anyone. Some people thought that no Finnish person would ever do this. They assumed it must be Russian hackers. But some people had different ideas about it because whoever was leaking these notes knew which notes to leak. They knew who was famous in Finland, who would get attention. And he also knew where to leak them in forums that are popular with Finnish people. So it seemed to some people that this person was a Finn.

• 11:44Phoebe Judge?

  How did Vastamo hear about the hack? I mean, how were they clued into this?

• 11:53Speaker 04

  Vastamo knew that their database had been hacked a month before any of their users knew. The hacker had originally tried to extort the company, had contacted the CEO and several other members of the company more than a month before all the files were released. And he was asking for a ransom in Bitcoin. The company called in a private security service to investigate whether or not the hacker's claims were credible. Medical data is an obvious target for hackers and many hackers try and get into hospitals and different kind of medical services.

• 12:36Speaker 04

  But there are also lots of hackers who don't have anything like what they claim to have when they're holding a company like this to ransom. So Vastamo, the CEO, employed this private security firm to see if there was any credibility in what the hacker was saying. And the security firm also demanded that the police be told at this earlier stage. So there was a kind of four or five week period where behind the scenes, Vastamo was frantically trying to stop the hacker from releasing this data, this incredibly precious data. But they were never going to pay a ransom. That was never on the cards because they couldn't trust. They would have to trust in someone who was certainly a criminal, that they would abide

• 13:20Speaker 04

  by their word and destroy the data once they'd received the ransom. And that's just not a viable proposition. It would leave them open to being victimized again. So they were never going to pay a ransom. They tried to stall the hacker over several weeks to try and see if they could find out who this person was and stop him before it was too late. But in the end, the hacker lost patience and just leaked everything.

• 13:47Phoebe Judge?

  How did the investigator find out about how they had been hacked?

• 13:56Speaker 04

  I spoke to one of the cybersecurity experts who was employed by Vastamo to look at what had happened. And this cybersecurity expert was actually a former detective in the Helsinki Police before going private. And he said he looked at Vastamo's servers and was really shocked by what he found. The security on these servers had been incredibly lax, in his view. He said he found that the database had effectively been left open. It was open to the internet with no firewall and essentially no password. The password was Enter.

• 14:41Speaker 04

  So all you needed to do was like press Enter and you could get into the database.

• 14:46Phoebe Judge?

  Were there initial clues or what were the initial clues about who the hacker might be?

• 14:51Speaker 04

  Initially, there weren't that many clues as to who the hacker was. People had some suspicions, but there weren't clues. And he was asking for payment in Bitcoin, which is theoretically impossible to trace, even if they had paid him. But once he dumped all of the patient files on the dark web and accidentally dumped also the contents of his home folder, that was a goldmine of clues for the authorities. Antti Kuritu, who's the cybersecurity expert engaged by Vastamo that I interviewed, said he started looking through the home folder and he got this strange sense of déjà vu whilst looking at it.

• 15:35Speaker 04

  He said that whoever the hacker was, they didn't organize their digital life in neat files, like you would expect a professional hacker, someone who's used to making their living this way, would do. Things were organized in a kind of random dump of information. There was no organization. And there was also something strangely familiar about the way the hacker was naming the files. It wasn't done in a way that somebody who is trying to be logical and help their future self out by giving the files a name that anyone could find at a later date. He was giving sort of jokey names for the files.

• 16:13Speaker 04

  For example, the file containing the patient's notes was called Therapised, P-I-S-S-E-D.

• 16:23Speaker 04

  And there was something about this kind of juvenile approach to hacking and naming files that brought Antti Kuritu back to his time in the Finnish police. And he remembered getting hold of a hard drive belonging to a 16-year-old boy who had organized his digital life in very much the same way. And that boy was Alexander Julius Kivimaki.

• 16:46Phoebe Judge?

  Who was Kivimaki?

• 16:49Speaker 04

  Kivimaki is probably one of the most famous hackers in Finland, not because he's a particularly sophisticated hacker, but because of the lengths that he was prepared to go to cause harm and drama wherever he went. When he was younger, when he was 14 years old, he first came to the attention of the authorities. He'd been involved in a group called Hack the Planet that had hacked into MIT and taken over their homepage and their domain. But he quickly progressed to even bigger targets and more audacious, outrageous hacks.

• 17:29Speaker 04

  He once rang in a fake bomb threat on a plane carrying the executive in charge of PlayStation for Sony, and that grounded the entire plane. On Christmas Day one year, he and a group of people that he was working with are said to have hacked into Xbox and PlayStation, meaning that Christmas was ruined for millions of people across the world because they couldn't get online and play their new games.

• 18:00Speaker 04

  And he seemed to really enjoy the drama of it. When Lizard Squad, who's the hacking group that he was involved with, were linked to this Sony and PlayStation Christmas Day hack, he went on television, giving interviews, not using his real name, but with his face completely undisguised, saying that he'd done it because, you know, he thought it was depressing that kids were not going to be speaking to their families over Christmas. And he was doing it because he could, because it was fun, and because he found it funny.

• 18:33Phoebe Judge?

  You spoke with another hacker he used to chat with on forums, Blair Strater.

• 18:38Speaker 04

  Yes. Blair and Julius initially were friends, I guess you could say, or at least Blair found him amusing at first. They used to chat together on internet relay channels connected to hacking. And then they had a falling out when Julius was 14 and Blair was 17. It was over a small thing. Who was going to host the report of a recent hack on their own server? They had this fight. And then pizzas started turning up at the home Blair shared with his family in Illinois. And when the family would open the door, the pizza delivery guy would say, oh, it's a pizza for Julius Kivimaki.

• 19:24Speaker 04

  And then Chinese food was ordered, taxis were ordered, sex workers would turn up at the house, three tons of gravel was delivered to their home. Then somebody hacked into the Twitter account of Elon Musk and Tesla, giving Blair's address and saying that if anyone wanted a free car, all they needed to do was turn up at Blair's home, and also his phone number. Their home phone was not usable for an entire weekend. Then someone hacked into Blair's mother's Twitter account and posted racist and anti-Semitic slurs directed at her employer. Blair's mother lost her job shortly after that.

• 20:08Speaker 04

  Someone had been calling the police, claiming to be Blair Strater and claiming that he had murdered his mother. And the police turned up several times with laser sights, fully armed to the teeth, outside the Strater's home. This happened several times. And then eventually, somebody phoned in a bomb threat on the local police force claiming to be Blair. And Blair got taken away and put in juvenile detention for three weeks over Christmas. So Blair's life was effectively ruined because of the feud that he had been having with Julius Kivimaki.

• 20:43Phoebe Judge?

  So when you spoke with Blair, he had no doubt that Kivimaki could be, had it in him to do something like release the therapy notes of all of Finland?

• 20:55Speaker 04

  Yes. Blair said to me that he wasn't the person. He knows people who were victimized more than he was by Kivimaki, other people online. And Blair was furious that nothing could have been done to stop him beforehand. He had called the police. He had reported Kivimaki to the authorities, but still, Kivimaki had never faced the consequences for anything he allegedly did to Blair. And so it didn't surprise him that Kivimaki's name was being brought up in connection with this huge crime in Finland.

• 21:49Speaker 05

  Are you tired of hearing about business, tech and finance from the bros? We are the Tiger Sisters, a top business podcast with the Vox Media Podcast Network. Tiger Sisters releases every Monday and we decode money, power and love. And who doesn't love all those things? We are the internet's Wall Street and Silicon Valley big sisters. Tune in every Monday for late night sister talk meets boardroom strategy.

• 22:12Speaker 06

  Check out Tiger Sisters on YouTube, Spotify, or wherever you get your podcasts.

• 22:17Speaker 05

  Welcome to the Tiger Fam.

• 22:21Phoebe Judge?

  How did police start investigating this therapy hack?

• 22:28Speaker 04

  The home folder that the hacker had left was incredibly important to the investigation. And they were trying to establish that they were, they were looking for links between Julius Kivimaki and the hacker who had been calling himself Ransom Man in online forums, in his online posts. There were several links between Kivimaki and Ransom Man. The first was that a credit card that Kivimaki had been using to pay for an Apple subscription and an OnlyFans subscription had also been used to pay for servers that were involved in the hack.

• 23:12Speaker 04

  So a credit card linked to Kivimaki was also linked to Ransom Man. During the initial negotiations, ransom negotiations with Vastamo, Vastamo had made a payment of 0.1 Bitcoin to Ransom Man. And the intention was that this would be some kind of breadcrumb, something to follow. And the police, using quite sophisticated techniques, had managed to see that when that Bitcoin was turned into real world currency, laundered into real world currency, it had ended up in Julius Kivimaki's account. But for me, the thing that was most striking, the piece of evidence that was, that was most striking was that when they looked at the home folder that the hacker had accidentally leaked, they were able to look at the hacker's command history, which means they were able

• 23:57Speaker 04

  to look at exactly what the hacker had been doing on his computer, at what time, in what order. And they found that as well as searching for pedophilia, rape, adultery, the most outrageous things in, in the therapy notes to flaunt online, the hacker had also been looking for details that would only be relevant to Julius Kivimaki. Julius Kivimaki's loved ones, places where Julius Kivimaki lived. Essentially, the hacker was trying to make sure that there wasn't anything in the, in the patient notes that would have a negative effect on Julius Kivimaki or his loved ones before those notes were leaked.

• 24:40Speaker 04

  And also in the home folder, there was a photograph, which they managed to establish had been taken at Julius Kivimaki's grandparents' cabin. And there was a final piece of circumstantial evidence that was extremely important. When the notes were all leaked, they were leaked from an IP address in London. And they could tell from records that the person living at that particular address at the time in London, the person renting that apartment was Julius Kivimaki.

• 25:13Phoebe Judge?

  So they had pretty good evidence of, of who had done this. But what were some of the, the challenges they were facing in the investigation?

• 25:24Speaker 04

  There were many challenges. First of all, there were terabytes and terabytes of data to sift through. They also had, had an enormous number of victims. Each one of them had to register an individual complaint. So even though the therapy notes of 33,000 people were leaked, I think there were only around 21,000 people who registered themselves as victims on this online portal that they set up. But they had to go through everybody's individual complaint, check that they actually were victims, they had gone to therapy with Vastamo. And also there were other challenges in that whilst there was a huge web of evidence linking Julius Kivimaki to Ransom Man, there was no smoking gun.

• 26:06Speaker 04

  It was all circumstantial evidence, building up a picture of someone who it was incredibly likely was responsible for the hack. But they didn't catch him in the act, sitting behind his computer. There was no one single definitive piece of evidence that on its own would prove that Julius Kivimaki was Ransom Man.

• 26:28Phoebe Judge?

  And as this whole investigation was going on, I mean, the therapy notes had been released, were out there. Were people reading these, these notes?

• 26:38Speaker 04

  I think Finnish people were very good at not making public anything that had been illegally stolen and leaked online. But that's not to say that people didn't read this stuff. When it was first leaked online, even some of Finland's hackers were appalled and, and expressed their disgust, said, you know, this is beyond the pale, this is too much. But lots of people did look and people were commenting on the forums and laughing about people's therapy notes. I spoke to someone who said she, she remembered a victim who had gone online to see if her notes were there. And she said, when she looked at the forum, she could see people laughing about a 10-year-old child who had gone to therapy, because there were children among the victims as well.

• 27:23Speaker 04

  And we know that even though the therapy notes were taken down from lots of platforms, an untold number of people had taken a copy. And in the months and years following the leak, those therapy notes continued to circulate online. People have even made searchable databases. So all you need to do is put in someone's name and you can call up their therapy notes. So this shows that this isn't just about a single hacker who was prepared to, to break every moral boundary possible. It is a, a thing that other people are prepared to do too.

• 27:59Phoebe Judge?

  So yeah, once the, the notes were released, it's not as though Vastamo or the Finnish government could pull them back. They were out there.

• 28:07Speaker 04

  Once things are online, they are online forever. And we don't know how many people took a copy of those notes and, and still have those notes sitting in a hard drive, prepared to, to, to use them. Several of the people I interviewed have had people try and get out credit cards and loans in their name and all the other things that can happen when your social security number is out there. The Finnish authorities are not allowing them to change their social security numbers. So this is something they're going to be living with for the rest of their life. Not just the therapy notes being leaked, but their identity effectively being stolen too.

• 28:38Phoebe Judge?

  You spoke with a lot of victims of this hack. What, what were some stories that stuck out to you of people's experience with it?

• 28:45Speaker 04

  I spoke to a, a very successful comedian in Finland who's a, a stand-up comic. And, you know, for him, he had had suicidal thoughts. And yet he's a professional funny man. He needs the audience to be laughing along with him. So it was terrifying at first for him. But then he very quickly realized that, no, he was going to use this personal experience as part of his act and he was going to make jokes about it. And he said, when he got up and stayed on stage and started talking about it, at first people were awkward and, and nervous to hear him talk about what had happened. But as he looked out into the audience, he saw many nods of recognition and he realized

• 29:27Speaker 04

  there were other Vastamo victims in the audience too. And this is, this is a country of, of just over 5 million people. 33,000 people had their therapy notes hacked. So everyone knows someone who was a victim. And he realized that by facing his worst fears head on, by realizing that people were going to know his vulnerabilities, his worst fears actually weren't so bad. And he, he felt emboldened by the fact that he was able to talk about this publicly and be okay.

• 29:59Phoebe Judge?

  Do you know, I think that if, not even if my notes had been released, but if my partners or my mothers or my, I would not want to read them because I wouldn't want to be hurt. You know, so it's the peoples whose notes are released, but it's also, oh no, what if they were talking about me? I mean, I, can you imagine the strife in, in homes over the dinner table?

• 30:23Speaker 04

  Absolutely. And, you know, some people hadn't even told their family members they were going to therapy. There's also this kind of extra layer, which I hadn't really thought about until one of the victims told me that it was a, a big source of anxiety for her, which is, you know what you told your therapist, but you don't know what your therapist wrote down. You don't know how they interpreted what you said. One of the people who I interviewed said she was desperate to know what her therapist had said. And in fact, she went to Vastamo, she asked for Vastamo to, to, to give her a hard copy of her notes. She was the one who had been on the dark web, looking for her, for her notes. And she said, when she read what her therapist had, had written, she was really hurt by how she had appeared to him.

• 31:07Speaker 04

  The therapist had said things like, you know, that she was talking in an erratic manner, that she had an immature way about her, various things like that. And she felt devastated that she had appeared that way to her therapist. And she also was taken back to the time of crisis that she had been in when she went to therapy. A lot of people had made huge gains going to therapy, which were just completely undone by the fact that these therapy notes were out there. And a lot of people had, had completely lost faith in the therapeutic process and in doctors. You know, people felt that they couldn't trust their doctors anymore. They didn't feel comfortable going to doctors anymore.

• 31:47Speaker 04

  Because if this incredibly sacred space could be breached, how could they trust anywhere else to be safe?

• 31:55Phoebe Judge?

  Tell me about the arrest.

• 32:00Speaker 04

  Two years after the first ransom emails were sent,

• 32:06Speaker 04

  the Finnish police announced that they had a suspect, Julius Kivimaki, but they couldn't find him. He's a very international person. They didn't know exactly where he was. He was put on Europol's list of most wanted fugitives. Then, in February 2023, the police in Paris got a tip-off about a domestic disturbance. They visited an address at 7:00 a.m. in a Paris suburb. Somebody had rung and said that they had heard shouting and they were worried that a woman was being victimized by her partner. The police knocked on the door, got no answer. They knocked the door down with a battering

• 32:49Speaker 04

  ram. And inside, they saw a kind of bleary-eyed couple, no sign of any disturbance. They asked the man to hand over his passport to identify himself. And the man, who was over six foot tall, blond-haired, blue-eyed, handed over a passport identifying himself as a Romanian national called Asan Ahmed. The police thought that the name didn't match the face. They put the name through their databases and found out that Asan Ahmed was a known alias for Julius Kivimaki. So he was finally arrested and then sent back to Finland to face justice.

• 33:31Phoebe Judge?

  What were the charges?

• 33:33Speaker 04

  Kivimaki was charged with 9,600 counts of aggravated invasion of privacy and more than 21,000 counts of attempted aggravated extortion.

• 33:47Phoebe Judge?

  How did the victims find out that someone had been arrested?

• 33:51Speaker 04

  Most of them saw it on the news. And for some of the people who saw it on the news, it was really traumatic, particularly because Julius Kivimaki looks like any other regular Finnish guy. And seeing him walking into the courthouse, I know certainly for Tina, it was extremely traumatizing. She was sitting down to watch the news with her partner. And up came Kivimaki into her living room. And she felt, she felt completely distraught. She said she couldn't sleep for nights after then, because it felt like another violation. Other people I spoke to were just shocked by his ordinariness. I

• 34:33Speaker 04

  think perhaps it would be easier to imagine that this was kind of Russian criminals or criminals from overseas, you know, intent on doing you harm. The idea that it would be a fellow Finn, the sort of person who would pass in the street every day who was responsible, that was really traumatizing for some people.

• 34:51Phoebe Judge?

  What was the trial like?

• 34:53Speaker 04

  The trial was a bit of a circus. Julius Kivimaki seemed to enjoy his time in the spotlight. He would come in reading different books. He came in reading a book by L. Ron Hubbard about Scientology one day. The next day, he came in reading War and Peace. And he liked to prop up his books in front of the cameras. It, there was no jury. There were three judges. And Julius Kivimaki was playing computer games on his court-approved computer throughout most of the trial, I was told. He seemed bored, unless they were talking about specific pieces of hacking evidence, in which case he would become more engaged.

• 35:39Phoebe Judge?

  And is it true, is it true that there were so many victims who wanted to watch what was going on, that they were, they were broadcasting in movie theaters?

• 35:50Speaker 04

  There were 21,000, over 21,000 registered victims in this case. And no courtroom in the world is big enough to house 21,000 victims. So the Finnish authorities set on, set up public screenings in places like movie theaters across the country. Some of the people I spoke to attended some of these screenings. And they said it was just profoundly awkward experience, because you're there because your privacy has been violated. And yet you are sitting next to other people whose privacy has been violated. And you don't really know what to say to the other people there. So everyone pretty much tried to keep to themselves in this very surreal environment.

• 36:30Phoebe Judge?

  And, and he was convicted?

• 36:33Speaker 04

  He was. He was eventually found guilty after a trial during which he had, at one point, escaped and apparently gone on the run and couldn't be found for a week. It was a trial full of drama, but eventually, he was caught. And he was brought to face justice. And he was convicted of all of those charges, guilty on all charges, and sentenced to six years and three months in prison, which is actually a long time by Finnish standards. But a few months shy of the maximum sentence, he could have, he could have received. And in fact, recently, Julius Kivimaki tried to appeal this sentence. He lost his appeal. And his sentence was increased by another six months.

• 37:19Phoebe Judge?

  I gotta tell you, it doesn't seem, doesn't seem long enough.

• 37:24Speaker 04

  It really doesn't. And when you, the, the whole thing I found reporting this story is that the suffering is kind of unquantifiable. When you have 33,000 people whose lives have been turned upside down by this crime, it's an impossible thing to measure. And in fact, the prosecutor who I interviewed said he and his colleagues had, had tried to quantify how much suffering this had caused, multiplying the number of victims by a week. Like, if you could assume that each victim suffered a week of suffering, how, how much suffering was caused by this crime? And he said, when you do the maths,

• 38:03Speaker 04

  if you, if you, if you allow each victim a week of suffering, this crime caused 635 years of suffering.

• 38:12Phoebe Judge?

  Was there any compensation for the victims?

• 38:16Speaker 04

  The victims are going to get compensation ranging from a few hundred euros to a few thousand, depending on what was in their therapy notes, how many pages of notes were in Vastamo's database, and how sensitive the details in those notes was. The Finnish authorities are probably going to end up paying that compensation. It's not going to come from Julius Kivimaki, because he claims to have no money. And none of the police have been able to find any of his money, if he does have money.

• 38:46Phoebe Judge?

  You actually met him. What was he like?

• 38:50Speaker 04

  At first, he didn't want to meet me. And in fact, I was in Finland reporting this story with him continually saying no. And then, on my last day of reporting, when I had a few key interviews left to record, I heard that he'd changed his mind. And so I dumped all my other plans and got on a train to Turku, which is where he was in prison. It was one of the most extraordinary interviews I've ever done in my life. I was told I would only have about 15 minutes with him. I had over two hours with him. He turned up 40 minutes late. And at first, I thought he was just trolling me, that

• 39:33Speaker 04

  he just wanted to kind of ruin the plans that I had for, for, for doing interviews that day without any intention of ever leaving his cell. But he did eventually arrive. And for two hours, he looked me straight in the eye and unemotionally answered all of my questions. He maintained his story, which was that he didn't do it. The police have all of this evidence, but it's just circumstantial. I said to him, you'd have to be the unluckiest person in the world to have so many pieces of evidence linking to you. And he said, well, the correct answer is that it's not me, but it's somebody close to me. And I said, oh, so, so who is, who is it then? And he said, I have a good idea

• 40:16Speaker 04

  about who it is, but I'm not going to tell you. I don't want to name any names. And Julius Kivimaki had always made a very big deal out of living a very luxurious lifestyle. He was always posting on social media about drinking champagne in Saint-Tropez, going on luxury holidays. And to me, the idea of that person being willing to serve time in a Finnish prison for somebody else seemed quite absurd. I asked him if he had anything to say to the victims. I told him that Tina had said to me that having her notes leaked felt like a public rape. And he said, well, I'm sure she feels that way. I don't have anything to say to the victims because I didn't do it. And I said, well, you know,

• 40:58Speaker 04

  you must have some response to this crime on an emotional level. Whenever I talk to anybody about this story that I'm doing, they have an emotional response to it because it's, it's, it's so outrageous. And he said, well, no, it's just another story in the news. What's in the news at the moment? Oh, you know, people being killed in Gaza. It's like that, he said. How do you, how do most people feel when they, when they see news about Gaza? The answer is, most people, they feel nothing at all, because they've got nothing to do with, with, with those victims. So that's how I feel. They're nameless, faceless people. That's what he said to me.

• 41:36Phoebe Judge?

  Did it make you, I mean, if, if, if the courts are right, and, and he is guilty, and he was lying to you, does it make you think that when he is let out in just a few years, one should be worried about what he might do next?

• 41:53Speaker 04

  I think we should all worry about what he might do next, because he is a criminal without boundaries. He, as far as I can tell at the moment, he is not in custody. He's supposed to be back in prison, but the Finnish authorities haven't been able, been able to, to find him. Because he was released during the appeal. He was released from prison, and they haven't been able to locate him yet. On a personal level, I, I don't feel that I am going to be a particular target for him. I think he always has his sights set on, on bigger, bigger, more dramatic, high-profile targets than the likes of me.

• 42:34Speaker 04

  But I, I, I could be wrong. You know, I, I've tried to take care with my digital life. But I'm also somebody who hasn't put a lot of myself online, which is perhaps what draws me to this story, is I've always been afraid of, of, of what can happen when you live too much of your life in a, in a digital way. I mean, I'm sitting here in my office now and looking up at the 500 or so notebooks that I still keep with all of my work. I'm, I'm still someone who still very much believes in, in paper and pen. But, you know, this sort of thing can happen to any of us. So much of our lives is now spent online. You know, I still communicate with my doctor online. I, so much of my work

• 43:15Speaker 04

  is conducted online. You know, it's an undeniable fact of our lives now. And we know that whatever we put into a computer or into a phone could one day get into the hands of somebody that we don't want to have it. But that doesn't stop us from doing it, because this is just part of human life now.

• 43:35Phoebe Judge?

  Well, Jenny, thank you very much for speaking.

• 43:37Speaker 04

  Thanks so much for having me, Phoebe.

• 43:40Phoebe Judge?

  That's journalist Jenny Kleeman. You can find the link to her podcast series for the BBC called Ransom Man at the link in our show notes. In addition to listening here, you can also watch all of these Tuesday conversations on YouTube. Just go to youtube.com/criminalpodcast or click the link in our show notes. I'm Phoebe Judge. Thanks for listening.