UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF WISCONSIN
________________________________________________________________________
UNITED STATES OF AMERICA,
Plaintiff,
Case No. 17-CR-124
v.
MARCUS HUTCHINS,
Defendant.
________________________________________________________________________
DEFENDANT MARCUS HUTCHINS’
MOTION TO COMPEL DISCOVERY
________________________________________________________________________
Defendant Marcus Hutchins seeks an order from the Court compelling the
government to produce an array of discovery the government has declined to
turn over. Mr. Hutchins seeks this discovery in connection with motion practice,
to prepare for trial, and for the trial itself. The discovery is necessary to assist
with Mr. Hutchins’ efforts to defend himself, and without it he will be severely
prejudiced. Thus, the Court should grant this motion and order the government
to produce the requested discovery.
COMPLIANCE WITH CRIMINAL LOCAL RULE 16(B)
As detailed in the December 11, 2017 status report (Dkt. No. 42) and the
status conference held that same day (Dkt. No. 43), the parties met and conferred
in good faith to attempt to resolve the pending discovery disputes on November

Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 1 of 18 Document 44

 21, 2017, in accordance with Criminal Local Rule 16(b). Both before and after
meeting and conferring, the parties exchanged letters regarding the defense’s
requested discovery.1
The parties have discussed each category of discovery requested in this
motion. The government has not taken the position that the requested discovery
does not exist, nor has the government asserted that the discovery is not in its
possession, custody, or control.
THE REQUESTED DISCOVERY
The defense respectfully asks this Court to order the government to
produce the following items for which there is a more than sufficient basis on the
facts and law:
1. All materials and communications relating to the surveillance and arrest of
Mr. Hutchins in Las Vegas, Nevada.
2. All materials and communications relating to Mr. Hutchins’ co-defendant.2
3. All materials and communications relating to “Randy,” a pseudonymous
government cooperator.
4. Portions of the grand jury transcripts dealing with the legal instructions for
the crimes charged in the pending indictment.
Following the parties telephonic meet-and-confer, the government sent the last letter on
November 29, 2017. The defense did not respond to it because it was clear at that time that the
parties had irreconcilable differences. There are additional disputed defense discovery requests
that are not the subject of this motion. By filing this motion, the defense is not waiving its right
to move to compel that discovery later.
2 Although the government has disclosed the co-defendant’s name to the defense, that name is
not used here because it remains redacted in the indictment.
1

2
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 2 of 18 Document 44

 5. All materials and communications relating to the search warrants and
Mutual Legal Assistance Treaty (“MLAT”) requests in this case, including
warrants and MLAT requests connected to any of the previously disclosed
or forthcoming discovery.
Mr. Hutchins is a 23-year-old citizen of the United Kingdom and a
worldwide hero due to his assistance stopping the “WannaCry” ransomware
attack in May 2017, which infected hundreds of thousands of computers in over
150 countries, including in hospitals, banks, government agencies, and major
companies. White House Homeland Security Advisor Tom Bossert recently
lauded Mr. Hutchins for his role in stopping the attack, which the United States
has attributed to North Korea.3
Unrelated to his assistance stopping WannaCry, on August 27, 2017, Mr.
Hutchins was arrested in Las Vegas on the pending six-count indictment alleging
a variety of computer related crimes dating from approximately July 2014 to July
2015. After that time period, Mr. Hutchins started working as a cybersecurity
professional, and he became a well-known expert in the field. At the time of his
arrest, he resided with his family in North Devon, England, and worked
remotely for a Los Angeles-based computer security company.
The government is withholding discovery Mr. Hutchins is entitled to
receive pursuant to Federal Rule of Criminal Procedure 16; the “open file policy,”
Kevin Collier, Words of Praise But No Forgiveness for Hacker Who Stopped North Korean
Cyberattack, BUZZFEED NEWS, Dec. 19, 2017, https://www.buzzfeed.com/kevincollier/wordsof-praise-but-no-forgiveness-for-hacker-who-stopped?utm_term=.lykQGxXww#.bx7mkyRgg.
3

3
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 3 of 18 Document 44

 as defined by Criminal Local Rule 16; the Brady doctrine; and other applicable
case law. It should be noted that Brady requires the disclosure of evidence
favorable to the defense so it can be used effectively at trial. As the Court will
see below, the defense meets its burden of a prima facie showing of materiality for
each of the discovery requests, and the requested discovery is well within the
bounds of what the defense is entitled to receive under the law.
With respect to all the requested discovery (other than one possible
exception noted below), the defense is not aware of any government concerns
regarding ongoing investigations or witness safety issues.
 Request 1: Materials and Communications Relating to the Surveillance
and Arrest of Mr. Hutchins
The defense seeks all materials and communications relating to the
surveillance and arrest of Mr. Hutchins in Las Vegas. The government has
produced some discovery related to Mr. Hutchins’ arrest, but the defense
believes there is additional discovery that has not been produced. This discovery
is necessary for the defense to prepare an anticipated motion to suppress Mr.
Hutchins’ post-arrest statements as involuntary and obtained in violation of
Miranda. And if those statements are not suppressed, this discovery is necessary
for the jury to evaluate those statements in their full context at trial, should the
government to seek to introduce them into evidence.

4
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 4 of 18 Document 44

 When Mr. Hutchins was arrested, he was at the Las Vegas airport, sitting
in an airline lounge awaiting a flight home to the United Kingdom. He had been
in Las Vegas for over a week in conjunction with DEF CON, the world’s largest
and longest running hacking conference.
The defense has every reason to believe that the government surveilled
Mr. Hutchins in Las Vegas leading up to his arrest. He had been indicted under
seal on July 12, 2017, weeks before his arrest. The government would have been
aware of his travel plans and, among other things, would not have wanted him
to take an unscheduled early flight home. Surveilling a suspect before arrest is
also a standard law enforcement practice. The government has not denied
conducting pre-arrest surveillance, although it has refused to produce any
discovery on this issue.
After Mr. Hutchins was taken into custody, two law enforcement agents
interviewed him at the airport. The memorandum of that interview generically
states: “After being advised of the identity of the interviewing Agents, the
nature of the interview and being advised of his rights, HUTCHINS provided the
following information . . .” A lengthy portion of Mr. Hutchins’ interview with
the agents was audio recorded. Importantly, however, the agents did not record
the part of the interview in which they purportedly advised of him of his

5
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 5 of 18 Document 44

 Miranda rights, answered any questions he might have had, and had him sign a
Miranda waiver form.
The defense needs all communications and materials related to the
surveillance and arrest of Mr. Hutchins to help establish that his post-arrest
statements were involuntary and in violation of Miranda. The defense intends to
argue that the government coerced Mr. Hutchins, who was sleep-deprived and
intoxicated, to talk. As such, his decision to speak with the agents was not
knowing, intelligent, and made in full awareness of the nature of the right given
up and the consequences of giving up that right, as the law requires. Coleman v.
Hardy, 690 F.3d 811, 815 (7th Cir. 2012).
The Seventh Circuit recognizes that intoxication is relevant to the
voluntariness—legally, in terms of a statement’s admissibility, and factually, in
terms of the weight to be given to an admissible statement—of post-arrest
statements. See, e.g., United States v. Carson, 582 F.3d 827, 833 (7th Cir. 2009). The
defense believes the requested discovery will show the government was aware of
Mr. Hutchins’ activities while he was in Las Vegas, including the fact that he had
been up very late the night before his arrest, and the high likelihood that the
government knew he was exhausted and intoxicated at the time of his arrest.
In addition, the requested discovery is needed because Mr. Hutchins is a
citizen of the United Kingdom, where a defendant’s post-arrest rights are very
6
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 6 of 18 Document 44

 different than in the United States.4 The United Kingdom’s version of Miranda
contains no mention of the right to counsel, and if a defendant does not talk, it
may later be used against him under certain circumstances.5 Because of this, any
government communications in advance of Mr. Hutchins’ arrest and regarding
how to advise him of his rights under Miranda are important to demonstrate that
Mr. Hutchins would not have understood any purported Miranda warnings and
that he was coerced to waive his rights. As the Seventh Circuit has noted,
deceptive interrogation tactics can overcome a defendant’s free will. Carson, 582
F.3d at 833; United States v. Dillon, 150 F.3d 754, 757 (7th Cir. 1998).
Materials and communications in the government’s possession, custody,
and control relating to Mr. Hutchins’ activities leading up to his arrest and his
status as a United Kingdom citizen are relevant to the totality of circumstances
by which the voluntariness of his statements is evaluated, both for pretrial

United Kingdom law requires the following caution being given upon arrest (though minor
wording deviations are allowed): “You do not have to say anything. But it may harm your
defence if you do not mention when questioned something which you later rely on in Court.
Anything you do say may be given in evidence.” Police and Criminal Evidence Act 1984 Code
G ¶ 3.5, Revised Code of Practice for the Statutory Power of Arrest by Police Officers (revised
July 2012),
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/117583/p
ace-code-g-2012.pdf.
5
See Police and Criminal Evidence Act 1984 Code C Annex C, Revised Code of Practice for the
Detention, Treatment and Questioning of Persons by Police Officers (revised Feb. 2017),
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/592547/p
ace-code-c-2017.pdf.
4

7
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 7 of 18 Document 44

 motions and for the jury at trial. This Court should order the government to
produce all such discovery.
 Request 2: Materials and Communications Relating to Mr. Hutchins’
Co-Defendant
The defense is entitled to additional discovery relating to Mr. Hutchins’ codefendant. The government’s theory of the case has them joined at the hip. They
are alleged conspirators, charged with one count of conspiracy to commit
computer fraud and abuse. The remaining five counts all accuse Mr. Hutchins
and his co-defendant of acting in concert.6
Despite this fact, the government has only produced a limited set of
materials it received relating to the co-defendant through an MLAT request.7
There is every reason to believe the government is withholding substantial
additional information in its possession, custody, and control related to the codefendant, presumably until the co-defendant is arrested. This is impermissible
for at least four reasons.
First, pursuant to Federal Rule of Criminal Procedure 16(a)(1)(E), the
defense is entitled to information that is “material to preparing the defense.”
Those five counts are: three counts of distributing and advertising an electronic
communication interception device (Counts 2-4); one count of endeavoring to intercept
electronic communications (Count 5); and one count of attempting to access a computer without
authorization (Count 6).
7
MLATs are agreements between countries that permit law enforcement to enlist the
investigatory authority of another nation to secure evidence for use in criminal proceedings by
requesting mutual legal assistance. Using MLAT requests, prosecutors can obtain physical
evidence, documents, and testimony located in other countries around the world.
6

8
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 8 of 18 Document 44

 Information related to the lone co-defendant charged along with Mr. Hutchins in
every count of the indictment must be material to preparing Mr. Hutchins’
defense. After all, the evidence the government offers at Mr. Hutchins’ trial will
be not just about his alleged conduct, but also about his co-defendant’s. The fact
the co-defendant has not yet been apprehended is immaterial.
Second, the government may be withholding information that could
exculpate Mr. Hutchins. For example, any material showing that the codefendant operated independently of Mr. Hutchins’ alleged conduct would tend
to demonstrate that they did not conspire to commit computer fraud and abuse
(Count 1). The indictment itself supports that notion: it alleges that the codefendant advertised and sold the Kronos malware independently of Mr.
Hutchins. (Indictment at 3 ¶ 4(e)-(f).) Moreover, the indictment alleges that the
malware was advertised on the AlphaBay market forum, which the Department
of Justice seized and shut down on July 20, 2017 in cooperation with a number of
foreign authorities.8 In connection with that case, the government likely has
records of the co-defendant’s activities on AlphaBay that it has not produced
(e.g., records obtained through MLAT requests).
Third, the defense has the right to investigate the co-defendant. See Bethel
v. United States, 458 F.3d 711, 717 (7th Cir. 2006) (noting defense counsel’s
Press Release, Dep’t of Justice, AlphaBay, the Largest Online ‘Dark Market,’ Shut Down (July
20, 2017), https://www.justice.gov/opa/pr/alphabay-largest-online-dark-market-shut-down.

8

9
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 9 of 18 Document 44

 obligation to learn all relevant facts about the case). For example, to the extent
the government has information that would help the defense locate the codefendant, that information would assist the defense investigation.
Finally, when the co-defendant is arrested, the government will
presumably produce the requested discovery to the co-defendant and Mr.
Hutchins. But if it is discoverable then, it is discoverable now. To withhold
anything now when Mr. Hutchins appears to be the only one going to trial is
prejudicial to his defense.
The defense is willing to enter into an amended protective order to address
any concerns the government might have about how the requested discovery
could impede the arrest of the co-defendant.
 Request 3: Materials and Communications Relating to “Randy”
The defense seeks all communications and materials relating to “Randy,”
which is a pseudonym of a key cooperating witness. In response to the defense’s
discovery requests, the government produced a heavily redacted FBI 302 of an
interview of “Randy.” But the government refuses to produce anything more,
including “Randy’s” real identity or even the name of his or her attorney,
claiming such information is protected by the confidential informant privilege.
The government is wrong.

10
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 10 of 18 Document 44

 The informant privilege does not permit the government to conceal a
witness when, as here, disclosure “is relevant and helpful” to a defendant’s
defense “or is essential to a fair determination of a cause.” United States v.
McDowell, 687 F.3d 904, 911 (7th Cir. 2012) (quoting Roviaro v. United States, 353
U.S. 53, 60-61 (1957)). Indeed, the Seventh Circuit’s treatment of the privilege
indicates that its reach is typically limited to background sources of information,
as in a tipster who furnishes details that commence an investigation resulting in
a prosecution premised on the fruits of the investigation, not the details of the
background tip.
A mere tipster, according to the Seventh Circuit, is “someone whose only
role was to provide the police with the relevant information that served as the
foundation to obtaining a search warrant.” Id. Tipsters differ from what the
Seventh Circuit terms “transactional witnesses,” who are individuals “who
participated in the crime charged . . . or witnessed the event in question.” Id. For
tipsters, “the rationale for the privilege is strong and the case for overriding it is
generally weak.” Id. In contrast, “the case for overriding the privilege and
requiring disclosure tends to be stronger” for transactional witnesses. Id.
Here, the government’s refusal to disclose even the identity of “Randy’s”
attorney is apparently the result of miscategorizing an important witness as a
mere tipster. “Randy” is a cooperating witness, one whose provision of
11
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 11 of 18 Document 44

 information to law enforcement was facilitated by consideration—proffer
immunity, at the least—from the government. This circumstance alone weighs
against continuing confidentiality because “Randy” surely knows his
cooperation will be revealed. See, e.g., United States v. W.R. Grace, 401 F. Supp.2d
1093, 1101 (D. Mont. 2005) (noting that by agreeing to serve as witnesses in a
criminal case, the testifying witnesses must assume that they will be subject to
defense scrutiny).
The defense expects “Randy” to testify at trial because he is alleged to have
had extensive online chats with Mr. Hutchins around the time of the purported
crimes in which Mr. Hutchins discussed his purported criminal activity. Any
communications and materials relating to “Randy” are therefore material to
defense preparations.
Further, as noted above, the defense has the right to conduct its own
investigation. Refusing even to provide the name of “Randy’s” attorney so the
defense can contact him or her to see if “Randy” will speak with the defense is
improper. This impairs the defense’s access to a witness and its obligation to
investigate. The government should not be permitted to interfere with that
function.
“[T]he inability of a defendant to interview witnesses is a constitutional
problem,” but only when the prosecution “artificially restrict[s] the defendant’s
12
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 12 of 18 Document 44

 ability to obtain evidence.” United States v. DeRobertis, 766 F.2d 270, 274 (7th Cir.
1985). For these reasons, the government may not, for example, instruct a
witness not to cooperate with the defense. United States v. Agostino, 132 F.3d
1183, 1191-92 (7th Cir. 1997). To be clear, nothing of that specific sort is
suggested here, but the notion of concealing a witness’ identity from the defense
raises these concerns by doing directly (i.e., rendering a witness entirely
inaccessible to the defense) what cannot be done indirectly (i.e., discouraging an
accessible witness’ responsiveness to the defense).
The confidential informant’s privilege should not be found to permit
concealment of discovery here. The government should be required to produce
additional discovery relating to “Randy.”
 Request 4: Portions of the Grand Jury Transcripts Dealing with Legal
Instructions
Because the government has displayed a fundamental misunderstanding
of the laws at issue in the indictment, the Court should order the government to
disclose the legal instructions provided to the grand jury to ensure the grand jury
was properly instructed.
Although Federal Rule of Criminal Procedure 6(e) generally imposes
secrecy obligations on grand jury proceedings, it permits a court to authorize
disclosure under certain circumstances, including “at the request of a defendant
who shows grounds may exist to dismiss the indictment because of a matter that
13
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 13 of 18 Document 44

 occurred before the grand jury.” Rule 6(e)(3)(E). A defendant can obtain grand
jury information with a showing of “compelling necessity” or “particularized
need.” In re Grand Jury Proceedings, 942 F.2d at 1194, 1198 (7th Cir. 1991). The
defense meets the requirements of both factors.
The defense needs the legal instructions for an anticipated motion to
dismiss the indictment. One ground for that motion is that at least two of the
charged counts are defective on their face, failing to include the appropriate mens
rea. Since the two counts deviate materially from the required and heightened
mental states set forth in the operative statutes, this demonstrates likely
irregularities in how the grand jury was instructed on the law.
In the Seventh Circuit, “[a]n indictment is sufficient if it: (1) states all the
elements of the offense charged; (2) informs the defendant of the nature of the
charge, enabling the defendant to prepare a defense; and (3) enables the
defendant to plead the judgment as a bar to later prosecution for the same
offense.” U.S. v. F.J. Vollmer & Co., Inc., 1 F.3d 1511, 1518 (7th Cir. 1993) (citing
United States v. James, 923 F.2d 1261, 1265 (7th Cir. 1991). When an indictment
states the charged offense in the words of the statute itself, it is sufficient “as long
as those words expressly set forth all the elements necessary to constitute the
offense intended to be punished.” United States v. Hinkle, 637 F.2d 1154, 1157 (7th
Cir. 1981). In this case, the indictment fails to pass those tests.
14
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 14 of 18 Document 44

 Count 2 alleges that the defendants:
[K]knowingly disseminated by electronic means an
advertisement of any electronic, mechanical, or other
device, knowing or having reason to know that the
design of such device renders it primarily useful for the
purpose of the surreptitious interception of electronic
communications, knowing the of the advertisement and
having reason to know that such advertisement will be
transported in interstate and foreign commerce.
In violation of Title 18, United states Code, Sections
2512(1)(c)(i), and 2.
(Indictment at 4 (emphasis added).) But “knowingly” is not the correct mens rea.
Section 2512(1)(c)(i) makes it illegal to “intentionally” advertise an interception
device, “knowing or having reason to know” that it may be used for the purpose
of surreptitious interception. The indictment therefore misstates an essential
element of the offense.
Count 6 suffers from a similar defect. It charges that the defendants:
[K]nowingly caused the transmission of a program,
information and command and as a result of such
conduct, attempted to cause damage without
authorization, to 10 or more protected computers
during a 1-year period.
In violation of Title 18, United States Code, Sections
1030(a)(5)(A), (c)(4)(B)(i) and (ii), (c)(4)A(i)(VI), 1030(b),
and 2.

15
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 15 of 18 Document 44

 (Indictment at 8 (emphasis added).) But 1030(a)(5)(A) states it is illegal to:
[K]nowingly cause[] the transmission of a program,
information and command, and as a result of such
conduct, intentionally cause[] damage without
authorization, to a protected computer[.]
(Emphasis added.) Likewise, the Seventh Circuit Pattern Jury Instructions state
the elements of the offense are:
1. The defendant knowingly caused the transmission of
a [program; information; code; command]; and
2. By doing so, the defendant intentionally caused damage to a
protected computer without authorization.
(Emphasis added.) The plain text of 1030(a)(5)(A) and the Pattern Jury
Instructions leave no doubt that Count 6, as it is pleaded, does not include the
requisite “intentional” mens rea for causing damage without authorization, again
failing to allege an essential element of the offense. (There are no Pattern Jury
Instructions for Count 2.)
Considering that Counts 2 and 6 misstate the required mental states
specified in the statutes, there is a high likelihood the government did not
properly instruct the grand jury on the law, and the grand jury returned a legally
defective indictment, as a result of improper legal instructions. See United States
v. Wabaunsee, 528 F.2d 1, 3-5 (7th Cir. 1975) (finding an indictment “fatally
defective” for failing to include the required mens rea). For this reason, the
16
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 16 of 18 Document 44

 defense has shown both a “compelling necessity” and “particularized need” for
the Court to order the production of the grand jury legal instructions.
 Request 5: Materials and Communications Relating to Search Warrants
and MLAT Requests
The defense seeks all MLAT requests and search warrant applications,
including supporting affidavits, which the government has so far refused to
produce. Both categories of legal process are material and necessary to the
defense, and both are discoverable.
To date, the government has produced materials responsive to a single
MLAT request, and has declined to produce the MLAT request itself. The MLAT
request, however, surely contains information regarding the government’s
theory of the case and may have been signed by an agent who will testify at trial.
MLAT requests vary from country to country, but they can be quite similar to
search warrants, since they are often used to obtain documents.
The defense seeks MLAT requests and search warrant applications,
including supporting affidavits, to help understand the government’s theory of
the case, which is, of course, critical to Mr. Hutchins’ defense. This is particularly
true because the indictment is bare bones—for many charges, it essentially recites
code provisions. In addition, if an agent who is going to testify at trial attested to

17
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 17 of 18 Document 44

 a portion of the MLAT request, the government should produce it as a witness
statement discoverable under Criminal Local Rule 16(a).
CONCLUSION
For all the reasons above, the Court should grant this motion to compel
and order the government to produce the requested discovery.
DATED: January 5, 2018

Respectfully submitted,
/s/ Brian E. Klein
BRIAN E. KLEIN
Baker Marquart LLP
2029 Century Park E – Suite 1600
Los Angeles, CA 90067
Email: bklein@bakermarquart.com
Telephone: (424) 652-7800
/s/ Daniel W. Stiller
DANIEL W. STILLER
DStillerLLC
Box 511130
Milwaukee, WI 53203
Email: dan@dstillerllc.com
Telephone: (414) 207-3190
/s/ Marcia Hofmann
MARCIA HOFMANN
Zeitgeist Law PC
25 Taylor Street
San Francisco, CA 94102
Email: marcia@zeitgeist.law
Telephone: (415) 830-6664
Attorneys for Marcus Hutchins

18
Case 2:17-cr-00124-JPS-NJ Filed 01/05/18 Page 18 of 18 Document 44