Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6495 Page 1 of 38
`
`
`RANDY S. GROSSMAN
`United States Attorney
`MELANIE K. PIERSON
`SABRINA L. FEVE
`Assistant U.S. Attorneys
`California Bar No. 112520/226590
`Office of the U.S. Attorney
`880 Front Street, Room 6293
`San Diego, CA 92101
`Tel: (619) 546-7976
`Fax: (619) 546-0631
`Email:Melanie.Pierson@usdoj.gov/Sabrina.Feve@usdoj.gov
`
`CANDINA S. HEATH
`Senior Counsel
`Texas Bar No. 09347450
`Computer Crime and Intellectual Property Section
`U.S. Department of Justice
`Washington, D.C. 20005
`Tel: (202) 307-1049
`Email: Candina.Heath2@usdoj.gov
`
`Attorneys for Plaintiff
`United States of America
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`SOUTHERN DISTRICT OF CALIFORNIA
`UNITED STATES OF AMERICA,
`Case No.: 18cr4683-GPC
`
`
`GOVERNMENT’S TRIAL
`
`Plaintiff,
`MEMORANDUM
`
`v.
`
`
`
`
`JACOB BYCHAK (1),
`Date: May 23, 2022
`MARK MANOOGIAN (2),
`Time: 9:00 a.m.
`ABDUL MOHAMMED QAYYUM (3), and
`Place: Courtroom 2D
`PETR PACAS (4),
`Judge: Hon. Gonzalo P. Curiel
`
`
`Defendants.
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`COMES NOW the plaintiff, United States of America, by and through its counsel,
`Randy S. Grossman, United States Attorney, and Assistant United States Attorneys
`Melanie K. Pierson, Sabrina L. Fève, and Computer Crime and Intellectual Property
`Section Senior Counsel Candy Heath, and hereby files its Trial Memorandum in this case.
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6496 Page 2 of 38
`
`
`I.
`STATUS OF THE CASE
`
`A. INDICTMENT
`On October 31, 2018, a federal grand jury in the Southern District of California
`returned an indictment against defendants Jacob Bychak, Mark Manoogian, Abdul
`Mohammed Qayyum and Petr Pacas. The defendants are charged with Conspiracy, in
`violation of Title 18, United States Code, Section 371; five counts of Electronic Mail Fraud,
`in violation of Title 18, United States Code, Section 1037(a)(5) (the CAN-SPAM Act); five
`counts of wire fraud, in violation of Title 18, United States Code, Section 1343; and
`Criminal Forfeiture, in violation of Title 18, United States Code, Sections 981(a)(1)(C),
`982(a)(1) and 1037(c) and Title 28, United States Code, Section 2461(c). The Conspiracy
`count alleges that, between December 2010 and September 2014, defendants conspired
`with each other and with others, including two named coconspirators, Daniel Dye and
`Vincent Tarney, both of whom were charged elsewhere.
`B. RELATED CASES
`Daniel Dye is charged in matter 18cr0822-GPC. On February 2, 2018, Dye pled
`guilty to a one-count information charging him with Conspiracy to Commit Electronic Mail
`Fraud, in violation of Title 18, United States Code, Section 1037(a)(5) and (b)(2)(E).
`[18cr0822-GPC, ECF 4, 6.] The court accepted Dye’s guilty plea on March 9, 2018, and
`Dye’s sentencing is set for August 22, 2022. [Id., ECF 14, 43.]
`Vincent Tarney is charged in matter 18cr3469-GPC. On August 7, 2018, Tarney
`pled guilty to a one-count information charging him with Conspiracy to Commit Electronic
`Mail Fraud, in violation of Title 18, United States Code, Section 1037(a)(5) and (b)(2)(E).
`[18cr3469-GPC, ECF 4, 11.] The court accepted Tarney’s guilty plea on January 8, 2019,
`and Tarney’s sentencing is set for August 22, 2022. [Id., ECF 19, 35.]
`C. TRIAL STATUS
`The trial is scheduled to commence on May 23, 2022, at 8:30 a.m. The Court has
`granted each side 52 hours to conduct its direct examinations and cross examinations of
`2
`
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6497 Page 3 of 38
`
`
`adverse witnesses. Accordingly, the case should conclude on or about June 22, 2022. (This
`date assumes a 3-day trial week the first week, and 4-day trial weeks thereafter.)
`D. STATUS OF COUNSEL
`Defendant Jacob Bychak is represented by David Wiechert, Jessica Munk, and
`Jahnavi Goldstein of the firm Wiechert, Munk & Goldstein, PC. Defendant Mark
`Manoogian is represented by Randy K. Jones, Daniel Goodrich, and Ryan Dougherty of
`the firm Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, PC. Defendant Mohammed Abdul
`Qayyum is represented by Thomas Bienert, James Riddet, Whitney Bernstein, and Carlos
`Nevarez of the firm Bienert, Katzman, Littrell & Williams, PC. Defendant Petr Pacas is
`represented by Gary Lincenberg, Alexis Wisely, and Darren Patrick of the firm Bird,
`Marella, Boxer, Wolpert, Nessim, Drook, Lincenberg & Rhow, PC.
`E. CUSTODY STATUS
`All defendants are released on bond.
`F. INTERPRETER
`None of the witnesses for the United States will require the services of an interpreter.
`G. JURY WAIVER
`No jury waiver has been filed by any of the defendants.
`H. PRETRIAL MOTIONS
`1. Pretrial Motions
`a. Motions Regarding Discovery
`On November 20, 2018, defendant Qayyum filed a motion to compel discovery
`[ECF 36] and a day later defendant Bychak filed a motion for a Bill of Particulars. [ECF
`38.] On March 15, 2019, defendants filed a motion to compel discovery related to a
`confidential informant. [ECF 71.] The court denied the motion for discovery regarding the
`informant on April 30, 2019. [ECF 93.] On July 30, 2021, the defense filed an additional
`motion to compel discovery regarding the informant. [ECF 257.] On August 20, 2021, this
`motion was granted in part, and denied in part, with the court directing the government to
`ask the informant to identify the documents the informant provided to the government that
`3
`
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6498 Page 4 of 38
`
`
`the informant received from CY, but denying the request for all additional discovery. [ECF
`275.] Defendants’ oral request for records related to “Anon-1” was also denied. Id. On
`September 20, 2021, the defendants filed a motion to compel further discovery regarding
`the informant [ECF 281], and a motion to have the court reconsider its previous order [ECF
`93], which had denied discovery regarding the informant. [ECF 282]. On November 18,
`2021, the court orally denied the defendants’ motions to compel disclosure of the
`informant’s identity and to turn over all information regarding government cooperation
`with Spamhaus in other investigations. [ECF 313, 314 at 72.] The court did, however, direct
`the parties to submit supplemental briefing regarding the scope of a potential in camera
`hearing regarding the informant. Id. The parties submitted their supplemental briefing on
`December 3, 2021, and December 10, 2021. [ECF 315, 316.] On January 18, 2022, the
`court reiterated its earlier rulings denying the defense motions for additional discovery
`regarding the informant’s identity and Spamhaus’s contacts with the federal government
`and further ruled that no in camera hearing was justified. [ECF 318, 319 at 9-11.]
`
`On February 1, 2019, the government filed a motion for a protective order regarding
`the discovery. [ECF 56, 57.] At a hearing on February 14, 2019, the court ordered the
`government to provide an amended protective Order to the defense. [ECF 62.] On March
`6, 2019, the court granted the government’s motion for a protective order. [ECF 67.] On
`March 29, 2019, defendants filed a motion to modify the protective order. [ECF 77.] The
`court granted the motion to modify the protective order on June 11, 2019. [ECF 106.]
`b. Motions to Dismiss
`On March 15, 2019, defendants filed two motions to dismiss. The first motion was
`to dismiss Counts 6 through 10 (the CAN-SPAM counts) as void for vagueness as to the
`term “registrant.” [ECF 69.] The second motion was to dismiss the indictment for
`misadvisement of the grand jury. [ECF 70.] At a hearing on October 24, 2019, the court
`denied the motion to dismiss for misadvisement of the grand jury and took the motion to
`dismiss the CAN-SPAM counts under advisement. [ECF 135.] After supplemental
`
`Government’s Trial Memorandum
`
`4
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6499 Page 5 of 38
`
`
`briefing, the court issued a written order on February 28, 2020, denying the motion to
`dismiss the CAN-SPAM counts. [ECF 154.]
`On January 23, 2020, defendants filed a motion to dismiss the wire fraud counts
`(Counts 2 through 5) for failure to state an offense. [ECF 149.] The Court issued a written
`order denying this motion on April 8, 2020. [ECF 160.]
`On May 28, 2020, defendants filed a motion to dismiss the wire fraud counts for
`violating the Fifth Amendment Due Process and Sixth Amendment Fair Notice Protections,
`arguing that Internet Protocol (IP) addresses did not constitute property for purposes of
`wire fraud. [ECF 169.] After multiple rounds of briefing, and a hearing on July 16, 2020,
`the court took the motion under advisement. [ECF 202.] Additional briefing was submitted,
`and a hearing was held on December 17, 2020, where the court again took the motion under
`advisement. [ECF 225.] On February 25, 2021, the court issued a written order denying
`this motion to dismiss the wire fraud counts. [ECF 232.]
`On February 18, 2022, defendants filed a motion to dismiss for outrageous
`government conduct based on an alleged pattern of invasion of the defense camp by the
`informant. [ECF 329.] The motion to dismiss based on outrageous government conduct
`was denied orally by the court on April 26, 2022. [ECF 396.] Also on February 18, 2022,
`the defense filed a motion to dismiss and suppress under the Fourth Amendment, based on
`the alleged illegal acquisition of internal Company A documents by the informant. [ECF
`330.] On May 13, 2020, the Court issued a written order, denying that motion and finding
`that no hearing was warranted. [ECF 418.]
`c. Motion to Suppress
`On May 15, 2020, defendant Qayyum filed a motion to suppress statements he made
`to the FBI. [ECF 162.] After additional briefing and telephonic hearings, the government
`withdrew its opposition and agreed not to use the statements in its case-in-chief at trial.
`d. Motions for Depositions
`On June 23, 2021, the government filed a motion to take depositions of two
`witnesses (SAD and LWT) under Rule 15 of the Federal Rules of Criminal Procedure.
`5
`
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6500 Page 6 of 38
`
`
`[ECF 242.] On July 8, 2021, the court granted the motion as to witness LWT, and denied
`without prejudice the motion as to SAD. [ECF 254.] After supplemental briefing was
`submitted under seal, on August 20, 2021, the court granted the motion for the deposition
`of witness SAD. [ECF 275.] The Court has since reviewed the deposition transcripts and
`ruled on the portions that are to be admitted in the government’s case-in-chief. [ECF 396.]
`2. Motions In Limine1
`a. Gov. MIL to Set Time Limits
`On January 26, 2021, the government filed a motion to set time limits on the parties
`for trial. [ECF 228.] On April 26, 2022, the court granted the motion and allowed each side
`52 hours to conduct the direct examination of its witnesses and the cross examination of
`adverse witnesses. [ECF 396.]
`b. Gov. MIL to Admit 404(b) Evidence
`On April 26, 2022, the court granted in part, and denied in part, the government’s
`motion to admit 404(b) evidence. [ECF 350, 396.] In particular, the court granted the
`motion to admit evidence regarding the 11 domains and associated netblocks acquired from
`GetAds, an affiliate marketing firm, including evidence related to netblocks not charged in
`substantive counts. The court requested additional briefing regarding the AFRINIC
`netblocks, for which the defendants had submitted a false LOA that was unconnected to
`GetAds or any cooperating defendant. [ECF 396.] The government submitted a
`Supplemental 404(b) Notice on April 29, 2022. [ECF 398.] The court denied the
`government’s motion on May 6, 2022. [ECF 406].
`c. Gov. MIL to Exclude Certain Evidence Elicited at Depositions
`As mentioned, the court ruled on the parties’ respective objections to the deposition
`transcripts on April 26, 2022. The government’s motion to exclude certain evidence
`elicited at the witness depositions [ECF 351] was granted in part and denied in part. [ECF
`396]. The court admitted all the exhibits offered by the government and excluded three
`exhibits [A, B, and C] offered by the defense. Id. The court also ruled on specific objections
`
`1 Unless otherwise indicated, all Motions in Limine were filed on March 24, 2022.
`6
`Government’s Trial Memorandum
`18cr4683-GPC
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6501 Page 7 of 38
`
`
`made during the depositions, and the government has conformed the deposition videos to
`be presented to the jury in compliance with the court’s rulings.
`d. Gov. MIL to Exclude Witnesses from the Courtroom
`The government’s motion to exclude witnesses from the courtroom [ECF 352-5]
`was granted in part and denied in part. The court ruled that each party may have one case
`agent in the courtroom, and all other witnesses will be excluded. [ECF 382.]
`e. Gov. MIL to Exclude Evidence of Immigration Status & Punishment
`On April 22, 2022, the government’s motion to exclude evidence of immigration
`
`status and punishment [ECF 352-7] was granted, but the court ruled that defendants are
`free to present evidence of their country of origin. [ECF 382.]
`f. Other Gov. MILs Deferred Until Trial
`The following government motions in limine were deferred until trial: motion to
`admit co-conspirators statements [ECF 350]; motion to exclude the testimony of
`undisclosed defense experts [ECF 352-1]; motion to exclude defendants’ undisclosed
`reciprocal discovery [ECF 352-2]; motion to exclude evidence of the law [ECF 352-3];
`motion to exclude evidence of advice of counsel [ECF 352-4]; and a motion to exclude
`improper use of FBI reports and notes [ECF 352-6]. On January 26, 2021, the government
`filed a motion to preclude speaking objections. [ECF 228]. On April 11, 2022, the court
`determined that this motion was moot. [ECF 382.]. During a hearing on May 12, 2022,
`when discussing the first round of reciprocal discovery provided by the defense that
`consisted of case law and other legal filings, the court directed the defense to provide
`briefing to explain the admissibility of such documents. [ECF 419.]
`g. Def. MIL to Exclude Evidence of Nortel Transaction
`On March 24, 2022, defendants filed a motion to exclude evidence related to the
`bankruptcy sale of the Nortel netblock to Microsoft in 2011. [ECF 349.] At a hearing on
`April 11, 2022, the court denied this motion. [ECF 382.]
`
`Government’s Trial Memorandum
`
`7
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6502 Page 8 of 38
`
`
`h. Def. MIL to Preclude Reference to “Spam” and “Spammers”
`On April 11, 2022, the defense motion to preclude reference to “spam” and
`“spammers,” [ECF 353], was denied in part and granted in part. The term “spam” may be
`used, but the government shall not refer to the defendants as “spammers.” [ECF 382.]
`i. Def. MIL to Preclude Evidence that Defendant Manoogian is an Attorney
`On April 11, 2022, the defense motion to preclude evidence that defendant
`Manoogian is an attorney [ECF 353] was denied. [ECF 382.]
`j. Def. MIL to Exclude Evidence Beyond the GetAds Netblocks
`On April 11, 2022, the defense motion to preclude evidence of netblocks other than
`the netblocks acquired via GetAds [ECF 354] was denied. [ECF 382.]
`k. Def. MIL to Exclude Reference to Identity Theft
`On April 11, 2022, the defense motion to exclude references to identity theft [ECF
`355] was denied. [ECF 382.]
`l. Def. MIL to Preclude Government Argument Regarding the Use of DBAs
`On April 11, 2022, the defense motion to preclude the government from framing its
`evidence and argument to suggest that the use of DBAs, post office boxes and email
`addresses under different names is illegal conduct and for a clarifying instruction [ECR
`356] was denied. [ECF 382.]
`m. Def. MIL for Attorney Voir Dire
`On April 11, 2022, the uncontested defense motion for attorney voir dire [ECF 357]
`was granted. [ECF 382.]
`n. Def. MIL to Preclude Reference to “Victims”
`On April 11, 2022, the defense motion to preclude references to certain individuals
`as “victims” [ECF 358] was denied. [ECF 382.]
`o. Def. MIL to Preclude Expert Testimony and Hold a Daubert Hearing
`On April 11, 2022, the defense motion to preclude allegedly irrelevant and unfairly
`prejudicial expert testimony, or alternatively, request a Daubert hearing [ECF 359] was
`deferred to trial. [ECF 382.]
`
`Government’s Trial Memorandum
`
`8
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6503 Page 9 of 38
`
`
`p. Def. MIL to Exclude 404(b) evidence
`On April 26, 2022, the defense motion to exclude 404(b) evidence related to the
`AFRINIC netblocks [ECF 360] was reserved and the court directed the government to
`submit additional briefing [ECF 396], which it filed on April 29, 2022. [ECF 398.] On May
`6, 2022, the court granted the defendant’s motion. [ECF 406.]
`q. Def. MIL re Accounting Experts (Under Seal)
`Defendant Bychak filed a notice of motion to file documents ex parte and under seal
`relating to a sealed motion in limine to preclude the government from calling accounting
`experts retained by Company A to testify at trial. [ECF 348, 400 at 4-13.] On April 26,
`2022, the court directed defendant Bychak to provide a redacted copy of the briefing to the
`government by April 29, 2022, for the government to respond by May 6, 2022, and for the
`defense to file a reply by May 11, 2022. [ECF 400 at 13-14.] On May 2, 2022, the
`government submitted a limited unsealing order permitting it to share the redacted briefing
`with Company A, which the court granted. [ECF 401.] The government has submitted a
`sealed response and the matter is set for an evidentiary hearing on May 18, 2022. [ECF
`419.]
`
`r. Def. MIL to Preclude References to “Hijacking”
`On April 15, 2022, the defense filed a motion to preclude references to “hijacking”
`or “hijacked” with respect to the netblocks. [ECR 387.] On May 6, 2022, the court denied
`this motion. [ECF 406.]
`I. COURTROOM COMPUTER SYSTEM
`The United States will be using a projection-based evidence presentation system,
`that will utilize the technology in the courtroom. It will display exhibits admitted into
`evidence on monitors at the bench, counsel table, witness stand, and before the jury.
`J. STIPULATIONS
`The parties have stipulated that the videos of the depositions of witnesses SAD and
`LWT may be presented in lieu of their testimony in court, due to their unavailability based
`on health concerns. No other stipulations have been entered into to date.
`9
`
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6504 Page 10 of 38
`
`
`K. NOTICES OF INTENT TO PRESENT EVIDENCE
`The government filed three expert notices on March 10, 2022: The first notice
`discussed the testimony of Jennifer Rexford, a Princeton computer science professor who
`will explain relevant technical terms and concepts regarding the internet and IP addresses,
`and Sandra Brown, an IP broker who will testify regarding the fair market value of the
`GetAds netblocks at the time defendants acquired them. [ECF 340.] The second notice
`described the testimony of David Benkert and Jeffrey Kinrich, two Company A forensic
`accountants who calculated the revenue that Company A earned via use of the GetAds
`netblocks. [ECF 341.] The third notice described the anticipated testimony of seven
`individuals who are percipient witnesses or custodians of records whose testimony may
`potentially draw upon specialized knowledge due to their employment in a technical
`industry.2 [ECF 342.] Their testimony was provided in an abundance of caution under
`Federal Rule of Evidence (“FRE”) 702, despite the government’s belief that the witnesses
`will properly testify under FRE 701.
`On March 18, 2022, the government filed notice of its intent to present evidence
`pursuant to FRE 404(b), as well as summaries of voluminous evidence pursuant to FRE
`1006, and its intent to authenticate documents pursuant to FRE 902(11) and (13). [ECF
`347.]
`
`On April 29, 2022, the government filed an amended notice of intent to authenticate
`documents pursuant to FRE 902(11) and (13), which specified the precise trial exhibits to
`be authenticated as business and electronic records, along with the certificates of
`authenticity provided by the record holders. [ECF 397.]
`On May 5, 2022, defense counsel requested that the government identify the
`unindicted coconspirators so that the defense could review the government’s trial exhibits
`and related testimony for coconspirator hearsay exception purposes and know in advance
`
`2 The seven individuals are John Curran (ARIN – who has since been replaced by John
`Sweeting, who will testify for ARIN), Sean Zadig (Yahoo), Michael Ward (formerly of
`Via West), Ried Zulager (Cogent), Peter Holden (Hostwinds), and a custodian of records
`from GoDaddy.
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`10
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6505 Page 11 of 38
`
`
`to whom the government would seek the apply the exception. On May 6, 2022, the
`government provided the defense with the names of Dye, Tarney, and two Company A
`employees (uncharged coconspirators 1 and 2, or “CC-1” and “CC-2”). On May 9, 2022,
`the government supplemented its notice and provided the defense with the name of the
`individual identified as “Person-1” in Dye’s Plea Agreement (“CC-3”).
`II.
`STATEMENT OF FACTS
`A. BACKGROUND ON IP ADDRESSES
`To consider the evidence in this case, the jury will need a basic understanding of
`what IP addresses are and how they work. IP addresses are the beginning or ending points
`for sending electronic messages and data over the internet. IP addresses3 consist of four
`“fields” of numerals, separated by periods (e.g., 165.152.0.0). Because IP addresses can be
`difficult to remember, they are often assigned to an alphanumeric domain name (e.g.,
`uscourts.gov or example.com), which web users can type into a browser to access a website
`in lieu of specifying the website’s IP address.
`A discrete bundle of IP addresses in numeric order is known as a netblock. The size
`of the netblock is denoted by the number following a forward slash (/). Counterintuitively,
`as the number following the slash increases, the number of individual IP addresses within
`the netblock decreases. In this case, most of the netblocks at issue are what are known as
`“Class B” netblocks, represented as a “/16” (e.g., 165.152.0.0/16) and which contain
`65,536 IP addresses. This number results from each .0 field having 256 possible
`combinations. A “Class C” netblock, represented as a “/24” (e.g., 165.152.255.0/24),
`contains only 256 IP addresses. There are also blocks of IP addresses (e.g., 207.152.0.0/18)
`that fall in-between. For historical reasons, not every size netblock is assigned to a Class,
`but because the defendants in this case referred to netblocks both by Class and by the slash
`size, the jury will need to be familiar with both forms of describing a netblock’s size.
`
`
`3 This case deals exclusively with IPv4 IP addresses, meaning there are four “fields” of
`numbers separated by a dot.
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`11
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6506 Page 12 of 38
`
`
`Because there are a finite number of IP addresses, IP addresses became scarce and
`steeply increased in value as the internet gained in popularity. A Class B netblock allocated
`at no cost to the registrant in the early 1990s was worth approximately $650,000 during the
`period of the conspiracy and as much as $3.3 million today.
`Beginning in December of 1997, the management of all IP addresses was transferred
`from the government to one of five non-profit, non-governmental organizations throughout
`the world known as regional internet registries (RIRs). The American Registry of Internet
`Numbers (ARIN) now manages the distribution of IP addresses in the United States,
`Canada and many Caribbean and North Atlantic Islands. ARIN and the other RIRs each
`maintain a directory known as “WHOIS” of the authorized registrants who were allocated
`IP addresses within their region’s ranges and track the transfer of such allocations. The
`records of each of these registries are cross-referenced, so that a query to ARIN’s WHOIS
`for an IP address assigned to RIPE (the RIR for Europe) will return a result.
`The RIRs’ WHOIS registries, which are publicly available on the internet, provide
`current information regarding the identity of an IP block’s registrant, as well as the
`registrant’s known contact information.4 ARIN’s WHOIS registry contains the registration
`information for all netblocks within ARIN’s region, including those that were allocated
`prior to when ARIN was created.
`For IP addresses to work, they must first be “announced” by an entity known as an
`“autonomous system,” which is commonly an internet service provider (ISP) or hosting
`company. The announcement process is how IP addresses are activated and can have
`internet traffic routed to and from them (similar to having a phone number activated, which
`allows it to send and receive calls). Before announcing IP addresses, ISPs and hosting
`companies often check WHOIS to confirm that the party seeking the announcement is the
`listed registrant. If the party seeking to announce the IP addresses is not the listed registrant,
`
`
`4 This contact information includes the name of the individual designated as the point of
`contact, their email address, and telephone number.
`12
`Government’s Trial Memorandum
`
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6507 Page 13 of 38
`
`
`one means of claiming authorization is a document known as a “Letter of Authority” or
`“LOA.”
` IP addresses can be leased temporarily, as well as permanently transferred. To
`validate the use of a block of IP addresses by a company or domain other than the IP block’s
`registrant, hosting companies and ISPs generally request a LOA from the registrant stating
`that the user is authorized by the registrant.
`ISPs such as Microsoft and Yahoo routinely employ filters to block unwanted
`commercial email (spam) from reaching a recipient’s inbox and to redirect such email to a
`junk mail or spam folder. These filters also often also block other emails associated with
`suspected junk mail or spam, including emails sent by the same person or company, or by
`the same IP address or domain. The ISPs subscribe to various services to obtain the
`information used in determining which IP addresses or domains to filter, including the
`services Spamhaus and SpamCop.
`A larger netblock can be broken up into smaller netblocks utilizing a process called
`SWIP to reassign blocks of IP addresses. SWIP is an acronym for the Shared WHOIS
`Project, which established a process used to submit, maintain, and update information on
`WHOIS records, reflecting the names and contact information for the authorized users of
`various subnetblocks of IP addresses. If a smaller subnetblock with a distinct SWIP
`registration was blocked by the spam filter of an ISP, it would not necessarily affect the
`remaining IP addresses in the larger netblock assigned to a different SWIP entry, and the
`IP addresses for that different SWIP entry could therefore continue to be used to send mail.
`By trying to register SWIPs associated with DBAs, false contact names, and domains and
`post office boxes associated with the DBAs (but controlled by the defendants), the
`defendants attempted to conceal their association with the hijacked netblocks, as well as
`their identity as the senders of spam.
`B. PURCHASE AND UNAUTHORIZED USE OF THE GETADS NETBLOCKS
`Between December 2010 and September 2014, the four defendants, Jacob Bychak,
`Mark Manoogian, Abdul Mohammed Qayyum, and Petr Pacas worked together to acquire
`13
`
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6508 Page 14 of 38
`
`
`and use netblocks registered to other organizations and people so that their employers
`Company A and Company B, which were both affiliate marketing companies owned and
`overseen by CC-1, could use those netblocks to send millions of commercial mail
`messages. They were joined in this conspiracy by coconspirators that included Daniel Dye
`and Vincent Tarney, who are charged separately.5 Dye and Tarney helped the defendants
`acquire and use these netblocks by providing forged or fraudulent LOAs that, Dye, Tarney,
`and the defendants submitted to various internet service providers.6 CC-2 and CC-3 helped
`facilitate the scheme by discussing the sale of the netblocks with Dye (CC-2 and CC-3)
`and by coming up with the initial proposal that Dye brought to Company A (CC-3).
`In particular, in December 2010, Pacas, Company A’s then-Director of Operations,
`received an email from a co-worker stating, “Hey man, Very hush hush, but get ads has 7
`/16’s that they are not using.” The co-worker provided Pacas with the contact information
`for Daniel Dye at a company called GetAds. At the time, both Dye and his employer
`GetAds were involved in the affiliate marketing industry, which included sending bulk
`commercial mail messages and placing digital ads both for themselves and for other
`affiliate marketers, including Company A.
`In January 2011, Pacas, along with CC-1, received an email from Dye with the
`WHOIS registry information for four Class B netblocks, none of which were registered to
`Dye or GetAds, which Dye was selling for $125,000/each. In the email, Dye wrote, “You
`would be purchasing the full [IP] block, domain name, etc. It is not a lease.” The offering
`price was roughly equal to the price that Company A paid to lease a netblock of equal size
`
`
`5 Both Dye and Tarney have pled guilty to conspiring with the defendants to violate the
`CAN-SPAM Act and will be testifying as witnesses for the government.
`
` 6
`
` Manoogian and Qayyum also prepared and modified forged or fraudulent LOAs sent to
`various internet service providers.
`
`Government’s Trial Memorandum
`
`18cr4683-GPC
`
`14
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`

`

`Case 3:18-cr-04683-GPC Document 424 Filed 05/16/22 PageID.6509 Page 15 of 38
`
`
`for two months. Pacas, in turn, forwarded Dye’s email to his coworkers Bychak and
`Qayyum, and asked them to research the IPs, which Qayyum did.7
`In January and February 2011, Dye exchanged multiple emails and phone calls with
`Pacas, including a February 2011 conference call that included Bychak and CC-3. During
`this call, the conspirators discussed the plan to control and use older netblocks by
`impersonating the organizations to which the netblocks were registered. On March 2, 2011,
`Pacas’s employer, Company A, wired $125,000 to GetAds (Dye’s employer). The wire
`transfer indicated it was for the IP netblock 168.129