Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4482 Page 1 of 7
`
`
`RANDY S. GROSSMAN
`United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No.: 18cr4683-GPC
`
`
`UNITED STATES’ NOTICE OF:
`
`Plaintiff,
`(1) 404(b) EVIDENCE;
`
`(2) AUTHENTICTION
`v.
`
`PURSUANT TO FED. R.
`
`EVID. 902(11) & (13)
`JACOB BYCHAK (1),
`(3) SUMMARIES OF
`MARK MANOOGIAN (2),
`VOLUMINOUS RECORDS
`ABDUL MOHAMMED QAYYUM (3), and
`PURSUANT TO FED. R.
`PETR PACAS (4),
`EVID. 1006
`
`
`Defendants.
`
`
`COMES NOW the plaintiff, United States of America, by and through its counsel,
`Randy S. Grossman, United States Attorney, and Assistant United States Attorneys
`Melanie K. Pierson, Sabrina L. Fève, and Computer Crime and Intellectual Property
`Section Senior Counsel Candy Heath, and hereby files its above-referenced Notices, based
`on the files and records in this case.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4483 Page 2 of 7
`
`
`I.
`INTRODUCTION
`Pursuant to Federal Rules of Evidence 404(b), 902(11) & (13), and 1006, the United
`States hereby provides notice of 404(b) evidence, reliance on business record and
`electronic records certifications, and the use of summaries of voluminous records. The
`United States reserves the right to supplement this notice with additional disclosures prior
`to trial. For example, the United States has previously served a trial subpoena for records
`and testimony from the domain registrar GoDaddy.com, which has yet to respond. The
`United States will expeditiously produce any such records when they are received.
`II.
`EVIDENCE UNDER RULE FED. R. EVID. 404(b)
`The Indictment in this case leads with a conspiracy charge (Count 1), which alleges
`that, between December 2010 and September 2014, the four defendants conspired with
`Daniel Dye and Vincent Tarney (both charged elsewhere) to violate the wire fraud and
`CAN-SPAM statutes by fraudulently acquiring blocks of Internet Protocol (“IP”) addresses
`registered to others through the creation and use of letters, known as “LOAs,” that falsely
`represented them to be the authorized users of those IP blocks. The Indictment also includes
`four substantive wire fraud counts (Counts 2-5) and five substantive CAN-SPAM counts
`(Counts 6-10) that each identify a specific block of Internet Protocol (“IP”) addresses and,
`in the CAN-SPAM counts, a specific day on which each block was used to transmit
`commercial mail messages.1
`Throughout this case, the United States has represented its intent to present evidence
`regarding all the IP blocks the defendants acquired via co-conspirator Daniel Dye, and, in
`response to defendants’ motion for a bill of particulars, pointed to the netblocks and domain
`names set forth in Grand Jury Exhibit 251 for a list of the netblocks acquired via Dye.
`
`
`1 Counts 2 through 10 of the Indictment specifically refer to IP blocks associated with the
`domains ect.net, telalink.net, moore-solutions.com, sierrasemi.com, and obs.net, and to
`specific dates between November 2013 and March 2014.
`2
`Government’s Notice of Intent to Admit 404(b)
`
`Evidence and to Authenticate under902(11) & (13)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4484 Page 3 of 7
`
`
`Domain
`trinitymicro.com
`cdnair.ca
`sierrasemi.com
`sura.net
`ect.net
`moore-solutions.com
`obs.net
`internex.net
`
`Grand Jury Exhibit 251 identifies the following IP blocks and, where applicable, related
`domain name:
`IP Block
`63.79.40.0/21
`142.147.0.0/16
`151.192.0.0/16
`163.253.0.0/16
`165.192.0.0/16
`167.87.0.0/16
`168.129.0.0/16
`198.68.64.0/18
`199.2.16.0/24
`199.2.17.0/24
`199.2.19.0/24
`199.2.20.0/24
`199.2.22.0/24
`199.2.24.0/24
`199.2.25.0/24
`199.2.30.0/24
`199.2.64.0/24
`205.158.176.0/20
`206.159.192.0/18
`208.10.20.20.0/24
`207.152.0.0/18
`207.234.0.0/17
`208.199.68.0/23
`149.118.0.0/16
`
`telalink.net
`
`paxny.com
`mediavis.com
`
`
`Government’s Notice of Intent to Admit 404(b)
`Evidence and to Authenticate under902(11) & (13)
`
`3
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4485 Page 4 of 7
`
`
`The United States maintains that all eleven domains and IP blocks listed in the chart
`above are direct evidence of the conspiracy and inextricably intertwined with the
`substantive counts. The United States contends that evidence of and relating to these
`domains and IP addresses is also admissible under Rule 404(b) to prove intent, plan,
`knowledge, and absence of mistake regarding the defendants’ deepening knowledge over
`time that they were not the authorized registrants or users of the IP blocks acquired via Dye
`and his employer, GetAds, and that they acted with the knowledge and intent to defraud
`and mislead.
`For example, the defendants learned that the IP blocks they acquired via Dye, which
`they sought to control and use through the eleven domains they obtained through him (the
`“GetAds IP blocks”), did not come with all the rights and properties that were available to
`legitimate IP block registrants. Defendants’ email messages show that they were repeatedly
`warned that GetAds IP blocks listed in Grand Jury Exhibit 251 were hijacked. At two
`different times during the conspiracy, the defendants also learned that GetAds IP blocks
`had been reclaimed by the rightful registrants, but nonetheless continued to work with Dye
`and use the remaining GetAds IP blocks. In their email discussions related to GetAds IP
`blocks, the defendants acknowledged both to Dye and each other the risk that the rightful
`registrants would reclaim GetAds IP blocks. The defendants also used the fact that GetAds
`IP blocks had been reclaimed to negotiate favorable terms for future contracts from Dye
`and GetAds. Evidence relating to these hijacked IP blocks, and the defendants’ knowledge
`of the risk that additional GetAds IP blocks might be reclaimed, demonstrates their intent,
`knowledge, and absence of mistake that they were not the IP blocks’ rightful registrant, as
`well as their plan for dealing with both Dye and the IP blocks’ rightful registrants who
`might reclaim them.
`The United States also provides notice pursuant to Rule 404(b) of its intent to use
`evidence of and relating to defendants’ fraudulent acquisition and use of IP addresses
`associated with the IP blocks 196.194.0.0/15, 196.193.0.0/16, and 196.246.0.0/16 (the
`“AFRINIC blocks”). Evidence of and relating to these additional IP blocks is admissible
`4
`
`
`Government’s Notice of Intent to Admit 404(b)
`Evidence and to Authenticate under902(11) & (13)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4486 Page 5 of 7
`
`
`to prove intent, preparation, plan, knowledge, and absence of mistake regarding
`defendants’ misuse of LOAs to acquire control and use of IP addresses that were not
`rightfully theirs. It is anticipated that the defendants will claim they were defrauded by Dye
`and Tarney, and therefore lacked criminal intent. The defendants’ acquisition and use of
`the hijacked AFRINIC netblocks did not, however, involve either Dye or Tarney.
`Defendants acquired the AFRINIC netblocks via a broker in India in April 2013, and
`then forged a LOA purporting to be signed by A.S.Y, in his capacity as “Manager” for
`“AirSea Freight Services” to announce and control 196.193.0.0/16 through Hostwinds, a
`hosting company they used to announce many of the GetAds IP blocks. On May 1, 2013,
`the hosting company received a complaint that the “AirSea Freight Services”
`announcement involved hijacked IP addresses. Despite this notice, defendants continued
`to try to use 196.193.0.0/16, and did so in conjunction with two other hijacked IP blocks
`they had acquired via Dye. Defendants’ acquisition of a hijacked IP block from a broker
`other than Dye, along with their emails drafting the forged LOA for this block, demonstrate
`their intent, preparation, plan, knowledge, and absence of mistake in their use of fraudulent
`LOAs to acquire control of and use the hijacked GetAds netblocks, in the substantive
`offenses that occurred later in time.
`
`III.
`AUTHENTICATION PURSUANT TO FED. R. EVID. 902(11) & (13)
`The United States intends to authenticate business records and records generated by
`an electronic process, pursuant to Federal Rule of Evidence 902(11) and 902(13) and
`consistent with Rule 803(6), using a certification from a custodian of records relating to
`those business records. Specifically, the United States intends to so authenticate records
`obtained from the following entities: the American Registry of Internet Numbers, Amobee
`(successor-in-interest to Adconion and Frontline Direct), Telic, GoDaddy, Hostwinds,
`Cogent Communications, Tucows (successor-in-interest to Enom), the Goodman Law
`Firm, Mandatus, LegalZoom (successor-in-interest to Earth Class Mail), Native Rank
`(successor-in-interest to GetAds), and CPH Resources. The certificates of the custodians
`5
`
`
`Government’s Notice of Intent to Admit 404(b)
`Evidence and to Authenticate under902(11) & (13)
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4487 Page 6 of 7
`
`
`of records have been produced as discovery as they were received; additional certificates
`encompassing the entirety of certain rolling productions will be produced as soon as they
`are received.
`
`IV.
`NOTICE OF SUMMARIES PURSUANT TO FED. R. EVID. 1006
`The United States intends to present summaries of voluminous writings that cannot
`be conveniently examined in court, pursuant to Federal Rule of Evidence 1006. The
`underlying records in the possession of the government have been disclosed to the defense
`in discovery. Those records fall into two categories.
`The first category of records involves those records that indicate the number of
`electronic mail messages sent by particular IP addresses. These records were maintained
`by Company A on a variety of electronic software platforms, including BlackMail and
`others. The records indicate the number of electronic mail message sent each day by
`particular IP addresses. It is anticipated that the evidence will show that over 8 billion
`electronic mail messages were sent using the netblocks at issue during the time of the
`conspiracy.
`The second category of records involves financial records indicating the revenue
`
`earned by sending electronic mail messages using the netblocks during the period of the
`conspiracy. It is anticipated that the experts will testify that, based on their review of the
`financial records created and maintained by Company A in the course of operating its
`//
`//
`
`
`
`
`
`
`
`Government’s Notice of Intent to Admit 404(b)
`Evidence and to Authenticate under902(11) & (13)
`
`6
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 347 Filed 03/18/22 PageID.4488 Page 7 of 7
`
`
`business, approximately $4.5-$5 million in revenue were generated through the use of the
`hijacked netblocks.
`
`DATED: March 18, 2022
`
`
`
`
`Respectfully submitted,
`
`RANDY S. GROSSMAN
`United States Attorney
`
`/s/Melanie K. Pierson
`Assistant United States Attorney
`
`/s/Sabrina L. Fève
`Assistant United States Attorney
`
`/s/Candy Heath
`Senior Counsel
`Computer Crime and Intellectual Property Section
`Department of Justice, Criminal Division
`
`
`
`
`Government’s Notice of Intent to Admit 404(b)
`Evidence and to Authenticate under902(11) & (13)
`
`7
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`