Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4183 Page 1 of 34
`
`
`
`WIECHERT, MUNK &
`GOLDSTEIN, PC
`David W. Wiechert, SBN 94607
`Jessica C. Munk, SBN 238832
`Jahnavi Goldstein, SBN 245084
`27136 Paseo Espada, Suite B1123
`San Juan Capistrano, CA 92675
`Telephone: (949) 361-2822
`Email: dwiechert@wmgattorneys.com
` jessica@wmgattorneys.com
` jahnavi@wmgattorneys.com
`
`Attorneys for Jacob Bychak
`
`
`
`MINTZ, LEVIN, COHN, FERRIS,
`GLOVSKYAND POPEO, P.C.
`Randy K. Jones, SBN 141711
`3580 Carmel Mountain Road, Suite 300
`San Diego, CA 92130
`Telephone: (858) 314-1510
`Email: rkjones@mintz.com
`
`Daniel J. Goodrich, BBO 692624 (Pro Hac)
`Ryan Dougherty, BBO 703380 (Pro Hac)
`1 Financial Center
`Boston, MA 02111
`djgoodrich@mintz.com
`rtdougherty@mintz.com
`
`Attorney for Mark Manoogian
`
`
`BIRD MARELLA BOXER WOLPERT
`BIENERT KATZMAN
`NESSIM DROOKS LINCENBERG
`LITTRELL WILLIAMS LLP
`RHOW P.C.
`Thomas H. Bienert, Jr., SBN 135311
`Gary S. Lincenberg, SBN 123058
`James D. Riddet, SBN 39826
`Alexis A. Wiseley, SBN 330100
`Whitney Z. Bernstein, SBN 304917
`Darren L. Patrick, SBN 310727
`Carlos A. Nevarez, SBN 324407
`1875 Century Park East, Floor 23
`903 Calle Amanecer, Suite 350
`Los Angeles, CA 90067
`San Clemente, California 92673
`Telephone: (310) 201-2100
`Telephone: (949) 369-3700
`Email: glincenberg@birdmarella.com
`Email: tbienert@bklwlaw.com
`awiseley@birdmarella.com
`
` jriddet@bklwlaw.com
` dpatrick@birdmarella.com
`
` wbernstein@bklwlaw.com
`
` cnevarez@bklwlaw.com
`Attorneys for Petr Pacas
`
`
`Attorneys for Mohammed Abdul Qayyum
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4184 Page 2 of 34
`
`
`
`
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE SOUTHERN DISTRICT OF CALIFORNIA
`
`Plaintiff,
`
`UNITED STATES OF AMERICA,
`
`
`
`v.
`
`JACOB BYCHAK, et al.,
`
` Defendants.
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`Case No. 18-CR-4683-GPC
`Honorable Gonzalo P. Curiel
`
`MEMORANDUM OF POINTS AND
`AUTHORITIES IN SUPPORT OF
`DEFENDANTS’ MOTION TO
`SUPPRESS AND DISMISS UNDER THE
`FOURTH AMENDMENT AND
`REQUEST FOR EVIDENTIARY
`HEARING
`
`[Declarations of Jacob Bychak; Mark
`Manoogian; Mohammed Abdul Qayyum;
`Petr Pacas; and Under Seal Declaration of
`Jessica C. Munk and attached Under Seal
`Exhibits filed concurrently herewith]
`
`Hearing Date: April 1, 2022
`Hearing Time: 2:30 p.m.
`Department: Courtroom 2D
`
`
`
`
`1
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4185 Page 3 of 34
`
`
`
`TABLE OF CONTENTS
`
`I.
`
`INTRODUCTION .................................................................................................... 1
`
`II.
`
`FACTUAL BACKGROUND ................................................................................... 1
`
`A. Defendants’ Employment at Company A and B, and Their
`Reasonable Expectation of Privacy ................................................................ 1
`
`B.
`
`CY’s Employment at Company A and B and Theft of Documents
`and Information............................................................................................... 3
`
`C.
`
`Background of Spamhaus and Its Agent the SI .............................................. 5
`
`1.
`
`2.
`
`3.
`
`Spamhaus’ History of Cooperating with the Government ................... 5
`
`SI’s History of Working with the Government .................................... 6
`
`SI’s Direction and Assistance to the Government In This
`Case ...................................................................................................... 6
`
`a.
`
`b.
`
`c.
`
`SI’s Communications with the Government and
`Sharing of Information and Documents From CY ..................... 7
`
`The SI Worked Closely and Continuously with the
`Government from the Outset of this Investigation ..................... 9
`
`The SI Shares with the FBI Purloined Documents,
`Including Privileged Material................................................... 11
`
`III.
`
`PROCEDURAL HISTORY .................................................................................... 13
`
`IV. LEGAL ARGUMENT ............................................................................................ 14
`
`A. Due to Spamhaus and the SI’s Collaboration with the Government,
`the Provision of Documents and Information Purloined By CY
`Involved State Action ................................................................................... 14
`
`1. Whether The Government Knew of or Acquiesced In the Intrusive
`Conduct................................................................................................ 15
`
`2. Whether the Party Performing the Search Intended to Assist Law
`Enforcement Efforts or Further His Own Ends ................................... 17
`
`
`
`
`
`i
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4186 Page 4 of 34
`
`
`
`
`
`
`
`B.
`
`CY’s Theft of Information and Documents Implicates the Fourth
`Amendment and the Defendants Have Standing to Challenge the
`Search............................................................................................................ 19
`
`1. Defendants Had a Subjective Expectation of Privacy In Their Company
`Email ...................................................................................................... 20
`
`2. Defendants’ Expectation of Privacy In Their Company Email was
`Objectively Reasonable .......................................................................... 22
`
`C.
`
`The Court Should Suppress and Dismiss Under the Fourth
`Amendment, or Alternatively Hold an Evidentiary Hearing to
`Determine the Relationship Between CY and Spamhaus and the SI,
`As Well As the Relationship Between the Government and the SI,
`and a Kastigar Hearing to Determine the Appropriate Remedy .................. 23
`
`V.
`
`CONCLUSION ....................................................................................................... 24
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`ii
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4187 Page 5 of 34
`
`
`
`Cases
`
`TABLE OF AUTHORITIES
`
`Arpin v. Santa Clara Valley Transportation Agency, 261 F.3d 912 (9th Cir.
`2001) ............................................................................................................................ 17
`
`Brigham City v. Stuart, 547 U.S. 398, 403 (2006) ............................................................ 20
`
`Coolidge v. New Hampshire, 403 U.S. 443 (1971) ........................................................... 14
`
`Frazer v. United States, 18 F.3d 778 (9th Cir.1994) ......................................................... 23
`
`Guest v. Leis, 255 F.3d 325 (6th Cir. 2001) ...................................................................... 20
`
`Kastigar v. United States, 406 U.S. 441 (1972) ................................................................ 24
`
`Katz v. United States, 309 U.S. 347 (1967) ....................................................................... 20
`
`Lugar v. Edmondson Oil Co., 457 U.S. 922 (1982) .......................................................... 16
`
`Lustig v. United States, 338 U.S. 74 (1949) ...................................................................... 15
`
`O’Connor v. Ortega, 480 U.S. 709 (1987) ........................................................................ 22
`
`Quon v. Arch Wireless Operating Co., Inc., 309 F. Supp. 2d 1204 (C.D. Cal.
`2004) ............................................................................................................................ 20
`
`Riley v. California, 573 U.S. 373 (2014)........................................................................... 20
`
`Smith v. Maryland, 442 U.S. 735 (1979)............................................................... 19, 20, 21
`
`United States v. Ageyev, 2019 WL 8989871 (E.D. Wash. September 20,
`2019) ............................................................................................................................ 19
`
`United States v. Babichenko, No. 1:18-cr-00258, 2020 WL 4043143 (D.
`Idaho July 16, 2020) ..................................................................................................... 20
`
`United States v. Burrows, 872 F.2d 915 (9th Cir.1989) .................................................... 23
`
`United States v. Caputo, No. 3:18-cr-00428-IM, 2019 WL 5788305 (D. Or.
`Nov. 6, 2019) .......................................................................................................... 21, 22
`
`United States v. Chavez-Miranda, 306 F.3d 973 (9th Cir. 2002)...................................... 23
`
`United States v. Chukwubike, 956 F.2d 209 (9th Cir. 1992) ............................................. 17
`
`iii
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4188 Page 6 of 34
`
`
`
`United States v. Cleaveland, 38 F.3d 1092 (9th Cir. 1994) .............................................. 15
`
`United States v. Greiner, 235 F. App’x 541 (9th Cir. 2007) ............................................. 22
`
`United States v. Heckenkamp, 482 F.3d 1142 (9th Cir. 2007) .......................................... 22
`
`United States v. Jacobsen, 466 U.S. 109 (1984) ............................................................... 20
`
`United States v. Keith, 908 F. Supp. 2d 33 (D.Mass. 2013) .............................................. 19
`
`United States v. Meregildo, 920 F. Supp. 2d 434 (S.D.N.Y. 2013) .................................. 18
`
`United States v. Reed, 15 F.3d 928 (9th Cir. 1994) ............................................... 15, 16, 17
`
`United States v. Slayer, No. S-10-061 LKK, 2012 WL 458472 (E.D. Cal.
`Feb. 10, 2012) .............................................................................................................. 20
`
`United States v. Walther, 652 F.2d 788 (9th Cir. 1981) .................................................... 16
`
`United States v. Warshak, 631 F.3d 266 (6th Cir. 2010) ................................................... 20
`
`United States v. Warshak, 631 F.3d 266 (6th Cir. 2010) .................................................. 20
`
`United States v. Ziegler, 474 F.3d 1184 (9th Cir. 2007) ............................................. 16, 21
`
`USA v. Bohannon, 506 F. Supp. 3d 907 (N.D. Cal. 2020) ................................................ 19
`
`Other Authorities
`
`Department of Justice, Bugat Botnet Administrator Arrested and Malware
`Disabled (October 13, 2015), https://www.justice.gov/opa/pr/bugat-
`botnet-administrator-arrested-and-malware-disabled (specifically
`identifying Spamhaus as a partner in the FBI’s investigation) ...................................... 5
`
`Elinor Mills, Q&A: FBI agent looks back on time posing as a cybercriminal,
`CNET Tech (June 29, 2009), https://www.cnet.com/tech/services-and-
`software/q-a-fbi-agent-looks-back-on-time-posing-as-a-cybercriminal/ ....................... 5
`
`FBI, Operation Ghost Click, November 9, 2011, https://www.fbi.gov/news/
`stories/international-cyber-ring-that-infected-millions-of-computers
`dismantled ...................................................................................................................... 5
`
`FBI, Testimony to House Committee on Small Business Regulatory Reform
`and Oversight Subcommittee,
`https://archives.fbi.gov/archives/news/testimony/small-business-cyber-
`security ........................................................................................................................... 5
`
`iv
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4189 Page 7 of 34
`
`
`
`https://www.spamhaus.org/organization/ (last visited February 10, 2022)......................... 5
`
`https://en.wikipedia.org/wiki/Steve_Linford. On February 23, 2015 ................................. 9
`
`https://www.ncfta.net/ (last visited Feb. 15, 2022) ........................................................... 10
`
`
`
`
`
`v
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4190 Page 8 of 34
`
`
`
`
`
`MEMORANDUM OF POINTS AND AUTHORITIES
`
`I.
`
`INTRODUCTION
`
`
`
`The Spamhaus Project (“Spamhaus”) is an international organization that touts
`
`itself as a member of the “Law Enforcement task force” that “works closely” with the FBI
`
`and other law enforcement agencies to combat cyber-crime. For more than a decade,
`
`Spamhaus has partnered with the FBI in criminal investigations, and the FBI credits
`
`Spamhaus as one of its “private sector partners” in prosecuting criminal cases. The
`
`Spamhaus Informant (“SI”) has advised and directed the government’s investigation and
`
`prosecution of the Defendants from the outset. Given their extensive relationship with the
`
`FBI, Spamhaus and the SI function far more like state actors than private individuals.
`
`Indeed, this case is rooted in information provided by the SI to the FBI. At its inception,
`
`the SI notified Special Agent Chabalko that he was receiving “tons of information” from a
`
`Company A insider, believed to be CY, putting the government on notice that the
`
`information the SI relayed may be tainted. In fact, it was tainted because the SI was
`
`receiving stolen information and documents from CY, which included the Defendants’
`
`confidential emails. The Fourth Amendment is violated when a state actor conducts an
`
`unreasonable search or seizure, or when a private actor engages in such conduct with the
`
`government’s knowledge and acquiescence. Spamhaus and the SI are state actors because
`
`the government encouraged their illicit relationship with CY. The fruits of that union
`
`should be suppressed under the Fourth Amendment, warranting dismissal of this case. In
`
`the alternative, the Court should hold an evidentiary hearing to confirm the Fourth
`
`Amendment violation, and then a Kastigar hearing to determine the tainted leads and
`
`evidence that flowed from the Fourth Amendment violation.
`
`II. FACTUAL BACKGROUND
`
`A. Defendants’ Employment at Company A and B, and Their Reasonable
`Expectation of Privacy
`
`
`Defendants Jacob Bychak, Mark Manoogian, Mohammed Abdul Qayyum and Petr
`
`
`
`1
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4191 Page 9 of 34
`
`
`
`Pacas (collectively, “Defendants”) are former and current employees of Company A.1 The
`
`allegations in the Indictment are for conduct that allegedly occurred between December
`
`2010 through September 2014. Dkt. No. 1. The following addresses each defendant
`
`seriatim.
`
` On April 5, 2010, Jacob Bychak was hired by Company A as a marketing analyst.
`
`Declaration of Jacob Bychak (“Bychak Decl.”) at ¶ 1. Mr. Bychak later moved to the
`
`Operations team. Id. at ¶ 2. In June through September of 2011, the date of some of the
`
`purloined emails by CY, Jacob Bychak was Company A’s Business Operations Manager.
`
`Id. Between 2011 to 2014, during Mr. Bychak’s employment at Company A he was
`
`issued a laptop and a company email address. Id. at ¶ 3. He had a password to login to his
`
`laptop and a password to login to his email address. Id. He took his laptop home almost
`
`every evening and if he left it at his office, it was locked in his desk drawer. Id. at ¶ 4. Mr.
`
`Bychak used his laptop for work and personal use and occasionally used his company
`
`email address for non-company related emails. Id. at ¶ 5. During this time, Mr. Bychak
`
`was not aware of any policy in place that they monitored company email. Id. at ¶ 6. Based
`
`on these facts, Mr. Bychak had an expectation of privacy in his email address with
`
`Company A. Id. at ¶ 7.
`
`Mark Manoogian was hired by Company A in October 2011 as a Business
`
`Development Manager. Declaration of Mark Manoogian (“Manoogian Decl.”) at ¶ 1. He
`
`held this position through late 2014. Id. at ¶ 2. Mr. Manoogian was issued a company
`
`laptop and email address and he set separate passwords for his laptop and email that to his
`
`knowledge the company did not have access to. Id. at ¶ 3. Mr. Manoogian took his laptop
`
`home almost every night or kept it locked in his desk if it was left at the office. Id. at ¶ 4.
`
`He occasionally used his laptop for personal uses and his company email address for non-
`
`company related emails. Id. at ¶ 5. To his knowledge, he was not aware of any company
`
`policy to monitor his company email. Id. at ¶ 6. Based on these facts, Mr. Manoogian had
`
`
`1 Company A had two prior predecessor companies for which Defendants worked. For
`ease, this motion will refer to these predecessor companies as Company A.
`
`2
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4192 Page 10 of 34
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`an expectation of privacy in his email address with Company A. Id. at ¶ 7.
`
`
`
`Between 2011 to 2013, Mohammed Abdul Qayyum was an employee of Company
`
`A. Declaration of Mohammed Abdul Qayyum (“Qayyum Decl.”) at ¶ 2. He was issued a
`
`laptop and company email address from Company A. Mr. Qayyum had a password to log
`
`into his laptop and a separate password to log into his email. Id. at ¶¶ 2-3. Mr. Qayyum
`
`was not aware of any company policy that permitted Company A to monitor his email and
`
`Company A did not have his passwords. Id. at ¶ 5. Mr. Qayyum almost always had his
`
`laptop in his possession. Id. at ¶ 4. Based on these facts, Mr. Qayyum had an expectation
`
`of privacy in his email address with Company A. Id. at ¶ 6.
`
`10
`
`
`
`Lastly, in October 2006, Petr Pacas was hired by Company A as an employee.
`
`11
`
`12
`
`13
`
`Declaration of Petr Pacas (“Pacas Decl.”) at ¶ 2. In January 2009, Mr. Pacas rejoined
`
`Company A as a Director of Business Management. Id. at ¶ 3. In early 2011, Mr. Pacas
`
`was promoted to Director of Operations. Id. at ¶ 4. In May of 2011, Mr. Pacas left
`
`14
`
`Company A and went to work for Company B2 as VP of Operations until the company
`
`was purchased by Company A in September 2013, when he returned to Company A as VP
`
`of Operations. Id. at ¶¶ 5-6. While employed by Company A and B, Mr. Pacas was given
`
`a laptop and company email address, which he protected by passwords that were not
`
`shared with anyone. Id. at ¶¶ 7-10. Mr. Pacas was unaware of any policy at either
`
`Company A or Company B indicating that it monitored his email account or laptop
`
`computer, nor did he believe that Company A or Company B had the technical ability to
`
`do so. Id. at ¶¶ 8, 10. Further, Mr. Pacas always took his Company A and Company B
`
`laptop home at night, and when he traveled. Id. Based on these facts, Mr. Pacas believed
`
`his Company A and B email accounts and laptop computers were private and that no one
`
`could access their contents. Id. at ¶ 11.
`
`B. CY’s Employment at Company A and B and Theft of Documents and
`Information
`
`
`
`
`2 Company B was a separate company from Company A, but was partially owned by
`Company A’s former CEO Kim Perell.
`
`3
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4193 Page 11 of 34
`
`
`
`For a period of time in 2011, CY worked at Company A. Under Seal Declaration of
`
`Jessica C. Munk (“Munk Decl.”) at ¶ 2. On January 1, 2012, CY began employment at
`
`Company B. Munk Decl. at ¶ 3, Ex. 1.3 CY was Company B’s Chief Technology Officer.
`
`Id. at ¶ 1. CY’s employment agreement with Company B, prohibited the taking of
`
`documents and other information from Company B4 and specifically provided:
`
`You shall, during and after the Term hereof, keep in confidence and shall not
`use for you or others, other than in connection with the business or affairs of
`the Company, or divulge to others, any secret or confidential information,
`knowledge or data of the Company or of any clients of the Company
`obtained by you as a result of your engagement hereunder unless authorized
`by Company or required by law. The covenants set forth in this Paragraph
`shall survive the termination of this Agreement and termination of your
`employment.
`
`Id. at ¶ 16. CY’s employment agreement also included a Confidentiality Agreement
`
`that prohibited the disclosure of confidential information to any third party. Id. at
`
`Ex. A, ¶ 2, pp. 3294-95.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`
`
`As early as September of 2013, according to the SI, CY began sharing “tons of
`
`information” about Company A and Defendants with Spamhaus and the SI. Ex. 19. It has
`
`been determined that CY purloined at least eleven emails from Company A and B and
`
`gave them to the SI, who in turn, gave them to the FBI. See Exs. 2-12. The defense
`
`determined that CY provided these internal emails to SI who provided them to the FBI.
`
`See Dkt. No. 283-1, Declaration of AUSA Melanie Pierson (“Pierson Decl.”) at ¶¶ 3-4.
`
`Rather, the government appears to dispute the significance these emails had on its
`
`investigation and Indictment of this case. However, based on the SI’s early
`
`communications with the government, the SI made it clear to the FBI that he was
`
`receiving “tons of information” from a Company A insider believed to be CY, and as
`
`established infra, this was the same time the SI laid out this case for the government,
`
`
`3 All Exhibits are submitted under seal as attachments to the under seal Munk Decl.
`
`4 It is believed that Company A had a similar agreement with CY, but counsel for
`Company A has notified the defense they cannot locate this agreement. Munk Decl. at ¶ 3.
`
`4
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4194 Page 12 of 34
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`which appears to be based on information CY took from his employment at Company A
`
`and B.
`
`C. Background of Spamhaus and Its Agent the SI
`
`
`
`1. Spamhaus’ History of Cooperating with the Government
`
`Spamhaus was founded in 1998. Spamhaus touts itself as a member of the “Law
`
`Enforcement task force” that “works closely” with law enforcement agencies such as the
`
`FBI to “assist[] investigations into spam senders, phishing, botnets and malware
`
`operations, and compil[e] . . . evidence on spam gangs and spam operations.”5 In 2006,
`
`the FBI’s then Assistant Deputy of the Cyber Division testified before Congress that the
`
`10
`
`FBI planned “to combat the growing threat of cyber-crime” alongside the “Spamhaus
`
`11
`
`Project” and other organizations.6
`
`Spamhaus has historically undertaken significant investigative duties and key roles
`
`in FBI investigations. For example, in 2008, Spamhaus “made a listing for [an undercover
`
`FBI agent] as being a top spammer” in order to bolster the FBI agent’s credibility in a
`
`sting operation that led to the arrest of individuals associated with the “DarkMarket.”7 In
`
`2011, in connection with the arrest of individuals allegedly associated with a “cyber ring,”
`
`the FBI credited Spamhaus as one of its “private sector partners.”8 And, in 2015,
`
`Spamhaus again “partner[ed]” with the FBI to bring various charges, including wire fraud,
`
`against a defendant.9 Consistent with this pattern, the FBI in this case has acknowledged
`
`
`5 Spamhaus, About Spamhaus, https://www.spamhaus.org/organization/ (last visited
`February 10, 2022).
`
`6 See FBI, Testimony to House Committee on Small Business Regulatory Reform and
`Oversight Subcommittee, https://archives.fbi.gov/archives/news/testimony
`/small-business-cyber-security.
`7 See Elinor Mills, Q&A: FBI agent looks back on time posing as a cybercriminal, CNET
`Tech (June 29, 2009), https://www.cnet.com/tech/services-and-software/q-a-fbi-agent-
`looks-back-on-time-posing-as-a-cybercriminal/.
`8 See FBI, Operation Ghost Click, November 9, 2011, https://www.fbi.gov/news/
`stories/international-cyber-ring-that-infected-millions-of-computers-dismantled.
`9 Department of Justice, Bugat Botnet Administrator Arrested and Malware Disabled
`(October 13, 2015), https://www.justice.gov/opa/pr/bugat-botnet-administrator-arrested-
`and-malware-disabled (specifically identifying Spamhaus as a partner in the FBI’s
`investigation).
`
`5
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4195 Page 13 of 34
`
`
`
`that Spamhaus “works with law enforcement to identify and pursue spammers
`
`worldwide.” Ex. 20 at p. 1011 (emphasis added).
`
`2. SI’s History of Working with the Government
`
`
`
` The SI in this case has been employed by Spamhaus since 1995. Id. SI on
`
`numerous occasions has acted as a government informant to the FBI, and along with this
`
`case, is currently a Confidential Human Source (CHS) “for another field office of the
`
`FBI.” Dkt. No. 316-1, Declaration of Special Agent Charles Chabalko (“Chabalko Decl.”)
`
`at ¶ 13. The government has also made numerous representations to the Court that the SI
`
`is cooperating and acting as an informant in other matters. Ex. 13 at 8:24-9:3; Ex. 14 at
`
`7:22-8:1, 31:15-17.
`
`3. SI’s Direction and Assistance to the Government In This Case
`
`In 2013, the SI approached the Baltimore FBI with information about allegedly
`
`“hijacked” IP addresses, identifying Company A as a target for the FBI’s investigation
`
`and recommending the FBI bring charges under the CAN-SPAM Act. Ex. 15. The FBI’s
`
`302 Report referred to the SI as “S-00091118.” Id. at p. 980.
`
`On July 15, 2013, the SI sent the FBI a report identifying alleged hijacked
`
`netblocks by Company A, many of which are charged in the Indictment. Ex. 16 at pp. 982,
`
`984.
`
`In September 2013, the SI began receiving “a ton of information” from an
`
`anonymous informant believed by the SI to be CY. Ex. 19 at p. 3284.
`
`On October 18, 2013, the SI emailed the FBI a spreadsheet containing a list of
`
`alleged “hijacked IP blocks.” Ex. 17.
`
`In February 2014, the Baltimore FBI Field Office referred this investigation to the
`
`San Diego FBI Field Office after the SI indicated the targets of the investigation were
`
`located in San Diego. See Dkt. No. 316-1, Chabalko Decl. at ¶ 2.
`
`Over the following years, the SI continued to help the government build its case,
`
`supplying the FBI with information about Company A and Defendants, and helping to
`
`facilitate the government’s access to witnesses and evidence.
`
`6
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4196 Page 14 of 34
`
`
`
`a. SI’s Communications with the Government and Sharing of Information and
`Documents From CY
`
`Shortly after this investigation was transferred to San Diego, and before the FBI
`
`collected any “objective” evidence, the SI disclosed to the FBI that he was receiving a
`
`“ton of information” from an insider from Company A since September 2013, whom he
`
`believed to be CY. See Ex. 19 (emphasis added).
`
`On May 16, 2014,10 Special Agent Charles Chabalko (“Chabalko”) emailed the SI
`
`with his contact information and wrote: “[p]er our telephone conversation, … please send
`
`me any new information you have and I will contact you early next week … to discuss the
`
`case.” Ex. 18 at p. 3280. That same day the SI replied to Chabalko and gave him access to
`
`Spamhaus’ Law Enforcement Portal to search through their classified information. The SI
`
`also informed Chabalko that “[t]he guy at [Company A] that is arranging all the hijacks is
`
`Mark Manoogian … [i]f you can subpoena [him] you will find a goldmine of info.” Id.
`
`at pp. 3279-80 (emphasis added).
`
`On May, 22, 2014, the SI emailed Chabalko that he has “an anonymous informant
`
`sending us a ton of info since September 2013 … [h]e knows all the people we’ll be
`
`talking about and everything about [Company A’s] operations … [h]e would be a
`
`goldmine of information[,]” and stated he believed the informant was CY. Ex. 19 at p.
`
`3284 (emphasis added). Chabalko encouraged the SI to facilitate the government’s access
`
`to CY, explaining that “[t]his would be vital to our investigation” and asking, “would he
`
`be willing to meet with us?” Id. at p. 3283 (emphasis added). The SI inquired how to tell
`
`this “‘anonymous’ guy that there is an FBI investigation … [w]ithout tipping everyone
`
`off” and Chabalko recommended, “[t]here are things we can do … “[b]etter to have those
`
`discussions in person.” Id. (emphasis added).
`
`On June 2, 2014, Chabalko interviewed the SI, who laid out this case for the
`
`
`10 This is the first email between the SI and Agent Chabalko that the government has
`disclosed to the defense. Munk Decl., at ¶ 20.
`
`
`
`7
`DEFENDANTS’ MOTION TO SUPPRESS AND DISMISS UNDER THE FOURTH AMENDMENT
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`30
`
`31
`
`32
`
`

`

`Case 3:18-cr-04683-GPC Document 330-1 Filed 02/18/22 PageID.4197 Page 15 of 34
`
`
`
`government. Ex. 20. According to the 302 Report, Spamhaus “works with law
`
`enforcement to identify and pursue spammers worldwide.” Ex. 20 at p. 1011 (emphasis
`
`added). The SI explained Company A’s need for IP addresses and advised on the
`
`American Registry for Internet Numbers (“ARIN”) and pre-ARIN netblocks. Id. The SI
`
`provided a list of IPs alleged to be hijacked by Company A, including many that have
`
`been indicted in this case. Id. at pp. 1014-1015. The SI again discussed his anonymous
`
`informant he believed was CY and indicated “[t]his individual has intimate knowledge of
`
`[Company A’s] operations and of the hijacking of IPs … [and] [t]his [informant] has
`
`provided information that only a former employee would know.” Id. at p. 1016
`
`(emphasis added). During this interview, the SI provided the FBI with “numerous
`
`documents,” including a dossier of the individuals allegedly involved in this hijacking
`
`scheme. Id. at 1017; Ex. 21.11 It is clear the SI began sharing with the government
`
`information from CY before the FBI had collected any “objective” evidence to build its
`
`case.
`
`On June 3, 2014, Chabalko emailed the anonymous informant, using an alias “Jon
`
`Doe” with the email address, “therealspmrsofoc@gmail.com,” to see if he was interested
`
`in working with the FBI. Ex. 22. The informant inquired how the FBI would maintain his
`
`confide