For the first time since 2012, WikiLeaks founder Julian Assange no longer has the legal protections of the Ecuadorean Embassy in London. He now faces the criminal charges he's always suspected and feared—although it's now clear that he's accused of criminal behavior not as a journalist, or even a spy, but a hacker.

On Thursday, London's metropolitan police physically dragged Assange out of his residence at the embassy and into a police van. Hours later, a grand jury unsealed an indictment against the WikiLeaks founder for one count of conspiracy to commit computer intrusion. The UK government has already made clear that it carried out Assange's arrest on behalf of the US government, implying that it intends to comply with his extradition to the US to face those hacking charges.

The indictment—which you can read in full below—centers on an incident nine years ago ago, when Assange allegedly told his source, then Army private Chelsea Manning, that he would help crack a password that would have given her deeper access to the military computers from which she was leaking classified material to WikiLeaks.

"On or about March 8, 2010, Assange agreed to assist Manning in cracking a password stored on United States Department of Defense Computers connected to the Secret Internet Protocol Network, a United States government network used for classified documents and communica­tions," the indictment reads, referring to the Pentagon's SIPRNet network of computers that store classified information.

That brief alleged offer of active assistance from Assange may be all the US government needs to charge him not as a journalist recipient of Manning's leaks, but as a coconspirator with Manning in the theft of Pentagon data.

"It can be as simple as that," says Bradley Moss, an attorney for the Washington, DC, law firm Mark Zaid P.C. who focuses on issues in national security and intelligence community personnel.

"It seems thin to me." Tor Ekeland, Lawyer

The password cracking incident has long loomed in the background of Assange's legal case. As WIRED first reported in 2011, prosecutors in Chelsea Manning's case asserted at the time that Assange had offered to help Manning crack a password "hash," a form of scrambling designed to protect stored passwords from abuse. Hashing irreversibly converts a password into another string of characters, but hackers often use lists of pre-computed hashes from millions of passwords, known as rainbow tables, to search for a matching hash, revealing the hidden password.

In a pretrial hearing in Manning's case, prosecutors presented evidence that Manning had asked Assange—who was instant messaging with Manning under the name Nathaniel Frank—if he had experience cracking hashes. Assange allegedly responded that he possessed rainbow tables for that, and Manning sent him a hashed password string. According to Thursday's unsealed indictment, Assange followed up two days later asking for more information about the password, and writing that he'd had "no luck so far." The indictment further alleges that Assange actively encouraged Manning to gather even more information, after Manning said she had given all she had.

It's not clear if Assange ever successfully cracked the password. According to the indictment, that password would have given Manning administrative privileges on SIPRNet, allowing her to pull more files from it while concealing the traces of her leaks from investigators.

Is one failed attempt to crack a password really enough to embroil Assange in a felony hacking case? "For the CFAA, unfortunately yes," says Jeffrey Vagle, a former University of Pennsylvania law professor and current affiliate scholar at the Stanford Center for Internet and Society. He points to a long history of using the overly expansive wording of the Computer Fraud and Abuse Act to hit hackers accused of even trivial acts with serious charges. "The fact that his involvement is de minimus isn't enough to stop an indictment, because the CFAA is just so broad."

"I think the press freedom issues are moot now." Susan Hennessey, Brookings Institute

That doesn't make the charges against Assange an open-and-shut case, argues Tor Ekeland, a well-known hacker defense attorney. The indictment only charges Assange with one count, with a maximum of five years in prison. And due to the complicating factor of his extradition from the UK, prosecutors won’t be able to pile on more charges with a so-called “superseding indictment,” since they have to justify any charges they make now to British authorities. Ekeland also says there could still be venue issues with the charges; prosecutors would have to prove that the case affected residents of the Eastern District of Virginia, the relatively conservative district where the case would be tried. "It seems thin to me," Ekeland says.