Man convicted after threats to bomb UK hospital during pandemic

A threat to bomb a UK hospital at the height of the Covid-19 pandemic’s first wave unless a £10m bitcoin ransom was paid was kept secret for fear people would be too afraid to seek treatment, it has been revealed.

The race against time by international police to track down the suspect was shared only with a tight circle of government and senior NHS staff as hundreds were dying each day in the UK’s April lockdown.

On Friday, Emil A, a 33-year-old Italian national living in Berlin, was convicted of attempted extortion at the district criminal court in the German capital.

His full name is restricted by German privacy laws. He has been sentenced to three years in prison but released on bail until the decision is ratified. He can appeal against Friday’s ruling.

He purported to be a member of far-right group Combat 18, and sent emails to the NHS and the UK’s National Crime Agency (NCA) threatening to detonate a bomb at an unspecified UK hospital. During a six-week extortion campaign from 26 April to 16 June 2020, involving 18 emails, he also threatened UK Black Lives Matter protests and, on the anniversary of MP Jo Cox’s murder, said he would target unspecified UK MPs.

German police special forces, the GSG 9, arrested him in an armed raid on his Berlin flat in June after information from the NCA, including from its cybercrime and behavioural science experts.

The threat was made at a time of “deep, heightened and dramatic vulnerability” for the NHS and acute national crisis, the NCA said. With no hospital specified, if the threat had become public it could have left people too terrified to attend any hospital, resulting in loss of life.

Behind the scenes, hospitals were made as “target-hardened” as possible. But evacuating patients on ventilators and keeping them alive in the event the threat was carried out would have been impossible. The fact oxygen therapy was the main treatment for Covid, with large canisters being stored, raised the risk level even higher.

“To make this public would have been such a real threat that the circulation was kept to highest parts of government,” said Tim Court, the head of investigations at the NCA’s national cyber crime unit (NCCU), as the man was convicted.

Court added: “What was in those emails was so threatening and so damaging, were it to have been made known outside a very tight circle of people, and I mean very tight, the realisation of that secondary risk – which was loss of confidence in the NHS and therefore absolutely loss of life when people didn’t attend hospitals – was not acceptable to us.” A lot was done behind the scenes, he added, but not a lot was known outside the need-to-know circle.

“At the highest levels it was recognised that nothing should be done to deter people from seeking medical treatment.”

In the event, once arrested Emil A had no links to Combat 18, and no way of deploying any device. Single, with no children, no known links to the UK or UK hospitals, and with a background in computing, he used encryption and obfuscation services from the dark web to try to hide his identity.

As part of Operation Leasing, NCA officers used behavioural and linguistic scientists, counter-terrorism and covert methods to pinpoint him to Germany, with Berlin’s Landeskriminalamt (LKA), the equivalent of the CID, finally identifying him. His flat was raided on 16 June, the ransom deadline.

Though not a member of Combat 18, the threat he was from the far right was of deep concern at a time rightwing extremists around the world appeared to be hijacking the Covid pandemic, the NCA said. When arrested he was found to be acting alone, with no ideological links to the far right.

“But it was a serious crime utilising social engineering technique to make the risk seem more significant,” said Nigel Leary, gold commander of Operation Leasing. He chose the NHS because of its vulnerability at the time, with no axe to grind with the NHS or UK, Leary added.

Given his strong ties to Germany extradition was not deemed viable, but the NCA handed its material to German prosecutors. As a result of Brexit, Germany now has no extradition treaty with the UK.

The suspect was convicted in 2013 of a similar threat against a Dutch company and sentenced to 10 months probation, the Berlin court was told.

Nigel Leary, deputy director of the NCCU, said: “As soon as this was reported to us, we took the threat extremely seriously. For it to be carried out would have been absolutely catastrophic.”

An NHS spokesperson said: “The threat made during the extortion demand significantly added to the pressures on the NHS during the Covid pandemic and meant senior leaders and emergency response staff were called on to direct the NHS aspects of the response to this threat.

“The threat and demand was made at a time that hospitals were at their most vulnerable, and could have resulted in significant loss of life.”