Case 1:16-cr-00042-LMB Document 21 Filed 02/16/16 Page 1 of 10 PageID# 115 IN THE UNITED STATES DISTRICT COURT FOR THE IN opf:n court EASTERN DISTRICT OF VIRGINIA FEB I 6 2016 Alexandria Division UNITED STATES OF AMERICA Criminal No. 1:16cr42 CLERK. U.S. DISTRICT COURT ALEXANDRIA. VIRGINIA Count One: 18 U.S.C, § 2339B Conspiracy to Provide Material Support and Resources to a Designated Foreign Terrorist Organization V. ARDIT FERIZI, a/k/a"Th3Dir3ctorY," Count Two: 18 U.S.C. § 2339B Providing Material Support and Resources to a Designated Foreign Terrorist Organization Defendant. Count Three: 18 U.S.C. § 1030(a)(2)(C) Unauthorized Computer Access and Obtaining Information Count Four: 18 U.S.C. § 1028A(a)(2) Aggravated Identity Theft INDICTMENT Februarv 2016 Term - At Alexandria. Virginia THE GRAND JURY CHARGES THAT: At all times relevant to this Indictment: GENERAL ALLEGATIONS 1. Islamic State of Iraq and the Levant On October 15,2004, the U.S. Department of State designated Al-Qa'ida in Iraq ("AQI"), then known as Jam'at al Tawhid wa'al-Jihad, as a Foreign Terrorist Organization under Section 219 of the Immigration and Nationality Act and as a Specially Designated Global Terrorist Entity pursuant to Executive Order 13224. On May 15, 2014, the Secretary of State amended the designation of AQI as a Foreign Terrorist Organization Case Document 21 Filed 02/16/16 Page 2 of 10 Page D# 116 under Section 219 of the Immigration and Nationality Act and as a Specially Designated Global Terrorist Entity under Executive Order 13224 to add the alias Islamic State of Iraq andthe Levant as its primary name. The Secretary also added the following aliases to the ISIL listing: the Islamic State of Iraq and al-Sham the Islamic State of Iraq and Syria ad-Dawla al-Islamiyya f1 al-?Iraq wa-sh-Sham, Daesh, Dawla a1 Islamiya, and Al-Furqan Establishment for Media Production. Although the group has never called itself ?Al-Qa"ida in Iraq,? this name has frequently been used by others to describe it. In an audio recording publicly released on or around June 29, 2014, ISIL announced a formal change of its name to the Islamic State To date, ISIL remains a designated Foreign Terrorist Organization. 2. On or about September 21, 2014, ISIL spokesperson Abu Muhammad al-Adnani called for attacks against citizens?civilian or military?of the United States and other countries participating in the United States-led coalition against ISIL. 3. ISIL sought to obtain and disclose personally identi?able information for individuals in the United States military and government, and directed its supporters to kill those individuals. ISIL published PII under the name the ?Islamic State Hacking Division? 4. Ardit Ferizi, FERIZI was a Kosovo citizen residing in Malaysia, who was the leader of a Kosovar intemet group that gained unauthorized access to servers. FERIZI knew that ISIL was a designated Foreign Terrorist Organization and that ISIL had engaged in and was engaging in terrorist activity and terrorism. 5. ?Victim Company,? an Illinois company that operated a website to sell goods to customers in the United States and abroad, was engaged in business practices that affected interstate and foreign commerce. Customers provided PII belonging to themselves to the Victim 2 Case Document 21 Filed 02/16/16 Page 3 of 10 Page D# 117 Company, through its website, to buy goods that were shipped throughout the United States and abroad. 6. ?Hosting Company,? a United States company with a data center in Arizona that hosted websites for the Victim Company and others, was engaged in business practices that affected interstate and foreign commerce. The Victim Company leased a server from the Hosting Company to store the P11 belonging to its customers. 7. On or about January 22, 2016, pursuant to Title 18, United State Code, Section 3238, FERIZI was ?rst brought to the Eastern District of Virginia. Case Document 21 Filed 02/16/16 Page 4 of 10 Page D# 118 COUNT ONE Conspiring to Provide Material Support to a Designated Foreign Terrorist Organization (18 US. C. 23393) THE GRAND JURY FURTHER CHARGES THAT: 8. Paragraphs 1 through 7 of the Indictment are incorporated herein by reference. 9. From? in and around April 2015 to August 11, 2015, in an offense begun and committed outside of the jurisdiction of any particular State or district of the United States, the defendant ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? and others known and unknown to the Grand ury, did knowingly combine, conspire, confederate, and agree together and with each other to provide material support and resources, as that term is de?ned in 18 U.S.C. 2339A(b), namely, property and services, including themselves as personnel, expert advice and assistance, and personally identi?able information belonging to persons in the United States, to a foreign terrorist organization, namely the Islamic State of Iraq and the Levant, knowing that the foreign terrorist organization was designated a terrorist organization and knowing that the foreign terrorist organization had engaged in and was engaging in terrorist activity and terrorism, in violation of Title 18, United States Code, Section 2339B. Manner and Means of the Conspiracy 10. It was part of the conspiracy that FERIZI would and did use his specialized knowledge about hacking to support ISIL, including accessing servers without authorization in order to take PH. 11. It was further part of the conSpiracy that FERIZI would and did communicate with ISIL members over the intemet using social media. Case Document 21 Filed 02/16/16 Page 5 of 10 Page D# 119 12. It was further part of the conspiracy that FERIZI accessed without authorization and exceeded authorized access to the Hosting Company?s server that maintained the Victim Company?s website, which gave FERIZI access to P11 belponging'to thousands of customers of the Victim Company. 13. It was further part of the conspiracy that FERIZI would and did access and obtain PII belonging to approximately 1,3 00 United States military and other government personnel from the Hosting Company?s server that contained PII for the Victim Company?s customers. 14. It was further part of the conspiracy that FERIZI would and did provide the P11 of approximately 1,300 United States military and other government personnel, including persons located in the Eastern District of Virginia, to ISIL, knowing that ISIL would use the P11 to engage in terrorist activity and terrorism. . 15. It was further part of the conSpiracy that ISIL, through the ISHD, would and did send a communication over Twitter that contained a document with the PII of approximately 1,300 United States military and other government personnel that FERIZI had taken from the Victim Company and Hosting Company. The beginning of the document warned the ?Crusaders? who were conducting a ?bombing campaign against the muslimsz? we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!? (Emphasis added.) (In violation of Title 18, United States Code, Section 2339B.) Case Document 21 Filed 02/16/16 Page 6 of 10 Page D# 120 COUNT TWO Attempting to Provide and Providing Material Support to a Designated Foreign Terrorist Organization (1 8 U.S.C. 233 93) THE GRAND JURY FURTHER CHARGES THAT: 16. Paragraphs 1 through 7 and 10 through 15 of the Indictment are incorporated herein by reference. 17. From in and around April 2015 to August 11, 2015, in an offense begun and committed outside of the jurisdiction of any particular State or district of the United States, the defendant ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? and others known and unknown to the Grand Jury, did knowingly attempt to provide and did provide material support and resources, as that term is de?ned in 18 U.S.C. 2339A(b), namely, property and services, including himself as personnel, expert advice and assistance, and personally identi?able information of persons in the United States, to a foreign terrorist organization, namely the Islamic State of Iraq and the Levant, knowing that the foreign terrorist organization was designated a terrorist organization and knowing that the foreign terrorist organization had engaged in and was engaging in terrorist activity and terrorism. (In violation of Title 18, United States Code, Section 2339B.) Case Document 21 Filed 02/16/16 Page 7 of 10 Page D# 121 COUNT THREE Obtaining Information from a Protected Computer (18 US. C. 1030(a) (2) THE GRAND JURY FURTHER CHARGES THAT: 18. Paragraphs 1 through 7 and 10 through 15 of the Indictment are incorporated herein by reference. 19. From on or about June 13, 2015, to August 11, 2015, in an offense begun and committed outside of any particular State or district of the United States, the defendant ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? intentionally accessed a protected computer without authorization and exceeded authorized access to a protected computer, and thereby obtained information from a protected computer, and the offense was committed in furtherance of a criminal act in violation of the laws of the United States, speci?cally, the criminal act of conspiring to provide, attempting to provide, and providing material support to Islamic State of Iraq and the Levant, a designated foreign terrorist organization, as prohibited by 18 U.S.C. 23393, as referenced in Counts One and Two of this Indictment. (In violation of Title 18, United States Code, Sections 103 and Case Document 21 Filed 02/16/16 Page 8 of 10 Page D# 122 COUNT FOUR Aggravated Identity Theft (18 (1.5. C. 1028A(a)(2)) THE GRAND JURY FURTHER CHARGES THAT: 20. Paragraphs 1 through 7 and 10 through 15 of the Indictment are incorporated herein by reference. 21. From on or about June 13, 2015, to August 11, 2015, in an offense begun and committed outside of any particular State or district of the United States, the defendant ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? did knowingly transfer, possess, and use, without lawful authority, a means of identi?cation of another person during and in relation to a felony violation enumerated in 18 U.S.C. 2332b(g)(5)(B), that is, conspiring to provide, attempting to provide, and providing material support to Islamic State of Iraq and the Levant, a designated foreign terrorist organization as prohibited by 18 U.S.C. 2339B, as referenced in Counts One and Two of this Indictment, knowing that the means of identi?cation belonged to another actual person. (In violation of Title 18, United States Code, Section 1028A(a)(2)) Case Document 21 Filed 02/16/16 Page 9 of 10 Page D# 123 FORFEITURE NOTICE l. The allegations contained in Counts One and Two of this Indictment are hereby re-alleged and incorporated by reference for the purpose of alleging forfeitures pursuant to the provisions of Title 18, United States Code, Sections and Title 28, United States Code, Section 2461 2. From his engagement in the violations alleged in Counts One and Two of this Indictment, punishable by imprisonment for more than one year, the defendant ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), all of his interest in any property constituting or derived from proceeds obtained directly or indirectly as a result of the said violation(s); pursuant to Title 18, United States Code, Section and Title 28, United States Code, Section 2461(c) all assets, foreign or domestic derived from, involved in, or used or intended to be used to commit any act of domestic or international terrorism against the United States, citizens or residents of the United States, or their pr0perty. 3. The allegations contained in Count Three of this Indictment are hereby re?alleged and incorporated by reference for the purpose of alleging forfeitures pursuant to the provisions of Title 18, United States Code, Sections 982(a)(2)(B) and and Title 28, United States Code, Section2461(c). . 4. From his engagement in the violations alleged in Count Three of this Indictment, punishable by imprisonment for more than one year, the defendant, ARDIT FERIZI, a/k/a ?Th3Dir3ctorY,? shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section any and all right, title, and interest he has in any preperty constituting, 9 Case Document 21 Filed 02/16/16 Page 10 of 10 Page D# 124 or derived from, proceeds the person obtained directly or indirectly, as a result of such violation(s) and pursuant to Title 18, United States Code, Section and Title 28, United States Code, Section 2461(0) all assets, foreign or domestic derived from, involved in, or used or intended to be used to commit any act of domestic or international terrorism against the United States, citizens or residents of the United States, or their property. 5. If any of the property described above, as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; 0. has been placed beyond the jurisdiction of the court; (1. has been substantially diminished in value; or e. has been commingled with other property which cannot be divided without dif?culty, the United States of America shall be entitled to forfeiture of substitute property under the provisions of Title 21, United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 2461 A Irishjalittlgihl? B-Govenunem Act" . The origin omits page has been ?led ..: DANA J. BOENTE UNITED STATES ATTORNEY rem? Brandon L. Van Grack Special Assistant United States Attorney Gregory R. Gonzalez Trial Attorney US. Department of Justice, National Security Division 10