I read the police investigation (it has been "leaked" to WikiLeaks but it is actually official)
Some of the evidence:
The IRC nick "tLt" brags about the intrusion. Svartholm acknowledges that he has used this nick in the past but not to make these statements. However, in conversations where the bragging has been done, other chat participants have asked something like "Anakata: Are you still in Cambodia" and tLt answers the question.
There are files on his computers that originated on the intruded computers.
There are files on the intruded computers that originates on his computers (build artifacts etc).
Svartholm acknowledges that his computer must have been used for the intrusion, but that he did not do it. He says that Remote Desktop or Powershell Server must have been used. However, forensic investigations of Windows logs etc show that no one has ever logged in with these services since the OS was installed.
One / some of the intrusions have by using the login credentials of Monique Wadsted, lawyer supporting the prosecution in the Pirate Bay trial.
As far as I can remember form the investigation protocol, he hacked the company/ies when he was in Cambodia. He used one of his computers there if memory serves. He also talked on IRC about the hack when connecting from Cambodia if I recall correctly.
My memory is a bit hazy on where the logs were found, but I think it was on an encrypted partition on one of his computers, IRC logs and putty logs. Or something along those lines. The putty logs matched the connection logs from the hack.
The investigation protocol was 'leaked' on Wikileaks in the begin of the trial. It is in Swedish but the logs are, imo, pretty convincing, suggesting that he was the one/one of the people behind the hack.
This will with all likelihood get appealed to a higher instance.
I do encourage you to check out the investigation protocol, even though most of it is in Swedish, the investigation is very extensive, surprisingly so. It puts the Swedish IT investigators in a very good light, from my amateur perspective.
>One / some of the intrusions have by using the login credentials of Monique Wadsted, lawyer supporting the prosecution in the Pirate Bay trial.
Do you by any chance know how they found it on an _encrypted_ partition? Did he give them the password voluntarily or did they somehow break it?
Agreed on this point. When you consider he was a major meth addict at the time, being careful isn't something you consider when you're in a drug induced haze.
Not sure how jails in Sweden work, but why appeal it? He could probably be out in 18 months or less with good behavior.
[1] http://gizmodo.com/5881212/the-pirate-bays-founders-are-goin...
This is why a large group of people pointed out that if you declare 2/3 of the population as criminals, the effect is very bad for society. It doesn't really matter if you are pro- file-sharing, or anti-piracy. If we loose the mutual respect between citizens and law creating government, everyone will loose.
http://www.dn.se/nyheter/sverige/svartholm-warg-domd-till-fa...
But seriously, anyone who has been a blackhat would understand this. A target with tax info would be a great hack, if only to say you did it.