Depends on how good OP's opsec is as a security researcher. If they're any good, they should know what traces they left. Did they use a VPN via a coffee shop's

Depends on how good OP's opsec is as a security researcher. If they're any good, they should know what traces they left. Did they use a VPN via a coffee shop's wifi, or did they connect from home. Canada is a different country from the US though, so it might be time for them to lawyer up and see how extradition works for CFAA violations.