Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3768 Page 1 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`RANDY S. GROSSMAN
`Acting United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No. 18cr4683-GPC
`
`
`UNITED STATES’ RESPONSE IN
`
`Plaintiff,
`OPPOSITION TO DEFENDANTS’
`
`SUPPLEMENTAL MOTIONS TO
`v.
`
`COMPEL DISCOVERY AND FOR
`
`RECONSIDERATION OF
`JACOB BYCHAK et. al.,
`DENIAL OF MOTION TO
`
`COMPEL DISCOVERY
`
`Defendants.
`REGARDING THE IDENTITY OF
`
`THE SOURCE OF
`INFORMATION AT SPAMHAUS
`
`
`
`
`
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3769 Page 2 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`I.
`INTRODUCTION
`The fatal factual flaws in defendants’ motions to compel discovery relating to
`Spamhaus and the Spamhaus Source (SS) are that: 1) the allegedly illegal search committed
`by a former Company A employee, CY, occurred no later than mid-2013, weeks before the
`government first met with SS and years before SS received the “purloined” emails;
`2) contemporaneous emails show that SS did not send CY’s emails to the FBI until 2017,
`four years after the alleged search occurred; 3) search warrant affidavits and grand jury
`exhibits show that the government never used or relied on CY’s emails; and 4) the
`government’s case centers on defendants’ own emails, not CY or SS, and the voluminous
`records obtained via grand jury subpoenas issued in 2016.
`The core legal deficiencies with defendants’ motion are two-fold. First, their briefing
`does not articulate a theory of defense, let alone show how the requested discovery is
`relevant to their defense at trial, which they must do to demonstrate the information sought
`is material. United States v. Gonzalo Beltran, 915 F.2d 487, 489 (9th Cir. 1990). Second,
`even if they demonstrated materiality, the authorized remedy would be in camera review,
`not disclosure. Id. at 488-89; United States v. Henderson, 241 F.3d 638, 645 (9th Cir.
`2000).
`While the Court could conduct an in camera review in an abundance of caution, the
`evidentiary record before it neither justifies nor requires judicial intervention. The
`hundreds of pages submitted in support of this episodic and ever-expanding discovery
`request contain no actual evidence of the government tasking SS or CY to do anything, let
`alone something illegal or unethical. Similarly, all the available evidence indicates that,
`even if the Court were to interview SS, SS would say the same thing SS has consistently
`said, namely that “Spamhaus does not act under the direction of the FBI or any other
`government agency. Information given to us was not ‘stolen’ but freely given to us by CY
`who claims he was not under any NDA[,] was free to give us the emails, and [] was
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`2
`
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3770 Page 3 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`motivated by [Company A] constantly lying and defaming him. He was not aware of any
`FBI investigation at the time.” [ECF 295, Ex. 21.]
`II.
`PROCEDURAL BACKGROUND
`On March 13, 2019, defendants filed a joint motion to compel discovery of SS’s
`
`identity. [ECF 71.] The government filed its opposition on March 29, 2019, and defendants
`filed their reply on April 12, 2019. [ECF 74, 83.] On April 30, 2019, the Court denied
`defendants’ motion to compel. [ECF 93.]
`
`On July 30, 2021, defendants moved to compel discovery of the identity of
`documents obtained by SS from a suspected Company A informant. [ECF 257.] On August
`6, 2021, the government filed its opposition [ECF 265.] During oral argument, defendants
`broadened their request and sought disclosure of SS’s Confidential Human Source (CHS)
`file. [Hrg Tr. of Aug. 20, 2021, p. 10.] On August 20, 2021, the court granted defendants’
`motion in part, ordering the government to ask SS to identify which documents SS had
`received from CY (the suspected Company A informant) and then provided to the
`government. [ECF 275.]
`
`On September 20, 2021, defendants moved to compel discovery regarding all
`assistance the United States has ever received from Spamhaus and for reconsideration of
`the denial of the motion to compel discovery of SS’s identity. [ECF 281, 282.] The
`government filed a consolidated response to both motions on September 27, 2021. [ECF
`283.] On October 1, 2021, defendants moved for leave to file a reply to the government’s
`opposition. [ECF 288]. On October 4, 2021, the Court denied defendants’ request to file a
`reply, but allowed them to file a supplemental brief to which the government could
`respond, directing the parties to “tak[e] note of the areas where the court expressed
`questions or concerns so that we can focus on the most salient questions before the court.”
`[Hrg Tr. Of Oct. 4, 2021, p.54].
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`
`
`3
`
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3771 Page 4 of 22
`
`
`A.
`
`III.
`STATEMENT OF RELEVANT FACTS
` Defendants’ motion advances a series of misconceptions that portray SS as the
`
`puppet master of an otherwise clueless prosecution team to try to demonstrate the
`materiality of SS’s identity. To correct the record, the government provides the following
`factual background along with a timeline and evidentiary citations, attached as Exhibit 1.
`
`
`The Spamhaus Source did not act at the direction
`of the government at the time of CY’s private search.
` At the heart of defendants’ motion is the argument that the government conducted a
`warrantless search when CY “purloined” Company A emails from his then-employer. To
`prevail, defendants must show that, at the time of the search, the private searcher (i.e., CY)
`acted at the direction or encouragement of the government. United States v. Sherwin, 529
`F.2d 1, 6 (9th Cir. 1976) (en banc). It is undisputed that CY left his employer, an affiliate
`of Company A (hereafter, Company B), in mid-2013. [ECF 283, EX 3; Adconion-Disc02-
`Reports-00928.1] The eleven emails CY allegedly “purloined” from Company A were sent
`between June 2011 and May 2013. Id. To suppress these emails (which the government is
`not using in its case-in-chief), defendants must show that, in mid-2013, CY took documents
`from Company A without authority at the government’s direction or encouragement. To
`connect these dots, defendants hypothesize that SS directed or encouraged CY’s search
`and acted as a government informant in or before mid-2013. [ECF 295 at 8.2] To support
`this theory, defendants rely on reports produced in discovery wherein SS was inadvertently
`identified by a CHS number, including the report of the FBI’s initial interview of SS,
`conducted by the FBI’s Baltimore field office on July 12, 2013. [ECF 295, p.1-2.] This
`
`
`1 The government’s discovery citations reference the first page of the document and not
`the entire page range.
`
` 2
`
` The government’s citations to defendants’ brief refer to the page number in the
`document’s footer and not to the number in the ECF header.
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`4
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3772 Page 5 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`reliance is misplaced for four reasons. First, CY left Company B in mid-2013 and the last
`“purloined” email was from May 2013. The FBI could not have directed SS or CY to act
`(or discouraged them from acting) prior to meeting them. Rather, by the time the FBI first
`met with SS, any potential private search by CY had already occurred.
`Second, the defense has received the FBI report clarifying how and when a CHS
`number was inadvertently substituted for SS’s name at the time of redaction for discovery
`purposes. [ECF 295, Ex. 26.] This report explained that another FBI field office first
`designated SS as a CHS on October 12, 2018, pursuant to SS’s involvement in an unrelated
`investigation.3 Defense counsel has since received redacted copies of the original FBI
`reports, which identified SS by name and not by CHS number. [Adconion-Disc38-00001;
`Adconion-Disc39-00038.] Rather than acknowledge that they are relying on a scrivener’s
`error to make a factual argument, defendants dismiss the original reports as “irrelevant”
`and “pretextual” and insist that these discovery-redacted reports are proof that SS was
`always a CHS. [ECF 295, p.8.]
`Third, the best evidence of SS’s status during the investigation’s stages are not the
`302s inadvertently redacted in late 2018, but rather the 2014 and 2015 search warrant
`affidavits that contemporaneously described SS as a Confidential Witness (CW). See Gov.
`Exs. 2 and 3 (filed under seal). The term “Confidential Human Source,” or CHS, is an FBI
`term-of-art that refers to a formalized relationship. In the search warrant affidavits, the FBI
`would have described SS as a CHS had that been true. Instead, the affiant identified SS as
`
`3 Two weeks before a San Diego grand jury indicted this case, an unrelated FBI field office
`designated SS as a CHS pursuant to an investigation opened by that office and created a
`FBI file for SS’s CHS activities relating to their separate investigation. The FBI’s San
`Diego field office has no “file” detailing any agreement between SS and the San Diego FBI
`because San Diego did not task SS to take any action in this case. Defendants’ motion for
`discovery of SS’s CHS file will not gain further information on the actions of SS in this
`case. [See Decl. of AUSA Melanie Pierson, attached hereto.] Rather, defendants already
`possess the emails and reports of contact between SS and the San Diego FBI that relate to
`this case. The records sought by defendants that have not already been produced in
`discovery consist solely of contacts between Spamhaus and SS and the FBI relating to other
`cases.
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`5
`
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3773 Page 6 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`a CW. By only submitting the first three pages of the 2014 search warrant affidavit,
`defendants ignore the evidence showing that agents vetted SS’s information by
`corroborating it against open-source records and through interviews with a second CW in
`July 2014, who, unlike SS, had direct knowledge of the criminal conduct. Id.
`Fourth, the defense’s claim that it needs to interview SS about whether SS was a
`CHS in 2013 ignores SS’s consistent denials. As the Court is aware, SS has sent multiple
`unsolicited emails to the government that reveal SS’s awareness that SS’s emails will be
`produced to the defense. In these emails, SS unambiguously stated the following:
` 8/1/2021: “FBI never requested that [CY] or Spamhaus needed to do
`anything. . . Spamhaus does not act under the direction of the FBI or any
`other government agency.” [ECF 295, Ex. 21.]
` 8/5/2021: “I don’t get paid anything and the FBI doesn’t tell me what to do
`and vice versa. . . The prosecution doesn’t ask for my advice, and if they
`could tell me what to do, they’d probably tell me to stop sending this stuff.”
`[ECF 295, Ex. 22.]
` 9/21/2021: “Spamhaus never encouraged [CY] to send internal emails . . .
`. Spamhaus didn’t think the internal emails were particularly important. . .
`. [and] the internal emails were not even sent to law enforcement for three
`years after receiving them.” [ECF 293, Ex. 14.]
`Despite these express disavowals, defendants insist it is “grossly inaccurate” not to describe
`SS as a CHS, [ECF 295, p.9], and that they need to interview SS to learn more. Similarly,
`despite discovery of over 1,000 pages of emails between SS and the FBI in this
`investigation, the defense offers no emails wherein the FBI tasked SS with obtaining any
`evidence in this case, much less internal Company A documents.
`B.
`SS did not recruit a “vital” Company A insider.
`The discovery provided to defendants demonstrates that SS did not help the FBI
`recruit a “vital” Company A insider, as the defense claims. [ECF 295, p.2.] Rather, the
`evidence shows that the FBI failed to recruit a Company A insider and relied instead on
`6
`
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3774 Page 7 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`interviews with victims, third parties, and former employees until June of 2017, when the
`government began subpoenaing Company A employees to testify before the grand jury.
`[Adconion-Disc38-00003.]
`Defendants do not dispute that CY left Company B’s employment in mid-2013.
`[Adconion-Disc02-Reports 00928.] In September 2013, CY’s former boss, JM, told
`Spamhaus that CY was responsible for spamming activities that Spamhaus had attributed
`to Company B. [ECF 295, EX 27.] That same month, “an anonymous informant” (ANON-
`1) whom SS believed to be CY began sending Spamhaus information about Company A
`and Company B in what SS believed was an effort to rebut JM’s attempt to blame CY.
`[ECF 295, Ex. 2 and 3.] ANON-1 used an anonymized email address, which SS provided
`to the FBI on June 2, 2014, one week after having told the FBI that that ANON-1 “doesn’t
`know anything about THIS investigation.” Id. On June 3, 2014, the FBI emailed ANON-1
`at the anonymized email address. ANON-1 responded with questions about how ANON-1
`could remain anonymous. [Adconion-Disc39-01779.] The FBI responded with a request to
`meet on or about June 11, 2014, and never received any further response or any documents
`or information from ANON-1. Id.
`Three years later, on September 27, 2017, SS emailed the FBI, “so far I have not
`included anything our informants have given us” and then asked, “Do you want to see these
`emails?” [ECF 295, Ex. 13.] On October 12, 2017, SS sent the FBI eleven emails obtained
`from CY. [ECF 295, Ex. 14.] It is undisputed that the first meeting between CY and the
`FBI occurred on December 18, 2017, in the presence of CY’s counsel. [Adconion-Disc02-
`Reports 00928.] Between the last email with ANON-1 on June 11, 2014, and CY’s meeting
`with the government on December 18, 2017, there is no evidence of any contact between
`CY and the government. Rather, he only documents provided by CY to the government are
`the eleven emails sent to the FBI by SS on October 12, 2017, and four documents provided
`by CY’s counsel in January 2018. [Adconion-Disc39-01781.] CY’s limited cooperation
`through counsel rebuff the notion that he was a “vital” insider, let alone one recruited by
`SS.
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`7
`
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3775 Page 8 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`C.
`
`The government learned that SS had received Company A
`records from CY two weeks before SS provided them to the FBI.
`Despite SS’s emails from 2017 (“so far I have not included anything our informants
`have given us”) and 2021 (“[Spamhaus] waited YEARS before sending [CY’s emails] over
`to the FBI”) in which SS unambiguously stated SS did not provide CY’s emails to the
`government prior to October 2017, the defense speculates that, in May 2014, “the
`Government was placed on notice that information provided by [SS] might be tainted by
`information from [CY’s] illegally obtained documents” and therefore “acquiesced in [SS’s]
`unlawful conduct.” [ECF 295, p.21.]
`Their speculation rests on a May 22, 2014 email from SS to the FBI wherein SS
`stated that, since September 2013, Spamhaus had received “a ton of info” from ANON-1.
`SS’s email described ANON-1 as someone who “knows all of the people we’ll be talking
`about and everything about their operations.” [ECF 295, Ex. 2.] SS’s email did not,
`however, attach any documents or mention any internal Company A documents. The FBI’s
`response to SS said they could discuss ANON-1 on June 2, 2014, when the FBI’s San
`Diego field office had its first interview with SS. In the seven-page report of that interview,
`SS described ANON-1 as someone “with intimate knowledge of [Company A] operations”
`who had provided “information only a former employee would know;” however, there was
`no mention of Company A documents possessed by ANON-1, much less documents
`provided by ANON-1 to SS such that the government would have known of an alleged
`illegal search by May 2014. [ECF 295, EX 3.]
` To nonetheless argue that the government was “on notice” of CY and/or SS’s
`illegal search and thus “acquiesced” to a subsequent illegal search, the defense contrives a
`scenario in which SS received “additional” purloined emails from CY with the
`government’s knowledge and consent. [ECF 295, p.22.] Defendants’ scenario in which
`these “additional” emails supplement unidentified earlier purloined emails rests on a
`misreading of an August 25, 2021 email in which SS, pursuant to the Court’s order,
`identified the eleven emails SS received from CY and provided to the FBI. [ECF 295, Ex.
`12.] In this August 2021 email, SS identified December 29, 2015 as the date that Spamhaus
`8
`Government’s Response to Defendants’ Motion to
`18cr4683-GPC
`
`Reconsider Denial of Motion to Compel Discovery
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3776 Page 9 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`received the allegedly purloined emails. The unrefuted evidence, however, shows that SS
`did not provide these emails to the government until October 2017 and there is no evidence
`of any other purloined emails that were previously shared with the government and would
`have thereby put them on notice of an alleged warrantless search.
` Undeterred by this lack of evidence, defendants further speculate that, because SS’s
`August 2021 email summarized the contents of CY’s eleven emails, SS must have also
`summarized the emails prior to sending them to the FBI in October 2017. [ECF 295, p.4.]
`There is simply no evidence to support this assumption. In spite of possessing over 1,000
`pages of communications between SS and the FBI related to this case, the defense cannot
`identify any communication where CY’s documents were summarized or otherwise passed
`to the FBI prior to October 2017.
`D.
`SS did not mastermind the government’s case.
`To amplify SS’s role in the investigation, the defense argues that SS identified the
`government’s “key witnesses,” “instructed the Government who to interview and
`subpoena,” and counseled “the Government regarding its responses to Defendants’
`motions and overall case strategy.” [ECF 295, p.10,13.] Defendants’ insinuation that the
`agents and prosecutors served as mere pawns of SS’s machinations ignores the expertise
`required to build and litigate a complex cybercrime case. Glossing over the actual work,
`some of which is described below, enables defendants to mischaracterize the investigation
`as relying on a non-testifying source, SS, rather than on the testimony of percipient
`witnesses, coconspirators, and victims, as well as the defendants’ own emails – which are
`the crux of the case and, unlike any of CY’s emails, were presented to the grand jury.
`(Defendants received all the grand jury exhibits in discovery in December 2018.) Indeed,
`the fact that the grand jury investigation spanned nearly five years is further evidence that
`SS’s information did not provide the government with the evidence needed for its
`prosecution.
`Even in the investigation’s early stage, the discovery shows that the FBI had begun
`independently interviewing percipient witnesses who corroborated SS’s initial tip. In
`9
`
`
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3777 Page 10 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`August 2013, the FBI interviewed an employee of a major Internet Service Provider (ISP)
`who had identified a hijacked netblock (the “Telalink” netblock) used by Company A to
`send spam. [Adconion-Disc02-Reports 00031.] By July 2014, the FBI had interviewed and
`subpoenaed records from PH, whose hosting company had received multiple fraudulent
`LOAs from Company A. The subpoenaed records included a fraudulent LOA for the
`hijacked Telalink netblock, which defendant Mark Manoogian had emailed to PH from his
`Company A email account. [Adconion-Disc02-Reports 00039; Adconion-Disc04-SW-
`00009.] In October 2014, the FBI interviewed Telalink’s owners, who confirmed that the
`Telalink LOA sent by Manoogian was fraudulent and that they had not authorized
`Manoogian or Company A to use their IP netblock. [Adconion-Disc02-Reports 00057.]
`Based on this evidence and additional open-source records, the FBI obtained a
`warrant in December 2014 to search Manoogian’s Company A email account. [Ex. 2;
`Adconion-Disc04-SW-00001.] The defense chose to submit only the first three pages of
`the search warrant affidavit in support of its motion to suggest that the warrant relied on
`SS and, by implication, CY, rather than on independent evidence gathered by the FBI.
`[ECF 295, Ex. 11.] The defense similarly ignored the May 2015 search warrant that
`authorized the FBI to search the emails of coconspirator Daniel Dye and four additional
`Company A employees.4 [Adconion-Disc04-SW-00020.] Both affidavits, however,
`demonstrate that the investigation did not rely on CY, a Company A insider, or even SS.
`Id. Rather, it centered on emails sent by Manoogian and his codefendants regarding their
`use of hijacked netblocks to send spam, such as an email from Qayyum to Manoogian on
`February 11, 2013, which attached a forged LOA with the instructions, “Please print and
`sign.” [Adconion-Disc04-SW-00035.]
`Defendants’ insistence that SS “continued to act as a liaison between CY and the
`FBI” throughout the investigation [ECF 295, p.3-4.], and that this relationship, rather than
`
`4 The May 2015 search warrant discussed Manoogian’s emails with codefendants Qayyum
`and Bychak but did not seek warrants for their accounts because the company that hosted
`Company A’s emails advised the FBI that the codefendants’ accounts had been deleted.
`ADCONION-DISC04-SW-00034.
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`10
`
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3778 Page 11 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`defendants’ own emails, was material to the investigation ignores the case’s actual
`trajectory. On September 9, 2016, the FBI approached defendant Qayyum to seek his
`cooperation. [Adconion-Disc18-00003.] On September 13, 2016, Qayyum told the FBI that
`he did not want to assist with its investigation. Id. On September 19, 2016, recognizing that
`the investigation into Company A was no longer covert, the government served subpoenas
`for internal emails and company records on Company A and its affiliate partners.
`[ADCONION-DISC02-00020.] In June 2017, as part of the now-overt grand jury
`investigation, the government began subpoenaing Company A employees to testify before
`the grand jury. [Adconion-Disc38-00003.] The evidence produced in response to this grand
`jury investigation, which the government’s 257 grand jury exhibits distill and highlight,
`shows that CY and his emails as well as SS’s second-hand tips were peripheral to the
`investigation and that SS’s information was repeatedly corroborated by percipient
`witnesses with actual knowledge of the crimes. Any insinuation that SS was a de facto
`member of the prosecution team is therefore unfounded.
`E.
`Spamhaus Has an Independent Mission to Combat Spam
`and Does Not Act at the Direction of the FBI.
`Spamhaus was founded in 1998 in London, England, as a private non-profit
`organization dedicated to fighting spam and “related cyber threats such as phishing,
`malware, and botnets.”5 Spamhaus is located and registered as a Not-For-Profit Limited
`Liability Company in Andorra.6 Spamhaus does not have a U.S. presence and is not a law-
`enforcement entity.7 Spamhaus does not receive income or generate profits, does not have
`customers, and is not involved in commerce.8 Spamhaus’s mission is to track and report
`accurate information regarding spam and related cyber threats,9 which it then offers free to
`
`
`5 https://www.spamhaus.org/organization/.
`6 https://www.spamhaus.org/organization/statement/013/popular-myths-about-spamhaus
`https://www.spamhaus.org/faq/section/Organization.
`7 https://www.spamhaus.org/organization/statement/003/case-answer-e360insight-vs.-
`the-spamhaus-project; https://www.spamhaus.org/faq/section/ROKSO%20FAQ.
`8 https://www.spamhaus.org/organization/statement/013/popular-myths-about-spamhaus.
`9 https://www.spamhaus.org/organization/.
`11
`Government’s Response to Defendants’ Motion to
`
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3779 Page 12 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`the worldwide public, including to ISPs, government and military organizations, security
`vendors, corporations, academia, and industry.10 The data compiled by Spamhaus includes
`the IP addresses associated with the sending of spam, and the entities controlling, using, or
`owning those IP addresses. Spamhaus’s publicly-available databases protect, as of October
`2021, over 3 billion user mailboxes in over 18 countries.11 This anti-spam mission
`demonstrates that Spamhaus has a legitimate independent motivation for obtaining and
`compiling data, making that data available to the public, and for passing tips or information
`received from other private parties to law enforcement or other regulatory agencies.
`The SBL (Spamhaus Block List) Advisory is a database of known or verified spam
`sources (i.e., IP addresses that violate Spamhaus’s policy for acceptance of inbound
`email).12 Entities that are repeat offenders are listed in the Spamhaus database ROKSO
`(Register of Known Spam Operations). While much of the information in the ROKSO
`database is publicly available, Spamhaus provides additional information to law
`enforcement and other investigative or regulatory agencies through a secure portal.
`Agencies currently able to access this secure portal include (UK) NCA, National Cyber
`Crime Security Centre;(USA) NCFTA, the FBI, the USSS, the US Marshal's Service, the
`FTC, the IRS, the USPIS, the U.S. Army, the DOE, and various State AG offices;
`(Netherlands) OPTA;(Australia) ACMA;(New Zealand) DIA; and (Switzerland)
`Cybercrime Coordination Unit.13 Consistent with Spamhaus’s independent mission, SS
`advised the parties in an unsolicited August 1, 2021 email that “Spamhaus does not act at
`the direction of the FBI or any other government agency.” [ECF 295, Ex. 21.]
`F.
`Spamhaus collects and shares data about users
`of its website pursuant to its privacy policy.
` Spamhaus has a privacy policy found on its website,14 which explains what data it
`collects, maintains, and makes accessible to other entities. Specifically, Spamhaus advises
`
`10 https://en.wikipedia.org/wiki/The_Spamhaus_Project.
`11 https://www.spamhaus.org/organization/.
`12 https://www.spamhaus.org/faq/section/Spamhaus%20SBL.
`13 https://www.spamhaus.org/faq/section/ROKSO%20FAQ.
`14 https://www.spamhaus.org/organization/privacy/.
`12
`Government’s Response to Defendants’ Motion to
`
`Reconsider Denial of Motion to Compel Discovery
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3780 Page 13 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`users that user data is collected simply by interacting with its website and that it collects
`the following information on any individual or entity accessing its site based on its terms
`of service and implied consent: (1) identity data including first name, last name, and
`username or similar identifier, (2) contact data, including postal address, delivery address,
`email address, and telephone numbers, (3) technical data, including IP address, the user’s
`login data, browser type and version, time zone setting and location, browser plug-in types
`and versions, operating system and platform and other technology on the devices the user
`uses to access the Spamhaus website, (4) profile data, including the user’s username and
`password, requests made by the user, and any account preferences, (5) usage data,
`including information about how the user uses the Spamhaus website, products, and
`services, and (6) marketing and communications data, including the user’s preferences in
`receiving marketing from Spamhaus and third parties related to Spamhaus and the user’s
`communication preferences.15
`
`IV.
`DEFENDANTS’ DISCOVERY MOTIONS SHOULD BE DENIED
`Defendants’ motions to seek discovery of SS’s identity and any record bearing on
`
`Spamhaus’s relationship to the entire U.S. government should be denied.
`A.
`SS’s identity is privileged and immaterial to the defense.
`1.
`The Informant Privilege applies to SS
`“The government has a limited privilege to withhold the identity of confidential
`informants” unless “disclosure of an informer’s identity, or of the contents of his
`communication, is relevant and helpful to the defense of an accused, or is essential to a fair
`determination of a cause...” United States v. Sai Keung Wong, 886 F.2d 252, 255 (9th Cir.
`1989) (quoting Roviaro v. United States, 353 U.S. 53, 59 (1957)).
`The burden of proof is on defendants to show a need for disclosure. Mere suspicion
`that information will prove helpful is insufficient to require disclosure. United States v.
`Buffington, 815 F.2d 1292, 1299 (9th Cir. 1987); see also United States v. Santiago, 46 F.3d
`
`
`15 Id.
`Government’s Response to Defendants’ Motion to
`Reconsider Denial of Motion to Compel Discovery
`
`13
`
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 299 Filed 11/01/21 PageID.3781 Page 14 of 22
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`885, 894 (9th Cir. 1995) (“Neither a general description of the information sought nor
`conclusory allegations of materiality suffice.”). The “mere suspicion” that an informant
`has information that will prove “relevant and helpful or will be essential to a fair trial” is
`not enough to warrant disclosure. United States v. Amador Galvan, 9 F.3d 1414, 1417 (9th
`Cir. 1993). Mere speculation that an informant might have helpful information is not
`sufficient to overcome the public interest in the protection of the identity of informants.
`United States v. Marshall, 532 F. 2d 1279, 1282 (9th Cir. 1976).
`To evaluate whether the helpfuln