Ransom Man: 4. The Zen Garden

finished authorities finally announced that they had a name and a face.

“25-year-old Alexandra Julius Kivimaki was added to Europe's list of most wanted criminals.”

He's chubby, cheeked and floppy head in his photo on the Europe-all website, staring impassively into the camera alongside mugshots of murderers, kidnappers and drug traffickers. This is the face of the self-styled, untouchable hacker god, suspected of stealing the most personal data imaginable, the therapy notes of 33,000 of asthma patients. The biggest crime in finished history.

Vasivanio, the deputy chief district prosecutor, is the man who puts Kivimaki on that list. "How are you suit investigation orders around Europe to get some hints?"

Ransson man, the extortionist who had hacked Vastamo, had always insisted he'd never

be brought to justice. In the messages he'd sent to Vastamo two years earlier, he'd at one point demanded

“20,000 euros a month, every month, until he was caught.”

Even in the unlikely event that they identify us, he wrote, "We are far beyond their reach." The act of the 12th tells that someone who's ironed enough to think that he's at reach more. Passee and his team believed Julius Kivimaki was behind it, but what evidence did they have and would they ever catch him?

I'm Jenny Kliman, and from BBC Radio 4 and Intrigue, this is Ransson man. Episode 4, The Zen Garden I meet Passee in the prosecutor general's office, amaze of corridors and wood paneling. Passee's very tall, with a neat beard and a crisply iron shirt. He's an old-fashioned heir to him.

“He somehow manages to exude both authority and warmth, like a kind of calm, dependable”

uncle. Working on this case has changed him, he tells me. Blocked myself from a social media and stuff like that, it's getting harder for me to understand why people give out their information. Once it's out there, it's lost.

He's been a prosecutor for 15 years. He's spent eight of them specialising in cyber crime, so he's not easily shocked by the work that lands on his desk, but this case disturbed him. Last time I was the biggest case that we had very different from anything it so far. What made it different?

From day one, it was very clear that the amount of suffering that's involved was understandable. Now, with the expectations of tens of thousands of victims on his shoulders, it was Passee's responsibility to bring the perpetrator to justice.

The first question for him and his team was, "Where to begin?"

One thing the investigators weren't short of was data. In many ways, there was too much terabytes and terabytes to sift through. For three days, ransomman had been drip feeding the therapy notes online, in batches of 100 a day until he accidentally dumped the entire database of over 30,000 patient records. Whoopsie, as the hacker himself put it.

It was a particularly catastrophic mistake, because as well as the patient data, ransomman had accidentally released the entire contents of the home folder of his own computer. For the police, it was a gold mine, a portal to millions of pages of documents, videos, images, and browsing habits. It contained ransomman's command history.

That meant investigators could piece together exactly what the hacker had been doing on his computer. They could see that as well as searching for keywords like rape, abuse, and child molestation in the database of vast remote patient records, ransomman had been looking for things that would only be of interest to Julius Kivimaki.

There was a search on Mr. Kivimaki's own home address, and other churches, we think that they were linked to him finding out before the publications that there was not the information of someone close to him or family members.

I think he ensured that there was no harmful information about him or people close to him.

That is fascinating. Before anything was made public, ransomman had ensured that the patient records didn't contain anything related to Kivimaki or his loved ones. Although, of course, he could argue that somebody could have been doing that. To implicate him, that's before that error that had been made, it's quite a conspiracy

to leave trails, and if you make an error afterwards, that releases the information off the server. It's not in keeping with somebody who had accidentally done all the data to have been

criminal masterminders, done searches that would stitch up someone else in the past.

“Next, the home folder, led investigators to key bits of tech that have been paid for using”

a credit card that their established had belonged to Kivimaki. We had the card that had been used to link Mr. Kivimaki in the real world to activities, paying for servers, and he also used some services, Apple, hotels, only fans. It's paying for the rent of the servers, with the credit card that he had used to look at porn on only fans.

This same credit card provided other evidence that would prove vital to the case that Julius Kivimaki and Rantsam Man were the same person.

Kivimaki had paid for a server that had been used to store a backup of the entire database

stolen from Vastimal, but aside from the credit card, there were other ways of connecting Kivimaki to Rantsam Man.

“In Vastimal was first negotiating with the hacker, the police made a payment of 0.1 of”

a Bitcoin equivalent to around 1,000 euros. It was a breadcrumb, it gave the authorities something to follow. They managed to trace it from a Bitcoin account to a money laundering service. And from that money laundering service, it went to Mr. Kivimaki's bank account. Other clues on Rantsam Man's home folder called for some old-fashioned detective work.

Can we find a picture of a lake view? It was entitled Beach.Jpeg, an image of a lake with rocky shores lined with trees. One of the investigators said, "I bet that this is from Kivimaki's grandparents' cabin." And another investigator said, "If that's the case, it had full of shit." Rassie doesn't say whether any hackfills were ever eaten, but when investigators travelled

to Kivimaki's grandparents' cabin, it was the same view. The investigator was proved right.

“And there was another key piece of evidence, but it wasn't on the home folder.”

It came from the real world, from the UK, from my home city. He was in London when the crime is welcome. We're sitting in this lush, beautiful London park with a fountain in the middle. Lots of London plain trees surrounded by buildings, and we know that when Rantsam Man was searching through the database, looking for the most outrageous things he could leak.

So details of affairs, suicidal thoughts, details of pedophilia, was doing it from an addressing London. That physical address in London had the IP address of this building just next to us here. An IP address is kind of like a postcode for your computer or phone that can give pretty accurate information about where you are in the real world when you're online.

And we also know that the person who is living in the same flat as that IP address at the time was Julius Kivimaki. As well as being a vital part of the investigation, this address also gives us an insight into the kind of life Kivimaki was able to enjoy and afford. Kivimaki's credit card statements for this time showed that he was enjoying fine dining,

regular sauners, and even manicures while he was living in London. And he'd chosen to rent in one of the most expensive areas in the whole of the UK. We're about a three-minute walk from the headquarters of Channel 4. I spent many years making television programs for Channel 4. So this is an area I know really well.

I used to come here all the time on my way to work, it's near Westminster Abbey.

official buildings and offices and important places, but there's not really a kind of community

around here.

“It's full of transient people, people who are coming here on business.”

It's a rich outside as few of English-nurs. I wonder if anyone around here remembers Julius Kivimaki. My producer Sam and I managed to make it into the lobby of his apartment block. Hey, here we go, right. So, Marvel Stairs, Smoked Bones, Fannisters.

Ooh, there's a little fountain in the communal gardens, and there is a concierge desk. Oh, here we go. Hi there. Hi there. Can we ask you, do you recognise this man?

Sure, let's have a look, shall we get? No. The concierge is happy for us to go out into the blocks private courtyard, overlooked by balconies and floor to ceiling windows. Ooh, now this is nice.

“I think you could fairly call this a Zen garden, couldn't you?”

I mean, what would you have been 23? To be 23 years old and living here, he would have had to have had quite a serious income to be able to afford to live here. I could see somebody's watching TV on a giant screen and they're watching Russian TV. We sit for a moment in this Zen garden, this oasis of calm and tranquility in the center

of the city, and I think about the chaos, the turmoil and suffering caused in one of the apartments that overlooks it. We ring Kitty Mackey's old doorbell, but no one answers. We have a little more luck in the cafe next door. This person, it was a while ago.

You've seen him before. Yeah, yeah. What do you remember about him? Yes, he's very tall. He's sort of being by from Philan.

Yes, he's from Philan. Do you remember anything about him? No, no. We're coming here for a food ring, if you can order whatever. Yeah.

This cafe, this address, is seconds away from the HQ of MI5, the UK's Security Service. Ransom Man was rifling through the vast amount database just down the road in Julius Kivimaki's posh London flat. It's so brazen, I would say, 20 meters away from MI5, where all the spies are, this person was doing this, it's insane.

The IP address, the command history, the credit card, the cabin, by October 22, over

two years since the first Ransom demand, Pasi felt there was enough evidence to charge Kivimaki

with hacking vast amount and trying to blackmail its customers. But there was a problem. By this point, Kivimaki had long since left London behind, no one knew where he was. That was when his face and name were added to Europe's list of most wanted fugitives. One Friday morning, the media called me, he's still your client.

Peter Yari is the defense lawyer who'd represented 14-year-old Kivimaki when he was facing charges for hacking into the prestigious university MIT, and later, when he had called in a bomb threat that grounded the plane carrying the boss of playstation. Kivimaki had been found guilty of those offenses, but he'd managed to avoid jail, this time, the stakes felt far higher.

A warrant had been put in for his arrest, and then from there it started. What was he doing when the crimes took place? 2020 wasn't he in the UK, and then he was in France, and then he was in Dubai, so somewhere there between. How was he making a living?

There were developing a software or systems to sell to insurance company to determine the company's vulnerability in the cyber. So he had legitimate sources of revenue at the time.

On the one hand, Peter seemed so approachable, so open, but he never forgets who he's

working for. He bats away anything that would paint his clients in an negative light. I can't work out what to make of Kivimaki now, a man suspected of carrying out a horrific crime, but absolutely bungling it by uploading his entire home folder.

“Is then able to evade the authorities across Europe, is he sloppy, or slick?”

And then he goes on the run. Well, apparently so.

When you were in touch with him, I think I lost his number and didn't adhere for me.

“Detective Marco Lepponon, the lead investigator on the case for the Finnish police force,”

tells me over zoom that he knew his suspect was particularly slippery. The one fear I had was that we couldn't find the suspect and this will stay open years and years to come. There was a chance that he could be on the run forever. Not forever, but for years.

But Kivimaki had an Achilles heel. He just couldn't stop showing off online. In December 2020, someone using an online handle, linked to ransom man, was posting on Ulul Outer, Finland's version of 4chan. He uploaded a photo taken in front of a swimming pool.

It's of his hand holding up an Evion Missing spray with a copy of a luxury travel magazine

behind it. Investigators zoomed in on the photo and worked out that the fingerprints matched Kivimaki's. Two years later, when the authorities were searching for Kivimaki across Europe, he popped up in an Instagram video, coughing champagne and parting with friends in a plush apartment in Santa Pei.

In the footage to me, Kivimaki looks quite drunk. He's grinning and lip-sinking to Bohemian Rhapsody. Easy come, easy go. Something that we have learned from the evidence as well, he is very financerly driven. He has grown up from the Bully from Lisa Squat and Hack the Planet in using his Morivation

and ruthlessness in gaining money.

Passi says he's financially driven.

He's in it for the cash. But listening to him, I'm thinking there's so much more to this than money. Kivimaki didn't just want to live the life of an international playboy. He wanted to flaunt it. If he hacked Vastimo, what was his motivation, making other people envious, winning

“clout from other hackers, or was he still just in it for the laws?”

It's about more than money there, isn't it? Yes, of course he values money, but also it gives him the tools to sew it off to everyone else and get people commenting on that. And I might say that he likes prevention. He's not a coder, he's something else.

What is he? He has some ruthlessness, some skill and lack of empathy and I think. Lack of empathy. Yes, that's my personal opinion. At 7 a.m., on Friday the 3rd of February 2023, when Kivimaki had been on Europe's most wanted

list for 3 months, French police called out to investigate a report of domestic violence at an apartment in Kivimaki, a suburb of Paris known for its glimmering hierises. They knock on the door, there's no answer, so they take out a battering round and break it open. Inside they find a couple, but no sign of any disturbance.

The man is bleary eyed, bewildered. He hands over his passport, which identifies him as Asan Armad, a Romanian national. It's 8 a.m. in Finland, and Marco and Passi are beginning their working day, while the French police are thumbing through Asan Armad's passport. They had a song think that was bothering them and they decided to do a double check

which isn't normal. There was something about Armad's appearance Passi tells me, something that just didn't look right.

“We have a tall, Scandinavia living guy, 195 centimeters tall, so I think they just thought”

that something is off. Acting on that feeling, they put Asan Armad's name through a database, and it came up as a known alias for Julius Kivimaki. The French police had stumbled upon one of the most wanted criminals in Europe. There was no disturbance in the apartment, but the police were called out to it all the same.

I'm hoping Passi can explain this to me. In terms of the domestic violence call, do you know who made the call? I think it was a friend of Mr. Kivimaki's wife at the time. Kivimaki, his wife and her friend had been out drinking together all night to pass he tells me.

They were all wasted. I haven't been told that anything had actually happened in the flat, but the calmest mate. The call was made out of genuine concern. That's what I've been for myself, yeah.

I'm interested to know if the call was made out of genuine concern, because if it wasn't,

Maybe in a way, Kivimaki got swatted. We tried to reach Kivimaki's wife and her friend for this series, but have been unable to contact them. However, it began, it ended with Kivimaki in custody.

First in France, then eventually back in Finland.

The police finally had their guy. What did they? When they were almost at the finish line, Marco Lepponon headed into the office of his chief investigator with a mug of coffee. I said to him that, last night, I woke up and I was afraid that we have a wrong guy.

And he told me that Marco's sit down, I would tell you, and he told me, "Have an hour that we have right guy."

“Do you think that was just your mind playing tricks on your in the middle of the night?”

Or did you ever have serious doubts? No, I think it was a lot of pressures, more my mind and axle hesitation. The spider went of evidence that you were building and the result is at the end that there are no other options, this guy is our suspect.

When I first started looking into this story, I was convinced that to really understand

it, I had to speak to Kivimaki. I wanted to understand what kind of person could be held responsible for a crime like this, whether the hack was extraordinary, perpetrated by an exceptional person, a one-off, or whether what happened to Vastamo is a cautionary tale. The sort of crime anyone could commit, one that could easily happen again and again anywhere

across the world. And it looked like Kivimaki might be willing to give me an interview at first, but before we could travel to Finland to record it, he changed his mind. My producer Sam and I wrote him emails. I had video calls with Peter, asking what I could do to get him to agree to talk, but nothing

made a difference. I'm very sorry about... Let's see what happens. He's not willing, I'm asking three to four times. Well, we can talk about that, we're still having...

Now we're in Finland, I'm not giving up. Why won't he speak to me, Peter? I don't know what happened. I don't know what happened.

“I think he'd enjoy speaking to me, Peter.”

I think... I'm sure he would. I hadn't had any hope that anyone would ever be prosecuted or convicted for this. It seemed like an impossible task. Mary Tuli Hour had been scared to leave her flat when she found out someone had stolen her

therapy notes. Now, the man accused of the crime was back in her home country.

I think when I first saw pictures of him, I don't know what I had expected about it.

I was sort of surprised to see that he looked so normal. He looks like just a regular Finnish young man. You see people like him walking around the streets all the time and did that make him more frightening? Sort of, but there were also immediately news about his criminal history, his previous

crimes.

“I was like, "I don't know, man, it seems like this could be our guy."”

Tina Parika, the head teacher, tells me it was a relief to hear Kivimaki had been arrested, but once she learned he had returned to face justice, that relief turned to panic. I had seen information on the media that he was brought to Finland and that he was in a court hearing, and I saw that there might be some video clips, and I didn't want to see him.

I felt really anxious about it. I was so disgusted with him. Since embarking on this story, I've been trying to understand what ransom man's motivation really was. Towards the end of my time with Pasey, he concedes that he thinks this crime was about

something much darker than simple financial gain. When talking about ransom man, besides money, it was about power. You have power of work, business. You have their most sensitive information, you have the power to make them bankrupt. At that point, when you start publishing people's mental patient records, you realize that

you have power or individuals as well. And he has power over a whole nation, that was the atmosphere here in Finland at that point. Power over the whole nation, the power to horrify and terrify all of Finland, and he enjoyed

Well, I can't code to anyone's head, but when looking at the acts themselves, I think

that's a good conclusion.

“Each day at 830 pm, Tina and her partner liked to lie on the sofa together and watch”

the evening news. One night, the opening shot was Julius Kivimaki strolling into court.

Kivimaki came to my living room and what he did was so mixed me sick to my stomach, because

he was there, he was screaming and smurking and laughing. And then he turned to his lawyer saying, "Oh, it was a pity I didn't have time to have a haircut."

“I've seen this footage too, as cameras flash, Kivimaki takes it all in with a smile on”

his face. He looks totally at ease. He was playing like a star, it was so arrogant. I still can't see your overcome just remembering it now. I didn't sleep the next night.

For so long, all Tina and the other victims had been able to do was speculate about who ransom man was and how he was prepared to do what he did. Now, three years after their deepest secrets were held to ransom, 25-year-old Julius Kivimaki

was finally facing justice.

A man who revels in having power and control was going to have his day in court, beginning the 23rd of November, 2023.

“There was a web of evidence linking ransom man to Julius Kivimaki, but would it be enough?”

Could the man who called himself the untouchable hacker god prove himself untouchable once again? Who do you think you are? And even when he was on trial, might he still be able to slip through their fingers? Turn the media cold, and we had to then tell that to harm Mr. Kivimaki's missing.

Ransson man is written and presented by me, Jenny Cleaman. The producer is Sam Peach. The executive producer is Georgia Cat. The commissioner is Dan Clark, and the commissioning executive is Tracy Williams. This sound design by Sam Peach.

Original music for the series was composed, performed and produced by Echo Collective. It's a BBC Studios production for BBC Radio 4.