Ransom Man: 5. 635 Years of Suffering

Lesson three weeks after 33,000 therapy patients had their most intimate secrets exposed online. A finished stand-up comic is on stage telling jokes about it. "My therapy notes were released online in the big Vastamo case," he says, "and don't worry, you've already heard all about it. You're quite famous here, you've got a lot of followers online.

You're a successful comedian." "Yeah, you could say that." "How would you describe the kind of comedy you do?" "I do mix of observational and crowd interaction." "And you use your personal experience?"

"Yeah, yeah, that's the base of my comedy."

Tomi Housstala had always liked the idea of publishing a memoir he's telling crowd.

"He's the varmaku ka yulukasis." But before he could, someone leaked his therapy records and did it for him. I'd always imagine that stand-up comics must have massive self-confidence, but there's a quiet nervousness to Tomi, as he sits an alcohol-free beer in our Helsinki hotel. Tomi's darkest personal experiences were among those held to ransom and then dumped online.

"In one respect, the entire story is about people don't want their personal information. "Yeah." "And then I'm here, Oscar." "What did you tell you?" "Yeah, what?

The diverse thing you don't want." "That's exactly what we see." "Exactly." "So I appreciate you agreeing to do this interview."

Tomi first heard about the vaster mohack in late October 2020,

when the extortion email landed in his inbox. "Our one hero, Tomi Hausto." "And that's nothing you hear before in Finland. Nobody says that."

“"So I was like, "Oh, this guy's like, how do you say?”

"Polite." "Yeah, exactly." "Super-polite." "Extortion." The ransom note was written so nicely Tomi tells the crowd,

"If the hacker had come over to massage his scalpel, he would have paid up." He can joke about it now. But at the time he sought therapy, Tomi had been having suicidal thoughts. He had been burnt out, working for months on end without any break.

He struggled with anxiety. There were problems in his personal life, and he was unable to tell anyone how he really felt. "I didn't feel good, and I was searching for some help." "My problem during that time was like I didn't share it."

"So I was nodding with the people and then inside I was furious." If you're a stand-up comic, the stakes are high.

“You need to be willing to make yourself vulnerable on stage with everyone looking at you,”

but you have to take the audience with you. "The audience have to feel safe that I'm okay." "Yeah." "So they won't laugh." "Yeah, yeah, second."

But therapy helped Tomi manage things, and then came the hack, and the email from ransomman. "Did you know from the beginning that you were going to talk about this in your show?" "No."

First thought was like, "Uh, nobody wants to hear it. It's too personal."

It became obvious to Tomi that lots of people in his audience were fellow vaster patients and victims. "There are people who are nodding and being with me like, yeah, this is what happened." "And also, I know it's when I started to do the beats, people use their go up." "They do it."

"Because they don't know where we go in here." "And then they get back in." "Yeah." "Because they know that they're in safe hands with you." "Did the hack affect the progress that you had made with your mental health?"

“"Yeah, I think I got chaded about this kind of crime."”

"Or at least I fell a bit like, "Oh, people are just doing this stuff and they won't get caught." "And you've started to feel sort of way of the war." "You lose faith in the world." "Yeah, in a way." But eventually someone was called Julius Kivimaki,

the hacker who once grounded a plane with a bomb threat, and boasted on television about shutting down ex-box and PlayStation on Christmas Day. Now, he was the prime suspect in the vast amount of case. Finally in custody, following an international manhunt. "It was like, okay, this is like next chapter."

First of all, you get this super polite, extortion with her. For years after that, you get this invitation to watch the trial. An invitation to watch the trial.

and more than 21,000 counts of attempted aggravated extortion.

“It was the largest court case in Finnish criminal history, and it was being broadcast around Finland.”

Tommy was invited to be in the audience to see a very different kind of show than any comedy set. I'm Jenny Kleemann, and from BBC Radio 4 and Intrigue, this is Ransson Man. Episode 5, 635 years of suffering. The trial took place in Espo, the affluent city close to Helsinki, where Kivimaki grew up. The courtroom is paneled in beach from floor to ceiling.

There are eight banks of desks, each with a microphone and a monitor on which evidence is displayed. Three judges would decide the case. There was no jury. On one bank of desks sat the team of three prosecutors, led by Pasivanio, all with immaculate suits, ties and trimmed beard. Into this scene, strode Kivimaki dressed in a green duffle coat over a black t-shirt, a bottle of water in one hand, a laptop in the other, grinning once more at the assembled cameras.

“Kivimaki took a seat and plugged his laptop in on another bank of desks, next to Peter Yari, the lawyer defending him.”

I mean, hope wouldn't like to have a case like this. The eyes of a nation were on him. Who wouldn't want to take on a case like this, Peter asks me, "Do you know anybody personally who had their data hacked?" Yes, we had even here some people. I'd imagine that having colleagues who'd had their therapy notes stolen by an extortionist would be enough to stop his firm from taking the case,

but Peter doesn't see it that way. When you nervous? Yeah, of course. What was your strategy? Well, of course, the defense strategy has he disputed our daily allegations that didn't have all the evidence. Kivimaki denied the charges. Peter argued there wasn't enough evidence to convict him.

“All the clues were small and circumstantial he claimed.”

There was no single piece of evidence that could definitively link his client to the crime. The way Peter tells it, "Kivimaki is a victim of his own infamy." We all thought when we heard about fast time, "Oh hey, maybe this could be Julius." And in a way, the investigation goes this way when they know that they have their own little domestic hacker.

Your position is the police never had an open mind.

The minute the crimes committed, they thought it is Julius Kivimaki. Exactly. And let's go this way. Yes. Arguing the prosecutions case, Passi Vanio had to prove that there was such a weight of evidence connecting Julius Kivimaki to ransom man that he had to be the person who perpetrated the crime.

The case was very technical. It was concerned that even if I understood how can I get the call to understand what this all means. Passi, leading the prosecution case on behalf of the state of Finland and Peter, defending Kivimaki, were going head to head.

But there was a third lawyer, also present in court,

one with over 6,000 clients. Jenny Ricegio represented the victims who had chosen to bring a civil claim for compensation in the vast amount of case. If found guilty, Kivimaki would have to pay them all damages. Jenny attended the criminal trial as a bystander, learning the facts of the case against Kivimaki, and ensuring that the victims were not forgotten amid the circus in the courtroom.

But she had a ring-side seat just across the aisle from Kivimaki himself. He looks like baby-faced. He doesn't look like, you know, tough criminal. Jenny had the daunting task of building over 6,000 different individual compensation claims. Some vast amount of victims have been left unable to work,

and afraid to intend therapy that they desperately need, she tells me. There are some that have asked me that if I no longer exist, it's my family entitled to proceed with this. So you can read between lines, what they are asking, I got two phone calls from families who told us that after the newsbreak that this had happened,

their family member had taken their life,

But of course, I can not never be sure about that,

but I have to be in their word. When I ask Tommy about the people who killed themselves, his face falls. It's really horrible, it makes me really sad. And also, like, you feel powerless, because these are people who try to find help. And when you're being close yourself of this kind of situation,

since you want to take your life, you can feel that emotion when you're here about it. - And you have been close. - I've been thinking about it sometimes. - Yeah. - Yeah. No courtroom in the world would be big enough to accommodate all the victims of this crime. Over 21,000 former vast demo patients had registered themselves as plaintiffs in the criminal case.

They were given an opportunity to view the trial in special screenings across Finland. In public areas, like cinemas.

Tina Parika wanted to see just this being done.

“- I went there for the couple of first days, and what was that like?”

- It was really important for me to go there. I wanted to see him there on the vent to answer. - In a case that was all about the right to privacy and anonymity, it was a pretty awkward setup. - We pretty much kept to ourselves.

- That's the worst kind of free tickets I ever had for cinema. - Yeah. - So the crime was about our privacy. So let's everyone be in there. - What did he get on you? - Yeah. - Yeah. - It was really fun at the same time.

Go in movies and watch your trial. - Watch the person who's stolen your secrets. - Yeah. - Yeah. - Yeah.

- With everyone finally in their seats, it began.

Watching it all unfold on the big screen.

“Mary Tully decided she's no fan of Kivimaki's lawyer, Peter Yari.”

- Yari said something along to the words of like, "These are not crimes on people's lives and health. And me and the other people, sitting there in the movie theater, we were a very pissed. Sitting awkwardly in the cinema, the victims got to see a bit of a spectacle.

To demonstrate all the evidence against Kivimaki, the prosecution had produced an enormous chance. - I have, by the way, the map of the whole procedure. I just know if you ever see it. - I haven't seen it. - Would you like to see it? - I would love to see it.

- You're crossing the corridor. - Fantastic. Peter unrolls this chart along his law firm's boardroom table. - It's a vast, sprawling spider diagram, with arrows linking servers, credit cards, names, IP addresses, and icons representing people.

- You have Kivimaki here in S.E.A.A. space. - Where we're talking about... - It is detailed, meticulous, and, for me, almost entirely incomprehensible, a first glance at least. - This is where somebody says, "Wooopsy,"

when he says that all the information hadn't gone. But where Pase presented this to the court as a web of evidence, in snaring Kivimaki. Peter told the court room it was a bunch of coincidences that couldn't prove beyond reasonable doubt

that his client had committed the crimes. - The prosecution's showing there's a kind of correlation between... - And what you just cannot be. - This correlation doesn't prove anything. - He's here, and the other ones are there. He wasn't connected to this.

- And throughout it all, Kivimaki seemed to take things in his stride. - At one point Pasey tells me, Kivimaki brought into the courtroom a book by El Ron Hubbard, father of Scientology. He propped it up so that photographers could get a shot of it. The previous week, he'd done the same with Tolstoy's war and peace.

- Do you think he enjoyed the attention?

“- Somewhat, he was something of a host play of his... - You've playing games?”

- No, yeah. - Yeah. - He was literally playing games in court too. Jenny Ricekyo, the victim's lawyer, sitting across the aisle from Kivimaki, saw him on his court-approved computer, often playing solitaire. - He's doing his own thing, playing some computer game,

minding his own business. When he has something to say, then he keeps going, because he speaks about things that he's interested in. When the prosecution produced expert witnesses, Kivimaki paid more attention, engaging with their evidence,

questioning them directly. His lawyer, Peter, was impressed. - They're dividing, they're doing calculations in the head

No, it'll go like this.

“You can't deduct that, that's not normal.”

- Do you think he's a bit of a genius, though? - He's capable of having a lot of things. - I want to find out just how capable Julius Kivimaki is for myself by getting him to answer my questions. But when I ask Peter again, for what feels like the 20th time,

do you think he'll change his mind? - We're here until Sunday and we'll come back. We just really want to build up a picture of who he is.

- The answer is still no.

- Who are you messaging? - He's myder. - They don't want. - I'm sorry, I tried. - My mother has said no. - Yep. - In February 2024, four months into the trial,

the court went into recess. Kivimaki was granted bail. He was allowed to return to his parent's home, so long as he reported to a police station every day.

“But fearing he was a flight risk, a few days later,”

the prosecution appeals the decision to release him. The court of the appeal agreed, ruling that Kivimaki must be taken back into custody. Only there was a problem. - I was on my way somewhere, sitting in the airport.

He caused me. He decided that he will not go to the prison. He went missing. - After more than three years of work, it was devastating for Passee.

- The police called me. Then the media called. And we had to then tell that Mr. Kivimaki is missing. Peter says his client wasn't on the run. Kivimaki said he'd returned to court when it was next in session.

He wasn't evading justice. - He wanted to stay out of the prison. - And you trusted him. - Well, I had to trust him. - Kivimaki was nowhere to be found in the real world.

But online, he was as present as ever. - Mr. Kivimaki posted in online forums and commented on his disappearance, blaming that I'm not disappeared. I'm here, in Finland,

and I'm going to come to court. But we couldn't take the risk.

- It took a week of hunting him down before they had a breakthrough.

Kivimaki could not stop himself from showing off his lavish lifestyle. But once again, he had inadvertently left clues for the authorities to follow. - He posted a picture of a bottle of crook champagne and a plate where he has finished his supper. And from that picture, there is a bench

where the bottle of champagne is on. And there's visible little corner of the floor that it's in the apartments. - The upholstery of the bench and the flooring underneath it gave the police something to look for

in the Airbnb and booking.com listings of the high-end parts of Helsinki they knew Kivimaki liked best. They found a listing that matched the picture he'd uploaded and discovered it was being rented out by Kivimaki's sister.

- So we then knew where he was residing and the police went there the next morning. Ernst and Mr. Kivimaki. - He got him. - Yeah.

- After seven days, Kivimaki was back in custody and the court was back in session. As the trial neared its conclusion, pass he noticed a change in Kivimaki.

- That was the first time I noticed that he was nervous

and it was visible. - Visible and what way? - Sagan. - Really? - Sagan is leg-end

and less so I feel that he's very sad. Thanks like that. During the closing arguments, the victims lawyer, Jenny Ricechio, called for a moment of silence.

- I was angry because people don't understand and I wanted to tell their courts

“and emphasize the suffering and I think I made to bond.”

- Everyone in the courtroom stood, including Kivimaki. And then, all anyone could do was wait for the verdict. [music] - I remember coming home and I think, "Oh my god, they're going to conflict it!"

On the 30th of April, the three judges announced they had come to a decision. - Justice is done. He was convicted. Kivimaki was found guilty of all charges.

- How does it compare to sentences for other crimes in Finland

for murder or for rape?

“- Brape, for example, two years would be normal.”

Murder, you get life sentence. But usually, in Finland, you can appeal when convicted from murder after 12 years. And people usually serve 14. For example, drug crimes, you might end up getting eight to ten years.

So, how to correlate with this? It's a good question, because when putting the perspective on how much suffering this case has caused. - Passy and his team have tried to put a number on the harm caused by this crime. - If one person of these victims would have a total suffering

of one week, like total agony. - Multiply that one week of agony by the number of victims in this case and you would have 635 years of suffering. For Mary Tully, the verdict felt like a validation. - I felt seen by the court.

I felt like the victim's suffering was seen by the court

“and that they recognized the severity of the crime.”

That I was thankful for. - There are other ways of trying to quantify the suffering this crime has caused. Victims will get compensation. Anything from a few hundred euros to a few thousand, depending on how many pages of their therapy notes

have asked them or had in its database and how sensitive the information contained in those pages was. - Kivimaki is supposed to pay these damages, but if he can't afford it, the government will foot the bill. Despite his champagne lifestyle,

the authorities have so far been unable to locate any of his money. - There's another person who'd been present in the courtroom, a spectator at Kivimaki's trial. The founder and one time CEO of Vastamo, Villetapio. - He wanted to see the case through

he wanted to get some kind of closure for the breach.

“- The year before Kivimaki's case came to court,”

Tapio had been on trial himself, charged with data protection offenses. Tapio denied the claim saying he was unaware of the breach until autumn 2020 and had handed over responsibility for technical oversight to external IT consultants.

- Passi led the case against Tapio too. - We're prosecutors think that Vastamo has had information prior to the extortion that Vastamo's information security is not good. - The prosecution had argued Tapio had been well aware of the vulnerabilities with Vastamo's information security.

- Do you think he was more focused on growing the company than protecting the customers? - Yes, that's his opinion. - Vastamo was declared bankrupt in February 2021. Tina, a former head teacher, knows a thing or two

about how to run an organization. - I was really mad at Vastamo, especially, and I still am. - Hmm.

- Because actually they did the first crime.

- And the first crime was what? - They left all our information, open doors. Anybody could come and take the information, and now he says that he didn't know. I know.

And he should know that a CEO cannot say that I'm not responsible because I didn't know. - You seem really angry. - I'm really angry. Mary Tully and Tommy had similar reactions.

- I have actually been more angry towards Vastamo than I have been towards giving, like it. - I feel like, oh, this guy. My phone, I have better passport in my phone than he could have in this database,

so it gets to my nerves. - It seems like information security

was never a priority to him.

- What was his priority? - Making money. Because Vastamo was so successful, he must have done a lot of things right. Maybe if he owned up to it

and said, okay, I didn't allocate enough resources for this, I should have known better. But he too denies all guilt. Just own up to your incompetence

- Vili Tapio has said Vastamo's operating system had restricted database access to authenticated users and did not allow password-free network logins.

Tapio has always denied any wrongdoing

and he has refused on many requests to interview him. Tommy, Tina, and Mary Tully have reserved so much of their anger for Tapio. I wonder what pass he makes a little.

“- Who then is ultimately responsible for this hack?”

Is it the people who own Vastamo or is it the hacker? - Oh, it's the hacker definitely. - I'm convinced it must take a particular subset of hacker, a specific kind of human being

to commit a crime that causes so much suffering to so many people.

I'm desperate to know what kind of person that is.

But so far, Julius Kivimaki has refused to talk to me. And then, as we're walking between interviews, I look at my phone. - Oh my God, you recording?

- Yes.

“- Right, we're crossing the road in Helsinki.”

We've just come out of an interview. Just check my email, it's from Peter Yari. Hi, you'll get the interview. Need to know ASAP tomorrow or Saturday.

This has he needs to know ASAP.

Shall I reply now? Where do we need to be and when? In April 2023, Villetapio was found guilty of breaching the general data protection regulation in his handling of patient data.

He appealed and was cleared of all charges in December 2025. The Court of Appeal ruled that neither the GDPR nor the applicable Finnish healthcare legislation

“required encryption or pseudononymization”

of patient data at the time in question. The Court found there was no clear legal requirement at the time of blodging tapio as CEO to take specific security measures and his conduct in relation to the breach

did not amount to criminal negligence. The BBC understands he has submitted a complaint in relation to the conduct of his prosecution. Rants a man is written and presented by me, Jenny Cleaman. The producer is Sam Peach.

The executive producer is Georgia Cat. The commissioner is Dan Clark and the commissioning executive is Tracy Williams. Sound design by Sam Peach. Original music for the series was composed,

performed and produced by Echo Collective. It's a BBC studio's production for BBC Radio 4. Look at this. I found a secret behind a child. We're looking for someone who controls

on the largest gangs of people's smugglers. He calls himself Scorpion. The top one, impossible ill-confined him. His gang has made millions from people coming to the UK in small boats. This was so cold.

So cold, I wonder. Finding him won't be easy, and it will be dangerous. Oh, we need to get out of here. So go look out.

I'm Sam Mitchell, and this is intrigue to catch a scorpion from BBC Radio 4. Listen on BBC Sounds. (gentle music)