Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 1 of 9 - Page ID#: 1 ~~of~ PILI D UNITED ST ATES DISTRICT COURT EASTERN DISTRICT OF KENTUCKY CENTRAL DIVISION LEXINGTON JUL - 7 2016 AT LEXINGTON ROBERT R. CARR CLERK U.S. DISTRICT COURT UNITED STATES OF AMERICA INDICTMENT NO . .5; J ~ · (L - ~l ::Y(_p'- v. DERIC LOSTUTTER * * * * * THE GRAND JURY CHARGES: COUNTl 18 u.s.c. § 371 1. At all times relevant to this Indictment: 2. Defendant DERIC LOSTUTTER resided in Clark County, in the Eastern District of Kentucky, and used an online account with the identity "KYAnonymous." 3. Co-conspirator 1 resided in the Eastern District of Virginia, and used an online account with the identity "JustBatCat." 4. Victim 1 was a resident of Steubenville, Ohio, and operated a fan website for Steubenville High School athletics. 5. On or about August 22, 2012, two Steubenville High School athletes were arrested by the Steubenville Police Department for the August 12, 2012 rape of a high school student in Steubenville, Ohio. 6. From on or about December 21, 2012. and continuing through at least on or about December 25, 2012, in the Eastern District of Kentucky and elsewhere, Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 2 of 9 - Page ID#: 2 DERIC LOSTUTTER, together with others, knowingly and intentionally joined and voluntarily participated in a conspiracy and agreement to commit offenses against the United States, that is, intentionally and without authorization accessing a computer used in or affecting interstate or foreign commerce or communication, and thereby obtaining information from a protected computer, in furtherance of a criminal and tortious act in violation of the laws of the states of Ohio and Kentucky, specifically invasion of privacy, libel, Ohio Revised Code§§ 2909.07(A)(6)(a), 2913.04(B), and Kentucky Revised Statutes §§ 434.853, 526.050, 526.060. All in violation of 18 U.S.C. § 1030(a)(2)(C) and 18 U.S.C. § 1030(c)(2)(B)(ii). OBJECT OF THE CONSPIRACY 7. The object of the conspiracy was that Defendant DERIC LOSTUTTER and others gain unauthorized access to the website and e-mail account of Victim 1, harass and intimidate Victim 1 and others, and gain publicity for their online identities. OVERT ACTS 8. In furtherance of the conspiracy and to advance the object of the conspiracy, one or more of the co-conspirators committed at least one of the following overt acts, among others, in the Eastern District of Kentucky and elsewhere: 9. On or about December 21, 2012, Defendant DERIC LOSTUTTER sent Coconspirator I a message asking Co-conspirator I to work for him as part of a computer hack to draw attention to the August 12, 2012 rape in Steubenville, Ohio. 2 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 3 of 9 - Page ID#: 3 10. On or about December 21, 2012. Defendant DERIC LOSTUTTER sent Coconspirator 1 a message instructing Co-conspirator 1 to gain access to Victim 1's website. 11. On or about December 23, 2012, Co-conspirator 1 created an account on a virtual private networking service to anonymize his Internet activity. 12. On or about December 23, 2012, Defendant DERIC LOSTUTTER and Coconspirator 1 gained unauthorized access to the e-mail account of Victim 1 and obtained information stored on Victim l's e-mail account, including nude pictures belonging to other Victims. 13. On or about December 23, 2012, Defendant DERIC LOSTUTTER and Coconspirator 1 accessed Victim l's e-mail account and downloaded Victim l's e-mails without authorization. 14. On or about December 23, 2012, Defendant DERIC LOSTUTTER and Coconspirator 1 gained unauthorized access to the password-protected account management page of Victim l's website, and changed the administrator password for Victim l's website. 15. On or about December 23, 2012, Defendant DERIC LOSTUTTER and Coconspirator 1 changed an administrator e-mail address for Victim l's website. 16. On or about December 23, 2012, Defendant DERIC LOSTUTTER filmed a video of himself in a mask and wrote a manifesto in which he admitted accessing Victim l's e-mail account and website account management page, issued threats that he would disclose the personal identifying information of Steubenville High School students, and 3 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 4 of 9 - Page ID#: 4 falsely claimed that Victim 1 was a child pornographer and directed a "rape crew." 17. On or about December 23, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message instructing Co-conspirator 1 to publicly post the video and the manifesto to Victim 1's website, and to also publicly post an electronic link to download Victim 1's e-mails, including the nude pictures belonging to other Victims. 18. On or about December 23, 2012, Co-conspirator 1 publicly posted to Victim l's website the video, the manifesto, and the link to download Victim l's e-mails. 19. On or about December 23, 2012, Defendant DERIC LOSTUTTER accessed the password-protected account management page of Victim l's website without authorization. 20. On or about December 23, 2012, Defendant DERIC LOSTUTTER changed the administrator usemame and password for Victim 1's website, to prevent Victim 1 from regaining control of the website. 21. On or about December 23, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 messages containing the new administrator usemame and password for Victim l's website. 22. On or about December 23, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message instructing Co-conspirator 1 to delete electronic evidence of their access to the password-protected account management page of Victim 1's website, to avoid detection of their actual identities. 23. On or about December 24, 2012, Defendant DERIC LOSTUTTER sent Co- 4 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 5 of 9 - Page ID#: 5 conspirator l a message promising to share credit with Co-conspirator 1 to increase the publicity and reputation for Co-conspirator l's online identity. 24. On or about December 24, 2012, Defendant DERIC LOSTUTTER accessed the password-protected account management page of Victim l's website without authorization. 25. On or about December 24, 2012, Co-conspirator 1 registered a new Internet host for Victim 1's website name, to prevent Victim 1 from regaining control of the website. 26. On or about December 24, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message asking whether the change of the Internet host for Victim 1's website name had been completed. 27. On or about December 24, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message suggesting how to post the video to the new Internet host. 28. On or about December 24, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message asking that he post the manifesto to the new Internet host. 29. On or about December 24, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message advising Co-Conspirator 1 how to promote publicity for the computer hack and for their online identities. 30. On or about December 25, 2012, Defendant DERIC LOSTUTTER sent Coconspirator 1 a message instructing Co-conspirator 1 to delete electronic evidence of their access to the password-protected account management page of Victim l's website, to 5 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 6 of 9 - Page ID#: 6 avoid detection of their actual identities. All in violation of 18 U.S.C. § 371. COUNT2 18 U.S.C. § 1030(a)(2)(C) 31. All above allegations are re-alleged and incorporated by reference. 32. On or about and between December 23, 2012 and December 24, 2012, in the Eastern District of Kentucky, DERIC LOSTUTTER intentionally and without authorization accessed a computer used in or affecting interstate or foreign commerce or communication, and thereby obtained information from a protected computer, and the offense was committed in furtherance of a criminal and tortious act in violation of the laws of the states of Ohio and Kentucky, specifically invasion of privacy, libel, Ohio Revised Code§§ 2909.07(A)(6)(a), 2913.04(B), and Kentucky Revised Statutes§§ 434.853, 526.050, 526.060. All in violation of 18 U.S.C. § 1030(a)(2)(C) and 18 U.S.C. § 1030(c)(2)(B)(ii). COUNT 3 18 U.S.C. § 1030(a)(S)(A) 18 u.s.c. § 2 33. All above allegations are re-alleged and incorporated by reference. 34. On or about December 23, 2012, in the Eastern District of Kentucky, DERIC LOSTUTTER, aided and abetted by another, knowingly caused the transmission of programs, information, code, and commands, and as a result of such conduct, intentionally and 6 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 7 of 9 - Page ID#: 7 without authorization caused damage to a protected computer, used in or affecting interstate or foreign commerce or communication. All in violation of 18 U.S.C. § 1030(a)(5)(A), 18 U.S.C. § 1030(c)(4)(G), and 18 U.S.C. § 2. COUNT 4 18 U.S.C. § 1001(a)(2) 35. All above allegations are re-alleged and incorporated by reference. 36. On or about April 16, 2013, in Clark County, in the Eastern District of Kentucky, DERIC LOSTUTTER did willfully and knowingly make, among others, at least one materially false, fictitious, and fraudulent statement and representation in a matter within the jurisdiction of the Federal Bureau of Investigation, an agency of the executive branch of the government of the United States, by stating in an investigative interview with FBI agents that he had not written the manifesto posted to Victim I's website, that he had not accessed the password-protected account management page of Victim l's website, and that he had not changed the administrator password for Victim l's website. Each of these statements 7 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 8 of 9 - Page ID#: 8 was materially false, as DERIC LOSTUTTER then and there knew. All in violation of 18 U.S.C. § 100l(a)(2). A TRUE BILL g ~~ KERR~. HAR=vEfi UNITED STATES ATTORNEY 8 Case: 5:16-cr-00062-DCR-REW Doc #: 1 Filed: 07/07/16 Page: 9 of 9 - Page ID#: 9 PENALTIES COUNTS 1-2, 4: Not more than 5 years imprisonment, $250,000 fine, and 3 years supervised release. COUNT 3: Not more than 1 year imprisonment, $100,000 fine, and 1 year supervised release. PLUS: Mandatory special assessment of $100 for Counts 1, 2, and 4; Mandatory special assessment of $25 for Count 3. PLUS: Restitution, if applicable. 9