What Happened When 33,000 People’s Therapy Notes Were Released Onto the Internet

Support for Criminal comes from IM8. If you're looking for a way to make your supplement routine simpler, you might want to consider IM8. Their Daily Ultimate Essentials has 16 supplements in one drink, and I like their lemon and orange flavor, which made the drink feel refreshing, especially in the morning. Go to im8health.com slash criminal right now and use code CRIMINAL for a free welcome kit, five free travel sachets plus 10% off your order. That's code CRIMINAL at im8health.com slash criminal. These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease. Avoiding your unfinished home projects because you're not sure where to start? Thumbtack knows homes, so you don't have to. Don't know the difference between matte paint finish and satin? Or what that clunking sound from your dryer is? With Thumbtack, you don't have to be a home pro. You just have to hire one. You can hire top-rated pros, see price estimates, and read reviews all on the app. Download today. This episode contains mentions of suicide and sexual violence. Please use discretion. He was posting on Reddit and also the Finnish equivalent of 4chan. It's called Ululauta. And he wrote, Hello, Finnish colleagues. We have hacked the psychotherapy clinic vastamo.fm, and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a small payment of 40 bitcoins, nothing for a company with yearly revenues of close to 20 million euros. But the CEO has stopped responding to our emails. We are now starting to gradually release the patient records, 100 entries every day. And he signed off the posts with a single word. Enjoy. This is Criminal. I'm Phoebe Judge. And before we start today's episode, I want to remind you that you can also watch this entire conversation on YouTube at youtube.com slash criminal podcast. Today, I'm talking with journalist Jenny Kleeman about the biggest criminal case in Finland's history. Jenny covered this story for the BBC in her podcast, Ransom Man. Thanks, Jenny, for being here. Thank you so much for having me, Phoebe. Thank you. In October of 2020, people all over Finland started getting strange emails. What started happening? They received emails that contained details that nobody else should know. At first, they looked like spam. But when the people receiving the emails had a proper look at them, they realized that this was no ordinary junk mail. It had their name, their full contact details, and their social security number. And whoever had sent these emails knew, that the person receiving them had been having psychotherapy through a service called Vastamo. The person who sent the emails said that they had accessed their therapy notes, and if they didn't pay a ransom, those therapy notes would be released online for the whole world to see. One of the women victims you spoke to, her name was Tina. Will you tell me a little bit about how she realized she was part of this? Well, Tina received the email on a Saturday. She was a head teacher. It was right in the middle of COVID, and there had been a COVID burst at her school. So it was a really frantic time for her. And she was unwinding, like a lot of Finnish people do, by taking a sauna. She got out of the sauna. She was just dressed in a towel, and she picked up her phone. She was idly looking through her phone, and there she saw the email. What role had therapy played in her life? And what relationship did she have with therapy? Therapy had been a lifeline for her. She was someone who was used to always being competent, always being in charge. She was a mother of three. And two of her children had been born extremely prematurely in the 1980s, when the chances of having a premature baby survive are very low. So those children had. Really serious disabilities. One of the children had cerebral palsy. The other one was blind. And for years, Tina had been juggling the care of her children, a demanding job, and a marriage that was in crisis. And she had been surviving. But then once she got a divorce, and her children were independent adults with their own lives, she had expected she would be able to. Exhale. But instead, she had a breakdown. And she found herself having very, very bleak, very dark thoughts. I think she would probably say. She wouldn't use the word. She didn't use the word suicidal when she was talking to me. But she did say to me, there was a time when she was driving on the motorway at great speed, and she was thinking, I really wouldn't mind if this car crashed. So she was in a really serious situation when she sought therapy. So what did she do when she saw this email? She was terrified. She told me she thought she was going to have a heart attack, and she didn't know what to do. She thought she was the only person to have received this email. She was completely unaware that 33,000 people across Finland were having the same experience. The first thing she did was she called the police. That's what people do when they're in an emergency. And the police told her that she shouldn't be taking up the phone line, the phone line was for real emergencies. They couldn't help. So she felt utterly alone. And as you said, she was not the same person, the only person who had received that email that morning. No, she was not. She was far from alone. She was one of 33,000 people who had all received the same email from this hacker demanding money. And also, the demands were time pressured. The hacker had said, you need to pay me the Bitcoin equivalent of. €200, otherwise the price will go up to €500 within 48 hours. So he wanted €200 within 24 hours, otherwise it would be €500 within 48 hours. And if he didn't receive payment by then, then the notes would be released for all to see. Were any of the notes being released? At the time that the ransom demands were sent, the hacker had been drip feeding the notes of 100 people a day. He had cherry-picked them and he had been putting them online in order to try and put pressure on Vastamo, the therapy service through which they'd all accessed therapy. And so every day for three days, the hacker had been posting the most intimate, difficult, private thoughts. He had been deliberately choosing famous people, politicians, policemen, celebrities, in Finland. And he'd also been trying to find the most extreme kinds of things in the therapy notes that could be leaked. Details of child sexual abuse, affairs, secret homosexuality. And he had been dropping them every 24 hours for three days. And then on the third day, a much larger file was uploaded and it contained all the patient files. Everybody's therapy. The therapy notes were just dumped on the dark web for all to see. What was he saying in his online posts as he put these therapy notes out there? We have hacked the psychotherapy clinic Vastamo.fi and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. And he signed off the posts with a single word, enjoy. Somebody alerted the hacker to the fact that he had accidentally dumped not only all the patients, all of the patient therapy files, but the contents of his home folder on his computer onto the dark web. And when he realized that this had happened, he went online, wrote the word whoopsie, and then logged off forever. How did the victims react? Many of the people who received the ransom email were not aware that their therapy notes had already been dumped on the dark web for all to see. No two victims reacted in the same way to learning that their therapy notes had been hacked. Some people were distraught and called the police. Some people went online and tried to seek help in communities of other victims. Some people tried to contact Vastamo to get an answer from them. And we know that at least two people took their own lives after discovering that they had been hacked. I mean, we think that the worst breach you can imagine is we do everything we can to protect our social security. numbers, right? Don't let anyone ever have your social security number. That is going to be the most personal, intimate thing until you think about someone reading the notes you say to your therapist. I can't imagine a greater invasion of privacy. As Tina herself said to me when I interviewed her, we all have thoughts that we would never write down. We might not even write it down in a journal because we wouldn't want someone to read them. We might not even say those thoughts to our closest loved ones for fear of shocking them or upsetting them. But we would say them to a therapist if we thought we needed to for the sake of our mental health. That trust you have in your therapist is sacred. It's a vital part of the therapeutic process. And therapy doesn't work if you think you're speaking to the entire world when you're talking to your therapist. So it's hard to imagine a greater violation. And when I spoke to Tina, she said to me, it felt like a public rape to her. Did anyone initially know who did this or were they stumped? At first, nobody had any idea it could be anyone. Some people thought that no Finnish person would ever do this. They assumed it must be Russian hackers. But some people had different ideas about it because whoever was leaking these notes knew which notes to leak. They knew who was famous in Finland, who would get attention. And he also knew where to leak them in forums that are popular with Finnish people. So it seemed to some people that this person was a Finn. How did Vastamo hear about the hack? I mean, how were they clued into this? Vastamo knew that their database had been hacked a month before any of them had been hacked. The hacker had originally tried to extort the company, had contacted the CEO and several other members of the company more than a month before all the files were released. And he was asking for a ransom in Bitcoin. The company called in a private security service to investigate whether or not the hacker's claims were credible. Medical data is an obvious target for hackers, and many hackers try and get into hospitals and different kind of medical services. But there are also lots of hackers who don't have anything like what they claim to have when they're holding a company like this to ransom. So Vastamo, the CEO, employed this private security firm to see if there was any credibility in what the hacker was saying. And the security firm also demanded that the police be told at this earlier stage. So there was a kind of, I don't know, four or five week period where behind the scenes, Vastamo was frantically trying to stop the hacker from releasing this data, this incredibly precious data. But they were never going to pay a ransom. That was never on the cards because they couldn't trust, they would have to trust in someone who was certainly a criminal that they would abide by their word and destroy the data once they'd received the ransom. And that's just not a problem. It's not a viable proposition. It would leave them open to being victimized again. So they were never going to pay a ransom. They tried to stall the hacker over several weeks to try and see if they could find out who this person was and stop him before it was too late. But in the end, the hacker lost patience and just leaked everything. How did the investigator find out about how they had been hacked? He spoke to one of the cybersecurity experts who was employed by Vastamo to look at what had happened. And this cybersecurity expert was actually a former detective in the Helsinki police before going private. And he said he looked at Vastamo's servers and was really shocked by what he found. The security on these servers had been incredibly lax. In his view, he said he found that the database had effectively been left open. It was open to the internet with no firewall and essentially no password. The password was enter. So all you needed to do was like press enter and you could get into the database. Were there initial clues or what were the initial clues about who the hacker might be? Initially, there weren't that many clues as to who the hacker was. People had some suspicions, but there weren't clues. And he was asking for payment in Bitcoin, which is theoretically impossible to trace, even if they had paid him. But once he dumped all of the patient files on the dark web and accidentally dumped also the contents of his home folder, that was a goldmine of clues for the authorities. Antti Kuritu, who's the cybersecurity expert engaged by Vastamo that I interviewed, said he started to find out about the data. And he said, well, I don't know. I don't know. I don't know. I started looking through the home folder and he got this strange sense of deja vu whilst looking at it. He said that whoever the hacker was, they didn't organize their digital life in neat files like you would expect a professional hacker, someone who's used to making their living this way, would do. Things were organized in a kind of random dump of information. There was no organization. And there was also something strangely familiar about the way the hacker was naming the files. It wasn't done in a way that somebody who is trying to be logical and help their future self out by giving the files a name that anyone could find at a later date. He was giving sort of jokey names for the files. For example, the file containing the patient's notes was called Therapist, P-I-S-S-E-D. And there was something about this kind of juvenile approach to hacking and naming files that brought Antti Kuritu back to his time in the Finnish police. And he remembered getting hold of a hard drive belonging to a 16-year-old boy who had organized his digital life in very much the same way. And that boy was Alexander Julius Kivimäki. Who was Kivimäki? Kivimäki is probably one of the most famous hackers in Finland, not because he's a particularly sophisticated hacker, but because he's a very well-known hacker. And he's a very well-known hacker because of the lengths that he was prepared to go to cause harm and drama wherever he went. When he was younger, when he was 14 years old, he first came to the attention of the authorities. He'd been involved in a group called Hack the Planet that has hacked into MIT and taken over their homepage and their domain. But he quickly progressed to even bigger targets and more outrageous hacks. He once rang in a fake bomb threat on a plane carrying the executive in charge of PlayStation for Sony. And that grounded the entire plane. On Christmas Day one year, he and a group of people that he was working with are said to have hacked into Xbox and PlayStation, meaning that Christmas was ruined for millions of people across the world because they couldn't get online. And he seemed to really enjoy the drama of it when Lizard Squad, who's the hacking group that he was involved with, were linked to this Sony and PlayStation Christmas Day hack. He went on television giving interviews, not using his real name, but with his face completely undisguised, saying that he'd done it because he thought it was depressing that kids were not going to be speaking to their families over Christmas. And he said, well, I don't know, I don't know, I don't know. And he was doing it because he could, because it was fun, and because he found it funny. You spoke with another hacker you used to chat with on forums, Blair Strader. Yes. Blair and Julius initially were friends, I guess you could say, or at least Blair found him amusing at first. They used to chat together on internet relay channels connected to hacking. And when Julius was 14 and Blair was 17, it was over a small thing. Who was going to host the report of a recent hack on their own server? They had this fight. And then pizzas started turning up at the home Blair shared with his family in Illinois. And when the family would open the door, the pizza delivery guy would say, oh, it's a pizza for Julius Kivimaki. And then Chinese food was ordered. Taxis were ordered. Sex workers would turn up at the house. Three tons of gravel was delivered to their home. Then somebody hacked into the Twitter account of Elon Musk and Tesla, giving Blair's address and saying that if anyone wanted a free car, all they needed to do was turn up at Blair's home. And also his phone number. Their home phone was not usable for an entire weekend. Then someone hacked into Blair's mother's Twitter account and posted racist and anti-Semitic dramatic slurs directed at her employer blair's mother lost her job shortly after that um someone had been calling the police claiming to be blair strater and claiming that he had murdered his mother and the police turned up several times uh with laser sights fully armed to the teeth outside the straightest home this happened several times and then eventually somebody phoned in a bomb threat on the local police force claiming to be blair and blair uh got taken away and put in juvenile detention for three weeks over christmas so um blair's life was effectively ruined because of the feud that he had been having with julius kivimaki so so when you spoke with with blair he had no doubt that kivimaki could be had it in him to do something like release the therapy notes of all of finland yes blair said to me that um he wasn't the person he knows people who were more than he was by kivimaki other people online and blair was furious that nothing could have been done to stop him beforehand he had called the police he had reported kivimaki to the authorities but still uh kivimaki uh had never faced the consequences for anything he allegedly did to blair and uh so it didn't surprise him that kivimaki's name was being brought up in connection with this huge crime in finland we'll be right back to listen without ads join criminal plus at patreon.com slash criminal support for criminal comes from skylight family life can be busy between school work activities and appointments it's easy for plants to get lost in the shuffle skylight gives everyone one central place to see what's coming up helping the whole family stay organized the all-in-one digital smart calendar syncs with google calendar apple calendar outlook and more you can organize chores and grocery lists and color code everything by family member so instead of constantly reminding everyone what's happening next each person can easily see where they need to be and what they need to do one of our producers has tried skylight she says the color code feature is a really helpful tool and she says it's a really helpful tool to be able to customize your calendar and make it easy for kids to check the calendar on their own families are better when they're working together right now skylight is offering our listeners thirty dollars off their 15-inch calendars by going to my skylight.com slash criminal go to my skylight.com slash criminal for thirty dollars off your 15-inch calendar that's m-y-s-k-y-l-i-g-h-t.com slash criminal so you might know i have a dog her name is eight she's only a few years old and luckily she's in great health but last year i had to take her to the vet after she ate something she shouldn't have so i know firsthand that vet bills can be unexpected and they can be high fetch is built so you can afford the best care for your pet the most complete coverage for dogs and cats according to consumeradvocate.org you get paid back up to 90 of vet bills for accidents illnesses diagnostics and care for your pet and you can get paid back up to 90 of vet bills for more every vet in the u.s and canada is a network so you keep the vet you trust and you can build a plan that fits your budget once your claim's approved you're paid back in as little as two days don't wait until your pet has a health problem go to fetchpet.com slash save for your free custom quote it takes about two minutes that's fetchpet.com slash save fetch love longer how did police start investing this therapy hack the home folder that the hacker had left uh was incredibly important to the investigation and they were trying to establish that they were they were looking for links between julius kivimaki and the hacker who had been calling himself ransom man in online forums in his online posts there were several links between kivimaki and ransom man the first was that a credit card that kivimaki had been using to pay for an apple subscription and an only fan subscription had also been used to pay for servers that were involved in the hack so a credit card linked to kivimaki was also linked to ransom man during the initial negotiations ransom negotiations with vastamo vastamo had made a payment of zero to kivimaki for ransom man zero point one bitcoin to ransom man and the intention was that this would be some kind of breadcrumb something to follow and the police using quite sophisticated techniques had managed to see that when that bitcoin was turned into real world currency laundered into real world currency it had ended up in julius kivimaki's account but for me the thing that was most striking the piece of evidence that was that was most striking was that when they looked at the home folder that the hacker had left it was a piece of evidence that was that was most striking they were able to look at the hacker's command history which means they were able to look at exactly what the hacker had been doing on his computer at what time in what order and they found that as well as searching for pedophilia rape adultery the most outrageous things in in the therapy notes it to flaunt online the hacker had also been looking for details that would only be relevant to julius kivimaki julius kivimaki's loved ones places where julius kivimaki lived essentially the hacker was trying to make sure that there wasn't anything in the in the patient notes that would have a negative effect on julius kivimaki or his loved ones before those notes were leaked and also in the home folder there was a photograph which they managed to establish had been taken at julius kivimaki's grandparents cabin there was a circumstantial evidence that was extremely important when the notes were all leaked they were leaked from an ip address in london and they could tell from records that the person living at that particular address at the time in london the person renting that apartment was julius kivimaki so they had pretty good evidence of of who had done this but what were some of the the challenges they were facing in the investigation there were many challenges first of all there were terabytes and terabytes of data to sift through they also had had an enormous number of victims each one of them had to register an individual complaint so even though the therapy notes of 33 000 people were leaked i think there were only around 21 000 people who registered themselves as victims on this online portal that they set up but they had to go through everybody's individual complaint check that they actually were victims they had gone to therapy with vastamo and also there were other challenges in that whilst there was a huge web of evidence linking julius kivimaki to ransom man there was no smoking gun it was all circumstantial evidence building up a picture of someone who it was incredibly likely was responsible for the hack but they didn't catch him in the act sitting behind his computer there was no one single definitive piece of evidence that he was responsible for the hack that on its own would prove that julius kivimaki was ransom man and as this whole investigation was going on i mean the therapy notes had been released were out there were were people reading these these notes i think finnish people were very good at not making public anything that had been um illegally stolen and leaked online but that's not to say that people didn't read this stuff when it was first leaked online even some of finland's hackers were appalled and and expressed their disgust said you know this is beyond the pale this is too much but lots of people did look and people were commenting on the forums and laughing about people's therapy notes uh i spoke to someone who said she she remembered a victim who had gone online to see if her notes were there and she said when she looked at the forum she could see people laughing about a 10 year old child who had gone to therapy because there were children among the victims as well and uh we know that even though the therapy notes were taken down from lots of platforms an untold number of people had taken a copy and in the months and years following the leak those therapy notes continue to circulate online people have even made searchable databases so all you need to do is put in someone's name and you can call up their therapy notes so this shows that this isn't just about a single hacker who was prepared to uh to break every moral boundary possible it is a a thing that other people are prepared to do too so you once the the notes are released it's not as though vastimo or the finnish government could pull them back they were out there once things are online they are online forever and we don't know how many people took a copy of those notes and still have those notes sitting in a hard drive prepared to to use them several of the people i interviewed have had people try and get out credit cards and loans in their names. and all the other things that can happen when your social security number is out there. The Finnish authorities are not allowing them to change their social security numbers. So this is something they're going to be living with for the rest of their life. Not just the therapy notes being leaked, but their identity effectively being stolen too. You spoke with a lot of victims of this hack. What were some stories that stuck out to you of people's experience with it? I spoke to a very successful comedian in Finland who's a stand-up comic. And for him, he had had suicidal thoughts, and yet he's a professional funny man. He needs the audience to be laughing along with him. So it was terrifying at first for him. But then he very quickly realized that, no, he was going to use this personal experience as part of his act. And he was going to make jokes about it. And he said when he got up on stage and started talking about it, at first people were awkward and nervous to hear him talk about what had happened. But as he looked out into the audience, he saw many nods of recognition. And he realized there were other vast amount of victims in the audience too. And this is a country of just over 5 million people. 33,000 people had their therapy notes hacked. So everyone knows someone who was a victim. And he realized that by facing his worst fears head on, by realizing that people were going to know his vulnerabilities, his worst fears actually weren't so bad. And he felt emboldened by the fact that he was able to talk about this publicly and be okay. Do you know, I think that if, not even if my notes had been released, but if my partner's or my mother's or my, I would not want to read them because I wouldn't want to be hurt. You know, so it's the people's whose notes are released, but it's also, oh no, what if they were talking about me? I mean, can you imagine the strife in homes, over the dinner table? Absolutely. I mean, some people hadn't even told their family members they were going to therapy. There's also this kind of extra layer, which I hadn't really thought about until one of the victims told me that it was a big source of anxiety for her, which is, you know what you told your therapist, but you don't know what your therapist wrote down. You don't know how they interpreted what you said. One of the people who I interviewed said she was desperate to know what her therapist had said. And in fact, she went to Vastamo, she asked for Vastamo to give her a hard copy of her notes. She was the one who had been on the dark web looking for her notes. And she said when she read what her therapist had written, she was really hurt by how she had appeared to him. The therapist had said things like, you know, that she was talking in an erratic manner, that she had an immature way about her, various things like that. And she felt devastated that she had appeared that way to, her therapist. And she also was taken back to the time of crisis that she had been in when she went to therapy. A lot of people had made huge gains going to therapy, which were just completely undone by the fact that these therapy notes were out there. And a lot of people had completely lost faith in the therapeutic process. And in doctors, you know, people felt that they couldn't trust their doctors anymore. They didn't feel comfortable going to doctors anymore. Because if this incredibly sacred space could be, breached, how could they trust anywhere else to be safe? Tell me about the arrest. Two years after the first ransom emails were sent, the Finnish police announced that they had a suspect, Julius Kivimäki, but they couldn't find him. He's a very international person. They didn't know exactly where he was. He was put on Europol's list of most wanted fugitives. Then in, February 2023, the police in Paris got a tip off about a domestic disturbance. They visited an address at 7am in a Paris suburb. Somebody had rung and said that they had heard shouting and they were worried that a woman was being victimized by her partner. The police knocked on the door, got no answer. They knocked the door down with a battering ram. And incidentally, they found a man in a white T-shirt, wearing a black T-shirt and a black T-shirt. He was wearing a white T-shirt and a black T-shirt. They asked the man to hand over his passport to identify himself. And the man, who was over six foot tall, blonde haired, blue eyed, handed over a passport identifying himself as a Romanian national called Assan Ahmed. The police thought that the name didn't match the face. They put the name through their databases and found out that Assan Ahmed, was a known alias for Julius Kivimäki. So he was finally arrested and then sent back to Finland to face justice. What were the charges? Kivimäki was charged with 9,600 counts of aggravated invasion of privacy and more than 21,000 counts of attempted aggravated extortion. How did the victims find out that someone had been arrested? Most of them saw it on the news. And for some of the people who saw it on the news, it was really traumatic, particularly because Julius Kivimäki looks like any other regular Finnish guy. And seeing him walking into the courthouse, I know certainly for Tina, it was extremely traumatizing. She was sitting down to watch the news with her partner and up came Kivimäki into her living room. And she felt completely destroyed. She said she couldn't sleep for nights after then because it felt like another violation. Other people I spoke to were just shocked by his ordinariness. I think perhaps it would be easier to imagine that this was kind of Russian criminals or criminals from overseas, you know, intent on doing you harm. The idea that it would be a fellow Finn, the sort of person who would pass in the street every day, who was responsible, that was really traumatizing for some people. What was the trial like? The trial was a bit of a circus. Julius Kivimäki seemed to enjoy his time in the spotlight. He would come in reading different books. He came in reading a book by L. Ron Hubbard about Scientology one day. The next day, he came in reading War and Peace, and he liked to prop up his books in front of the cameras. There was no jury. There were three judges. And Julius Kivimäki was playing computer games on his court-approved computer throughout most of the trial, I was told. He seemed bored, unless they were talking about specific pieces of hacking evidence, in which case he would become more engaged. And is it true that there were so many victims who wanted to watch what was going on that they were broadcasting it in movie theaters? There were 20. There were 21,000, over 21,000 registered victims in this case, and no courtroom in the world is big enough to house 21,000 victims. So the Finnish authorities set up public screenings in places like movie theaters across the country. Some of the people I spoke to attended some of these screenings, and they said it was just a profoundly awkward experience because you're there because your privacy has been violated, and yet you are sitting next to other people whose privacy has been violated, and you don't really know what to say to the other people there. So everyone pretty much tried to keep to themselves in this very surreal environment. And he was convicted? He was. He was eventually found guilty after a trial during which he had at one point escaped and apparently gone on the run and couldn't be found for a week. It was a trial full of drama, but eventually he was caught, and he was brought to face justice and he was convicted of all of those charges, guilty on all charges, and sentenced to six years and three months in prison, which is actually a long time by Finnish standards, but a few months shy of the maximum sentence he could have received. And in fact, recently, Julius Kivimäki tried to appeal this sentence. He lost his appeal, and his sentence was increased by another six months. I've got to tell you, it doesn't. It doesn't seem long enough. It really doesn't. And when you. The whole thing I found reporting this story is that the suffering is kind of unquantifiable. When you have 33,000 people whose lives have been turned upside down by this crime, it's an impossible thing to measure. And in fact, the prosecutor who I interviewed said he and his colleagues had tried to quantify how much suffering this had caused, the number of victims by a week. Like, if you could assume that each victim suffered a week of suffering, how much suffering was caused by this crime. And he said, when you do the maths, if you allow each victim a week of suffering, this crime caused 635 years of suffering. Was there any compensation for the victims? The victims are going to get compensation ranging from a few hundred euros to a few thousand, depending on what was in their therapy notes, how many pages of notes were in Vastamo's database and how sensitive the details in those notes was. The Finnish authorities are probably going to end up paying that compensation. It's not going to come from Julius Kivimäki because he claims to have no money and none of the police have been able to find any of his money, if he does have money. You actually met him. What was he like? At first, he didn't want to meet me. And in fact, I was in Finland reporting this story with him continually saying no. And then on my last day of reporting, when I had a few key interviews left to record, I heard that he'd changed his mind. And so I dumped all my other plans and got on a train to Turku, which is where he was in prison. It was one of the most extraordinary interviews I've ever done. in my life. I was told I would only have about 15 minutes with him. I had over two hours with him. He turned up 40 minutes late. And at first, I thought he was just trolling me, that he just wanted to kind of ruin the plans that I had for doing interviews that day without any intention of ever leaving his cell. But he did eventually arrive. And for two hours, he looked me straight in the eye and unemotionally, answered all of my questions. He maintained his story, which was that he didn't do it. The police have all of this evidence, but it's just circumstantial. I said to him, you'd have to be the unluckiest person in the world to have so many pieces of evidence linking to you. And he said, well, the correct answer is that it's not me, but it's somebody close to me. And I said, oh, so who is it then? And he said, I have a good idea about who it is, but I'm not going to tell you. I don't want to name any names. And Julius Kivimäki had always made a very big deal out of living a very luxurious lifestyle. He was always posting on social media about drinking champagne in Saint-Tropez, going on luxury holidays. And to me, the idea of that person being willing to serve time in a Finnish prison for somebody else seemed quite absurd. I asked him if he had anything to say to the victims. I told him that Tina had said to me that having her notes leaked felt like a public rape. And he said, well, I'm sure she feels that way. I don't have anything to say to the victims because I didn't do it. And I said, well, you know, you must have some response to this crime on an emotional level. Whenever I talk to anybody about this story that I'm doing, they have an emotional response to it because it's so outrageous. And he said, well, no, it's just another story in the news. What's in the news at the moment? Oh, you know, people being killed in Gaza. It's like that, he said. And I said, well, no, it's just another story in the news. And I said, well, no, it's just another story in the news at the moment. It's like that, he said.