Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4423 Page 1 of 7
`
`
`RANDY S. GROSSMAN
`United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No.: 18cr4683-GPC
`
`
`UNITED STATES’ FIRST
`
`Plaintiff,
`NOTICE OF EXPERT
`
`WITNESSES AND WITNESSES
`v.
`
`WITH EXPERTISE
`
`JACOB BYCHAK (1),
`MARK MANOOGIAN (2),
`ABDUL MOHAMMED QAYYUM (3), and
`PETR PACAS (4),
`
`
`Defendants.
`
`
`
`
`COMES NOW the plaintiff, United States of America, by and through its counsel,
`Randy S. Grossman, United States Attorney, and Assistant United States Attorneys
`Melanie K. Pierson, Sabrina L. Fève, and Computer Crime and Intellectual Property
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4424 Page 2 of 7
`
`
`Section Senior Counsel Candy Heath, and hereby files its First Notice of Expert Witnesses
`and Witnesses with Expertise.
`
`INTRODUCTION
`Pursuant to Rule 16(a)(1)(G) of the Federal Rules of Criminal Procedure and Federal
`Rules of Evidence 702, 703, and 705, the United States hereby provides notice of its intent
`to elicit the testimony during its case in chief of two subject matter expert witnesses:
`(1) Professor Jennifer Rexford and (2) Sandra Brown, who are qualified to testify as expert
`witnesses, and as witnesses with subject matter expertise. Copies of their curricula vitarum
`were provided to the defense on March 2, 2022. A summary of Professor Rexford’s and
`Ms. Brown’s backgrounds and proposed testimonies is set forth below. The United States
`reserves the right to offer additional testimony by these subject matter experts, and other
`such expert witnesses, pursuant to Federal Rules of Evidence 701 through 705, and for
`these subject matter experts to amend or adjust their opinions and bases therefor, based on
`information perceived by or made known to the experts before or during trial. Both
`Professor Rexford and Ms. Brown are appearing by virtue of a trial subpoena, and neither
`has been retained by the government.
`This case concerns complex, technological issues that are beyond the training and
`experience of a layman. The government expects that many of the fact witnesses who will
`testify during the trial will use terms and acronyms and discuss concepts that, without a
`proper context or explanation, will be confusing for the jury. The anticipated fact
`testimony regarding the acquiring, selling, registering, owning, transferring ownership,
`hijacking, and value of Internet Protocol (IP) netblocks (a block of IP addresses) is
`sufficiently beyond common experience, and thus requires explanation from witnesses
`with the subject matter expertise, such as Professor Rexford and Ms. Brown.
`A. Professor Jennifer Rexford
`Overview of Relevant Background
`Since February 2005, Professor Jennifer Rexford has been a full professor in the
`Computer Science Department at Princeton University, having earned a BSE degree in
`2
`
`
`Government’s First Notice of Experts and Witnesses
`with Expertise (Rexford/Brown)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4425 Page 3 of 7
`
`
`electrical engineering in 1991 from Princeton University, and MSE and PhD degrees in
`computer science and engineering in 1993 and 1996, respectively, from the University of
`Michigan. Her career includes working at and conducting research at the Naval Research
`Laboratory and the AT&T Bell Laboratories from 1986 through 2004. As documented in
`her 30-page curriculum vitae and highlighted on the Princeton University website’s faculty
`page http://www.cs.princeton.edu/~jrex, Professor Rexford’s subject matter expertise was
`developed and cultivated via her education, training, skills set, and real-life experiences
`regarding the Internet and computer networking. She is a prolific speaker and lecturer, and
`has authored and co-authored many publications and chapters within publications, to
`include:
`Web Protocols and Practice: HTTP/1.1, Networking Protocols, Caching, and
`Traffic Measurement, Addison-Wesley, May 2001;
`“Passive traffic measurement for IP operations,” pp. 91-120, The Internet as a
`Large-Scale Complex System, Oxford University Press, 2005;
`“BGP1 policies in ISP2 networks,” IEEE Network Magazine, special issue on
`interdomain routing, November/December 2005;
`“Cooperative content distribution and traffic engineering in an ISP network,” in
`Proc. ACM SIGMETRICS, June 2009;
`“A survey of BGP security issues and solutions,” in Proceedings of the IEEE,
`January 2010;
`“Identifying performance bottlenecks in CDN3s through TCP4-level monitoring,” in
`Proc. ACM SIGCOMM Workshop on Measurement Up the Stack, August 2011.
`
`
`1 “BGP” means border gateway protocol, which is the protocol that enables the Internet to
`exchange routing information between autonomous systems.
`2 “ISP” means Internet service provider.
`3 “CDN” means content delivery network, which is a highly distributed platform of servers
`providing essential functions of delivering content and minimizing delays in delivering
`content on the Internet.
`4 “TCP” means transmission control protocol, which is the protocol then ensures the
`reliable transmission of packets on the Internet.
`3
`Government’s First Notice of Experts and Witnesses
`
`with Expertise (Rexford/Brown)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4426 Page 4 of 7
`
`
`“The compositional architecture of the Internet,” in Communications of the ACM,
`March 2019; and
`“Securing Internet applications from routing attacks,” in Communications of the
`ACM, June 2021.
`
`Additionally, Professor Rexford has mentored and supervised dozens and dozens of
`Masters, PHD, and Post-doc students during her tenure at Princeton University, and has
`received innumerable recognition and honors over the years. Her technical and scientific
`expertise attracts regular invitations to present at, participate in, and provide leadership for
`various symposiums, conferences, committees, and advisory boards.
`
`Summary of Testimony
`
`Professor Rexford’s testimony, based on her scientific, technical, and specialized
`knowledge, will assist the jury by defining and explaining complex technical terms and
`concepts regarding the infrastructure of the Internet so that the jurors can understand the
`evidence presented and the testimony elicited during the trial. The government anticipates
`that Professor Rexford will define and explain certain concepts, terms, entities, and
`acronyms to include, but not limited to, the following: the Internet, Internet connectivity,
`Internet traffic, server, client, router, hop, IP address, netblock, ISP (Internet service
`provider), packets, DNS (dynamic name system), domain, website, URL (uniform resource
`locater), IPv4 (Internet protocol version 4), LOA (letter of authorization), web address,
`AS (autonomous system), ASN (autonomous name system), BGP (border gateway
`protocol), address block, ARIN (American Registry for Internet Numbers) and its foreign
`counterparts, SMTP (simple mail transfer protocol), WhoIs.com, TCP (transmission
`control protocol), and CDN (content delivery network). The government anticipates that
`it will use exhibits such as charts or diagrams or a PowerPoint presentation to assist in its
`presentation of Professor Rexford’s testimony. The government will produce these
`exhibits to the defense when prepared.
`All materials known to the government regarding Professor Rexford’s expertise is
`publicly available, and primarily can be found on the Princeton University website’s
`
`Government’s First Notice of Experts and Witnesses
`with Expertise (Rexford/Brown)
`
`4
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4427 Page 5 of 7
`
`
`faculty page. The government is unaware of any report prepared by Professor Rexford
`directly related to her anticipated testimony, nor has the government requested such a
`report.
`B. Sandra Brown
`Overview of Relevant Background
`IPv4 Market Group
`founder of
`Sandra Brown
`is
`the president and
`(https://ipv4marketgroup.com). Since its creation in May 2011, IPv4 Market Group has
`been a full-service broker of IPv4 netblocks, and specializes in IPv4 transfers from sellers
`to buyers in ARIN, RIPE, and APNIC regions. Prior to creating IPv4 Market Group, Ms.
`Brown worked as the Director of IT Engineering at Nortel Networks Corporation (Nortel)
`from January 2010 through May 2011. In May 2011 while at Nortel, Ms. Brown
`orchestrated the very first commercial transfer, a $7.5 million sale of 660,000 IPv4
`addresses from Nortel to Microsoft, which inspired the creation of IPv4 Market Group.
`Since that first commercial sale, Ms. Brown and IPv4 Market Group have completed over
`700 transfers of blocks of IP addresses. Ms. Brown obtained a BS degree in Computer
`Science in 1985 from the University of Toronto – New College, and an MBA in Business
`and Information Technology in 1992 from the University of Toronto – Rotman School of
`Management. Ms. Brown’s subject matter expertise was developed and cultivated via her
`education, training, and experience regarding the characteristics, marketability, and value
`of IP netblocks. The government has provided a copy of Ms. Brown’s CV to the defense
`in discovery.
`
`Summary of Testimony
`Ms. Brown will provide a brief history of IPv4 and the market for sales, purchases,
`and leases of IP addresses and netblocks. She will explain the practical and commercial
`aspects and industry standards of the market for IP addresses. Ms. Brown will define and
`explain additional terms and concepts to include, but not limited to RIR (regional Internet
`registry), IANA (Internet assigned numbers authority), and DNSBL (domain name system
`blacklists, such as Spamhaus, Sorbs, Barracuda, and Spamcop). Ms. Brown will discuss
`5
`
`
`Government’s First Notice of Experts and Witnesses
`with Expertise (Rexford/Brown)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4428 Page 6 of 7
`
`
`the industry standards for due diligence in examining the reputation of IP netblocks and
`the resources available to determine a netblock’s viability, that is, whether any of the IP
`addresses were blocked by commonly used blacklists, such as those used by Spamhaus and
`Spamcop. In the event that the transaction involves blacklisted IP addresses, Ms. Brown
`will discuss the industry standards and practices applicable and the process and procedures
`to clean or delist the IP addresses. Ms. Brown will discuss the differences in delegated,
`undelegated, allotted, legacy, historical, and pre-ARIN spaces.
`Ms. Brown will describe a typical transaction to sell, purchase, or lease an IP block,
`as well as the paperwork, time, and resources involved from the 2011-time frame to
`present-day. Ms. Brown will discuss the industry’s standards and practices at or near the
`dates of the transfers of the netblocks at issue in this case.
`Based on her extensive experience in brokering IPv4s and negotiating and
`consummating the sale, purchase, or lease of IP netblocks, the government anticipates she
`will testify that IP addresses are unique, can be sold, and the registered users and/or
`purchasers of IP addresses can have exclusive possession, use, and control. She will further
`testify that a sale of a block of IP addresses conveys the rights, title, and interest of the
`block, and IP addresses have value. Relying on her subject matter expertise, and
`considering the 700 transactions by IPv4 Market Group from 2011 to current-day, Brown
`will render opinions on the value of IP addresses and the factors affecting or influencing
`value during the times relevant to the conspiracy timeframe.
`All materials known to the government regarding Ms. Brown’s expertise is publicly
`available, and primarily can be
`found on or via her company’s website
`https://ipv4marketgroup.com, including a blog she hosts, which is available at
`https://ipv4marketgroup.com/blog/. The government is unaware of any report prepared by
`//
`//
`
`
`Government’s First Notice of Experts and Witnesses
`with Expertise (Rexford/Brown)
`
`6
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 340 Filed 03/10/22 PageID.4429 Page 7 of 7
`
`
`Ms. Brown directly related to her anticipated testimony, nor has the government requested
`such a report.
`
`DATED: March 10, 2022 Respectfully submitted,
`
`RANDY S. GROSSMAN
`United States Attorney
`
`/s/Melanie K. Pierson
`Assistant United States Attorney
`
`/s/Sabrina L. Fève
`Assistant United States Attorney
`
`/s/Candy Heath
`Senior Counsel
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`
`
`
`
`
`
`
`
`Government’s First Notice of Experts and Witnesses
`with Expertise (Rexford/Brown)
`
`7
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`