Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 1 of 25 1 2 3 4 5 6 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE 7 8 9 AT&T MOBILITY LLC, No. 10 11 12 13 14 15 Plaintiff, COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF v. MARC SAPATIN, SAPATIN NGUYEN ENTERPRISES, INC., SAPATIN ENTERPRISES, INC., NGUYEN LAM, KYRA EVANS, PRASHANT VIRA, SWIFT UNLOCKS, INC. and JOHN DOES 1-50, United States individuals and entities, JURY TRIAL DEMANDED Defendants. 16 17 18 19 Plaintiff AT&T Mobility LLC (“AT&T”) hereby files this Complaint for Damages and Injunctive Relief against Defendants Marc Sapatin, Sapatin Nguyen Enterprises, Inc., 20 Sapatin Enterprises, Inc., Nguyen Lam, Kyra Evans, Prashant Vira, Swift Unlocks, Inc. and 21 John Does 1-50 and states: 22 23 NATURE OF ACTION 1. This is an action for damages arising out of Defendants’ participation in a 24 conspiracy to fraudulently abuse AT&T’s computer systems in order to illegally “unlock” 25 26 wireless telephones used on AT&T’s network. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 1 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 2 of 25 1 2 3 4 2. As set forth in greater detail below, Defendants engaged in, and knowingly facilitated and encouraged others to engage in, a scheme using an unauthorized computer program to attack AT&T’s protected computer systems and illegally “unlock” wireless phones for use on other networks (the “Unlock Scheme”). 5 6 7 3. “Unlocking” a phone disables certain software pre-installed by the phone manufacturers, which is designed to limit the activation of the phones exclusively to AT&T’s 8 network. Once a phone is unlocked, it can be used on multiple carrier systems rather than 9 exclusively with AT&T. 10 11 4. The software is vital to AT&T’s business because it allows AT&T to subsidize the cost of the phone to consumers while protecting AT&T’s investment in the phones 12 through term contracts. The software also protects AT&T’s goodwill with respect to phones 13 14 15 16 that carry AT&T’s brand, because some of the phones’ functionality may not work as effectively on non-AT&T networks. 5. Defendants perpetuated the Unlock Scheme by creating, distributing, and 17 placing on AT&T’s computer systems a “malware” program designed to fraudulently, and 18 without authorization, transmit unlock requests that unlocked hundreds of thousands of 19 phones from exclusive use on AT&T’s network. 20 6. Through this conduct, the Unlock Scheme caused substantial damage to 21 22 23 AT&T’s protected computer systems and effectively stole AT&T’s subsidy investment in its phones. 24 25 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 2 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 3 of 25 PARTIES 1 2 3 4 7. Plaintiff AT&T Mobility LLC is a limited liability company organized and existing under the laws of the state of Delaware. AT&T’s principal place of business is 1025 Lenox Park Boulevard NE, Atlanta, Georgia 30319. 5 8. Defendant Marc Sapatin is an individual resident of the state of Washington. 6 7 8 9 Sapatin may be served with a summons and a copy of this complaint at 6713 74th Drive NE, Marysville, WA 98270-6506. 9. Defendant Nguyen Lam is an individual resident of the state of Washington. 10 Lam may be served with a summons and a copy of this complaint at 9905 32nd Drive SE, 11 Everett, WA 98208-3100. 12 10. Defendant Kyra Evans is an individual resident of the state of Washington. 13 Evans may be served with a summons and a copy of this complaint at 1002 12th Street, No. 14 15 16 208, Auburn, WA 98002-6271. 11. Defendant Sapatin Nguyen Enterprises, Inc. (“SNE”) is a corporation 17 organized and existing under the laws of the state of Washington. Filings made with the 18 Washington Secretary of State do not identify SNE’s principal place of business, but state that 19 20 its President, Treasurer, and Chairman, Marc Sapatin, is located at 15907 Ash Way, Apt. C202, Lynnwood, Washington 98087 and that its Vice-President and Secretary, Mike 21 22 23 Nguyen, is located at 12303 Harbour Pointe Boulevard, Apt. C208, Mukilteo, Washington 98275. SNE may be served through its registered agent for service of process, Marc Sapatin, 24 at 20815 67th Avenue West, Suite 202/203, Lynwood, Washington 98036-7359, or through 25 any office, managing or general agent, or other agent authorized by appointment or law to 26 receive service of process at the office address denoted above. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 3 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 4 of 25 12. 1 2 3 4 5 6 7 Defendant Sapatin Enterprises Inc. (“SE”) is a corporation organized and existing under the laws of the state of Washington. Filings made with the Washington Secretary of State do not identify SNE’s principal place of business, but state that SE’s address is P.O. Box 2424, Lynnwood, Washington 98036. SE may be served through its registered agent for service of process, Marc Sapatin, at 19131 56th Avenue West, Lynnwood, Washington 98036, or through any office, managing or general agent, or other agent 8 authorized by appointment or law to receive service of process at the office address denoted 9 above. 10 11 13. Defendant Prashant Vira is an individual doing business as Swift Unlocks and residing in the state of California. Vira may be served with a summons and a copy of this 12 complaint at 8504 East Woodcove Dr., #126, Anaheim, California 92808. 13 14. 14 Defendant Swift Unlocks, Inc. is a corporation organized and existing under 15 the laws of the state of California. Its principal place of business is 751 S. Weir Canyon Road, 16 Suite 157-345, Anaheim, California 92808. Swift Unlocks may be served through its 17 registered agent for service of process, Michael S. Weigold, at 635 N. Eckhoff Street, Suite B, 18 Orange, California 92868, or through any office, managing or general agent, or other agent 19 authorized by appointment or law to receive service of process at the office address denoted 20 above. 21 22 15. Upon information and belief, John Doe Defendants 1-50 jointly participated in 23 the development of software used in the illegal and fraudulent scheme at issue in this 24 complaint, the provision of that software to current and former AT&T employees, payment to 25 current and former AT&T employees for their unauthorized installation of the software on 26 AT&T’s protected computer systems, and the resale of phones that were fraudulently COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 4 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 5 of 25 1 unlocked without AT&T’s authorization or consent as a result of Defendants’ scheme. AT&T 2 will amend this complaint to allege the John Doe Defendants’ true names and capacities when 3 4 ascertained. AT&T will exercise due diligence to determine the John Doe Defendants’ true names, capacities, and contact information to effect service upon the John Doe Defendants. 5 6 7 16. AT&T is informed and believes and thereupon alleges that each of the fictitiously named Doe Defendants is responsible in some manner for the occurrences herein 8 alleged and that AT&T’s injuries as herein alleged were proximately caused by such 9 Defendants. 10 11 JURISDICTION AND VENUE 17. The Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. 12 § 1331 because AT&T’s claims for violations of the Computer Fraud and Abuse Act, 18 13 14 U.S.C. § 1030, et seq. arise under federal law. The Court also has subject matter jurisdiction 15 pursuant to 28 U.S.C. § 1332 because AT&T is a citizen of Delaware and Georgia, the 16 Defendants are citizens of Washington and California, and this case involves claims 17 exceeding $75,000 in damages, not including interest and costs. The Court has supplemental 18 subject matter jurisdiction over AT&T’s state law claims pursuant to 28 U.S.C. § 1367 19 because those claims are so related to the federal claims that they form part of the same case 20 or controversy. 21 22 18. Venue is proper in this judicial district pursuant to 28 U.S.C. § 1391(b) 23 because a substantial part of the events or omissions giving rise to AT&T’s claims occurred 24 within this judicial district. 25 26 19. This Court has personal jurisdiction over the Defendants either by residence or because Defendants have conducted, engaged in, and carried out business ventures within the COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 5 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 6 of 25 1 state of Washington, have committed torts within or directed at the state of Washington, and 2 have engaged in substantial and not isolated activity within the state of Washington. 3 FACTUAL BACKGROUND 4 5 AT&T’S BUSINESS AND SERVICES 20. AT&T is one of the nation’s largest wireless carriers, with millions of 6 7 8 9 subscribers using AT&T’s wireless voice and data network. 21. AT&T enables customers to choose from a variety of monthly voice and data plans for use with devices on the AT&T wireless network. In addition to being available on 10 AT&T’s website and in its stores, AT&T phones and wireless services are sold through 11 authorized AT&T dealers and retailers across the country. 12 22. AT&T’s business model is based upon AT&T’s ability to deliver an affordable 13 and cutting edge product to its customers. At all times relevant to this Complaint, AT&T 14 15 offered subsidies to its customers by selling the phones for substantially less than the phones 16 cost AT&T to assist customers with the acquisition of AT&T phones. AT&T recouped this 17 subsidy through profits earned on the sale of AT&T’s wireless services, including calls, text 18 messages, and transmission of data through AT&T phones. AT&T was able to offer its 19 phones to customers at reduced prices because of the revenue AT&T generated when the 20 phones were used as intended on the AT&T wireless network for the term of the contract. 21 23. AT&T’s subsidy program was designed to ensure that AT&T customers have 22 23 access to the newest technology, in order to provide customers with the best possible wireless 24 service experience. Providing customers with the latest equipment also helps AT&T maintain 25 the efficiency of its wireless network and facilitates the migration of customers from older 26 technologies to newer products. AT&T offers new phones, upgraded with the latest COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 6 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 7 of 25 1 technology, to its customers at the inception of a new customer account and at various 2 intervals during the customer’s tenure. 3 4 24. Manufacturers that produce wireless phones for AT&T install proprietary locking software into AT&T phones. Among other things, this locking software prevents the 5 6 7 8 9 10 11 phones from being used on any wireless network other than the AT&T network unless and until the phones are unlocked. 25. Like all wireless carriers in the United States, AT&T has policies in place to unlock phones for customers in certain circumstances. One example is when a customer wishes to use her phone for international travel. 26. The Wireless Customer Agreement entered into between AT&T and each of its 12 customers also authorizes AT&T to effectuate the unlocking of a customer’s phone upon the 13 14 15 16 17 satisfaction of certain criteria. In 2013, AT&T customers were only permitted to unlock five phones per account per year under their Wireless Customer Agreements. 27. Defendants and others who improperly unlocked phones for the purpose of illicitly profiting from the resale of the unlocked phones were not authorized to do so. 18 19 DEFENDANTS’ UNLOCK SCHEME 28. The practice of locking cell phones has been an essential part of the wireless 20 industry’s business model for many years and has been used by many major wireless 21 22 23 providers. 29. Unlocked phones – which can be sold and used on any other compatible 24 network anywhere around the world – are therefore a valuable commodity in secondary resale 25 markets. 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 7 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 8 of 25 1 2 3 4 30. The wireless industry has frequently fallen victim to large-scale phone trafficking operations in which illegal operators buy or steal large quantities of phones (prepaid or with term contracts), unlock them, and resell them in foreign markets that do not subsidize the devices. 5 31. Accordingly and unfortunately, illicit bulk unlock schemes are not uncommon. 32. Defendants here engaged in just such a scheme. 8 A. AT&T’s Discovery of Increased Unlock Requests 9 33. In 2013, AT&T employed Defendants Evans, Sapatin, and Lam as Customer 6 7 10 11 Support Specialists in its Bothell, Washington Mobility Customer Care call center. 34. As Customer Care Support Specialists, Defendants Evans, Sapatin, and Lam 12 had access to AT&T’s computer systems in order to assist AT&T customers with service and 13 14 billing issues. They also had the ability to submit unlock requests on behalf of eligible 15 customers. 16 35. AT&T authorizes customer care personnel to utilize a web-based application, 17 now referred to as “Torch,” to research and troubleshoot customer service issues. Access to 18 Torch is limited to authenticated users connected to AT&T’s internal and protected corporate 19 network. 20 36. In addition to resolving service and billing issues, Torch permits users with the 21 22 proper authorization to, in appropriate circumstances, send requests to unlock the phones of 23 AT&T customers. 24 37. 25 26 Based on the credentials that users must provide to log into the Torch program, all unlocking transactions can be traced to the specific AT&T employee that sent the unlock request. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 8 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 9 of 25 1 2 3 4 38. On or around September 26, 2013, AT&T Asset Protection (“AP”) personnel received information from the Torch technical support team that suggested abuse of the Torch program may have caused a recent surge in requests to unlock phones from AT&T’s wireless network. AT&T AP personnel began an investigation into the potential compromise of the 5 6 7 Torch program. 39. AT&T’s investigation revealed that the employee credentials of Defendants 8 Evans and Sapatin were associated with disproportionately large instances of use of Torch’s 9 “unlocking” function during the relevant time period. 10 11 40. AT&T’s review of the unlock requests associated with Defendants Evans and Sapatin further revealed that the unlock requests occurred within milliseconds of one another, 12 suggesting the use of an automated or scripted process to unlock devices, rather than manual 13 14 submission of unlock requests in the ordinary course of business. 15 B. Defendant Evans’s Participation in the Unlock Scheme 16 41. A review of Evans’s computer by AT&T AP personnel revealed the presence 17 18 19 of unusual and unauthorized malware programs. 42. “Malware” is a term that means “malicious software” and refers to software designed to damage or disable computers or computer systems. 20 43. The nature and characteristics of the malware files on Evans’s computer 21 22 23 24 25 26 indicated that she received and installed the files manually on AT&T’s protected computer systems. 44. Once placed on AT&T’s computer network by Evans, the malware permitted commands issued from a remote and unauthorized server, external to AT&T, to be communicated to the Torch program through Evans’s infected computer. Through these COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 9 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 10 of 25 1 external commands, the malware program used valid customer service personnel 2 identification numbers, including those of Defendants Evans, Sapatin, and Lam, to process 3 4 automated unlock requests without AT&T’s authorization. 45. Investigation of Evans’s computer file activity during the relevant time period 5 6 7 revealed that, from April to September 2013, Evans downloaded to and accessed from AT&T’s protected computers numerous malware programs, which were intended to and 8 actually did transmit or facilitate the transmission of fraudulent and unauthorized unlock 9 requests through the Torch program, resulting in the unauthorized unlocking of thousands of 10 11 phones on AT&T’s wireless network. 46. The multiple malware programs downloaded and accessed by Evans 12 progressed from early iterations, which gathered confidential and proprietary information on 13 14 15 16 how internal AT&T applications worked, to the final version, which was ultimately unlocking thousands of AT&T devices per day through the compromised Torch program. 47. Upon information and belief, the early iterations of the malware programs 17 gathered confidential and proprietary information regarding AT&T’s internal applications and 18 computer systems and transmitted that information to John Doe Defendants 1-50 through the 19 remote server. The John Doe Defendants used that information to adjust the malware to 20 specifically facilitate the hacking of the Torch application and then sent revised malware files 21 22 23 24 25 26 to Evans for installation. 48. As a result of Evans’s conduct, thousands of unauthorized and fraudulent unlock requests were transmitted under her employee identification number. 49. Evans’s access to and/or execution of the malware programs was done intentionally, knowingly, and with intent to harm and defraud AT&T and was without COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 10 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 11 of 25 1 authorization by AT&T or in excess of her authorized access to AT&T’s protected computer 2 systems. 3 4 50. Defendant Vira, doing business as Swift Unlocks (together with Swift Unlocks, Inc., “Swift Unlocks”), paid Evans at least $20,000 for her placement and/or 5 6 7 8 9 10 11 execution of the malware programs on AT&T’s protected computer systems for the purpose of securing the fraudulent unlocks. 51. Evans took action to conceal or delete her fraudulent and unauthorized activities on AT&T computers. 52. In October 2013, Evans went on medical leave. She returned to work in February 2014, and was subsequently placed on administrative leave pending the outcome of 12 AT&T’s investigation into the Torch malware attack. Evans was directed to return to work on 13 14 February 20, 2014, but declined to do so. She is no longer employed by AT&T. 15 C. Defendant Sapatin’s Participation in the Unlock Scheme 16 53. Defendant Sapatin’s employee credentials were associated with the largest 17 number of unlock requests during the relevant time period. When AT&T AP personnel 18 collected and reviewed Sapatin’s computers in late September or early October 2013, many of 19 the same malware programs present on Evans’s computers were found on Sapatin’s 20 computers. 21 22 54. As with Evans’s malware, the nature and characteristics of the malware files 23 on Sapatin’s computer indicated that he received and installed the files manually on AT&T’s 24 protected computer systems. 25 26 55. The investigation of Sapatin’s file activity during the relevant time period revealed that, from April to October 2013, Sapatin downloaded to and accessed from AT&T’s COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 11 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 12 of 25 1 protected computers numerous malware programs, which were intended to and actually did 2 transmit or facilitate the transmission of fraudulent and unauthorized unlock requests through 3 4 the Torch program, resulting in the unauthorized unlocking of thousands of phones on AT&T’s wireless network. 5 6 7 8 9 10 11 56. As a result of Sapatin’s conduct, thousands of unauthorized and fraudulent unlock requests were made under his employee identification number. 57. Sapatin’s access and/or execution of the malware programs was done intentionally, knowingly, and with intent to harm and defraud AT&T and was without authorization by AT&T or in excess of his authorized access to AT&T’s protected computer systems. 12 58. Upon information and belief, Swift Unlocks paid Sapatin at least $10,500 for 13 14 15 16 17 18 19 his access and/or execution of the malware programs on AT&T’s protected computer systems for the purpose of securing the fraudulent unlocks. 59. Sapatin took action to conceal or delete his fraudulent and unauthorized activities on AT&T computers. 60. After being interviewed by AT&T AP, Sapatin left the company in October of 2013, purportedly for unrelated reasons, and is no longer employed by AT&T. 20 D. Defendant Lam’s Participation in the Unlock Scheme 61. During the investigation of Defendants Evans and Sapatin, AT&T AP 21 22 23 personnel began monitoring the Internet Protocol (“IP”) address of the remote server under 24 external control that issued commands to the Torch program through the malware. During this 25 monitoring, AT&T AP personnel observed Defendant Lam’s computer connecting to the 26 remote server. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 12 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 13 of 25 1 2 3 4 62. AT&T AP collected and reviewed Lam’s computers in October of 2013. The same malware present on the computers of Evans and Sapatin was also found on Lam’s computers. 63. As with Evans and Sapatin’s malware, the nature and characteristics of the 5 6 7 8 9 10 11 malware files on Lam’s computer indicated that he received and installed the files manually on AT&T’s protected computer systems. 64. AT&T AP personnel’s October investigation of Lam’s file activity revealed that, during September 2013, Lam downloaded to and accessed from AT&T’s protected computers numerous malware programs, which were intended to and actually did transmit or facilitate the transmission of fraudulent and unauthorized unlock requests using the Torch 12 program. 13 14 15 16 65. As a result of Lam’s conduct, thousands of unauthorized and fraudulent unlock requests were made under his employee identification number. 66. Lam’s access and/or execution of the malware programs was done 17 intentionally, knowingly, and with intent to harm and defraud AT&T and was without 18 authorization by AT&T or in excess of Lam’s authorized access to AT&T’s protected 19 computer systems. 20 67. Lam took action to conceal or delete his fraudulent and unauthorized activities 21 22 23 on AT&T computers. 68. As a result of AT&T’s investigation into the Unlock Scheme, Lam was 24 suspended and eventually terminated by AT&T. As with Sapatin and Evans, he is no longer 25 employed by AT&T. 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 13 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 14 of 25 1 E. Defendants Vira and Swift Unlocks, Inc.’s Participation in the Unlock Scheme 69. Prashant Vira, an individual doing business as Swift Unlocks, and/or Swift 2 3 4 Unlocks, Inc., operates a well-known website that markets unlocking services for consumers 5 using a wide variety of domestic and international wireless carriers, including AT&T. 6 7 8 70. The rates charged by Swift Unlocks vary by type of phone, carrier, and turnaround time required by the individual purchasing unlock services. 71. Swift Unlocks also allows individuals to become a reseller of its unlock 9 10 11 services. 72. Upon information and belief, Swift Unlocks has paid individuals, including 12 Defendants Evans and Sapatin, to illegally and without authorization unlock phones from the 13 networks of various wireless carriers, including AT&T. 14 15 73. While the complete extent of Swift Unlocks’s participation in the Unlock Scheme is not yet known, Swift Unlocks was actively involved in several integral parts of the 16 conspiracy; specifically, providing Defendants Evans, Sapatin, and Lam with the malware 17 18 that the former AT&T employees then installed and executed, without authorization or 19 consent, on AT&T’s protected computer systems and compensating Defendants Evans and 20 Sapatin (and Lam, through Sapatin) for their illegal and unauthorized actions. 21 F. Defendants’ Cooperation and Coordination in the Unlock Scheme 22 74. Upon information and belief, Defendants had an agreement and a conspiracy to 23 profit from their unauthorized and fraudulent access, manipulation, and use of AT&T’s 24 protected computers to unlock hundreds of thousands of AT&T phones. 25 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 14 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 15 of 25 1 2 3 4 75. The malware was developed for use in the Unlock Scheme by John Doe Defendants 1-50. Once the malware was placed on AT&T’s protected computer systems by Defendants Evans, Sapatin, and Lam, the John Doe Defendants then issued commands from the remote and unauthorized external server through the infected computers of Defendants 5 6 7 Evans, Sapatin, and Lam to improperly access the Torch program. The John Doe Defendants used confidential and proprietary information gathered and transmitted from the Torch 8 application to specifically tailor the malware to attack and alter the Torch application to 9 transmit hundreds of thousands of fraudulent and unauthorized unlock requests without 10 11 AT&T’s knowledge or consent. 76. Swift Unlocks and John Doe Defendants 1-50 provided Defendants Evans, 12 Sapatin, and Lam with the malware that the former AT&T employees then installed and 13 14 executed without authorization or consent on AT&T’s protected computer systems. After 15 their investigation into the potential compromise of the Torch program, which began on or 16 around September 26, 2013, AT&T AP personnel, in late September and in October 2013, 17 discovered this malware on the computers of Defendants Evans, Sapatin, and Lam. 18 19 77. The presence of the same malware specifically designed to attack AT&T’s internal programs on the computers of Defendants Evans, Sapatin, and Lam reflects their 20 cooperation and coordination with Swift Unlocks and John Doe Defendants 1-50 in 21 22 23 effectuating the Unlock Scheme. 78. Upon information and belief, Swift Unlocks and John Doe Defendants 1-50 24 paid Defendants Evans, Sapatin, and Lam for their illegal and unauthorized placement of the 25 malware on AT&T’s protected computer systems and execution of that malware. 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 15 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 16 of 25 1 2 3 4 79. Upon information and belief, John Doe Defendants 1-50 sold or otherwise benefitted from the unlocking of the phones effected by Defendants’ fraudulent and unauthorized Unlock Scheme. 80. Upon information and belief, Sapatin recruited Defendants Evans and Lam to 5 6 7 participate in the Unlock Scheme. 81. Sapatin also attempted to recruit other AT&T employees to participate in the 8 Unlock Scheme. Sapatin told at least one other AT&T employee he was trying to recruit that 9 he knew an individual that had paid to develop software designed to unlock phones. Sapatin 10 11 told the AT&T employee that she only had to click on a link provided by someone else involved in the Unlock Scheme to download the software, and the program would run 12 invisibly on his computer. Sapatin promised the employee that she would make $2,000 every 13 14 15 two weeks through her participation in the Unlock Scheme. 82. Sapatin also stated that he had a friend who started working at AT&T 16 specifically to further the Unlock Scheme. Upon information and belief, that friend is 17 Defendant Lam. 18 19 83. Sapatin further stated that there were many people across the country participating in the Unlock Scheme and others like it against different wireless carriers. Upon 20 information and belief, some of these individuals are the John Doe Defendants 1-50. 21 22 84. Defendant Sapatin incorporated two businesses in 2013, which were used in 23 furtherance of Defendants’ Unlock Scheme: Sapatin Enterprises Inc. and Sapatin Nguyen 24 Enterprises, Inc. 25 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 16 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 17 of 25 1 2 3 85. As a result of Defendants’ intentional and coordinated conspiracy, AT&T suffered damage to its protected computer systems and impairment of the Torch program and data, and hundreds of thousands of phones on AT&T’s network were illegally unlocked. 4 HARM CAUSED BY DEFENDANTS’ MISCONDUCT 5 6 7 8 9 10 11 86. Defendants’ misconduct has damaged the integrity and availability of AT&T’s Torch program and the related data associated with the program and the unlocked phones. It has also damaged Defendants’ computers infected with the malware. 87. Defendants’ misconduct has caused AT&T to incur significant losses, including, but not limited to, the costs associated with investigating and responding to the malware attack, assessing the damage caused by the malware attack, and restoring and 12 protecting the Torch program, the data associated with the program, and Defendants’ infected 13 14 15 computers. 88. Defendants’ actions also harmed AT&T by depriving AT&T of the 16 opportunity to recoup its subsidies on the sale of its phones and to earn profits by providing 17 wireless service to legitimate AT&T customers on the unlocked phones. 18 19 20 21 22 23 89. Defendants’ actions have also tarnished AT&T’s reputation and goodwill. COUNT I: COMPUTER FRAUD AND ABUSE ACT, 18 U.S.C. § 1030 (AGAINST ALL DEFENDANTS) 90. AT&T reasserts the allegations set forth in Paragraphs 1 – 89 as though fully set forth herein. 91. All computers used by Defendants without authorization or in excess of their 24 authorized access, or to damage, impair, access, or traffic AT&T information, including, but 25 26 not limited to, all servers, desktop computers, and laptop computers, were at all relevant times COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 17 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 18 of 25 1 used in interstate commerce and are protected computers under the Computer Fraud and 2 Abuse Act (“CFAA”), 18 U.S.C. § 1030(e). 3 4 A. Violation of Section 1030(a)(4) of the CFAA 92. Defendants Evans, Sapatin, and Lam knowingly, and with intent to defraud, 5 6 7 8 9 10 11 downloaded onto AT&T’s protected computers and executed the malware programs designed to defraud AT&T’s Torch program into unlocking phones on AT&T’s wireless network without AT&T’s knowledge or consent. 93. AT&T did not authorize Defendants Evans, Sapatin, and Lam to download and execute the malware. 94. Defendants’ conduct, which was intended to and actually did defraud AT&T, 12 exceeded their authorized access to AT&T’s protected computer systems, as defined by 13 14 15 Section 1030(e)(6) of the CFAA. 95. Downloading the malware onto AT&T’s protected computer systems and 16 executing that malware was an integral part of the fraudulent Unlock Scheme and in fact 17 furthered that scheme. As a result of their participation in this scheme, Defendants Evans, 18 Sapatin, and Lam obtained information regarding AT&T’s internal applications, secured the 19 unlocking of hundreds of thousands of phones on AT&T’s network, and received cash 20 consideration, all of which are things of value. 21 22 96. By providing Defendants Evans, Sapatin, and Lam with the malware specially 23 designed to attack AT&T’s protected computer systems and compensating Defendants for 24 downloading that malware onto AT&T’s protected computer systems, Swift Unlocks and 25 John Doe Defendants 1-50 knowingly, intentionally, and with the intent to defraud, facilitated 26 the unauthorized access of AT&T’s protected computer networks. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 18 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 19 of 25 1 2 3 4 97. As a result of their participation in this scheme, Swift Unlocks and John Does 1-50 at a minimum obtained information regarding AT&T’s internal applications and secured the unlocking of hundreds of thousands of phones on AT&T’s network, both of which are things of value. 5 6 7 98. Accordingly, the conduct of all Defendants constitutes unauthorized access of AT&T’s protected computer systems in violation of Section 1030(a)(4) of the CFAA. 8 B. Violation of Section 1030(a)(5)(A) of the CFAA 9 99. Defendants knowingly caused the transmission of the malware, which 10 11 constitutes a program, code, or command under Section 1030(a)(5)(A) of the CFAA, onto AT&T’s protected computer systems. 12 100. By downloading and executing the malware on AT&T’s protected computer 13 14 15 16 systems, Defendants Evans, Sapatin, and Lam knowingly caused the transmission of the malware and intentionally caused damage to AT&T’s protected computer systems. 101. By providing Defendants Evans, Sapatin, and Lam with the malware specially 17 designed to attack AT&T’s protected computer systems and compensating Defendants for 18 downloading that malware onto AT&T’s protected computer systems, Swift Unlocks and 19 John Doe Defendants 1-50 knowingly caused the transmission of the malware to AT&T’s 20 protected computer systems without authorization from AT&T and intentionally caused 21 22 23 damage to AT&T’s protected computer systems. 102. AT&T did not authorize Defendants to transmit the malware onto AT&T’s 24 protected computer systems. Defendants’ transmission was without AT&T’s knowledge or 25 consent. 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 19 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 20 of 25 1 2 3 4 103. Accordingly, the conduct of all Defendants constitutes unauthorized transmission of a program, information, code, or command in violation of Section 1030(a)(5)(A) of the CFAA. C. Violation of Section 1030(a)(5)(C) of the CFAA 104. Defendants Evans, Sapatin, and Lam intentionally accessed AT&T’s protected 5 6 7 computers to download onto them the malware programs designed to defraud AT&T’s Torch 8 program into unlocking phones on AT&T’s wireless network without AT&T’s knowledge or 9 consent. AT&T did not authorize Defendants Evans, Sapatin, and Lam to download and 10 11 execute the malware. 105. The conduct of Defendants Evans, Sapatin, and Lam caused damage to 12 AT&T’s protected computers infected with the malware, as well as to the Torch application 13 14 15 and the data associated therewith, and loss to AT&T. 106. Accordingly, the conduct of Defendants Evans, Sapatin, and Lam constitutes 16 unauthorized access of AT&T’s protected computer systems in violation of Section 17 1030(a)(5)(C) of the CFAA. 18 19 D. Facts Common to All Violations 107. All Defendants knowingly and intentionally conspired to commit the offenses 20 detailed above. 21 22 108. Defendants’ unauthorized and fraudulent use of AT&T’s protected computer 23 systems has caused AT&T to suffer injury, with “damages” and “losses” – as those terms are 24 defined in Sections 1030(e)(8) and 1030(e)(11), respectively – substantially in excess of 25 $5,000 over a one-year period. 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 20 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 21 of 25 1 2 3 4 109. With respect to damage, by infecting AT&T’s protected computer systems with malware, Defendants have damaged and substantially impaired the integrity of the Torch program, its related data, and the computers infected by the malware in an amount in excess of $5,000 over a one-year period. Defendants’ actions have also deprived AT&T of the means 5 6 7 to control the quality of its products and services. 110. With respect to loss, Defendants’ actions have caused AT&T to spend well in 8 excess of $5,000 in a one-year period investigating and assessing the possible impairment to 9 the integrity of its protected computer systems, taking action to counteract Defendants’ 10 conduct, conducting a damage assessment regarding the myriad effects of the malware 11 infection, and restoring and protecting the Torch program. Defendants’ conduct also deprived 12 AT&T of its subsidy investment in its phones and caused AT&T loss of revenue and 13 14 15 goodwill. 111. Because Defendants’ conduct involves at least one of the factors identified in 16 Section 1030(c)(4)(A)(i), and for the reasons set forth above, AT&T is entitled to assert this 17 civil action to obtain compensatory damages and injunctive relief pursuant to 18 U.S.C. § 18 1030(g). 19 20 21 22 23 COUNT II: BREACH OF THE DUTY OF LOYALTY (AGAINST EVANS, SAPATIN, AND LAM) 112. AT&T reasserts the allegations set forth in Paragraphs 1 – 89 as though fully set forth herein. 113. At all times relevant to this Complaint, Defendants Evans, Sapatin, and Lam 24 were employees of AT&T. 25 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 21 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 22 of 25 1 2 3 4 114. As employees of AT&T, Defendants Evans, Sapatin, and Lam had a duty of loyalty to AT&T. 115. By improperly using AT&T’s property and confidential information for their own benefit and for the benefit of Swift Unlocks and John Doe Defendants 1-50, Defendants 5 6 7 Evans, Sapatin, and Lam acted against the best interests of their employer, AT&T. 116. By downloading and executing the malware, which was designed and intended 8 to defraud AT&T, on AT&T’s protected computer systems, Defendants Evans, Sapatin, and 9 Lam acted against the best interests of their employer, AT&T. 10 11 117. By failing to disclose the Unlock Scheme to AT&T, Defendants Evans, Sapatin, and Lam acted against the best interests of their employer, AT&T. 12 118. By accepting undisclosed payments from Swift Unlocks for downloading and 13 14 15 16 17 18 19 executing the malware on AT&T’s protected computer systems, Defendants Evans, Sapatin, and Lam acted against the best interests of their employer, AT&T.. 119. Through the above-stated conduct, as well as that set forth in Paragraphs 1-89, Defendants Evans, Sapatin, and Lam breached their duty of loyalty to AT&T. 120. Defendants Evans, Sapatin, and Lam’s breach of their duty of loyalty to AT&T proximately caused AT&T damages in an amount to be determined at trial. 20 21 22 23 COUNT III: TORTIOUS INTERFERENCE WITH CONTRACT OR BUSINESS EXPECTANCY (AGAINST ALL DEFENDANTS) 121. AT&T reasserts the allegations set forth in Paragraphs 1 – 89 as though fully set forth herein. 24 122. AT&T has contractual relationships with its customers, which are governed by 25 26 AT&T’s Wireless Customer Agreements. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 22 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 23 of 25 1 2 3 4 123. In 2013, these contracts authorized unlocking of phones on AT&T’s wireless network only in certain circumstances and limited unlocking to five phones per account per year under their Wireless Customer Agreements. 124. As then-employees of AT&T, Defendants Evans, Sapatin, and Lam were 5 6 7 aware of the existence of AT&T’s contracts with its customers and the requirements for unlocking phones on AT&T’s wireless network. Upon information and belief, Swift Unlocks 8 and John Doe Defendants’ 1-50 were also aware of AT&T’s customer contracts due to the 9 nature of Swift Unlocks’s business and through the Unlock Scheme. 10 11 125. By unlocking the phones of customers who may have otherwise been ineligible to unlock those phones through the use of unauthorized malware intended to defraud AT&T, 12 Defendants intentionally interfered with AT&T’s customer contracts through improper means 13 14 15 16 17 18 19 20 and for an improper purpose, thereby causing a breach of those contracts and a loss of AT&T’s expectancy in future business with those customers. 126. Defendants’ tortious conduct proximately caused AT&T damages in an amount to be determined at trial. COUNT IV: UNJUST ENRICHMENT (AGAINST DEFENDANT JOHN DOES 1-50) 127. AT&T reasserts the allegations set forth in Paragraphs 1 – 89 as though fully set forth herein. 21 22 23 128. By reselling phones unlocked fraudulently and without authorization pursuant to the Unlock Scheme, Defendant John Does 1-50 have received economic benefits acquired 24 at AT&T’s expense. 25 129. 26 Defendants John Does 1-50 have acquired these benefits voluntarily and with full knowledge of the benefits. COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 23 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 24 of 25 1 2 3 4 130. Defendants John Does 1-50 have retained the benefits under such circumstances that make it unjust and inequitable for Defendant John Does 1-50 to retain such benefits without paying AT&T the value of the benefits Defendant John Does 1-50 acquired. 131. Accordingly, Defendants John Does 1-50 should disgorge their unjustly 5 6 received gains in an amount to be determined at trial. COUNT V: CIVIL CONSPIRACY 7 8 9 10 11 12 132. AT&T reasserts the allegations set forth in Paragraphs 1 – 89 as though fully set forth herein. 133. An agreement and conspiracy existed between and among the Defendants and other co-conspirators to unlawfully defraud AT&T by unlocking AT&T phones via the use of unauthorized malware on AT&T computers, which resulted in violations of the CFAA, 13 tortious interference with contract, and unjust enrichment to Defendants, among other things. 14 15 16 17 18 19 134. Each Defendant intentionally participated in the agreement and conspiracy. 135. Each Defendant knowingly agreed to engage, and did engage, in one or more overt acts in pursuit of the conspiracy as set forth with particularity above. 136. AT&T has been proximately damaged by the conspiracy and Defendants’ actions in furtherance thereof. 20 DEMAND FOR JURY TRIAL 21 22 137. AT&T demands a trial by jury on all triable issues. PRAYER FOR RELIEF 23 24 25 WHEREFORE, Plaintiff AT&T Mobility LLC respectfully requests that the Court enter final judgment in favor of AT&T and against Defendants as follows: 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 24 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022 Case 2:15-cv-01462-MAT Document 1 Filed 09/11/15 Page 25 of 25 (a) 1 2 3 Awarding AT&T its compensatory, consequential, and special damages including, without limitation, its lost profits, lost goodwill and damage to its reputation, and Defendants’ profits, together with pre and post-judgment interest, as provided by law; 4 (b) Awarding AT&T its reasonable attorneys’ fees and costs associated with this (c) Granting permanent injunctive relief in favor of AT&T and against Defendants 5 6 action; 7 8 enjoining Defendants from engaging in the unlawful practices described in this Complaint; 9 and 10 (d) Granting such further relief as this Court deems just and proper. 11 12 Respectfully submitted this 11th day of September, 2015. 13 /s/ David A. Bateman David Bateman, WSBA #14262 K&L GATES LLP 925 Fourth Avenue, Suite 2900 Seattle, WA 98104-1158 Phone: (206) 370-6682 david.bateman@klgates.com 14 15 16 17 David L. Balser, Georgia Bar No. 035835 (pro hac vice application forthcoming) Claire C. Oates, Georgia Bar No. 702045 (pro hac vice application forthcoming) KING & SPALDING LLP 1180 Peachtree St. NE Atlanta, Georgia 30309-3521 Tel: (404) 572-4600 Fax: (404) 572-5100 18 19 20 21 22 23 Counsel for Plaintiff AT&T Mobility LLC 24 25 26 COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF - 25 Case No. _______________ DMSLIBRARY01:26967226.1 K&L GATES LLP 925 FOURTH AVENUE SUITE 2900 SEATTLE, WASHINGTON 98104-1158 TELEPHONE: (206) 623-7580 FACSIMILE: (206) 623-7022