Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4436 Page 1 of 7
`
`
`RANDY S. GROSSMAN
`United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No.: 18cr4683-GPC
`
`
`UNITED STATES’ THIRD
`
`Plaintiff,
`NOTICE OF POTENTIAL
`
`EXPERT WITNESSES
`v.
`
`
`JACOB BYCHAK (1),
`MARK MANOOGIAN (2),
`ABDUL MOHAMMED QAYYUM (3), and
`PETR PACAS (4),
`
`
`Defendants.
`
`COMES NOW the plaintiff, United States of America, by and through its counsel,
`Randy S. Grossman, United States Attorney, and Assistant United States Attorneys
`Melanie K. Pierson, Sabrina L. Fève, and Computer Crime and Intellectual Property
`Section Senior Counsel Candy Heath, and hereby files its Third Notice of Potential Expert
`Witnesses.
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4437 Page 2 of 7
`
`
`INTRODUCTION
`Pursuant to Rule 16(a)(1)(G) of the Federal Rules of Criminal Procedure and Federal
`Rules of Evidence 702, 703, and 705, the United States hereby provides notice of its intent
`to elicit the testimony during its case-in-chief of several individuals related to various
`aspects of their employment. Although they will not be asked to render an opinion, because
`they possess specialized knowledge, in an abundance of caution, their expected testimony
`is summarized herein. The United States anticipates that most of these witnesses will offer
`testimony akin to that of a custodian of records, explaining how their business’s records
`were prepared, maintained, and interpreted by the business. The United States reserves the
`right to offer additional testimony by these witnesses, or other expert witnesses, pursuant
`to Federal Rules of Evidence 701 through 705, and for these witnesses to amend or adjust
`their testimony, based on information perceived by or made known to them before or
`during trial.
`A. John Curran
`John Curran is the President and CEO of the American Registry of Internet Numbers
`(ARIN). A copy of his curriculum vitae was provided to the defense in discovery on March
`10, 2022, and a copy of his sworn declaration was provided to the defense via ECF on July
`10, 2019. Mr. Curran is a recognized expert on Internet and telecommunications matters
`and has been the Chief Technology Officer of three successful Internet companies:
`BBN/GTE-Internetworking, XO Communications, and ServerVault Corporation. Mr.
`Curran led development of several early Internet research networks and provided technical
`leadership to BBN’s transition to commercial Internet services. He has been an active
`participant in the Internet Engineering Task Force (IETF), having both co-chaired the IETF
`Operations and Network Management Area and served as a member of the IPng (IPv6)
`Directorate.
`Since April 2009, Mr. Curran has served as the President and CEO of ARIN. As
`CEO, Mr. Curran appoints and supervises all ARIN operational staff, serves on the ARIN
`Board of Trustees as a non-elected, full-voting member, advises all other ARIN officers
`2
`
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4438 Page 3 of 7
`
`
`and trustees, serves as an ex-officio member of ARIN’s Advisory Council, and acts as a
`liaison between ARIN’s Board of Trustees and Advisory Council. Mr. Curran is a founding
`member of the ARIN Board of Trustees, having served since August 1997. He was re-
`elected in 2000, 2003, and again in October 2006, and served as Chairman of the Board of
`Trustees from inception through early 2009.
`Additional details about Mr. Curran can be found in his CV, which has been
`produced
`in discovery, and on his official ARIN biography, available at
`https://www.arin.net/about/welcome/board/#curran. Mr. Curran also publishes comments
`on ARIN and issues of Internet governance on ARIN’s website. A collection of his blog
`posts is available at https://www.arin.net/blog/author/john-curran/. The government has
`also previously provided copies of and links to Mr. Curran’s statements regarding the issue
`of IP address registrants’ property rights in its responses to defendants’ motions to dismiss
`the wire fraud counts. See, e.g., ECF No. 176-1, Exs. C-E.
`
`The government anticipates that Mr. Curran will testify regarding the history and
`purpose of ARIN and its predecessors-in-interest, as well as the creation and role of the
`Internet Corporation for Assigned Names and Numbers (ICANN) and the other Regional
`Internet Registries (RIRs). Curran will further testify regarding the services offered by
`ARIN and the RIRs, including their management of registry services that identify to the
`public the parties that have been assigned the rights to specific Internet number resources,
`including WHOIS and SWIPs. Curran will explain how ARIN and its predecessors
`allocated rights to IP addresses, and how IP address registrants can transfer their rights in
`IP addresses, including through sales. Curran will provide testimony regarding the
`registrants recognized by ARIN’s current and historical registry records for the IP
`addresses acquired by defendants through Daniel Dye and GetAds (the “GetAds IPs”), and
`will testify that none of the defendants were listed in ARIN’s databases as the authorized
`registrants of, or otherwise affiliated with, the IP addresses that they fraudulently acquired
`and arranged to use. The government has produced in discovery registry records obtained
`from ARIN for the GetAds-related IPs.
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`3
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4439 Page 4 of 7
`
`
`B. Sean Zadig
`Mr. Zadig is the Chief Information Security Officer (CISO) at Yahoo, whose brands
`include Yahoo, AOL, TechCrunch, Verizon Media Platforms, and others. Prior to
`becoming Yahoo’s CISO, Mr. Zadig served as the company’s Vice President, Cyber
`Defense, and, before that, as a Director of Threat Operations and a Senior Manager of E-
`Crime Investigations. Prior to joining Yahoo, Mr. Zadig was a Trust & Safety Investigator
`for Google and a Special Agent with NASA’s Office of the Inspector General Computer
`Crimes Division. Mr. Zadig has taught computer forensics and digital investigations as an
`Adjunct Assistant Professor at the University of Maryland. Mr. Zadig is a Certified
`Computer Examiner as well as a Certified Information Systems Security Practitioner.
`Additional details can be found on his CV, which has been produced in discovery.
`The government anticipates that Mr. Zadig will testify regarding Yahoo’s webmail
`service, how Yahoo handles commercial email messages commonly referred to as “spam,”
`techniques that email marketers use to bypass Yahoo’s spam filter, how spam affects
`Yahoo’s business, how hijacked IPs affect Yahoo’s business, and Yahoo’s experience in
`2013 and 2014 with spam sent by defendants’ then-employer. Spam email headers for
`commercial email messages sent from defendants’ employer to Yahoo webmail addresses
`that Yahoo provided to the government have previously been produced in discovery, as
`have internal Company A BlackMail reports documenting Company A’s sending millions
`of commercial email messages to Yahoo mail addresses. The government has also
`produced the FBI 302s documenting its contacts with Mr. Zadig regarding this case, along
`with a September 11, 2018 email received by the FBI from Mr. Zadig.
`C. Michael Ward
`Mr. Ward obtained a Bachelor of Science degree in Computer Science in 1990 from
`Western Carolina University. Thereafter, he was employed as a network engineer,
`designing and managing internet network security and connectivity architecture. From
`2007 through April of 2018, he was employed in various capacities at ViaWest,Inc., rising
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`4
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4440 Page 5 of 7
`
`
`to Director of Network Service in December of 2015. ViaWest operated data centers with
`computer servers to support the needs of its clients.
`From 2007 through December of 2015, Mr. West held the position of Senior Staff
`Network Architect at ViaWest. In that position, he established policies and standards for
`network services. It is anticipated that he will discuss how companies like ViaWest with
`autonomous system numbers (ASNs) connect IP addresses to internet service providers
`(ISPs), and also explain the relationship between ViaWest and Broadcloud. It is further
`expected that he will explain the process of “announcing” IP addresses, and the content
`and purpose of a Letter of Authorization (LOA) in that process.
`Ward will testify that in February of 2013, he rejected a request from the defendants,
`via Broadcloud, to add the announcement of IP netblock 163.253.0.0/16 (Sura.net) to the
`ViaWest system, due to deficiencies in the LOA. Specifically, Ward noted that the LOA
`was not on the owner’s company letterhead, did not include the associated Autonomous
`System Number (ASN) for advertisement, the organization listed on the American Registry
`of Internet Numbers (ARIN) was different than that on the LOA and the IP block owner in
`the ARIN database had not been validated by ARIN for over two years. It is anticipated
`that Ward will testify that he requested changes in the LOA before the netblock would be
`announced on the ViaWest network to protect the integrity of the ViaWest network.
`D. Ried Zulager
`Mr. Zulager received his PhD.in History in 1992 from the University of Aberdeen,
`and thereafter was employed in the telecommunications industry. He has been employed
`by Cogent Communications Holdings, Inc. since 2002, and currently holds the position of
`Corporate Secretary. Cogent is one of the world’s largest internet services providers,
`servicing primarily two customer segments: (1) corporate, and (2) netcentric. Netcentric
`customers are carriers, service providers and application or content providers whose
`businesses rely primarily on internet access.
`It is anticipated that Mr. Zulager will testify that Cogent provided netcentric services
`for Vincent Tarney of the Mata Group. Cogent received several LOAs from the defendants
`5
`
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4441 Page 6 of 7
`
`
`via Tarney and the Mata Group seeking to announce various netblocks, including
`151.192.192/18
`(SierraSemi),
`168.129.192.0/18
`(OpenBusinessSytems),
`and
`142.147.0.0/16 (CanadaAir). On April 3, 2013, Cogent sent a message to the Mata Group,
`advising that the SierraSemi netblock had been listed on the Spamhaus Block List as
`hijacked, and Cogent removed the announcement the same day. The government
`anticipates that Mr. Zulager will testify that the announcement was removed to maintain
`the integrity and security of the Cogent network.
`E. Peter Holden
`Mr. Holden has been the owner and CEO of Hostwinds since October of 2010.
`Hostwinds provides hosting services for its clients, which have included Company A.
`Hostwinds announced various netblocks for the defendants, and received accompanying
`LOAs,
`including 163.253.0.0/16
`(Sura.net), 63.79.40.0/21
`(TrinityMicro.com),
`165.192.0.0/16 (ECT.net), 167.87.0.0/16 (MooreSolutions.com), 207.152.0.0/18 and
`207.234.0.0/17 (Telalink.net), 208.199.68.0/23 (Paxny.com), and 196.193.0.0/16 (AirSea
`Freight Services). To the extent that the government anticipates that Mr. Holden will
`testify to matters potentially involving specialized knowledge, this testimony will likely
`involve Mr. Holden explaining the process Hostwinds used to announce IP netblocks. It is
`anticipated that Mr. Holden will testify that after netblocks were listed on the Spamhaus
`block list (SBL), Hostwinds removed them from its network to protect the network’s
`integrity and security. Mr. Holden will also testify as a percipient witness to his
`communications and personal experiences working with the defendants. The government
`has produced a copy of Mr. Holden’s CV in discovery, along with the 302s documenting
`his interviews. Publicly available interviews with Mr. Holden that discusses Spamhaus
`blocklists and spam can be found at https://www.mailchannels.com/customers/hostwinds/
`and https://krebsonsecurity.com/2015/08/like-cutting-off-a-limb-to-save-the-body/.
`F. GoDaddy Custodian of Records
`It is anticipated that the GoDaddy witness (not yet designated by the company) will
`explain the purpose of domain names, their relationship to IP addresses, and how domain
`6
`
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 342 Filed 03/10/22 PageID.4442 Page 7 of 7
`
`
`names are purchased, as well as factors that affect the price. The witness will also explain
`how the public could determine the owner of a specific domain name, and whether it was
`available for purchase, as well as the purpose and operation of privacy settings. It is further
`anticipated that the witness will provide evidence regarding the purchaser and owner of
`some of the domain names associated with the netblocks at issue, during the relevant
`periods.
`DATED: March 10, 2022
`
`
`Respectfully submitted,
`
`RANDY S. GROSSMAN
`United States Attorney
`
`/s/Melanie K. Pierson
`Assistant United States Attorney
`
`/s/Sabrina L. Fève
`Assistant United States Attorney
`
`/s/Candy Heath
`Senior Counsel
`Computer Crime and Intellectual Property Section
`Department of Justice, Criminal Division
`
`
`
`
`Gov.’s Third Not. of Experts & Witnesses w/Expertise
`(Curran/Zadig/Ward/Zulager/Holden/GoDaddy)
`
`7
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`