BRYAN SCHRODER
United States Attorney
ADAM ALEXANDER
Assistant U.S. Attorney
Federal Building & U.S. Courthouse
222 West Scvc:,th Avenue, #9, Room 253
Anchorage, Aia">ka 99513-7567
Phone: (907) 271-5071
Fax: (907)271-1500
Email: adam.alexander@usdoj.gov
KENNETH A. BLANCO
Acting Assistant Attorney General
CATHERlNE ALDEN PELKER
Trial Attorney
Computer C:·i:n,: & Intellectual Property Section
1301 New York Avenue, NW, Suite 600
Washington, DC 20005
Telephone: (202) 514-1026
Facsimile: (202) 514-6113
Email: catherine.pelker@usdoj.gov

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRJCT OF ALASKA
UNITED. T:\TES OF AMERICA,
Plaintiff,
vs.
DAL TON NORMAN.
Defendant.

) No. 3:17-cr-00166-TMB

)

)
) PLEA AGREEMENT
)
)

)

)

)

Unless the parties jointly inform the Court in writing of any
additional agreements, this document in its entirety
contains the terms of the plea agreement between the
defendant and the Prosecuting Offices (the United States

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 1 of 18

 to the District of Alaska and the Computer Crime and
Intellectual Property Section; it does not bind other
federal, state, or local prosecuting authorities.
I.

SUMMARY OF AGREEMENT, FEDERAL RULE OF CRIMINAL
PROCEDURE 11, WAIVER OF CLAIM FOR ATTORNEY'S FEE AND
COSTS
A.

Summary of Agreement

The defendant agrees to plead guilty to the sole count of the Information in this case:
conspiracy to violate 18 U.S.C. � l 030(a)(5) in violation of 18 U.S.C. § 3 71. The defendant
further agrees to voluntarily abandon the cryptocurrency seized in this matter, which are
the proceeds of criminal activity. The United States agrees not to prosecute the defendant
further for any other offense related to the events that resulted in the charge contained in
the Infonnation.
The defendant will waive all rights to appeal the conviction and sentence imposed
under this agreement. The defendant will also waive all rights to collaterally attack the
conviction and sentence, except on the grounds of ineffective assistance of counsel or the
voluntariness of the plea.

n.

Federal Rule of Criminal Procedure 11

Unless the parties otherwise inform the Court in writing, Federal Rule of Criminal
Procedure l l(c)(l)(A) and (B) will control this plea agreement. Thus, the defendant may
not withdraw from this agreement or the guilty plea if the Court rejects the parties'
sentencing recommendations at the sentencing hearing.
!I

U.S. v. Dalton Norman

Page 2 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 2 of 18

 II.

CHARGES, ELEMENTS, FACTUAL BASIS, STATUTORY PENALTIES
AND OTHER MATTERS AFFECTL�G SENTENCE, FORFEITURE,
RESTITUTION, VOLUNTARY ABANDONMENT
Charges

A.

The defendant agrees to plead guilty to the sole count of
the Information:
1.

Conspiracy to violate 18 U.S.C. § 1030(a)(5)(A) in violation of 18

u.s.c. § 371;
Elements

B.

The elements of the charges to which the defendant is pleading guilty are as follows:
1.

An agreement between the defendant and at least one other
person to commit a violation of 18 U.S.C. 1030(a)(5)(A) (causing
intentional damage to a protected computer, to wit knowingly
causing the transmission of a program, code, or command to a
computer with the intention of impairing without authorization
the integrity or availability of data, a program, system, or
information; and the computer was used in or affected interstate
or foreign commerce or communication);

2.

The defendant became a member of the conspiracy knowing of at
least one of its objects and intending to help accomplish it; and

3.

One of the members of the conspiracy performed at least one
overt act for the purpose of carrying out the conspiracy.

U.S. v. Dalton Norman

Page 3 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 3 of 18

 C.

Factual Basis

The defcndant admits the truth of the allegalions in the sole count of the Information
and the truth of the following statement. and the parties stipulate that the Court may rely
upon this statement to support the factual basis for the guilty plea and for the imposition of
the sentence:
Beginning in or around December 2016, NORMAN and co-conspirators agreed to
work togeth�r with persons known and unknO\vn to create a botnet - a collection of
computers infected with malicious software and controlled as a group without the
knowledge or permission of the computers' owners. NORMAN and his co-conspirators
successfully infected hundreds of thousands of internet-connected computing devices,
including computers in Alaska and other states, with malicious software. NORMAN and
his co-conspirators used the compromised devices as a net\Vork of proxies through which
they would route internet traffic. The victim devices were used primarily in advertising
fraud, including "clickfraud," a type of Internet-based scheme that utilize "clicks," or the
accessing of URLs and similar web content, for the purpose of artificially generating
revenue.
In January 2017, during the course of the conspiracy, NORJv1AN and his co­
conspirators leased access to their botnel to other criminals in exchange for payment. With
the approval of NOR.NIAN and his co-conspirators, these customers used the botnet to
engage in advertising fraud, and particularly clickfraud. In this scheme, victim devices
were used to transmit high volumes of requesls to view web addresses associated with
U.S. v. Dalton Nom1an

Page 4 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 4 of 18

 affiliate advertising content. Because the victim activity resembled legitimate views of
these websites, the activity generated fraudulent profits through the sites hosting the
advenising content, at the expense of the online advertising companies.
During the course of the conspiracy, NORMAN and his co-conspirators actively
identified and infected devices without authorization in order to further the clickfraud
schemes.

NORMAN and his co-conspirators transmitted commands to the devices

controlled by the botnet in order to direct the devices' participation in various criminal
schemes, including clickfraud.

In doing so, NORJ.\1AN and his co-conspirators

intentionally caused damage to the victim devices. The installation of the malware and
subsequent commands all impaired the integrity of the victim devices, and the high volume
of web requests associated with the clickfraud activity slowed or degraded at least some of
the devices. NORMAN and his co-conspirators specifically targeted home internet routers
associated with a U.S.-based Internet Service Provider, and the volume of click.fraud
activity pushed through the routers limited the amount of bandwidth available to the home
consumers.
NORMAN and his co-conspirators designed the botnet to effectively participate in
clickfraud schemes, and, indeed, the botnet did further the clickfraud activity. The botnet
and the resulting fraud provided NORMAN and his co-conspirators with value. in the form
of pro.fits from the fraudulent advertising revenue earned through clickfraud activity, botnet
rental payment, information, and the use of the computers. As a result of this scheme,
NORMAN and his co-conspirators received as proceeds approximately one hundred
U.S. v. Dalton Norman

Page 5 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 5 of 18

 bitcoin, valued on January 29, 2017 at over $90,000. NORMAN personally earned
cryptocurrency, valued on January 29, 2017 at over $30,000. NORMAN converted a
portion of those proceeds into the cryptocurrency "golem."
NORMAN personally performed a number of acts in furtherance of the conspiracy,
including, but not limited to:
a. From December 2016 to January 2017, defendant DAL TON NORMAN
worked to identify vulnerable devices and wrote code to infect tens of
thousands of those devices with malware. The malware gave NORMAN and
his co-conspirators control over the bots, which they directed to engage in
clickfraud activities.
b. From December 2016 to January 2017,the co-conspirators worked to adapt
the malware to handle a large number of bots, which eventually exceeded
100,000, allowing NORMAN and his co-conspirators to capitalize on the
availability of a large pool of prospective victim devices and to maximize the
size of the botnet. The malicious program used by NORMAN and his co­
conspirators caused damage to the victim devices.
c. From December 2016 to January 2017, NORMAN and his co-conspirators
worked to identify private zero-day vulnerabilities, meaning vulnerabilities
that had not yet been disclosed. NORMAN identified and exploited at least
four such vulnerabilities, which he did not disclose to device manufacturers.

U.S. v. Dalton Norman

Page 6 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 6 of 18

 d. In or about January 2017, defendant DAL TON NORMAN was in direct
communication with customers of the clickfraud botnet.

NORMAN

communicated with the clients regarding the botnet and its activities.
NORMAN worked with his co-conspirators to ensure that the victim devices
participating in the botnet performed the activities requested by the criminal
customers leasing the botnet.
e. In or about January 2017, defendant DALTON NORMAN received proceeds
from the clients who rented the clickfraud botnet. Over the course of his
participation

m

the

consp1racy,

NORMAN

personally

earned

cryptocurrency, valued on January 29, 2017 at over $30,000.
D.

Statutory Penalties and Other Matters Affecting Sentence
1.

Statutory Penalties

The maximum statutory penalties applicable to the charge to which the defendant is
pleading guilty, based on the facts to which the defendant will admit in support of the guilty
plea, are as follows:
Count l : Conspiracy to violate 18 U.S.C. § 1030(a)(5)(A)
1) Imprisonment: Five years
2) Fine: $250,000
3) Supervised Release: Three years
4) Special Assessment: $100

U.S. v. Dalton Norman

Page 7 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 7 of 18

 2.

Other Matters Affecting Sentence
a.

Conditions Affecting the Defendant's Sentence

The following conditions may also apply and affect the defendant's sentence: l)
pursuant to Comment 7 of U.S.S.G. § SEl .2. the Court may impose an additional fine to
pay the costs to the government of any imprisonment and supervised release term; 2)
pursuant to 18 lJ.S.C. § 3612(t), unless otherwise ordered, if the Court imposes a fine of
more than $2.500, interest will be charged on the balance not paid within IS days after the
judgment date; 3) upon violating any condition of supervised release, a further term of
imprisonment equal to the period of the supervised release may be imposed, with no credit
for the time already spent on supervised release; 4) the Court may order the defendant to
pay restitution pursuant to the 18 U.S.C. § 3663 and U.S.S.G. § 5El .l : and if 18 U.S.C.
§ 3663A (mandatory restitution for certain crimes) applies, the Court shall order the
defendant to pay restitution.
b.

Payment of Special Assessment

The defendant agrees to pay the entire special assessment in this case on the day the
Court imposes the sentence. All payments will be by check or money order, and are to be
delivered to the Clerk of Court, United States District Court, 222 W. 7th Ave. Box 4, Rm.
229, Anchorage, AK 99513-7564.
c.

Consequences of Felony Conviction

Any person convicted of a federal felony offense may lose or be denied federal
benefits including any grants, loans, licenses, food stamps, welfare or other fonns of public
U.S. v. Dalton Norman

Page 8 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 8 of 18

 assistance, as well as the right to own or possess any firearms, the right to vote, the right to
hold public office, and the right to sit on a jury. If applicable, any defendant who is not a
United States citizen may be subject to deportation from the United States following
conviction for a criminal offense and will not be permitted to return unless the defendant
specifically recci vcs the prior approval of the United States Attorney General.
E.

Restitution

The parties agree that the proper restitution amount will be determined at
sentencing.
F.

Voluntary Abandonment

Defendant agrees to voluntarily abandon all cryptocurrency seized or unseized in
lhis maner, which are the proceeds of criminal activity.
The defendant warrants that the defendant had sole possession and ownership of the
property referenced above, �nd that there are no claims to, or liens or encumbrances on the
property referenced above. Defendant will take all steps as requested by the United States
to pass clear title to the property, including but not limited to executing documents, and
testifying truthfully in any legal proceeding. The defendant agrees to forever abandon and
disclaim any right, title, and interest the defendant may have in the property described
above, and warrant to the Court free, clear and unencumbered title to the aforelisted
property. Defendant further agrees to defend against any claims that may be filed against
said prop1:rty, and agrees not to assist others in filing a claim against said property in any
legal proceeding.
U.S. v. Dalton Norman

Page 9 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 9 of 18

 III.

AJ?VISORY UNITED STATES SENTENCING GUIDELINES, GUIDELINE
APPLICATION AGREEMENTS, SENTENCING RECOMMENDATIONS
A.

Advisory United States Sentencing Guidelines

The Court must consult the advisory United States Sentencing Commission
Guidelines [ U.S.S.G.] as well as the factors set forth in 18 U.S.C. § 3553(a) when
considering the sentence to impose. The U.S.S.G. do not establish the statutory maximum
or minimum sentence applicable to the offense to which the defendant is pleading guilty.
The U.S.S.G. are not mandatory and the Court is not bound lo impose a sentence
recommended by the U.S.S.G.
U.

Guideline Application Agreements

Pursuant to Federal Rule of Criminal Procedure 1 l(c){l)(B), and to assist the Court
in determining the appropriate sentence, the parties stipulate that the Offense Level for
each count under the U.S.S.G is not less than:
18 u.s.c. § 371
§ 2R1.l(a)

Base Offense Level

6

§ 2Bl.l(b)(2)Victims (10 or more)

+2

§ 2Bl.J.(b)(10)

+2

Sophisticated means

The parties have not reached an agreemem on the amount of loss. which will be
determined at sentencing.
t.

Acceptance of Responsibility

If tbe United States concludes that the defendant has satisfied the criteria set out in
U .S.S.G. § 3El. I and the applicable application notes, the United States agrees to
U.S. v. Dalton Norman
Page 10 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 10 of 18

 recommend the defendant for a two level downward adjustment for acceptance of
responsibility and, if U.S.S.G. § 3El.l(b) applies, to move for the additional one level
adjustment for acceptance of responsibility. If, at any time prior to imposition of the
sentence, the United States concludes that the defendant has failed to fully satisfy the
criteria set out in U.S.S.G. § 3El.l, or has acted in a manner inconsistent with acceptance
of responsibility, the United States will not make or. if already made, will withdraw this
recommendation and motion.
C.

Sentencing Recommendations

The United States Probation Office will prepare the defendant's pre-sentence report
in which it will include a recommended calculation of the defendant's sentence range under
the U.S.S.G. Both the United States and the defendant will have the opportunity to argue
in support of or in opposition to the guideline sentence range calculation the U.S.P.O.
recommends, as well as present evidence in support of their respective sentencing
arguments.
The parties are free to recommend to the Court their respective positions on the
appropriate sentence to be imposed in this case based on the stipulated facts set forth in
Section II C. any additional facts established at the imposition of sentence hearing. the
applicable statutory penalty sections, lhe advisory U.S.S.G., and the sentencing factors set
forth in 18 L.S.C. § 3553.
II

U.S. v. Dalton Norman
Page 11 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 11 of 18

 IV.

ADDITIONAL AGREEMENTS BY UNITEDSTATES
In exchange for the defendant's guilty plea and the Cow·t's acceptance of the

defendant's plea and the terms of this agreement, the United Stales agrees that it will not
prosecute the defendant further for any other offense - now known - arising out of the
subject oflYe i11vestigation related to the charges brought in the Information in this case
and the defendant's admissi.ons set forth in Section Il C.
Provided, however, if the defendant's guilty plea or sentence is/arc rejected,
withdrawn, vacated, reversed, set aside, or modified. at any time. in any proceeding, for
any reason, the United States will be free to prosecute the defendant on all charges arising
out of the investigation of this case including any charges dismissed pursuant to the terms
of this agreement, which charges will be automatically reinstated as well as for perjury and
false statements. The defendant hereby agrees that he waives any defense that the statute
of limitations bars the prosecution of such a reinstated charge.
V.

WAIVER OF TRU.L RIGHTS, APPELLATE RIGHTS, COLLATERAL
ATTACK RIGHTS, CLAIM FOR ATTORNEY FEES AND COSTS, AND
RULE 410
A.

Trial Rights

Being aware of the following, the defendant waives these trial rights:
- the right to have the charges presented to the grand jury prior to entering
the guilty plea:
- The right to a speedy and public trial by jury on the factual issues
establishing guilt or any fact affecting the mandatory minimum and
U.S. v. Dalton Norman
Page 12 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 12 of 18

 statutory penalties, and any issue affecting any interest in any assets
subject to forfeiture;
- The right to object to the composition of the grand or trial jury;
- The right to plead not guilty or to persist in that plea if it has already been
made;
- The right to be presumed innocent and not to suffer any criminal penalty
unless and until the defendant's guilt is established beyond a reasonable
doubt:
- The right to be represented by counsel at trial and if necessary to have a
counsel appointed at public expense to represent the defendant at trial the defendant is not waiving the right to have counsel continue to
represent the defendant during the sentencing phase of this case;
- The right to confront and cross ex.amine witnesses against the defendant,
and the right to subpoena witnesses to appear in the defendant's behalf;
- The right to remain silent at trial. with such silence not to be used against
the defendant. and the right to testify in the defendant's own behalf; and
- The right to contest the validity of any searches conducted on the
defendant's property or person.
B.

Appellate Rights

The defendant waives the right to appeal the conviction resulting from the entry of
guilty plea to the charge set forth in this agreement. The defendant further agrees that if
U.S. v. Dalton Noiman

Page I., of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 13 of 18

 the Court imposes a sentence that does not exceed the statutory maximum penalties - as
set forth in section 11.D above in this agreement. the defendant waives without exception
the right to appeal on all grounds contained in 18 U.S.C. § 3742 the sentence the Court
imposes - including forfeiture (if applicable) or terms or conditions of probation (if
applicable) or supervised release, any fines or restitution.
By waiving these rights, the defendant understands that the conviction and sentence
the Court imposes will be final. No other couit will conduct appellate review of the
conviction or the sentence.
'111e defendant agrees that the appellate and collateral attack waivers contained
within this agreement will apply to any U.S.C. § 3582(c) modifications, as well as the
district court's decision to deny any such modification.
Should the defendant file a notice of appeal in violation in this agreement, it will
constitute a material breach of the agreement. The government is free to reinstate any
dismissed charges, and withdraw any motions for downward departures, or sentences
below the mandatory minimum made pursuant to 18 U.S.C. § 3553(e).
C.

Collateral Attack Rights

The defendant agrees to waive all rights to . collaterally attack the resulting
conviction and/or sentence - including forfeiture (if applicable) or terms or conditions of
probation (if applicable) or supervised release, and any fines or restitution - the Court
imposes. The only exceptions to this collateral attack waiver are as follows: l) any
challenge tn the conviction or sentence alleging ineffective assistance of counsel - based
U.S. v. Dalton Norman
Page 14 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 14 of 18

 on information not now known to the defendant and which. in the exercise of reasonable
diligence, could not be known by the defendant at the time the Court imposes sentence;
and 2) a cha!lenge to the voluntariness of the defendant's guilty plea.
D.

Claim for Attorney Fees and Costs

Because this is a negotiated resolution of the case. the parties waive any claim for
the award of attorney fees and costs from the other party.
E.

Evidence Rule 410 and Fed. R. Crim. P. .l l(f)

By signing this agreement, the defendant admits the truth of the facts in the Factual
Basis portion or this agreement set forth in Section TLC. The defendant agrees that the
statements made by him in signing this agreement shall be deemed usable and admissible
against the defendant as stipulations in any hearing, trial or sentencing that may follow,
even if the defendant fails to enter a guilty plea pursuant to this agreement. The foregoing
provision acts as a modification. and express waiver, of Federal Rule of Evidence 410 and
Federal Rule of Criminal Procedure 1 l(t).
VI.

ADEQl' ACY OF THE AGREEMENT
Pursuant to Local Criminal Rule 11.2 (d)(7) and (8), this plea agreement is

appropriate in that it confonns with the sentencing goals that would otherwise be applicable
to the defendant's case if the defendant had gone to trial and had been convicted on all
counts in the charging instrument.
Ii

U.S. v. Dalton Norman

Page 15 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 15 of 18

 VII.

THE DEFENDANT'S ACCEPTANCE OF THE TERMS OF
AGREE\:lENT

THIS PLEA

I, Dalton Norman, the defendant, affirm this document contains all of the
agreements made between me - with the assistance of my attorney- and the United States
regarding my plea. There are no other promises, assurances, or agreements the United
States has made or entered into with me that have affected my decision to enter any plea
of guilty or to enter into this agreement. If there are any additional promises, assurances,
or agreements, I and the United States will jointly inform the Court in writing before I enter
my guilty plea.
l understand that no one, including my attorney, can guarantee the outcome of my
case or what sentence the Court may impose if I plead guilty. If anyone. including my
attorney. has done or said anything other than what is contained in this agreement, [ will
inform the Courl when I stand be fore it to enter my plea. If there were. I would so inform
the Court.
I enter into this agreement understanding and agreeing that the conditions set forth
herein are obligatory and material to this agreement and that any failure on my part to fulfill
these obligations will constitute a material breach of this agreement. If I breach this
agreement, I agree the United States, in its sole discretion, may withdraw from this
agreement and may reinstate prosecution against me on any charges arising out of the
investigation in this matter. If my compliance with the terms of this plea agreement
becomes an issue, at an appropriate hearing, during which I agree any of my disclosures
will be admissible, the Court will determine whether or not I have violated the terms of this
U.S. v. Dalton Norman
Page 16 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 16 of 18

 agreement.

I understand the government's burden to prove a breach will be by a

preponderance of the evidence.
l understand the Court will ask me under an oath to answer questions about the
offense to which I am pleading guilty and my understanding of this plea agreement. I
understand that I may be prosecuted if l make false statcment'i or give false answers and
may suffer other consequences set forth in this agreement.
I have read this plea agreement carefully and understand it thoroughly. I know of
no reason why the Court should find me incompetent to enter into this agreement or to
enter my plea. I enter into this agreement knowingly and voluntarily. I understand that
anything that I discuss with my attorney is privileged and confidential, and cannot be
revealed without my permission. Knowing this, l agree that this document will be filed
,vith the Court.
I am fu:iy satisfied with the representation given me by my attorney and am
prepared to repeat this statement at the time l stand before the Couri and enter my guilty
plea. My attorney and [ have discussed all possible defenses to the charges to which I am
pleading guilty. My attorney bas investigated my case and followed up on any information
and issues 1 have raised to my satisfaction. My attorney has taken the time to fully explain
the legal and factual issues involved in my ca<;e to my satisfaction. We have discussed the
statutes applicable to my offense and sentence as well as the possible effect the U.S.S.G.
may have on my sentence.

U.S. v. Dalton Nonnan

Page 17 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 17 of 18

 Based on my complete understanding of this pica agreement. I therefore admit that
1 am guilty of the sole count of the lnformation.

DATED: _

_l f /,�l�q�/__7f ___

Dalton Norman
Defendant

As counsel for the defendant, I have conveyed all written plea offers and I have
discussed the terms of this plea agreement with the defendant, have fully explained the
charge to which the defendant is pleading guilty and the necessary elements. all possible
defenses, and the consequences of a guilty plea to a felony. Based on these discussions, I
have no reason Lo doubt that the defendant is knowingly and voluntarily entering into this
agreement and entering a plea of guilty. I know of no reason to question the defendant's
competency to make these decisions. If, prior to the imposition of sentence, I become
aware of any reason to question the defendant's competency
this plea
agreement or to enter a plea of guilty, I will i mediately inform
DATED:_,._,_ll+/74-/_,_t+7---Attorney for Dalton Norman

On behalf of the United States, I accept the defendant's offer to plead guilty under the te1ms
of this plea agreement.

DATED:__
, z_(i'---/-+/i__fl __

I

U.S. v. Dallon Norman

Page 18 of 18

Case 3:17-cr-00166-TMB Document 5 Filed 12/05/17 Page 18 of 18