Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6075 Page 1 of 8
`
`
`RANDY S. GROSSMAN
`United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No.: 18cr4683-GPC
`
`
`GOVERNMENT’S
`
`Plaintiff,
`SUPPLEMENTAL NOTICE OF
`
`404(b) EVIDENCE
`v.
`
`
`JACOB BYCHAK (1),
`MARK MANOOGIAN (2),
`ABDUL MOHAMMED QAYYUM (3), and
`PETR PACAS (4),
`
`
`Defendants.
`
`
`COMES NOW the plaintiff, United States of America, by and through its counsel,
`Randy S. Grossman, United States Attorney, and Assistant United States Attorneys
`Melanie K. Pierson, Sabrina L. Fève, and Computer Crime and Intellectual Property
`Section Senior Counsel Candy Heath, and hereby files its above-referenced Supplemental
`Notice, based on the files and records in this case.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6076 Page 2 of 8
`
`
`I.
`PROCEDURAL BACKGROUND
`On April 26, 2022, the Court directed the government to identify the exhibits relating
`to a block of IP addresses (196.193.0.0/16) registered on the African Registry of Internet
`Numbers (“AFRINIC”) that it seeks to use at trial pursuant to Rule 404(b) of the Federal
`Rules of Evidence (“FRE”) and to explain the theory under which these exhibits are
`relevant and admissible.
`The Indictment in this case leads with a conspiracy charge (Count 1), which alleges
`that, between December 2010 and September 2014, the four defendants conspired with
`Daniel Dye and Vincent Tarney (both charged elsewhere) to violate the wire fraud and
`CAN-SPAM statutes by fraudulently acquiring blocks of Internet Protocol (“IP”) addresses
`registered to others through the creation and use of letters, known as Letters of
`Authorization, or “LOAs,” that falsely represented them to be the authorized users of those
`IP blocks. The Indictment also includes four substantive wire fraud counts (Counts 2-5)
`and five substantive CAN-SPAM counts (Counts 6-10) that each identify a specific block
`of IP addresses and, in the CAN-SPAM counts, a specific day on which each block was
`used to transmit commercial mail messages. Counts 2 through 10 of the Indictment
`specifically refer to IP blocks associated with the domains ect.net, telalink.net, moore-
`solutions.com, sierrasemi.com, and obs.net, and to specific dates between November 2013
`and March 2014.
`
`II.
`FACTUAL BASIS
`The charged conduct outlined in the Indictment involved eleven domain names,
`including the five listed above, that the defendants acquired from Dye’s employer, GetAds.
`The defendants used these domain names, in conjunction with falsified LOAs, to take
`unauthorized control of, or “hijack,” IP addresses that did not belong to them (hereafter,
`the “GetAds IPs”). Some of the falsified LOAs were prepared by Dye or Tarney, some
`
`Government’s Supplemental Rule 404(b) Notice
`
`2
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6077 Page 3 of 8
`
`
`appear to have been prepared or modified by the defendants. An issue at trial will be
`whether the defendants knew or had reason to believe these LOAs were fraudulent.
`The proposed Rule 404(b) conduct spans a seven-week period that began on March
`22, 2013, when defendant Mark Manoogian and codefendants Jake Bychak and Abdul
`Mohammed Qayyum exchanged emails regarding a block of IP addresses registered on
`AFRINIC to AirSea Freight (196.193.0.0/16, hereafter the “AFRINIC IPs”), which were
`good for mailing and for which they wanted to try to pay $1.00/IP. The AFRINIC IPs were
`being offered by “Dave” at a company called Techvensys. The proposed Rule 404(b)
`conduct ends on or about May 14, 2013, when Manoogian emails Peter Holden, the owner
`of the hosting company Hostwinds, which announced many of the GetAds IPs, and cc’s
`Qayyum, to ask Holden to stop announcing the AFRINIC IPs and notes this IP range “is
`the SBL’d range that we leased and must be returned.” (“SBL” stands for “Spamhaus Block
`List.”)
`In between the defendants learning that the AFRINIC IPs were available and
`returning them, the following conduct occurred:
`
`
`Date
`4/8/2013
`
`4/10/2013
`
`
`404(b) Conduct1
`Manoogian advises Bychak and Qayyum that the AFRINIC
`IPs will cost $1.37 each for two months and asks Qayyum,
`“Abdul, is this something we would want to announce with
`Hostwinds if we want to pursue it?”
`Manoogian emails Mohammed and Bychak that they should
`have the LOA for the AFRINIC IPs by 8am the next
`morning.
`Manoogian emails himself a template LOA for the AFRINIC
`IPs in which “(COMPANY NAME)”, represented by
`“NAME” authorizes Hostwinds, 9 E. 4th St., Ste: 1002, Tula
`[sic], Oklahoma 74105 to use and route the IP Block
`196.193.0.0/16.”
`
`
`1 The documents described herein, along with the March 22, 2013, and May 14, 2013,
`emails described directly above, are attached as Government Exhibit 1. Note that in these
`emails, Qayyum goes by the full name “Abdul Mohammed.”
`3
`Government’s Supplemental Rule 404(b) Notice
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6078 Page 4 of 8
`
`
`4/11/2013
`
`
`4/18/2013
`
`4/26/2013
`
`
`5/2/2013
`
`5/7/2013
`
`Manoogian emails “Dave” at Techvensys just before 10 am
`to ask where the AFRINIC LOA is and to remind him they
`were supposed to have it two hours ago.
`Manoogian emails the AFRINIC LOA to Bychak and
`Qayyum just before noon with the message, “TVS LOA
`attached. Looks official. In the hands of HostWinds [sic].”
`That night, “Dave” responds to Manoogian’s morning email
`demanding the LOA with the message, “Is everything ok
`with announcement?” and Manoogian replies that he will
`know more in the morning.
`Spamhaus places the AFRINIC IPs on its Spamhaus Block
`list and notes the reason for blocking the IPs is for
`“spamming through hijacked netblocks.”
`Manoogian emails Qayyum and other employees that the
`AFRINIC IPs are on the SBL and are nonetheless “ok for
`you to start using right away I think.”
`Holden receives an email from his internet provider
`indicating that the AFRINIC IPs are hijacked. Holden
`responds, “I spoke to the client who rents that space, they
`say it was a mistake, and the space owner accidentally gave
`the LOA to another client as well.”
`Manoogian emails Holden and asks him to keep the “sbl’d”
`AFRINIC IPs online until the end of the billing cycle.
`
`
`
`This proposed Rule 404(b) conduct is evidence of defendants’ intent, preparation,
`plan, knowledge, and absence of mistake regarding their misuse of LOAs to acquire control
`and unauthorized use of IP addresses for the following reasons:
`1) Manoogian’s custody and control of a LOA template is evidence that he had the
`knowledge and tools needed to prepare LOAs himself and was not exclusively
`relying on his coconspirators to draft or prepare these documents.
`2) Manoogian’s question to Qayyum (“Abdul, is this something we would want to
`announce with Hostwinds if we want to pursue it?”) is consistent with the
`conspirators’ practice of using Holden and Tarney to announce the IP addresses
`that involved dubious LOAs.
`
`Government’s Supplemental Rule 404(b) Notice
`
`4
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6079 Page 5 of 8
`
`
`3) The conspirators’ blasé response to the AFRINIC IPs being placed on the SBL
`after being deemed “hijacked” and their continued use of these IPs despite this
`derogatory information is consistent with their willingness to engage in
`unauthorized use of the GetAds IPs and shows an absence of mistake.
`4) The proposed Rule 404(b) conduct is intertwined and overlaps with the charged
`conduct.
`This fourth reason requires some context. During the seven week-period that the
`defendants acquired and used the AFRINIC IPs, they were also involved in acquiring and
`using GetAds IPs. For example, during this seven-week period, the members of the
`conspiracy did the following:
`
`
`Date
`3/28/2013
`
`5/2/2013
`
`5/7/2013
`
`
`
`5/8/2013
`
`GetAds Conduct
`Pacas discusses the GetAds Cdnair netblock with Dye and
`how use of these IPs requires “flying under the radar” until
`the rightful owner “claim[s] it back.”
`Bychak, Manoogian, and Qayyum review documents for
`purchasing the Telalink domain from GetAds, which they
`then used to control the Telalink IP addresses.
`Manoogian emails Holden the GetAds Telalink IP LOAs.
`Manoogian, Bychak, and Qayyum discuss whether Holden
`or Tarney would be willing to announce the TrinityMicro
`IPs they had just acquired via GetAds.
`Manoogian emails Bychak and Qayyum that Hostwinds will
`use the same server that hosted the AFRINIC IPs to host the
`GetAds Telalink IPs, and that Holden will “try to announce”
`the GetAds TrinityMicro, but “can[’]t guarantee it will go
`through.”
`
`
`
`III.
`INTRODUCTION OF EVIDENCE
`At the April 26, 2022 hearing, the Court asked the government to identify which
`witnesses would be used to introduce the proffered Rule 404(b) evidence. For ease of
`
`Government’s Supplemental Rule 404(b) Notice
`
`5
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6080 Page 6 of 8
`
`
`reference, the government has amended the chart summarizing the Rule 404(b) evidence
`to include which witness will authenticate or otherwise testify regarding the evidence:
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`4/10/2013
`
`
`4/11/2013
`
`
`4/26/2013
`
`
`404(b) Conduct
`Date
`4/8/2013 Manoogian advises Bychak and Qayyum that
`the AFRINIC IPs will cost $1.37 each for two
`months and asks Qayyum, “Abdul, is this
`something we would want to announce with
`Hostwinds if we want to pursue it?”
`Manoogian emails Mohammed and Bychak
`that they should have the LOA for the
`AFRINIC IPs by 8am the next morning.
`Manoogian emails himself a template LOA
`for the AFRINIC IPs in which “(COMPANY
`NAME)”, represented by “NAME” authorizes
`Hostwinds, 9 E. 4th St., Ste: 1002, Tula [sic],
`Oklahoma 74105 to use and route the IP
`Block 196.193.0.0/16.”
`Manoogian emails “Dave” at Techvensys just
`before 10 am to ask where the AFRINIC
`LOA is and to remind him they were
`supposed to have it two hours ago.
`Manoogian emails the AFRINIC LOA to
`Bychak and Qayyum just before noon with
`the message, “TVS LOA attached. Looks
`official. In the hands of HostWinds [sic].”
`That night, “Dave” responds to Manoogian’s
`morning email demanding the LOA with the
`message, “Is everything ok with
`announcement?” and Manoogian replies that
`he will know more in the morning.
`4/18/2013 Spamhaus places the AFRINIC IPs on its
`Spamhaus Block list and notes the reason for
`blocking the IPs is for “spamming through
`hijacked netblocks.”
`Manoogian emails Qayyum and other
`employees that the AFRINIC IPs are on the
`SBL and are nonetheless “ok for you to start
`using right away I think.”
`5/2/2013 Holden receives an email from his internet
`provider indicating that the AFRINIC IPs are
`hijacked. Holden responds, “I spoke to the
`6
`
`
`Government’s Supplemental Rule 404(b) Notice
`
`Witness
`FBI SA Jordan
`Goettsche &
`FRE 902(11)
`COA
`
`Goettsche &
`FRE 902(11)
`COA
`Goettsche &
`FRE 902(11)
`COA
`
`Goettsche &
`FRE 902(11)
`COA
`
`Goettsche &
`FRE 902(11)
`COA
`
`Goettsche &
`FRE 902(11)
`COA
`
`Goettsche
`
`Goettsche &
`FRE 902(11)
`COA
`
`Peter Holden
`
`18cr4683-GPC
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6081 Page 7 of 8
`
`
`client who rents that space, they say it was a
`mistake, and the space owner accidentally
`gave the LOA to another client as well.”
`5/7/2013 Manoogian emails Holden and asks him to
`keep the “sbl’d” AFRINIC IPs online until
`the end of the billing cycle.
`
`Holden
`
`
`
`IV.
`CONCLUSION
`To facilitate review of the Rule 404(b) conduct described herein, the FBI prepared a
`written memo in December 2019 describing this conduct, which was produced in January
`2020 alongside the 33 pages of discovery upon which the memo relied. This re-production
`of documents previously put out in discovery alleviated the need for the defense to comb
`through the earlier discovery productions to find the documents described therein. A copy
`of the FBI memo is attached as Exhibit 2, along with the discovery index that accompanied
`the memo and underlying documentation.
`The Rule 404(b) evidence at issue consists of approximately nine emails and one
`Spamhaus Block Listing. The witnesses who will speak to this evidence, Holden and FBI
`Special Agent Jordan Goettsche, are already testifying regarding the charged GetAds
`conduct. Holden is in fact already testifying regarding the May 7, 2013, AFRINIC IPs
`email because the email is part of a longer email chain that also discusses the GetAds
`Telalink IPs and Holden previously testified about this email before the grand jury, when
`it was presented to the grand jury as Exhibit 92. (See Holden G.J. Tr. 89:10 – 93:1; GJ Ex.
`92.) The additional AFRINIC IP emails will provide relevant context for an existing exhibit
`that would foreseeably be presented to the jury, both because it was marked as a grand jury
`exhibit and involved the GetAds IPs, and because it expressly discussed the use of “SBL’d”
`//
`
`
`
`
`
`
`Government’s Supplemental Rule 404(b) Notice
`
`7
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 398 Filed 04/29/22 PageID.6082 Page 8 of 8
`
`
`IP addresses. Because the Rule 404(b) evidence at issue is limited and fairly noticed, the
`government respectfully submits that it should be permitted to use this evidence at trial.
`
`DATED: April 29, 2022
`
`
`
`
`Respectfully submitted,
`
`RANDY S. GROSSMAN
`United States Attorney
`
`/s/Melanie K. Pierson
`Assistant United States Attorney
`
`/s/Sabrina L. Fève
`Assistant United States Attorney
`
`/s/Candy Heath
`Senior Counsel
`Computer Crime and Intellectual Property Section
`Department of Justice, Criminal Division
`
`
`
`
`Government’s Supplemental Rule 404(b) Notice
`
`8
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`