Spamhaus DDoS suspect extradited to the Netherlands

A 35-year-old Dutchman suspected of participating in a large DDoS attack on antispam organization Spamhaus was extradited from Spain to the Netherlands on Monday evening, the Dutch Public Prosecution Service said Wednesday.

A judge in the Rotterdam District Court Wednesday ruled to keep the suspect in jail for an initial 14 days, as requested by the Public Prosecution Service, said a service spokesman, Paul van der Zanden. "I can say nothing substantive about the case because it is still under investigation," he added. The investigation is led by the Team High Tech Crime of the Dutch police.

In two weeks, the court will decide whether to keep him in custody for a longer period pending the outcome of the investigation, Van der Zanden said.

At the moment, it is impossible to give an estimate of how long the investigation will take, Van der Zanden said.

The Public Prosecution Service did not name the suspect, referring to him only as S.K. However, he has been identified by an official close to the investigation as Sven Kamphuis, who was a spokesman of the Stophaus movement. That group's members included companies and individuals flagged as spammers by Spamhaus, a non-profit organization that develops widely used lists of networks identified as sending spam.

Stophaus claimed responsibility for attacks against Spamhaus, including one of the largest DDoS (distributed denial of service) attacks on record, with an estimated 300G bps peak, although the attack's intensity was later disputed by security experts.

The Dutchman is suspected of performing large-scale DDoS-attacks targeting Spamhaus, the Public Prosecution Service said. Performing a DDoS attack is a criminal offense under Dutch law.

The attacks were carried out against Spamhaus partners in the U.S, the Netherlands and the U.K., and the attackers used forged IP addresses, according to the Public Prosecution Service.

At the time of the attacks in March, Kamphuis denied his personal involvement and said that it was launched by Stophaus members from China and Russia.

The Dutchman was arrested late last month by Spanish authorities in Barcelona. He drove around Spain in a van he used as a mobile office, according Spain's Interior Ministry. The ministry also released a video of his home, which was the target of a raid by the police.

On Tuesday evening local time, the Dutch government websites Rijksoverheid.nl and Government.nl were hit by a large DDoS attack, reported Dutch news site Webwereld. Recently, Dutch banks and DigiD, an identity management platform used by Dutch government agencies, also experienced service disruptions due to DDoS attacks.

People who said they are supporters of Kamphuis claimed to be responsible for some of the attacks in a post on Pastebin Tuesday.

Loek is Amsterdam Correspondent and covers online privacy, intellectual property, open-source and online payment issues for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to loek_essers@idg.com