Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4360 Page 1 of 19
`
`
`
`RANDY S. GROSSMAN
`Acting United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No. 18cr4683-GPC
`
`
`UNITED STATES’ RESPONSE IN
`
`Plaintiff,
`OPPOSITION TO DEFENDANTS’
`
`MOTION TO SUPPRESS AND
`v.
`
`DISMISS UNDER THE FOURTH
`
`AMENDMENT AND REQUEST
`JACOB BYCHAK et. al.,
`FOR EVIDENTIARY HEARING
`
`
`Defendants.
`
`
`
`
`
`
`I.
`Introduction
`At the heart of defendants’ motion is the argument that the government conducted a
`warrantless search when CY obtained Company A and Company B emails (hereinafter “the
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4361 Page 2 of 19
`
`
`Eleven Emails”1) from his then-employer. All defendants lack standing to raise this Fourth
`Amendment challenge.
`Even if they had standing, to prevail, defendants must show that, at the time of the
`search, the private searcher (CY) acted at the direction or encouragement of the
`government. United States v. Sherwin, 529 F.2d 1, 6 (9th Cir. 1976) (en banc). It is
`undisputed, however, that CY left the employment of either Company A or Company B by
`July 2013 and that the Eleven Emails were sent between June 27, 2011, and May 29, 2013.2
`To prove a Fourth Amendment violation involving the Eleven Emails (which the
`government is not using in its case-in-chief), defendants must show that CY took the
`documents from Company A and Company B without authority, acting at the government’s
`direction or encouragement, at the time of the alleged search. To connect these dots,
`defendants posit that the Spamhaus Source (SS) directed or encouraged CY’s search and
`acted as a government informant at the time of the “search” in or before July 2013.
`The defense theory simply fails, chronologically, because CY acquired the Eleven
`Emails prior to July 2013, when his employment ended, at a time when his existence as a
`source of information and the existence of the Eleven Emails was unknown to either the
`FBI or Spamhaus. The uncontroverted documentary evidence demonstrates that CY
`contacted Spamhaus in September 2013, two months after he left his employment with
`Company B.3 The first notice to the FBI that CY existed and had been providing
`information to Spamhaus occurred in May 2014. It is impossible for the FBI to have
`directed someone to obtain documents for them when they didn’t even know of the
`person’s existence until nearly a year after the documents were obtained. The government’s
`
`1 The Eleven Emails were provided to the court by the Government, under seal, as Exhibits
`2-13, to ECF No. 283 (Gov. Resp. & Opp’n to the Defs’ Third Mot. for Disc’y of the
`Spamhaus Source, filed September 27, 2021).
`2 ECF No. 283, Ex. 3; Adconion-Disc02-Reports-00928. The government’s discovery
`citations reference the first page of the document and not the entire page range.
`3 ECF No. 295, Ex. 2 (SS May 2014 email to the FBI stating, “we’ve got an anonymous
`informant sending us a ton of info since September 2013” who “doesn’t know anything
`about THIS investigation”).
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`1
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4362 Page 3 of 19
`
`
`evidence demonstrates that although the FBI first attempted (unsuccessfully) to contact CY
`to obtain information on June 3, 2014, the FBI did not obtain the Eleven Emails that
`Spamhaus obtained from CY until October 12, 2017, and CY did not meet with the FBI
`until December 2017.4 Moreover, CY had an independent motive for contacting Spamhaus
`to provide his former employer’s records in September 2013 – namely, that his former boss
`had advised Spamhaus in September of 2013 that CY was to blame for spamming activities
`that Spamhaus had attributed to Company B. [ECF No. 295, Ex. 27.]
`Contrary to the defense theory, it is undisputed that although CY began providing
`information to Spamhaus in September of 2013, SS was first interviewed by the San Diego
`office of the FBI in June of 2104 and did not become a Confidential Human Source (CHS)
`for the FBI until October of 2018. Therefore, SS could not have been encouraged by the
`FBI to obtain internal Company A documents, much less the specific emails involved in
`this matter, prior to July of 2013, when CY obtained the Eleven Emails. SS has further
`consistently maintained that SS neither tasked CY to obtain documents, nor acted at the
`government’s request.5 Spamhaus itself also had an independent motive to collect and
`disclose such evidence, because the mission of Spamhaus is to eliminate all unsolicited
`commercial email, which essentially targets the very business of the defendants.
`II.
`Points And Authorities
`A. Each Defendant Lacks Standing to Challenge the Acquisition of the Eleven Emails
`The defendants’ motion fails as a preliminary matter based on a lack of standing.
`Each defendant can only challenge the admission of illegally-obtained evidence if that
`defendant can prove a personal violation of a legitimate expectation of privacy.6 United
`
`
`4 Adconion-Disc39-01779, Adconion-Disc02-Reports-00928, ECF No. 295, Exs. 13 & 14.
`5 See, e.g., ECF 295, Ex. 21 (SS August 2021 email stating that the “FBI never requested
`that [CY] or Spamhaus needed to do anything. . . Spamhaus does not act under the direction
`of the FBI or any other government agency”).
`6 The government notes here that the Fourth Amendment does not protect against
`unreasonable intrusions by private parties, which further cripples the defense’s arguments.
`2
`Government’s Response to Defendants’ Motion to Suppress
`18cr4683-GPC
`
`And Dismiss Indictment Under the Fourth Amendment
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4363 Page 4 of 19
`
`
`States v. SDI Future Health Inc, 568 F.3d 684, 695 (9th Cir. 2009). To the extent that the
`Eleven Emails involved any defendant, it was in that defendant’s business, rather than
`personal, capacity. “Property used for commercial purposes is treated differently for Fourth
`Amendment purposes from residential property.” Id. (citation omitted). In this vein, “an
`employee of a corporation, whether worker or manager, does not, simply by virtue of his
`status as such, acquire Fourth Amendment standing with respect to company” property.
`Id. at 696. In SDI, the Ninth Circuit distinguished the reasonable expectation of privacy in
`company property possessed by owners of a small family-run business that, at its peak,
`employed only 25 employees, versus that of employees of a large company. In this case,
`Company A, which was at varying times either a multinational UK corporation or, later, a
`multinational Singapore corporation, would be considered a large company under SDI, so
`defendants, as its non-executive employees, would have a diminished expectation of
`privacy in their business emails.
`The crux of the defense’s complaint is that a prior co-worker, CY, shared7 his own
`Company A and Company B emails8 with Spamhaus, and that Spamhaus, through SS,
`provided those eleven emails to the FBI in violation of the Fourth Amendment. The defense
`fails to provide any relevant facts or caselaw supporting each individual defendant’s
`standing to challenge CY’s alleged “search” of work emails sent to or received by CY.
`The cases cited by the defense regarding standing are not persuasive, as none address
`the acquisition and possession of workplace emails by a private party who was a sender or
`
`
`Walter v. United States, 447 U.S. 649 (1980), United States v. Reed, 15 F.3d 928, 931 (9th
`Cir. 1994).
`
` 7
`
` The defense uses multiple terms to include “stolen” and “purloined.” Either definition
`relies on a wrongfully appropriation of the property in question. In this case, it is undisputed
`that as an employee, CY was assigned a company email account, and during his
`employment with the company, was allowed to access and use his company email account
`to send and receive emails.
`8 The defense also complains that CY shared or stole “information.” This issue will be
`discussed later in the response.
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`3
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4364 Page 5 of 19
`
`
`recipient of the emails. Caselaw distinguishes the privacy expectations differently in a
`commercial workplace compared to a residence. New York v. Burger, 482 U.S. 691, 700,
`(1987) (“An expectation of privacy in commercial premises ... is different from, and indeed
`less than, a similar expectation in an individual’s home.”). The physical items challenged
`by the defense consist of nine Company A emails and two Company B emails. To establish
`standing, the defense must prove that physical evidentiary items (these eleven emails) were
`illegally obtained, that the violation was personal to the defendant-at-issue, and that the
`defendant-at-issue held an actual subjective expectation of privacy that also was
`objectively reasonable.
`The Ninth Circuit in SDI discussed at length the test necessary to prove that physical
`evidence was illegally taken from a place of business in violation of an employee’s
`legitimate expectation of privacy.9 To establish a personal connection to assert standing,
`each defendant needs to show:
`(1) whether the item seized is personal property or otherwise kept in a private place
`separate from other work-related material; (2) whether the defendant had custody or
`immediate control of the item when [it was seized]; and (3) whether the defendant
`took precautions on his own behalf to secure the place searched or things seized from
`any interference without his authorization. Absent such a personal connection or
`exclusive use, a defendant cannot establish standing for Fourth Amendment
`purposes to challenge the search of a workplace beyond his internal office.
`SDI, 568 F.3d at 1257 (citing United States v. Anderson, 154 F.3d 1225, 1230-32 (10th Cir.
`1998)). “[A]n individual challenging a search of workplace areas beyond his own internal
`office must generally show some personal connection to the places searched and the
`materials seized.” SDI, 568 F.3d at 1257.
`As to the first prong of the test, no defendant can say that even one of the Eleven
`Emails was his “personal property” or kept in a “private place” under his exclusive control.
`
`
`9 Although the defense’s motions and the defendants’ declarations discuss the defendants’
`work-issued laptops and their access to their company emails from that laptop, the defense
`never contends that their co-worker CY acquired the eleven emails from any of the
`defendants’ laptops.
`
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`4
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4365 Page 6 of 19
`
`
`It is undisputed that a third-party email provider, Intermedia, hosted Company A’s email
`system, as documented in the warrants to search defendant Manoogian and other
`employees’ Company A email accounts. [ECF No. 330-1, pp.16-17, 22, Ex. 26 & 34.]
`Company A and Company B issued defendants their corporate email accounts and thus had
`custody, control, and ownership of the emails the defendants sent and received from these
`accounts, as evidenced by the thousands of emails to and from the defendants that
`Company A and Company B produced in response to grand jury subpoenas (which
`defendants have received in discovery). Perhaps to avoid acknowledging their individual
`lack of control over the computers that hosted and operated their employee email systems,
`the defense does not identify where they claim the supposed “illegal search” occurred.
`Defendants also do not address the fact that, during his employment, CY, as defendants’
`coworker at Company A and B, would have had the same access to Company A and
`Company B emails stored on his work-issued computer or laptop Thus, the Eleven Emails
`were not kept in a private place controlled by any of the four defendants and CY could
`readily access emails in which he was a party during his employment with each company.
`As to the second prong, defendants cannot claim exclusive control of the eleven
`emails. While the defendants imply they had copies of the Eleven Emails on their work-
`issued laptops at the time of CY’s alleged “seizure,” any work emails would have also had
`to exist in locations controlled by Company A and Company B, such as on any sender or
`receiver’s company-issued laptop or computer, and definitely on the third-party provider’s
`system. Absent this storage on a centralized mail server, the FBI would not have been able
`to search and seize evidence from the Company A email accounts assigned to defendant
`Manoogian and other Company A employees, nor would either Company A or Company
`B have been able to search its employees’ email records for materials responsive to the
`grand jury’s subpoenas. Finally, CY’s receipt and possession of the Eleven Emails belies
`any defendant’s claim to exclusivity.
`As to the final prong, defendants cannot claim they “secured” CY’s computer or the
`third-party provider’s system. Logically, since the defendants did not have exclusive
`5
`
`
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4366 Page 7 of 19
`
`
`possession of these Eleven Emails, they could never “secure” them. Rather, once again,
`Company A’s and Company B’s production of thousands of employee emails shows that
`Company A and Company B maintained custody, control, and ownership of their
`employees’ emails at all relevant times. Ultimately, these facts show that the emails
`belonged to Company A and Company B, and the defendants cannot vicariously assert
`their employers’ Fourth Amendment rights. Rakas v. Illinois, 439 U.S. 128, 134 (1978).
`A deeper dive into the Eleven Emails further reveals that each defendant was not a
`party to all Eleven Emails. In fact, as admitted in the defense brief, Manoogian was not an
`identified party to any of the Eleven Emails. [ECF No. 330-1, FN 16].10 A review of the
`headers of the Eleven Emails reveals that Bychak specifically was identified in seven
`Company A emails, Qayyam specifically was identified in two Company A emails (which
`also included Bychak), and Pacas was the only defendant identified in the two Company B
`emails. Thus, the defense’s broad sweeping claim of “standing” is fatally flawed.
`At the same time, CY was specifically named in seven of the Eleven Emails and was
`likely a party to email groups that were copied on two others. The remaining two emails
`begin not with a traditional header but instead with the phrase “[part of a message reply],”
`indicating that there is more to the email than was transmitted. Based on other emails
`provided by Company A, it appears that CY was a part of the ensuing email thread.11
`Moreover, an email dated June 28, 2011, sent to all employees in the San Diego area, had
`an attachment listing dozens of email addresses (for example, kevin@CompanyA.com)
`and providing the password for these accounts. The practice of sharing passwords with
`
`
`to
`received Company A emails addressed
`10 Defendants may have also
`rdd@CompanyA.com, sdoperation@CompanyA.com, and adsdall@CompanyA.com.
`Additionally, Manoogian’s name does not even appear in a Company B Employee List
`provided in discovery. [Company B Employee List dated September 24, 2016, which listed
`the start and end dates of each employee (ADCONION-DISC03, TEL00001780.]
`11 AMOBEE 1356819 relates to the email of Aug. 18, 2011 and AMOBEE 11278519-
`1278530 relates to the email dated July 21, 2011.
`6
`
`
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4367 Page 8 of 19
`
`
`everyone in the office is inconsistent with a subjective belief in an expectation of privacy
`in one’s work emails.12
`Although each defendant submitted a declaration claiming a subjective expectation
`of privacy in the Eleven Emails, their contention really focused on a claim of privacy in
`their laptops. Since the record is devoid of any allegation that (1) CY accessed each
`defendant’s laptop without authorization, or (2) the emails acquired by CY were “personal”
`to the defendants, or (3) the defendants have standing to challenge a search of the
`company’s email system or of CY’s laptop, the defendants’ declarations fail to meet the
`legal threshold of a subjective expectation of privacy. While a password on a computer and
`a lock on a door may give rise to a subjective expectation of privacy in a computer or an
`office or room, that is not the situation here. The company emails belong to the company.
`A review of the employment agreements for Pacas and Bychak, (AMOBEE1263348,
`AMOBEE1263375), demonstrates that Company B considers all “company materials” to
`be the sole property of the company. Business communications such as emails are
`conventionally included in Company B’s definition of “company materials.” Also, in a
`2011 Company A employment agreement,13 Company A declared that “All E-Mail-
`Accounts provided by the company should only be used for business purposes,” and that
`the company “conducts continuous ongoing computer tracking surveillance of its staff and
`reserves the right to examine the Employee's use of the Internet, including email, at any
`time.” The agreement continues, “[t]he Employee consents to this surveillance.”
`B. The Defendants Have Not Articulated a Basis to Challenge the “Information” and
`Other “Documents” Referenced
`The defense spends an inordinate amount of time complaining about the
`“information” that SS provided to the FBI, speculating that some of the “information” may
`have come from CY. The defense fails to describe with specificity this “information;”
`
`
`12 The list did not include the email addresses of the individual defendants in this case.
`13 Company A employment agreement dated May 2011, AMOBEE1257031, paras. 24.4
`and 24.6, which involves an employee at a non-U.S. office.
`7
`Government’s Response to Defendants’ Motion to Suppress
`
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4368 Page 9 of 19
`
`
`where, how, or from whom the “information” originated; or, for that matter, how such
`“information” could have been unlawfully obtained. It appears these references to
`“information” are separate and distinct from the physical items referenced (the Eleven
`Emails) and instead relate to verbal or articulated “information” speculated to have passed
`from CY to SS to the FBI, without explaining how such verbal “information” is afforded
`protection under the Fourth Amendment. The Fourth Amendment protects “the right of the
`people to be secure in their person, house, paper or effects, against unreasonable search
`and seizure.” The defendants have failed to identify any items allegedly seized besides the
`Eleven Emails.
`Information, such as facts provided by an informant based on the informant’s
`personal observations, experiences, or knowledge, do not implicate the Fourth Amendment
`and are not subject to suppression for a violation thereof. Informants, more often than not,
`provide inside information to law enforcement about a person or an organization based on
`the informant’s relationship with or knowledge of that person or organization. A private
`individual’s observations or knowledge about the activities of those engaged in criminal
`activities neither constitutes a search nor a seizure, when not acting at the direction of the
`government. Thus, during his employment with both companies and dealings with the
`defendants, CY acquired knowledge. His acquisition of this knowledge in no way
`constitutes a “theft” of, or a search or a seizure of “information.”
`C. The Defendants Lack Any Expectation of Privacy Under the Invited Informant
`Doctrine.
`Even if Spamhaus, SS, or CY were government agents, their acquisition of
`“information” about Company A, Company B, and the defendants, still would not
`constitute a search under the invited informer or misplaced confidence doctrines. The Ninth
`Circuit recently summarized the lack of Fourth Amendment protections under the invited
`informer doctrine:
`Under the appropriate Fourth Amendment precepts, “[u]ndercover operations, in
`which the agent is a so-called ‘invited informer,’ are not ‘searches’ under the Fourth
`Amendment.” “[A] defendant generally has no privacy interest”—not merely an
`
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`8
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4369 Page 10 of 19
`
`
`unreasonable privacy interest—“in that which he voluntarily reveals to a government
`agent.” In other words, use of a government informant under the invited informer
`doctrine—even if not in good faith in the First Amendment sense—does not
`implicate the privacy interests protected by the Fourth Amendment.
`Fazaga v. Federal Bureau of Investigation, 965 F.3d 1015, 1033-34 (9th Cir. 2020) (cert
`granted on other grounds 141 S.Ct. 2720, U.S., June 7, 2021) (a defendant does not have
`any privacy expectations in communications recorded by a government informant)
`(internal citations omitted). In United States v. Aguilar, 883 F.2d 662, 703 (9th Cir. 1989)
`(superseded on other grounds by statute), the Supreme Court opined that a person does not
`have an expectation of privacy or confidentiality in his or her conversations or dealings
`with an invited informer, regardless of the location of those conversations or dealings.
`
`In United States v. Wahchumwah, 710 F. 3d 862 (9th Cir. 2013), the Ninth Circuit
`found that the defendant’s Fourth Amendment rights were not violated by the use of a
`buttonhole camera by an undercover agent in the defendant’s home, under the invited
`informant doctrine. The court noted that the camera, which recorded the events in the
`home, observed nothing more than the undercover agent himself, who had been invited
`into the home by the defendant to make an undercover purchase of Golden eagle feathers.
`Similar to Wahchumwah, CY was invited into the workplace by his employers, and the
`Eleven Emails were nothing more than he could observe with his own eyes, while on the
`premises. The defendants therefore cannot claim a legitimate expectation of privacy in the
`Eleven Emails, nor identify additional “information” they claim CY provided or obtained
`in violation of the Fourth Amendment. Smith v. Maryland, 442 U.S. 735, 743–44 (1979).
`D. Spamhaus, SS, and CY Are Not Agents of the Government
`The defense bears the burden to establish government involvement in a seizure made
`by a private party. See United States v. Snowadzki, 723 F.2d 1427, 1429 (9th Cir. 1984).
`The defense asks the court to find Spamhaus to be a “state actor,”14 and then to find SS to
`
`
`14 In United States constitutional law, a “state actor” is a person acting on behalf of the
`government, and subject to certain Constitutional limitations. Quirarte v United Domestic
`Workers, 438 F.Supp.3d 1108, 1117 (S.D.Cal. 2020) provides a detailed discussion of the
`9
`Government’s Response to Defendants’ Motion to Suppress
`18cr4683-GPC
`
`And Dismiss Indictment Under the Fourth Amendment
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4370 Page 11 of 19
`
`
`•
`•
`•
`•
`
`be a “state actor,” and then to infer that CY must also be a “state actor.” [ECF 330-1, pp.
`8, 21-22, 25-26]. Only by achieving a trifecta of “state actors” can the defense confuse
`CY’s legitimate acquisition and possession of CY’s own company emails with some sort
`of illegal search or seizure. Chronologically, the defense’s attempted trifecta fails. CY’s
`legitimate acquisition and possession of the eleven emails occurred well before any “state
`actor” activity could have occurred:
`Nine of the Eleven Emails are Company A emails, and they were dated between
`•
`June and September 2011.
`In or around September 2011,15 CY left the employ of Company A.
`The two Company B emails within the Eleven Emails were dated in May of 2013.
`In July 2013, CY left the employ of Company B.16
`In September 2013, Company B told Spamhaus that CY was responsible for
`alleged Company B spamming and CY, in turn, contacted Spamhaus to provide
`information about Companies A and B. [ECF No. 295, Exs. 2 & 27.]
`In February 2014, San Diego FBI opened its investigation into Company A.
`In May and June 2014,17 SS advised San Diego FBI (by email and in person,
`respectively)
`that Spamhaus had an anonymous
`informant providing
`“information.” SS also provided Spamhaus business records, open-source data,
`and technical explanations of that data to assist the FBI.
`In June of 2014, the FBI tried to contact the anonymous informant providing
`information to Spamhaus and was unsuccessful in obtaining information.
`
`•
`•
`
`•
`
`
`tests used to determine what conduct constitutes a state action. However, in this case, the
`government believes the defense really means “an agent of the government.”
`15 Date is from the FBI 302 of interview of CY on December 13, 2017, ADCONION-
`DISC02-REPORTS-00928-32.
`16 Date is from the Company B Employee List, identifying start and end dates.
`ADCONION-DISC03, TEL0000178.
`17 FBI SA Chalbalko first met and interviewed SS in June 2014. [FBI Supplemental
`Affidavit, ECF No. 231, p.1].
`Government’s Response to Defendants’ Motion to Suppress
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`10
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4371 Page 12 of 19
`
`
`•
`
`•
`
`On December 28, 2014, SS received the Eleven Emails from CY. [AMOBEE-
`DISC 42-00010.]
`On September 27, 2017, SS first advised the FBI that SS possessed some emails
`SS received from an anonymous informant, believed by SS to be CY.18
`In October of 2018, SS became a CHS for the FBI.
`The record indicates that CY acquired the eleven Company A and B emails during
`CY’s employment at each company (2011 and 2013), well before CY contacted SS, and
`years before SS advised the FBI that the emails existed. The timing of CY’s acquisition of
`the eleven emails eliminates any possibility that CY was an agent of the government or
`“deputized” by the case agent to act when CY acquired the eleven emails. Assuming that
`CY’s legitimate acquisition of the eleven emails constituted a search by a private party,
`“once a private search is completed, the subsequent involvement of government agents
`does not retroactively transform the original intrusion into a government search.” United
`States v. Veatch, 674 F.2d 1217, 1222 (9th Cir. 1982) (quoting United States v. Sherwin,
`539 F.2d 1, 6 (9th Cir. 1976) (en banc)).
`To support its flawed contention that Spamhaus is a “state actor,” the defense
`compares Spamhaus to the National Center for Missing and Exploited Children (NCMEC).
`NCMEC, a U.S. entity that was created by Congress in 1984, was reauthorized in 2013
`with $40 million in U.S. government funding. NCMEC is mandated by federal statutes,
`specifically 18 U.S.C. § 2258A and 34 U.S.C. § 11293, to collaborate with U.S. law
`enforcement. NCMEC is required to forward its information to law enforcement and
`thereby relies on law enforcement to locate and stop offenders.
`Spamhaus, on the other hand, was founded in 1998 in London, England as a private
`non-profit organization dedicated to fighting email spam and “related cyber threats such as
`
`•
`
`
`18 On October 12, 2017, SS sent the FBI a zip file titled “Interesting emails.zip.” On
`November 8, 2018, SS again sent the zip file “Interesting Emails Fixed.zip,” as a repaired
`version of the previously sent zip file. [FBI Supplemental Affidavit, ECF No. 321, p.1-2].
`11
`Government’s Response to Defendants’ Motion to Suppress
`18cr4683-GPC
`
`And Dismiss Indictment Under the Fourth Amendment
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4372 Page 13 of 19
`
`
`phishing, malware, and botnets.”19 Currently located and registered as a Not-For-Profit
`Limited Liability company in Andorra, Spamhaus does not receive income or generate
`profits, does not receive money from the U.S. government, does not have customers, and
`is not involved in commerce.20 Spamhaus’ mission is simple, that is to track and report
`accurate information regarding spam and related cyber threats.21 Spamhaus then offers this
`data free to the public, including to ISPs, government and military organizations, security
`vendors, private corporations, academia, and private industry worldwide.22
`To fulfill its mission, Spamhaus staff and the Spamhaus systems compile data to
`include the IP addresses associated with the sending of spam, and the entities controlling,
`using, or owning those IP addresses. Spamhaus’ publicly available databases serve to
`protect over 3 billion23 user mailboxes in over 18 countries.24 Spamhaus’ DNSBL
`databases (Domain Naming System-based Block Lists) provide real-time listings of
`domains or IP addresses which have been used for purposes to send spam in disregard to
`Spamhaus policy. Spamhaus Advisories consist of more focused databases, which identify
`domains or IP addresses involved in sending spam, injecting exploits, phishing, or violating
`Spamhaus policy. The SBL (Spamhaus Block List) Advisory is a database of known or
`verified spam sources, i.e. IP addresses that violate Spamhaus’ policy for acceptance of
`
`
`19 https://www.spamhaus.org/organization/.
`20 https://www.spamhaus.org/organization/statement/013/popular-myths-about-spamhaus.
`21 https://www.spamhaus.org/organization/. Spamhaus was created seven years before the
`CAN-SPAM Act was passed (in 2003), and thus, Spamhaus’ mission and operations are
`neither reliant on nor directed by any U.S. law.
`22 https://en.wikipedia.org/wiki/The_Spamhaus_Project;
`https://www.spamhaus.org/organization/.
`23 This figure is as of October 2021.
`24 https://www.spamhaus.org/organization/.
`12
`Government’s Response to Defendants’ Motion to Suppress
`
`And Dismiss Indictment Under the Fourth Amendment
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 337 Filed 03/04/22 PageID.4373 Pa