British Teen Gets Potential Life Sentence for Grand Theft Auto VI Hack

Rockstar Games told a U.K. court that it spent $5 million to recover from the hack. Is that worth the rest of a teenager's life?

Last week, a judge in the U.K. sentenced a teenager to an indefinite hospitalization for committing cybercrimes.

In September 2022, a user named Teapotuberhacker uploaded 90 videos onto the internet forum GTAForums. Collectively, the videos constituted more than 50 minutes of unfinished gameplay footage from Grand Theft Auto VI, a long-anticipated video game under development by Rockstar Games.

In a post on X (formerly Twitter), Rockstar Games confirmed the authenticity of the footage, blaming the leak on a "network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems." At the time, video game blog Kotaku called it "one of the largest video game leaks in history."

On September 22, just days after the leak, London Police arrested a British teenager for the hack. As it happened, the suspect—later identified as 17-year-old Arion Kurtaj, a member of the cybercrime gang Lapsus$—had already been arrested for hacking tech company Nvidia and U.K. telecom BT/EE. Even though he was in police custody at a Travelodge and his laptop had been confiscated, Kurtaj managed to hack into Rockstar using only his cell phone, a hotel TV, and an Amazon Firestick.

In August, a jury determined that Kurtaj had committed the acts alleged, although this was different than a guilty verdict: "Kurtaj is autistic and psychiatrists deemed him not fit to stand trial so he did not appear in court to give evidence," the BBC reported. "The jury were asked to determine whether or not he did the acts alleged—not if he did it with criminal intent." The outlet further reported that "Kurtaj had been violent while in custody with dozens of reports of injury or property damage."

Last week, according to the BBC, Judge Patricia Lees sentenced the teen to "remain at a secure hospital for life unless doctors deem him no longer a danger," on the basis that "Kurtaj's skills and desire to commit cyber-crime meant he remained a high risk to the public."

But…what exactly is the harm that has been alleged? In fairness, Kurtaj not only hacked firms like Rockstar and BT/EE but he also blackmailed the companies, asking the latter for $4 million (which was not paid).

The Guardian noted after the Grand Theft Auto hack that "there will be financial consequences, as Rockstar investigates the leak and likely evaluates working practices," while its parent company "may well face a dip in its stock value as well as uncomfortable questions from shareholders."

No doubt, the leak was embarrassing, and Rockstar told the court that it spent $5 million to recover from the hack. But it would be difficult to make the case that Rockstar was irreparably harmed by the unauthorized disclosure: Earlier this month, when the company finally released the official first-look trailer for Grand Theft Auto VI, it accrued more than 90 million views in 24 hours—more than any other video game reveal in YouTube history, according to Guinness World Records.

Speaking of records, 2013's Grand Theft Auto V, the previous title in the franchise, has sold more than 185 million copies, more than any game in history with the exceptions of Minecraft and Tetris. After the trailer debuted, the BBC's Eric Alt wrote that the franchise's sixth installment "may not only succeed – but blow its predecessor's revenue out of the water."

"In sentencing hearings, Kurtaj's defence team argued that the success of the game's trailer indicated that Kurtaj's hack had not caused serious harm to the game developer and asked that this be factored into the sentencing," the BBC reported last week. But the judge "said that there were real victims and real harm caused from his other multiple hacks on individuals and the companies he attacked with Lapsus$."

Perhaps so. But it's worth asking if Kurtaj's crimes are worth potentially spending the rest of his life in custody, especially when the jury that condemned him was not even asked to consider whether he possessed criminal intent.