.M an. AM ENDE DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN us. DISTRICT COURT i av: Cl COMPLAINT Cl INFORMATION INDICTMENT Name El SUPERSEDING NORTHERN DISTRICT OF CALIFO A0 257 (Rev. BITE) r?u?u?u OFFENSE CHARGED A A Petty FR NOISCO 2915 18 U.S.C. . 18 Iozstaitzt: r? DEFENDANT- U.S SUSAN ?rt {put?JNG 18 u.s.c. 5 Ioacraltzitct: Misde- gig-nggi??gicifggr mus-?5 ?039?31?90?1' Cl meanor YEVGENIY 0WD my DISTRICT COURT NUMBER See attached. 1! I fat A - in: DEFENDANT PROCEEDING is NOTIN CUSTODY Has not been arrested. pending outcome this proceeding. Name of Complaintant Agency, or Person Title. If any) 1) if not detained give date any prior FBI summons was served on above charges person is awaiting trial in another Federal or State Court. 2) Is a Fugitive give name of court 3) is on Ball or Release from (show District) this personlproceeding is trenslerred from another district per (circle one) 20. 21, or 40. Show District 18 IN CUSTODY 4) On this charge this is a reprosecution of charges previously dismissed which were dismissed on motion SHOW DOCKET No. . . 6) [j Awaiting trial on other charges [1 DEFENSE 5) On another conviction [3 Federal State [3 L13 ATTORNEY if answer to (6) is "Yes". show name of institution this prosecution relates to a . If We .1 pending case involving this same H35 deta'mr yes give dsate defendant MAGISTRATE been ?led? No med CASE ?0 Montth {Year prior proceedings or appearancels) 221.2%: 9 av before US. Magistrate regarding this 1 6?7} 303 MAG dafendam were recorder-i under if Arresting Agency Warrant were not Name and Of?ce of Person DATE TRANSFERREO MonthiDaleear Furnishing information on this form BRIAN J. STRETCH TO US. CUSTODY (EMS. Attorney Other U.S. Agency Name ofAssistant U.S. This report amends A0 25? previously submitted Attorney {if assigned) MICHELLE J. KANE OR COMMENTS PROCESS: SUMMONS NO WARRANT Bail Amount: No bail if Summons, complete following: Arraignment initial Appearance Defendant Address: Where defendant previously apprehended on complaint, no new summons or warrant needed. since Magistrate has scheduled arraignment Date?'ime: Before Judge: Comments: Defendant is in custody in foreign jurisdiction. Attachment Penalty Sheet Statutory Maximum Penalties: 18 U.S.C. 371: Five years of imprisonment, $250,000 fine (or alternatively, twice the gross gain or gross loss, whichever is greater), three years of supervised release, $100 special assessment, forfeiture, and restitution. 18 U.S.C. :Two-year mandatory minimum sentence of imprisonment to run consecutive to any other sentence and in addition to the sentence for the underlying felony, $250,000 fine (or alternatively, twice the gross gain or gross loss, whichever is greater), three years of supervised release, $100 special assessment, restitution. 18 U.S.C. 1029(a)(2) and Ten years of imprisonment, $250,000 fine (or alternatively, twice the gross gain or gross loss, whichever is greater), three of years supervised release, $100 special assessment, forfeiture, and restitution. 18 U.S.C. 1030(a)(2)(C) and Five years of imprisonment, $250,000 fine (or alternatively, twice the gross gain or gross loss, whichever is greater), three years of supervised release, $100 special assessment, forfeiture, and restitution. 18 U.S.C. 1030(a)(5)(A) and Ten years of imprisonment, $250,000 fine (or alternatively, twice the gross gain or gross 1058, whichever is greater), three years of supervised release, $100 Special assessment, forfeiture, and restitution. gamut: Stanza gaiairiri (?our-t FOR THE NORTHERN DISTRICT OF CALIFORNIA VENUE: IOakland ?3 ?0 ?imp?Ergo 0 ?5 UNITED STATES OF AMERICA, #42 Seggagm 2/ 7 ?Pfo?i?i?c?? V. <9 YEVGENIY NIKULIN, a/k/a ?ChinabigOI? a/k/a ?dex.007? a/k/a ?valeriy.krutov3? elk/a ?itBIackI?Iat", DEFENDANT. INDICTMENT 18 U.S.C. 371 - Conspiracy; 18 U.S.C. 1028A Aggravated Identity Theft; 18 U.S.C. 1029(a)(2) - Trafficking in Unauthorized Access Devices; 18 U.S.C. 103 Computer Intrusion; 18 U.S.C. 1030(a)(5)(A) Intentional Transmission Causing Damage to a Protected Computer; 18 U.S.C. 982(a)(2) (B), 1029(c)(1)(C), 18 U.S.C. 10306) and G) Forfeiture. Filed in open court this "2-0 day of Gg?gg?g. 2.0/4? clam #3194? NA I Clerk BRIAN J. STRETCH (CABN 163973) United States Attorney 6, . . C. 2 Attorney for Unlted States of America 0 A) I "V'e 592135.300 2/ 069? UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA OAKLAND DIVISION 11-. UNITED STATES OF AMERICA, CASQWR a . . 1 WE VIOLATIONS: 18 U.S.C. 371 Consp1racy; - U.S.C. 1028A - Aggravated Identity Theft; 18 v. U.S.C. 1029(a)(2) Traf?cking in Unauthorized . Access Devices; 18 U.S.C. 1030(a)(2)(C) YEVGENIY NIKULIN, Computer Intrusion; 18 U.S.C. 1030(a)(5)(A) Intentional Transmission Causing Damage to a a/k/a ?ChinabigOl? Protected Computer; 18 U.S.C. 1029(c)(1)(C), 18 U.S.C. 1030(1) and a/k/a ?dex.007? Forfeiture. a/lc/a ?valeriy.krutov3" SAN FRANCISCO VENUE a/k/a ?itBlackI-Iat? 1 Defendant. I I The Grand Jury charges: BACKGROUND At all times relevant to the Indictment: 1. LinkedIn Corporation was headquartered in Mountain View, California. LinkedIn operated a social networking website focused on business and employment connections. Each LinkedIn user had an individual account protected by a user name, which was an email address, and a passv'vord. LinkedIn maintained a database of user account information, including user names and INDICTMENT passwords, on computers located in the Northern District of California. LinkedIn employees were assigned individual credentials by which they could remotely access the LinkedIn corporate network. An individual with the initials N.B. worked for LinkedIn at its Mountain View, California, headquarters. 2. DrOpbox, Inc., was an electronic ?le storage service headquartered in San Francisco, California. Dropbox used cloud computing to enable users to store and share files and folders with other users across the Internet using file Each Dropbox user. had an individual account protected by a user name, which was an email address, and password. Dropbox maintained a computer 3. Inc., was a corporation with its headquarters in San Francisco, California. database of user account information, including user names and passwords. operated a social question answer website. Each user had an individual account protected by a user name and password. maintained a computer database of user account information, including user names and passwords. employees were assigned individual credentials by which they could remotely access the corporate network. An individual with the initials J.S. worked for at its San Francisco, California, headquarters. 4. Google, Inc., was a corporation with its headquarters in Mountain View, California. Google offered internet-related services, including the Gmail email service, to customers all over the world. COUNT ONE: (18 U.S.C. 1030(a)(2)(C) and Computer Intrusion) 5. The factual allegations contained in Paragraph One are realleged and incorporated herein. 6. Beginning on approximately March 3, 2012, and continuing to approximately March 4, 2012, in the Northern District of California and elsewhere, the defendant, YBVGENIY NIKULIN, intentionally accessed a protected computer used in interstate and foreign commerce without authorization and exceeding authorized access, and thereby obtained information from a protected computer, and committed the offense for purposes of commercial advantage and private ?nancial gain, and the value of the information obtained exceeded $5,000; that is, defendant used the Internet to access computers belonging to LinkedIn Corporation and obtained information, all in violation of Title 18 INDICTMENT United States Code, Sections 1030(a)(2)(C) and and COUNT TWO: (18 U.S.C. 103 Intentional TransmissiOn of Information, Code, or Command Causing Damage to a Protected Computer) 7. The factual allegations contained in Paragraph One are realleged and incorporated herein. 8. Starting on or about March 3, 2012, and continuing through on or about March 4, 2012, in the Northern District of California and elsewhere, the defendant, YEVGENIY NIKULIN, knowingly caused the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally caused damage without authorization to a protected computer; that is, NIKULIN knowingly transmitted a program, information, code, and command to a computer belonging to Linkedln employee NE. and thereby caused damage without authorization, and the offense caused loss to a person during a one year period from the defendant?s course of conduct affecting a protected computer aggregating at least $5,000 in value, all in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and COUNT THREE: (18 U.S.C. 1028A Aggravated Identity Theft) 9. The factual allegations contained in Paragraph One are r'ealleged and incorporated herein. 10. Beginning on approximately March 3, 2012, and continuing to approximately March 4, 2012, in the Northern District of California and elsewhere, the defendant, YEVGBNIY NIKULIN, did knowingly possess and use, without lawful authority, a means of identi?cation of another person, that is, the user name and password assigned to LinkedIn employee N.B., during and in relation to violations of Title 18, United States Code, Section 103 and and all in violation of Title 18, United States Code, Section 1028A(a)(1). COUNT FOUR: (18 U.S.C. 1030(a)(2)(C) and - Computer Intrusion) 11. The factual allegations contained in Paragraph Two are realleged and incorporated herein. 12. Beginning on approximately May 14, 2012, and continuing to approximately July 25, INDICTMENT 2012, in the Northern District of California and elsewhere, the defendant, YEVGENIY NIKULIN, intentionally accessed a protected computer used in interstate and foreign commerce without authorization and exceeding authorized access, and thereby obtained information from a protected computer, and committed the offense for purposes of cemrnercial advantage and private ?nancial gain, and the value of the information obtained exceeded $5,000; that is, defendant used the Internet to access computers belonging to Dropbox, Inc., and obtained information, all in violation of Title 18 United States Code, Sections 1030(a)(2)(C) and and COUNT FIVE: (18 U.S.C. 371 Conspiracy) 13. The factual allegations contained in Paragraphs Three and Four are reaileged and incorporated herein. 14. Beginning on a date unknown to the grand jury and continuing to on or about May 31, 2013, in the Northern District of California, and elsewhere, the defendant, YEVGENIY NIKULIN, did knowingly and willfully conspire with others known and unknown to the grand jury to commit offenses against the United States, that is, NIKULIN conspired to knowingly and with intent to defraud traf?c in unauthorized access devices, that is, user names, email addresses, and passwords, belonging to customers of Inc., and other companies, and by such conduct obtain $1,000 or more in any one-year period, and said traf?cking would have affected interstate and foreign commerce, in violation of Title 18, United States Code Section 1029(a)(2). Manner and Means of The Consuiracy 15. It was part of the conSpiracy that NIKULIN gained unauthorized access to protected computers and thereby obtained the unauthorized access devices, including user names, email addresses, and passwords. 16. It was further part of the conspiracy that CO-CONSPIRATOR 1 possessed the unauthorized access devices and offered them for sale. 17. It was further part of the conspiracy that 3 purchased the INDICTMENT unauthorized access devices. 18. It was further part of the conspiracy that CO-CONSPIRATORS 2 and 3 used Gmail accounts to communicate with 1 regarding the conspiracy. Overt Acts 19. In furtherance of the conspiracy and to effect its objects, NIKULIN and his co-co- conspirators committed and caused to be committed the following overt acts, among others, in the Northern District of California and elsewhere: a. Between on or about June 13, 2012, and on or about June 29, 2012, NIKULIN gained unauthorized access to the computers holding the user information database and downloaded the user information database, including user names, email addresses, and passwords, to a computer located outside the United States. b. On or about July 13, 2012, CO-CONSPIRATOR 2, using a Gmail?account, sent an email message to CO-CONSPIRATOR 1 vouching for reliability in selling stolen user credentials. c. On or about July 16, 2012, I sent an email message to CONSPIRATOR 3 Gmail account offering to sell the stolen user information database for ?5,500. All in violation of Title 18, United States Code, Section 371. COUNT SIX: (18 U.S.C. 1029(a)(2) Traf?cking in Unauthorized Access Devices) 20. The factual allegations contained in Paragraphs Three, Four, and Thirteen through Nineteen are realleged and incorporated herein. 21. Beginning on a date unknown to the grand jury and continuing to approximately September 19, 2012, in the Northern District of California and elsewhere, the defendant, YEVGENIY NIKULIN, knowingly and with intent to defraud, traf?cked in unauthorized access devices, that is, user names, email addresses, and passwords, belonging to customers of Inc., and by such conduct from on or about June 1, 2012, and ending on or about May 31, 2013, obtained $1,000 or more, said INDICTMENT 4'30de traf?cking affecting interstate and foreign commerce, in violation of Title 18, United States Code, Sections 1029(a)(2) and COUNT SEVEN: (18 U.S.C. 1030(a)(2)(C) and Computer Intrusion) 22. The factual allegations contained in Paragraphs Three, Four, and Thirteen through Nineteen are realleged and incorporated herein. 23. Beginning on approximately June 13, 2012, and continuing to approximately June 29, 2012, in the Northern District of California and elsewhere, the defendant, - YEVGENIY NIKULIN, intentionally accessed a protected computer used in interstate and foreign commerce Without authorization and exceeding authorized access, and thereby obtained information from a protected computer, and committed the offense for purposes of commercial advantage and private ?nancial gain, and the value of the information obtained exceeded $5,000; that is, defendant used the Internet to access computers belonging to Inc., and obtained information, all in violation of Title 18 United States Code, Sections 103 and and COUNT EIGHT: (18 U.S.C. 1030(a)(5)(A) Intentional Transmission of Information, Code, or Command Causing Damage to a Protected Computer) 24. The factual allegations contained in Paragraphs Three, Four, and Thirteen through Nineteen are realleged and incorporated herein. 25. Starting on or about June 13, 2012, and continuing through on or about June 29, 2012, in the Northern District of California and elsewhere, the defendant, YEVGENIY NIKULIN, knowingly caused the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally caused damage without authorization to a protected computer; that is, NTKULIN knowingly transmitted a program, information, code, and command to a computer belonging to and thereby caused damage without authorization, and the offense caused loss to a person during a one year period from the defendant?s course of conduct affecting a protected computer aggregating at least $5,000 in value, all in violation of Title 18, United States Code, Sections INDICTMENT 1030(a)(5)(A) and COUNT NINE: (18 U.S.C. 1028A Aggravated Identity Theft) 26. The factual allegations contained in Paragraphs Three, Four, and Thirteen through Nineteen are realleged and incorporated herein. 27. Beginning on approximately June 13, 2012, and continuing to approximately June 29, 2012, within the Northern District of California and elsewhere, the defendant, YEVGENIY NIKULIN, did knowingly possess and use, without lawful authority, a means of identi?cation of another person, that is, the user name and password assigned to employee .S., during and in relation to violations of Title 18, United States Code, Section 1030(a)(2)(C) and and all in violation of Title 18, United States Code, Section 1028A(a)(1). FORFEITURE ALLEGATION: (18 U.S.C. 1029(c)(1)(C), and 1030(i)and 28. The allegations contained in this Indictment are hereby realleged and incorporated by reference for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1029(c)(1)(C). 29. Upon conviction of the offenses in violation of Title 18, United States Code, Section 1030(a) set forth in Counts One, Two, Four, Seven, and Eight of this Indictment, the defendant, YEVGENIY NIKULIN, shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 103 0(i) and any personal property used or intended to be used to commit or to facilitate the commission of said violation or a conSpiracy to violate said provision, and any property, real or personal, which constitutes or is derived from proceeds traceable to the offenses, including but not limited to, a sum of money equal to the total amount of proceeds defendant obtained or derived, directly or indirectly, from the violation. 30. Upon conviction of any of the offenses set forth in Counts Five and Six of this Indictment, defendant, YEVGENIY NIKULIN, INDICTMENT Lashall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 982(a)(2)(l3), any property constituting, or derived from, proceeds obtained, directly or indirectly, as a result of such Violation, and, pursuant to Title 18, United States Code, Section 1029(c)(1)(C), any personal property used or intended to be used to commit the offense. 31. If any of the property described above, as a result of any act or omission of the defendant: 21. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or c. has been cominingled with other property which cannot be divided without dif?culty, the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21, United States Code, Section 853(p), as incorporated by Title 18, United States Code, Sections 982(b)(1), 1029(c)(2), and 1030(i)(2). All pursuant to Title 18 United States Code, Sections 1029(c)(1)(C), and 1030. Dated: FOREPERSON BRIAN J. STRETCH United States Attorney MATTHEW A. PARRELLA Chief, CHIP Unit (Approved as to form: M. KANE ENDICTM ENT