Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 1 of 19 PageID# 368 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Alexandria Division UNITED STATES OF AMERICA v. ARDIT FERIZI. a/k/a “Th3Dir3torY” Defendant. ) ) ) ) ) ) ) ) Criminal Case No. 1:16-cr-042 Hon. Leonie M. Brinkema Sentencing Hearing: Sept. 23, 2016 POSITION OF THE UNITED STATES WITH RESPECT TO SENTENCING The United States of America, by and through its attorneys, Dana Boente, United States Attorney for the Eastern District of Virginia, Brandon L. Van Grack, Special Assistant United States Attorney, and Gregory R. Gonzalez, Trial Attorney for the National Security Division’s Counterterrorism Section, in accordance with 18 U.S.C. § 3553(a) and the United States Sentencing Commission, Guidelines Manual (“U.S.S.G.” or the “Guidelines”) § 6A1.2, files this Position of the United States With Respect to Sentencing of the defendant, Ardit Ferizi. The United States submits that a sentence of 300 months (25 years) of imprisonment would be sufficient and not greater than necessary to satisfy the factors set forth in 18 U.S.C. § 3553(a). I. FACTUAL BACKGROUND On June 15, 2016, the defendant pleaded guilty to two counts in the Indictment: (i) providing material support to a designated foreign terrorist organization, in violation of 18 U.S.C. § 2339B (Count Two), and (ii) accessing a computer without authorization and obtaining information, in furtherance of his provision of material support to a designated foreign terrorist organization, in violation of 18 U.S.C. § 1030(a)(2)(C) (Count Three). The charges and plea stem from the defendant’s actions, beginning in April 2015, in support of the Islamic State of -1- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 2 of 19 PageID# 369 Iraq and the Levant (“ISIL”), a foreign terrorist organization that has called for attacks against United States citizens, including members of the military. The defendant supported ISIL in multiple ways, on multiple occasions, and has indefinitely put the lives of approximately 1,300 United States military members and government employees at risk. The defendant provided ISIL with private information from hundreds of United States citizens to facilitate ISIL’s efforts to spread its terror across the globe. On September 21, 2014, as ISIL metastasized in Syria and Iraq, one of its leaders, now-deceased spokesperson Abu Muhammad al-Adnani, called for attacks against citizens—civilian or military—of the United States and other countries participating in the United States-led coalition against ISIL. Thereafter, ISIL members, including now-deceased ISIL recruiter Junaid Hussain (“Hussain”), heeded Adnani’s call by facilitating attacks. In order to carry out ISIL’s plan of “crowdsourcing” terrorism, Hussain needed personally identifiable information (“PII”) to disseminate to ISIL supporters throughout the world. For example, on March 20, 2015, Hussain, under the name of the Islamic State Hacking Division (“ISHD”), posted a “kill list” that included the names and addresses of 100 United States military members. With complete awareness of ISIL’s expanding terrorist aims, the defendant began providing support for ISIL in April 2015. At first, he supported ISIL by administrating a website that hosted ISIL videos, Penvid.com. An archived copy of Penvid.com dated May 23, 2015, shows that it contained ISIL videos and included a drop-down menu with the name “Dabiq,” which is the name of ISIL’s official English-language magazine. 1 See Attachment A. The defendant knew that ISIL videos were being posted on his website, and that his website served as 1 The archived record came from the website www.archive.org, which offers a service called the Wayback Machine. The Wayback Machine is a digital archive of the World Wide Web and other information on the internet. -2- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 3 of 19 PageID# 370 a force multiplier for ISIL’s propaganda machine. On May 6, 2015, the defendant received an email stating that his website had been shut down because it was “being used as a website by a terrorist organization for the promot [sic] // of violence and criminal activity.” Attachment B. The defendant received numerous messages over Twitter from persons who were against ISIL, knew that he administered the website, and questioned why he was supporting ISIL. The defendant repeatedly defended ISIL and his website in these communications. For example, when asked about the beheadings by the now-deceased ISIL executioner known as Jihadi John, the defendant replied that ISIL “never kill [sic] someone without reason.” Id. During a different exchange, the defendant was asked whether he knew about a group “calling itself the Islamic State Hacking Div, [which] posted the names, home addresses and photos of 100 American service member families.” In response, Ferizi indicated the posting was justified because the U.S. military “killed peoples [sic] in Iraq and Syria.” Id. Although the website amplified ISIL’s message, the defendant wanted to do more. So he began providing information to facilitate specific ISIL attacks. As described in the Statement of Facts, on April 26, 2015, the defendant provided ISIL with what appeared to be PII belonging to people living in the United States and abroad. One of those ISIL members was Tariq Hamayun, also known as “Abu Muslim Al-Britani,” a Syria-based associate of Hussain. When speaking with Hamayun over Twitter, the defendant said that the PII belonged to people in “kuffar 2 countrys [sic] which attacking islamic state.” Id. At the end of this exchange, Hamayun asked the defendant to “come and join us in the Islamic state,” to which the defendant responded, “inshAllah,” which in Arabic means, “If Allah wills it.” Id. Less than two months later, the defendant outdid himself. On June 13, 2015, he gained 2 Kuffar is a derogatory term used to refer to non-Muslims. -3- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 4 of 19 PageID# 371 system administrator-level access to a server that maintained the website for an Illinois company (“Victim Company”) that sold goods to customers in the United States and abroad. 3 The server contained databases with PII belonging to tens of thousands of the Victim Company’s customers, which included United States military and other government personnel. The defendant searched for, accessed, and obtained customer information for tens of thousands of customers whose information was retained on the server, including phone numbers, e-mail addresses, locations, and account passwords. He subsequently culled the PII belonging to United States military (designated by “.mil”) and other government personnel (designated by “.gov”). In total, he obtained PII belonging to approximately 1,300 United States military and other government personnel, including persons located here in the Eastern District of Virginia. Immediately after extracting the PII for the 1,300 United States military and other government personnel, the defendant provided the information to ISIL. He reached out to Junaid Hussain, the ISIL recruiter and attack facilitator discussed above, who used the nom de guerre “Abu Hussain al-Britani.” The defendant knew that Hussain was a member of ISIL and was actively engaged in supporting ISIL. The defendant told Hussain how he obtained the information, named the company it came from, and stated that it contained almost 1,400 military and government email accounts. Attachment C. Hussain twice exclaimed that releasing this information would “hit them hard,” and each time the defendant responded “yes inshaAllah.” Id. The defendant and Hussain also discussed how the information would be released. Hussain, referencing the March 2015 release of PII for 100 U.S. military members, stated that “we will make like a message inshAllah // like u know the hitlist I made // with addresses // we will make message to kuffar and release the .mil and.gov [sic].” Id. Hussain further indicated that the 3 The Victim Company suffered quantifiable losses of at least $53,975. See PSR at ¶24. -4- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 5 of 19 PageID# 372 information would be released by the “Islamic State Hacking Division.” Without hesitation, Ferizi agreed with Hussain’s plans. Id. On August 11, 2015, Hussain, acting in the name of the Islamic State Hacking Division, sent communications over Twitter that contained a document with the PII of the 1,300 United States military and government personnel that the defendant had stolen from the Victim Company and provided to Hussain. The beginning of the document warned the “Crusaders” who were conducting a “bombing campaign against the muslims:” we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands! Shortly after sending that tweet, Hussain received a message from another ISIL supporter asking about the defendant’s whereabouts. Hussain explained that the defendant had “just [been] busy lately” and that “i work with that brother akhi // hes in [sic] our team.” Attachment D. On September 15, 2015, Malaysian authorities detained the defendant as he was attempting to leave the country. On October 12, 2015, Malaysian authorities provisionally arrested him at the request of the United States. The defendant was extradited to the United States on January 22, 2016. II. STANDARDS GOVERNING SENTENCING The standards governing sentencing are well-established. In United States v. Booker, 543 U.S. 220 (2005), the Supreme Court rendered the Sentencing Guidelines purely advisory, and emphasized that a sentencing court must consider both the Guidelines and the 18 U.S.C. § 3553(a) factors when making a sentencing decision. Id. at 264; see also United States v. -5- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 6 of 19 PageID# 373 Kimbrough, 552 U.S. 85 (2007) (stating that “the Guidelines, formerly mandatory, now serve as one factor among several courts must consider in determining an appropriate sentence”). In Gall v. United States, 552 U.S. 38, 128 S. Ct. 586 (2007), the Supreme Court instructed that the sentencing court should calculate the sentencing Guidelines range, permit the government and the defendant “an opportunity to argue for whatever sentence they deem appropriate,” consider all of the § 3553(a) factors, and finally pronounce a sentence taking into account all of the relevant factors. Id. at 596-97. The Gall Court further instructed that, in the event that the sentencing court decides to impose a variance sentence, the court “must consider the extent of the deviation and ensure that the justification is sufficiently compelling to support the degree of the variance.” Id. (noting that a “major departure should be supported by a more significant justification than a minor one.”). Applying these standards, the Fourth Circuit has concluded that a sentencing court must: “(1) properly calculate the Guideline range; (2) allow the parties to argue for the sentence they deem appropriate and determine whether the § 3553(a) factors support the sentences requested by the parties; and (3) explain its reasons for selecting a sentence.” United States v. Simmons, 269 Fed. Appx. 272, 2008 WL 681764, at *1 (4th Cir. March 11, 2008) (citing United States v. Pauley, 511 F.3d 468, 473 (4th Cir. 2007)). When “rendering a sentence, the district court must make and place on the record an individualized assessment based on the particular facts of the case.” United States v. Cuthrell, No. 12-4077, 2012 WL 3643677, *1 (4th Cir. Aug. 27, 2012) (citing United States v. Carter, 564 F.3d 325, 328 (4th Cir. 2009)). Ultimately, the court “must state in open court the particular reasons supporting its chosen sentence.” Carter, 564 F.3d at 328 (quoting 18 U.S.C. § 3553(c)). Courts “are not left with unguided and unbounded sentencing discretion.” United States v. Green, 436 F.3d 449, 455 (4th Cir. 2006). Instead, at -6- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 7 of 19 PageID# 374 sentencing a court “must first calculate the Guidelines range.” Nelson v. United States, 555 U.S. 350, 351 (2009); see also United States v. Hughes, 401 F.3d 540, 546 (4th Cir. 2005) (holding that a sentencing court is still required to “‘consult [the] Guidelines and take them into account when sentencing’” (quoting Booker, 543 U.S. at 264)). III. SENTENCING CONSIDERATIONS A. Acceptance of Responsibility In accordance with Section 6A1.2 of the Guidelines and Policy Statements and this Court’s policy regarding Guidelines sentencing, the United States hereby represents that it has reviewed the United States Probation Office’s presentence report (“PSR”) prepared in this matter. The United States moves this Court, pursuant to U.S.S.G. § 3E1.1(b), to grant the defendant an additional one-level reduction in the offense level for acceptance of responsibility, if the defendant receives a two-level reduction for acceptance of responsibility. The government states that the defendant has assisted authorities in the investigation and prosecution of his own misconduct by timely notifying the United States of his intention to enter a plea of guilty, thereby permitting the government to avoid preparing for trial and permitting the government and the Court to allocate their resources efficiently. B. Sentencing Guidelines The government generally agrees with the Probation Office’s Guidelines calculations. The Probation Office calculated that the defendant’s Total Offense Level is 40 and Criminal History Category is VI, resulting in a recommended Guideline sentence of 360 months to life. Since the statutory maximum for Count Two (18 U.S.C. § 2339B) is 240 months and Count Three (18 U.S.C. § 1030(a)(2)(C)) is 60 months, the sentence is limited by statute to 300 months (25 years). -7- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 8 of 19 PageID# 375 i. Count Two: Providing Material Support to a Terrorist Organization The parties agree that the base offense level for Count Two is 26 pursuant to Section 2M5.3(a). As stated in the Plea Agreement, the parties also agree that Section 3A1.4(a) applies because the defendant’s actions involved a federal crime of terrorism, which increases the offense level by 12 levels and automatically raises the defendant’s criminal history to Category VI. See Plea Agreement (Doc. 35) at 3-4. 4 In addition to these uncontested Guideline provisions, the Probation Office recommends that two other provisions apply to Count Two, Sections 2M5.3(b)(1) and 3A1.2, which together would increase the offense level by five levels. The government agrees with the Probation Office that both provisions apply in this case. 5 a. Section 2M5.3(b)(1) applies because the defendant provided material support to ISIL with the intent, knowledge, and reason to believe it would be used to assist in the commission of a violent act. The Probation Office recommends, and the government agrees, that pursuant to 2M5.3(b)(1)(E) the offense level for Count Two should increase by two levels because the 4 The government notes that Section 4A1.3(b) should not be applied to this case. Under that section, a court can depart downward if a defendant’s criminal history category substantially over-represents the seriousness of the defendant’s criminal history or likelihood that he will commit other crimes. First, under the Plea Agreement, both parties have recommended that the defendant’s criminal history is Category VI, as a result of the application of Section 3A1.4(b). Second, and more importantly, the departure contemplated under Section 4A1.3(b) should not be applied to cases where the terrorism adjustment under Section 3A1.4(b) has been applied, such as here. Pursuant to Section 3A1.4(b), the Guidelines mandate that the criminal history category in this case is Category VI, due to the serious nature of terrorism offenses. That section states that if the offense involved or was intended to promote terrorism, the criminal history “shall be” Category VI. The criminal history category determination in terrorism cases is thus not based on the defendant’s actual criminal history or likelihood of committing another crime, which are the enumerated bases for a downward departure under Section 4A1.3. Rather, the sole consideration is the seriousness of terrorism. Section 4A1.3(b) is intended for cases when the criminal history category has been determined by calculating the defendant’s actual criminal history, and that category does not accurately reflect the seriousness of the defendant’s conduct. Here, no such calculation was used to determine the criminal history category. 5 In the Plea Agreement, the government noted its belief that both provisions apply and its intent to argue at sentencing that they apply. -8- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 9 of 19 PageID# 376 defendant provided material support to ISIL with the intent, knowledge, or reason to believe it would be used to commit or assist in the commission of a violent act. When the defendant provided ISIL with the PII for 1,300 military members and other government employees, he intended, knew, or, at minimum, had reason to believe, that the information would be used to assist in the commission of a violent act. As the defendant admitted in the Statement of Facts, he was fully aware that ISIL was a terrorist organization that engaged in terrorist activity. He knew that ISIL targeted and killed civilians of countries militarily opposed to ISIL. When he communicated with people who confronted him about ISIL’s violent acts, such as beheadings, he defended those acts. He also willingly administered a website that hosted ISIL’s violent videos and propagated their justifications for that violence. Fully aware of ISIL’s desire to target the United States, the defendant searched for PII belonging to U.S. persons and provided that information to ISIL. His intent is clear from the facts. Once the defendant identified customer information from the Victim Company, he began looking for and culling information for U.S. military members and government employees, knowing full well that ISIL was seeking such information. His intent was made abundantly clear when, immediately upon culling the military and government personnel information, he shared it with a notorious ISIL recruiter and facilitator, Junaid Hussain. The defendant’s knowledge of what ISIL would use the information for is evidenced by the information itself and by ISIL’s previous use of that type of information: to disseminate a kill list. What other purpose would ISIL have with the names, addresses, and phone numbers of U.S. military members and government employees if not to locate and target them? Hussain indicated that they would release the PII, just like the “hitlist” Hussain had released months earlier. A “hitlist” does not refer to propaganda; it describes a list of people to be targeted and attacked. -9- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 10 of 19 PageID# 377 Hussain also twice stated that ISIL would use this information to “hit them hard.” The defendant expressed his complete agreement with Hussain. See Attachment C. Accordingly, as the Probation Office recommends, the offense level for Count Two should increase by two levels pursuant to Section 2M5.3(b)(1)(E). b. Section 3A1.2(a) applies because the victims were government officers and employees. The government also agrees with the Probation Office that pursuant to Section 3A1.2(a) the offense level for Count Two should increase by three levels because the victims were government officers and employees and the defendant targeted those victims because of their status. The defendant searched for and isolated PII for government employees, including members of the military and civilians. The defendant only discussed releasing the PII for those government employees. The defendant agreed with Hussain that they would “hit” those government employees “hard.” When ISIL released the information, they instructed their “soldiers” to “strike at [the] necks” of those government employees. Those government employees must now live in constant fear that a member of ISIL will use that information to find and harm them. There is no dispute that the defendant targeted government employees. And there can be no dispute that those government employees were harmed. Therefore, Section 3A1.2(a) applies. ii. Count Three: Accessing a Protected Computer Without Authorization and Obtaining Information The United States generally agrees with the Probation Office’s offense level calculation for Count Three. The parties agree that the base offense level for Count Three is six pursuant to Section 2B1.1(a)(2). Under the Plea Agreement, the parties also recommend the following offense level increases: six-level increase since the loss sustained by victims exceeds $40,000 (Section 2B1.1(b)((1)(D)); two-level increase since the offense involved unauthorized public -10- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 11 of 19 PageID# 378 dissemination of personal information (Section 2B1.1(b)(17)); two-level increase since the defendant used a special skill to commit the offense (Section 3B1.3). The parties also agree that a three-level upward adjustment applies pursuant to Section 3A1.2 since the victims were government employees, whereas the Probation Office recommends that this upward adjustment only be applied to Count Two. The government’s disagreement with the Probation Office stems from whether the government employees can also be considered victims of the defendant’s unauthorized computer intrusion and theft of information (the government and Probation Office agree that government employees were victims of the defendant’s provision of material support to ISIL). There is no dispute that the Illinois company was a victim when the defendant gained unauthorized access to its server and took PII from that server. The government maintains that customers of that company whose PII the defendant stole were also victims. That PII belonged to the company and to the customers. In many ways, the PII was more valuable to the customers than to the company. By removing the PII from the company’s server, the defendant exposed the customers to all sorts of harm, be it fraud or, as in this case, physical injury. Many of those customers were government employees and officers. Moreover, the harm to those government employees and officers was real. Those targeted individuals must live in a perpetual state of fear that they may be attacked. The charges in Count Three state that the defendant took the PII to further his support of ISIL. The defendant specifically targeted the PII of government employees and officers. Since the defendant’s theft of PII harmed, and was intended to harm, government employees and officers, Section 3A1.2(a) should be applied to Count Three. The Probation Office also recommends that there be a victim related adjustment to Count Three pursuant to Section 3A1.4(a) since the unauthorized computer intrusion and theft of -11- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 12 of 19 PageID# 379 information was intended to promote a federal crime of terrorism, which would add 12 levels to the offense level. The government agrees. In the Statement of Facts, the defendant admits that he gained unauthorized computer access and obtained information from that access “in furtherance of . . . the criminal act of . . . providing support to ISIL.” Statement of Facts at ¶2. The defendant’s admission virtually mirrors the language of Section 3A1.4(a). Accordingly, 12 levels should be added to the Guidelines calculation for Count Three. C. 18 U.S.C. Section 3553(a) Factors After calculating the appropriate Guidelines range, “the court must ‘determine whether a sentence within that range . . . serves the factors set forth in § 3553(a) and, if not, select a sentence [within statutory limits] that does serve those factors.’” United States v. Moreland, 437 F.3d 424, 432 (4th Cir. 2006) (quoting Green, 436 F.3d at 455). Title 18, United States Code, Section 3553(a)(1) provides that, in determining a sentence, courts must consider the nature and circumstances of the offense, as well as the history and characteristics of the defendant. Additional factors outlined in Section 3553(a)(2) include the need for the sentence to reflect the seriousness of the offense, to promote respect for the law, to provide just punishment for the offense, to afford adequate deterrence to criminal conduct, and to protect the public from further crimes of the defendant. 18 U.S.C. § 3553(a)(2)(A)-(C). D. Argument The recommended Guidelines sentence of 25 years of imprisonment appropriately reflects the seriousness of the offense, the ongoing danger posed to 1,300 military members and government employees, the critical need to deter this type of conduct, and the defendant’s clear knowledge of and intent to commit the harms he inflicted. -12- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 13 of 19 PageID# 380 i. Seriousness of the Offense The defendant’s actions have threatened the lives of over 1,300 military members and civilian government employees, and their families. Because of the defendant’s actions, ISIL members now know the names of these victims, their affiliation with the U.S. government, and where they live, among other identifying information. The defendant also released passwords used by these 1,300 victims, which could be used by ISIL to uncover additional private information. This is not analogous to simply publishing information from Google. The PII that the defendant stole and released was not publicly available. The threat to these 1,300 victims goes beyond the release of their private information. They have now been marked as enemies of ISIL. Any ISIL member or sympathizer in the United States looking for a target now has the information belonging to 1,300 individuals who ISIL has specifically marked for attack. The victims have a permanent target on their backs. While the defendant may not have pulled a trigger, he told members of ISIL where to shoot. And the threat to these 1,300 victims has no end in sight. Because ISIL transmitted the PII over the internet, there is no way to know if the risk to these military members, civilian government employees, and their families, will ever end. It is not possible to permanently remove items from the internet, which means the private information of the victims that was released in this case will remain public. We do not know who or how many people downloaded and saved the PII, and when they may republish the information again. What we do know is that ISIL supporters have republished the PII provided by the defendant multiple times since August 11, 2015. For instance, an individual is presently indicted in another district for transmitting and conspiring to transmit threatening communications in interstate commerce. The charges relate to -13- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 14 of 19 PageID# 381 the individual re-tweeting PII belonging to two of the victims in this case along with the phrase, “Wanted to kill,” followed by the victims’ first and last names, city of residence, zip code, and phone number. These 1,300 victims can never stop wondering whether someone will accept ISIL’s command to “strike at [their] necks.” One of the victims, a member of the military, perfectly captured this fear in his victim impact statement when he wrote, “I have to live constantly under the threat that someone might actually arrive at my residence and harm me or my family members.” The defendant’s conduct is particularly reprehensible because he targeted people for their service to our country. In the United States we hold military members in the highest regard because of the sacrifices they make to defend our country and preserve our way of life. We also respect our public servants who spend their lives furthering the public good. The defendant chose the victims for those very reasons. By targeting them, the defendant and ISIL believed they were punishing persons responsible for the U.S. government’s national security policies, while impairing the ability of the U.S. government to carry out those policies. While we know that such actions only strengthen our country’s resolve, it shows the defendant’s depravity and the need for a significant sentence. A 25-year sentence would signal that, when given the opportunity, our justice system protects and serves the military members and civil servants, just as they spend their lives protecting and serving us. ii. Need for Adequate Deterrence The defendant’s actions represent an evolving terrorist threat that requires a substantial sentence to deter others from making the same choice. This case represents the first time someone has been arrested for or convicted of providing material support to a terrorist -14- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 15 of 19 PageID# 382 organization through information that came from computer hacking. While the defendant will be the first terrorist hacker imprisoned for his actions, he is not the first or only terrorist hacker. A significant sentence is necessary to signal that the defendant is more than a hacker – he is a terrorist. Hackers gain unauthorized access to computer systems and take information, often for pecuniary gain or ideological reasons. Stealing information to make money or to embarrass people is one thing; stealing it to harm or kill people is another. No court has yet had the opportunity to draw this line. A sentence of 25 years would make that line unambiguous. In sentencing the first terrorist hacker convicted in the United States, this Court has the ability to send a clear message to other hackers who would likewise use their technical skills to support terrorist organizations. A sentence of 25 years would communicate that the United States has zero tolerance for hacking in support of terrorism. iii. Similarly Situated Defendants As noted above, this is the first instance in which a defendant has been convicted of using hacking skills to provide material support to a terrorist organization. The use of cyber tools to commit this act of terrorism does not diminish the significance of the defendant’s crime. In September 2014, one of ISIL’s leaders, Adnani, called for attacks against citizens of countries participating in the United States-led coalition against ISIL. Thereafter, ISIL members heeded Adnani’s call, by facilitating attacks across the globe. In order to carry out ISIL’s plan of “crowdsourcing” terrorism, Hussain needed PII that he could use to disseminate to ISIL supporters throughout the world. The defendant used his technical skills to provide ISIL with exactly that, knowing that his actions could have deadly consequences for the named victims. This is Terrorism 2.0 where attacks are no longer centrally planned in musty caves in Afghanistan by an inner circle of terrorist operatives. Using social media, terrorist groups can -15- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 16 of 19 PageID# 383 now achieve their goals from thousands of miles away, by supplying potential operatives with digital information about who to strike, where to strike, and when to strike. In this new landscape, the defendant’s actions are equivalent to someone who facilitates an attack by scouting landmarks, reviewing security measures, or providing weapons, all of which are critical to the success of a terrorist operation. While there are no cases directly on point, the most analogous case occurred in this District. Zachary Adam Chesser was sentenced to 25 years for posting on a jihadist website the personal contact information of individuals who had joined the “Everybody Draw Muhammad Day” group on Facebook and encouraging jihadists to attack the writers of South Park, including highlighting their residence. See United States v. Chesser, 1:10cr395 (Doc. 51) (Feb. 24, 2011). The defendant’s conduct here is arguably worse. While Chesser posted contact information for nine individuals, the defendant released more sensitive identifying information on 1,300 individuals. iv. Characteristics of the Defendant The defendant’s characteristics likewise favor a sentence of 25 years. He is an intelligent and skilled hacker, who was fully aware of the consequences of his actions. According to the defendant, he has been a hacker since he was a young teenager. His skills and intelligence are manifested by the fact that he created and led a group of computer hackers called Kosova Hacker’s Security (“KHS”). See PSR at ¶10. KHS was responsible for compromising private and government websites around the world, and has claimed responsibility for hacking more than 20,000 websites. Id. That skillset made the defendant particularly valuable to ISIL, as evidenced by Hussain’s pride that he was on their “team.” The defendant was fully aware of what he was doing, and the consequences of those actions when he obtained and provided the victims’ personal information to ISIL. As discussed -16- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 17 of 19 PageID# 384 earlier, the defendant was well versed in ISIL’s violence. He did not make a simple mistake. The defendant repeatedly supported and sought to support ISIL, in multiple ways. At first it was to help promote propaganda through ISIL videos. When that was not enough, he used his technical skills to obtain and provide information that ISIL was seeking. There is no evidence that the defendant was coerced. In each instance of support, the defendant did so willingly. He gathered and provided ISIL with the PII for the 1,300 military members and government employees. He gathered customer information from the Victim Company, culled the PII for the military members and government employees, and provided it to ISIL. The defendant freely made each of those choices while behind a keyboard, thousands of miles from the war zone in Syria. The defendant’s previous brushes with the criminal justice system have failed to cure his criminal behavior. According to the defendant, he was arrested multiple times for cyber crimes in Kosovo. In each instance, he was promptly released because he apologized and was a juvenile. Records from the Kosovo government confirm that the defendant has been charged with multiple offenses in Kosovo. We are here, in part, because the defendant’s previous arrests did nothing to deter him from committing cyber crimes. The defendant should be imprisoned for the maximum available period of time that ensures he won’t be able to use his specialized knowledge of hacking and computers to steal information for any purpose, particularly to cause physical harm. The defendant should be sentenced to 25 years’ imprisonment. -17- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 18 of 19 PageID# 385 IV. CONCLUSION For the reasons above, the Government believes that a sentence of incarceration of 25 years would be sufficient, and not greater than necessary, to satisfy the factors set forth in 18 U.S.C. § 3553(a). Respectfully submitted, Dana J. Boente United States Attorney By: _____/s/___________________ Brandon L. Van Grack Special Assistant United States Attorney (LT) Eastern District of Virginia United States Attorney’s Office 2100 Jamieson Avenue Alexandria, Virginia 22314 Phone: (703) 299-3700 Email: brandon.van.grack2@usdoj.gov Gregory R. Gonzalez Trial Attorney U.S. Department of Justice, National Security Division -18- Case 1:16-cr-00042-LMB Document 54 Filed 09/16/16 Page 19 of 19 PageID# 386 CERTIFICATE OF SERVICE I hereby certify that on this 16th day of September, 2016, I filed the foregoing pleading with the Clerk of Court and will send an electronic copy of such pleading to counsel of record via email. Respectfully submitted, Dana J. Boente United States Attorney By: _____/s/___________________ Brandon L. Van Grack Special Assistant United States Attorney (LT) Eastern District of Virginia United States Attorney’s Office 2100 Jamieson Avenue Alexandria, Virginia 22314 Phone: (703) 299-3700 Email: brandon.van.grack2@usdoj.gov Case Document 54-1 Filed 09/16/16 Page 1 of 13 Page D# 387 ATTACHMENTS Case Document 54-1 Filed 09/16/16 Page 2 of 13 Page D# 388 ATTACHMENT A Case Document 54-1 Filed 09/16/16 Page 3 of 13 Page D# 389 lulu? nun! I GO 54 upturn Hm mum-5st II I I I PenVid. HOME CATEGORY ARTICLES TOP VIDEOS NEWVIDEOS RANDOM VIDEO CONTACT US LATE 5T ARTIC LES TOP VIDEOS FEATURED uosr VICTORIES oi: TH mm Islamic State: ?Bombing at the Crusaders Upon the Ordinary Muslims Wiiayat 251?s ?ea: Islamic State: ?Joy ofthe Muslims theVicmries onhe Monotheists in r. Islamic State: ?Cubs of the Caliphate Brought Up in Their Environs Wil?yat at? View: lslarnic Stale: ?Joy of the Muj?hidin With the Broken Deteat oral-aian and Elie-v.5. New video message (mm The Islamic State: of the Battle nn hugs/h. Case Document 541 Filed 09/16/16 Page 4 of 13 Page D# 390 uunl HOME ARHCLES NEWVIDEOS RANDOM VIDEO COMIACTUS FEATURED VIDEO: ISLAMIC STATE: OF THE MUSLIMS WITH THE TOP VIDEOS VICTORIES 0F TH ONOTHEISTS IN WILRYATAL-ANEIAR WILAY Islamic State: ?Bombinnof use Crusatlels Upon me Oniimry Muslims Wiiyat Islamic State: ?Juy a! the Muslims lbev?lclories bl me Manolhelstsin Islamic State: ?Cub: otme I 9 Caliphate Bought Up In lne Environs ?W?I.Iynl al- Islanlc Stile: ?Joy of the Mu?hh?h mm the Broken Defamer-suler and Nekaleomessne from 'l'he Islamic Slale: ?Asp-eds olme Battle on VIDEOS BEING WATCHED RIGHT NOW I I CATEGORIES videos LATEST ARTICLES EXPOSED ?lhe Bemural How the Islamic State lsnmic stale prisoners Reconciliation between 9 ol Jaum Mum (AI came In lo cunllm with umng a speech about People by Islamlc sme ?woman: NEW VIDEOS :5 7 IE [El Shalr pmofallhe A Leadain ISIS EXPOSED The Beuayal Enamh?l?rmslalion of IS apostasy oftha lslarmc converse; Mlnan old 01? Jenna! Nusra IAI menu The bombing ol Indy Qaeda) lo Islamic Stale Crusaders on Muslim. men Bl?: .laa .139 lire: IE 173-; le?ied ICI If ~11 1:3) mm: l9 mnl?lt 310 A um um m: How the Islamic State Islamic stale pllsonels Islamic Ca?phale Reconciliation between cane In In oan?lct giving a speech about Repentance olMansoor People by [Harlin Slate the Shailat Irlbe lhe mylhe live in Isis 3?6?3" 3-39 Ame-I mm: age Mir-d Isl-vam new: ~c 2131:; 13mm m: IE Juslicelnmelslu-nic Amman-Mashed tends raid-UH .: AnsweloIMus?ms lo the Slate In mall) pourl'nlleaence Threnl: ?Apostate: was: 19 may,? we axe-.5 ls! mums [El-3:3 19 l'r'nl?az ts: ri?ed i3 new?; we Answer ol'hluslimll to the The Knlahls DIAL amiss-11 and lslamlc Slule: "Mess-We I'hrels oMposlaIes Jazeeran Islamlc Slate fie" to the Muslim In )L?Llei name: :3-3 Liar-? flunk: ki?e'i 5' me: :31 Somalia ?W'Iliyal al. Adda] 11mins. age Dawlah massage of Islamic Stale 'Unu': Islamic State: ?Joy ol the Islamic Slate's Shayllh supporl to media mujahls ThereCarne ToThem With me Abl] mam Iii-11:5 Clear Evidence" @roken Defenl 01 al- ?Condolence and ?2511 We; 5?20 ?lath?i I lie; Added Id}? lie-2 I I I New Islamlc Stale: ?Serve? ol Islamic Slate: ?Health manic Stale: ?Cubs of Islamic Slate: the Subjects 1! Sendce; In The manic the callphale BrouuhlUp ?Prepalallon orme N?mwi" Slate ?Wdiynl al? In Their Environs - Tutorials for the ilk-w I 631' 3.1L Ar}: :1 1qu 9-3-7 rue-l ma, :ddrn my; cg?: Islamic State. ?Knights 0! al-Jalitah" #11er 55'; Islamic Slate: ?Chyge ot the Monothelsls Upon the Dons ol' the satavlds ewe-.1 I cry Islamic State: ?Uberatlon oI? UmmaI-Tebibir Checkpoint 3.4::ch Iris, Islamic State: ?Shatfh jet-d dz'r 5-9er I r131 17.) New video nussage from The lslurrlc State: ?Hannah Slim . E: and: 5-3: =13 ?no 358 :1 'v Newaudiamessuge from Muiahidin uITunIsia ol aI-antawin: ?Bay'eh to Added I 61-, ago New video Mileage Irom The Islamic State: ?Glad tidings otthe Supponeu rid-35d I ago of the Enemy -IMIttyat Filed I or} 43': telamic Stole: ?Mouvauonameasagee From Yemen of and Adda-j I do): :30 Islamic State: ?Gamering ol'the Mandateisls With the Huslirn Clone r? ?r?i I Islamic State: ?Raid ol ?aerating d~anmuIt Refugee Canp ?wtliya cue: I53, Islamic State: ?Bhghazr: The?eming ul Slitiity ?Wi?yal al-Barum' 42, :33 Islam: State: ?Victory From God and An InminuttConquest - Aizj-i 1:27. .131 Islunic Stale: ?Shayldt Ab? 'Umar ul-Baud?c? Hillary Training Camp? 1112. 3:3 Newvldeo message Irom The Islamic State: ?Lion ol the Bame?eid .?Atcert I 112'; Ajnbd Foundation For Mattie Production presents a new release Luke-I id), uh") Newvideo message from The Islamic State: ?Bans ol the De?ant 41:91 I d3; :30 Newvideo measagetrom The Islamic State: ?F?'ll emanation Close From kiwi?1 I as, .3: Isianic Slate: I?Jogf oi the Monotheist: With the Victories Ar}::d Illa; ago Islamic Slate: ?Water: The Source of Life IMIaynt ol-Raqqah? Axed: di.? 1, Case Document 54-1 I Islamic Stolez?BomhIng oltheCnnadas Upon meOrd?mry Muslims lslunic State: Declaration oI' Emma and Cutting oIFamtIy ?ee: Ii: Filed 09/16/16 Page 5 of 13 Page D# 391 Isl-mic Stole: ?Storming Btigodea?l Headquarters ollhe Safavld Amw- I 2p. Islamic State: ?Yamenl Congratulations For the Bay'oh olour Brothers In Aid?2'} I 6.7; Islamic State: ?Amputation ol' the Corruption Witt the Islunic Slate: hPi-ety Tuna orcuemlr,? In the City clot-Nomi (Mosul) {-11:31 17!? oi?F uroan Met?a presents a new audio message from the Islamic State's Jud-tee I 33; J5: Newvldeo message Item The Islamic State: ?The Rain otzmauwuayot I {1175-}: Newvideo message Imm Theltlamic SIAM: ?Aspects of the name on Aided I at; 33-3 Newvldeo mesonoe Irom The Islamic State: ?The Raid of Turib al- mm I Newvldeo message from The Islamic State: ?The Beginning and Ending ot ?lmed I Nequnn Manic State: ?Joy of the Muslims With the Victories allhe 2 die) 5 ego Islamic State I'ddr? 2 :30 Islarn't: Stole: ?Give ialanic stole: ?Choroe ol the supporters weaan Sini'ISInoiI" Uth I .11; 33-: New video message from The SI:le:?Frorn Prisoner to Sacri?ce A hate-:1 I my New noeomessage from The Istunic Slate: a Spy of the ?11121.1 3:15;: New video message from The Islamic State: ?Military Camp otthe Added Idayx ego New videomesouoe Irom Slate: ?The Most Effective (?14ij I031 390 New videomeengo from The Islamic State: "Graduation Clan From Aided Ida] Pg?; Islamic State: ?Extend Your Hand To Pledge Allegiance" #3112 d3]: :13) Coalition terrorists attacking musllm children: In How! Amie: May; Case Document 54-1 Filed 09/16/16 Page 6 of 13 Page D# 392 ATTACHMENT ATTACHMENT Original Date Sender ID Receiver ID Message Text Sun Apr 26 11:24:06 +0000 2015 Ferizi Hamayun selam alejkum Sun Apr 26 11:24:27 +0000 2015 Ferizi Hamayun Sun Apr 26 11:24:34 +0000 2015 Ferizi Hamayun Sun Apr 26 11:24:37 +0000 2015 Ferizi Hamayun Sun Apr 26 11:24:40 +0000 2015 Ferizi Hamayun Sun Apr 26 11:24:43 +0000 2015 Ferizi Hamayun Sun Apr 26 11:24:46 +0000 2015 Ferizi Hamayun Sun Apr 26 11:25:05 +0000 2015 Ferizi Hamayun brotheri have 4 milion data of kuffar which attacking islamic state just first page and not all images coming saying big space Sun Apr 26 11:25:20 +0000 2015 Ferizi Hamayun do you need them just dumped i havent sleep for 3 days Sun Apr 26 11:27:41 +0000 2015 Ferizi Hamayun Sun Apr 26 22:01:57 +0000 2015 Hamayun Ferizi l?J? Sun Apr 26 22:02:22 +0000 2015 Hamayun Ferizi Sorry brother I couldnt reply back earlier on Sun Apr 26 22:02:37 +0000 2015 Hamayun Ferizi just seen ur messages Sun Apr 26 22:03:20 +0000 2015 Ferizi Hamayun ok brother Sun Apr 26 22:04:04 +0000 2015 Hamayun Ferizi Pliz explain whats this info about Sun Apr 26 22:04:27 +0000 2015 Hamayun Ferizi Sun Apr 26 22:04:38 +0000 2015 Hamayun Ferizi Sun Apr 26 22:05:00 +0000 2015 Hamayun Ferizi If possible come on [redacted] lets talk on there [Redacted] this is my [redacted] account Sun Apr 26 22:05:20 +0000 2015 Hamayun Ferizi Lol get ur sleep too Sun Apr 26 22:05:39 +0000 2015 Ferizi Hamayun brother im speaking with britani abu britani Sun Apr 26 22:13:55 +0000 2015 Hamayun Ferizi Yes brother Sun Apr 26 22:14:14 +0000 2015 Hamayun Ferizi Im muslim al britani Sun Apr 26 22:16:44 +0000 2015 Hamayun Ferizi MashAllah brother I checked some of this info its really good Sun Apr 26 22:16:58 +0000 2015 Hamayun Ferizi Can do some damage inshallah Sun Apr 26 22:17:21 +0000 2015 Hamayun Ferizi Who are brother? Sun Apr 26 22:17:33 +0000 2015 Hamayun Fe rizi sound like a good person Sun Apr 26 22:17:46 +0000 2015 Hamayun Ferizi May Allah SWT protect Sun Apr 26 22:33:31 +0000 2015 Hamayun Ferizi Now iv checked it . Wow know I was a credit card scammer in the UK Sun Apr 26 22:33:59 +0000 2015 Hamayun Fen? How can I thank Sun Apr 26 22:34:20 +0000 2015 Ferizi Hamayun ii 00 Sun Apr 26 22:35:15 +0000 2015 Hamayun Ferizi abu Hussain albritani is my friend he told me a lot about Sun Apr 26 22:35:45 +0000 2015 Hamayun Ferizi Pliz brother come and join us in the Islamic state Sun Apr 26 22:50:56 +0000 2015 Fen? Hamayun inshAllah Wed May 06 09:42:39 +0000 2015 Individual A Ferizi No one gets killed without reason eh? So what about jihadi Johns beheadings? What reason for that when they were trying to help Muslims Wed May 06 09:43:17 +0000 2015 Ferizi Individual A man ill tell they never kill someone without reason believe me i gurante u\ndo you know Wed May 06 11:01:18 +0000 2015 Individual A Ferizi A group, calling itself the a?celslamic State Hacking Div,a? posted the names, home addresses and photos of 100 American service member families Wed May 06 11:04:35 +0000 2015 Ferizi Individual A yes cos they was the peoples who killed peoples in iraq and syria Wed May 06 11:04:52 +0000 2015 Ferizi Individual A if someone kill urfamily and run would not find him and kill him Wed May 06 21:41:52 +0000 2015 Individual Ferizi I think they contacted your host though. I?m not certain Wed May 06 21:42:08 +0000 2015 Ferizi Individual yeah they have send me an email :3\nfor terrorism something Wed May 06 21:42:15 +0000 2015 Ferizi Individual 8 your team Wed May 06 21:42:49 +0000 2015 Individual 8 Ferizi Lol. Little do they know. Wed May 06 21:42:51 +0000 2015 Ferizi Individual It has come to my attention that the website is being used as a website by a terrorist organization for the promot Wed May 06 21:43:01 +0000 2015 Ferizi Individual of violence and criminal activity. One look at the website and you can see criminal activity all over it. The videos on your site are being Wed May 06 21:43:03 +0000 2015 Ferizi Individual used to promote violence and encourage it. Please act on this website. Wed May 06 21:43:21 +0000 2015 Ferizi Individual i saw it lately Wed May 06 21:43:39 +0000 2015 Individual 8 Ferizi Oh. So they did. Wow. Wed May 06 21:44:08 +0000 2015 Ferizi individual yeah they send to the hosting administrator (which is me) The social media account names have been anonymized or changed to reflect the true names of the account users. Victim information has been redacted or replaced. Case 1 Document 54-1 Filed 09/16/16 Page 7 of 13 PagelD# 393 Case Document 54-1 Filed 09/16/16 Page 8 of 13 Page D# 394 ATTACHMENT Case Document 54-1 Filed 09/16/16 Page 9 of 13 PagelD# 395 Author* Recipient Message Sent (UTC) Message Message Status Ferizi Hussain 06/13/2015 07:59:15 PM when here write me