Case 5:18-cr-00348-LHK Document 1 Filed 08/02/18 Page 1 of 8

LHK

4.

1
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA

SAN JOSEDIVISION
THE UNITED STATES OF AMERICA AUQ Qp
BRANDON CHARLES GLOVER, and

^

VASILE MEREACRE,

INDICTMENT
COUNT ONE: (18 U.S.C. § 1030(b) - Conspiracy to Violate 18 U.S.C. §§ 1030(a)(7)(B) and (c)(3)(A))

COUNT TWO: (18 U.S.C. §§ 1030(a)(7)(B) and (c)(3)(A), 2 - Extortion Involving Computers)

A true bill
Foreperson

Filed in open court this

^

day of A

A.D, 201 <r
United States Magistrate Judge

Bail $

a-o

p^rrrs-^

fo

cf

 Case 5:18-d500348-Q1- slant 1 Filed 08702/18 Page ALEX G. TSE (CABN 152348)
Acting United States Attorney

1 LED
1111:1113 1113

MU .
u? Nu
NOHn-f?hh RigiaAE) 

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION LH 
UNITED STATES or AMERICA, 8 1v A3 4 8 NC-.. 1

 

 

 

 

Plaintiff, VIOLATIONS: Title 18, United States Code, Section
1030(b) Conspiracy to Violate Title 18, United
i States Code, Sections 1030(a)(7)(B) and 
BRANDON CHARLES GLOVER, and Title 18, Unlted States. Code, Sectlons 1030(a)(2)(l3)
ASILE MERE ACRE, and Extortlon Involvmg Computers, Title
18, United States Code, Section 2 Aid and Abet.
Defendants. 

1 SAN JOSE VENUE
I I 
The Grand Jury charges:
BACKGROUND

At all times relevant to this Indictment:
l. Lyndacom LLC was an online education company that offered video courses in software,
creative, and business skills. On June 2, 2016, the company was acquired by the Linkedln Corporation,

which was headquartered in Sunnyvale, California.

2. ?Bug Bounty? programs are services wherein individuals that report security 3:1



rece1ve recognition and compensation. Bug bounty programs assist companies in discovering and 1.
.. .. I I-

 

INDICTMENT :t - 



Case Document 1 Filed Page 3 of 8

resolving security vulnerabilities so that they can be resolved before the general public is aware of them,
thus preventing the wide-spread exploitation of the vulnerability.

3. LinkedIn maintained an invitation-only bug bounty program and accepted individuals, such
as security researchers, into the program based upon the individual?s reputation and previous work.
LinkedIn established rules for participation in the program, and an individual would be disquali?ed from
participation in the program based on a variety of factors, including making threats, demanding money
exchange for security vulnerabilities, publicly disclosing security ?aws without notifying the company
?rst, modifying, copying, downloading, deleting or otherwise misusing other members? data, and
accessing non-public member information without authorization.

4. HackerOne was a San Francisco?based company that operated bug bounty programs for
corporations, including LinkedIn.

5. Brandon Charles Glover was a resident of Winter Springs, Florida.

6. Vasile Mereacre was a resident of Toronto, Canada.

COUNT ONE: (18 U.S.C. 1030(b) Conspiracy to Violate 18 U.S.C. 1030(a)(7)(B) and 
7. The factual allegations at Paragraphs One through Six are realleged and incorporated as if
set forth fully here.
8. Beginning in approximately December 2016 and continuing to approximately January 2017,
in the Northern District of California and elsewhere, the defendants,

BRANDON CHARLES GLOVER, and
VASILE MEREACRE,

did knowingly conspire and agree with persons known and unknown to the Grand Jury to commit an
offense under 18 U.S.C. 1030(a)(7)(B) and that is, with the intent to extort from a person
money and other things of value, transmitted in interstate and foreign commerce communications
containing a threat to impair the con?dentiality of information obtained from a protected computer
without authorization.





INDICTMENT 2

 

ALAN



Case Document 1 Filed 08702/18 Page 4 of 8

MANNER AND MEANS

9. Defendants GLOVER and MEREACRE possessed and controlled and claimed to possess
and control con?dential databases and other data belonging to the victim corporations all the while
knowing that the data had been stolen from the victim-corporations? Amazon Web Services accounts.
The defendants? exerted possession and control over the data in order to induce payments from the
victim-corporations.

10. The defendants used the email address ?johndoughs@protonmail.com? to contact the
victim-corporations to report security vulnerability and demand payment in exchange for deletion of the
data. The defendants used false names to communicate with the victim-corporations, and, on several
occasions, informed the victim-corporations that they had been paid by other victim-corporations for
identifying security vulnerabilities. They also sent the victim-corporations a sample of the data in order
for the victim-corporations to verify the authenticity of data.

11. After examining the sample data, the victim-corporations communicated with the
defendants about payment in exchange for the deletion of the data. In some instances, the victim-
corporations referred the defendants to HackerOne for payment pursuant to the victim-corporations? bug
bounty program. In other instances, the victim-corporation stopped communicating with the defendants
and did not pay them for the data.

PLAN TO EXTORT LIN KEDIN

12. As part of the conspiracy, defendants GLOVER and MEREACRE devised a plan to
extort LinkedIn by obtaining over 90,000 con?dential Lynda.com user accounts, and exerting control
over the accounts as a means to obtain money from LinkedIn.

13. The defendants used the email account ?j ohndoughs@protonmail.com? to communicate
with LinkedIn. They also established an account with HackerOne using the false name ?William
Loa?nann? and provided false information, such as names, addresses, and a Social Security number, on
Internal Revenue Service forms.

14. On December 11, 2016, the defendants, using the email account
sent an email to the security team at LinkedIn notifying them about a

?security ?aw compromising databases of Lynda.com along with credit card payments and much more.?

INDICTMENT 3

 



Case Document 1 Filed 0871722/18 Page 5 of 8

15. A LinkedIn executive responded a short time later requesting details so that they could
investigate the matter.
16. responded, stating the following:

Before I continue, I would like to say that this does not look good, I was able to
access backups upon backups, me and my team would like a huge reward for this,
[sic]. The things we found were some of the following, ynda database, email
names addresses, usernames, some passwords, payments, we also found backend
code and many more. We also found partian [sic] [L]inkedin ?les. Before I continue,
I would like to ask that you guys will promise to compensate for this ?nd.

17. A LinkedIn executive and ?johndoughs@protonmail.com? continued to communicate
about the Lynda.com database, and the LinkedIn executive invited ?johndoughs@protonmail.com? into
join LinkedIn?s bug bounty program through HackerOne.

18. After the invitation was extended, ?johndoughs@protonmail.com? told the Linkedln
executive that ?[P]lease keep in mind, we expect a big payment as this was hard work for us, we already
helped a big corp which paid close to 7 digits, all went well.?

All in violation of Title 18, United States Code, Sections 1030(b), 1030(a)(7)(B) and 
















INDICTMENT 4

 

Case Document 1 Filed 087'02/18 Page 6 of 8

COUNT TWO: (18 U.S.C. 1030(a)(7)(B) and 2 Extortion Involving Computers)

19. The factual allegations contained in Paragraphs One through Six are realleged and
incorporated as if set forth fully here.

20. On or about December 1 l, 2016, in the Northern District of California and elsewhere, the

defendants,

BRANDON CHARLES GLOVER and
VASILE MEREACRE,

with the intent to extort from a person money and or other thing of value, transmitted in interstate and
foreign commerce any communication containing any threat to impair the con?dentiality of information
obtained from a protected computer without authorization, to wit: the defendants possessed stolen
customer data belonging to Lyndacom and contacted Linkedln executives under the alias ?John
Doughs? asking to be paid for it.

In Violation ofTitle 18, United States Code, Sections 1030(a)(7)(B), and 2.

2/11?
DATED: 8 A TR 

 



   

ALEX G. TSE
Acting United States

 

'Deputy Chief, Criminal Division

(Approved as to form: W/?t f1

SUSAN Kyoto

INDICTMENT 5

 

 

 

 

A0 257 (Rev ans)

  

. "41?37'13 18 Page 7 of 8

DEFENDANT INFORMATION CRIMINAL ACTION - IN U. S. DISTRICT COURT I

 

BY: COMPLAINT INFORMATION INDICTMENT
CI SUPERSEDING

 

CHARGED
Count One: (18 U.S.C. 1030(b) - Conspiracy to Violate Petty
18 U.S.C. 1030(alt7IIB) and (Cli3ltAll .
Minor
Count Two: (18 U.S.C. and 2- Misde-
Extortion Involving Computers) meanor
Felony

Counts One and Two: 5 years? imprisonment, 3 years? supervis
release, SZSOK fine, 5100 special assessment 

Name of District Court, andl'or JudgelMagistrate Location

NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

 

 

DEFENDANT - U.S

. BRANDON CHARLES GLOVER

1 cou- 4 8 LH 

 

 

 

PROCEEDING

Name of Complaintant Agency. or Person Title, if any)

 

Special Agent Jeffrey Miller, FBI

 

person is awaiting trial in another Federal or State Court,
give name of court

 

this personlproceeding is transferred from another district
per (circle one) 20, 21, or 40. Show District

 

this is a reprosecution of
CI charges previously dismissed

which were dismissed on motion SHOW

of DOCKET NO
us. ATTORNEY DEFENSE 

this prosecution relates to a
pending case involving this same

defendant MAGISTRATE

CASE NO.
Name and Of?ce of Person

Furnishing Information on this form ALEX 6- TSE (Acting USA)
US. Attorney Other US. Agency

prior proceedings or appearance(s)
before US. Magistrate regarding this
defendant were recorded under

 

 

 

 

Name Of Assistant US.

Attorney (if assigned) SUSAN KNIGHT

 

 

PROCESS:
SUMMONS NO WARRANT

If Summons, complete following:
Arraignment Initial Appearance

Defendant Address:

 

Comments:

 

DEFENDANT 46*

IS NOTIN CUSTODY
Has not been arrested, pending outcome this proceeding.
I If not detained give date any prior
summons was served on above charges .

2) Is a Fugitive

3) Is on Ball or Release from (show District)



IS IN CUSTODY 0 
4) On this charge . 2078
mg (i 5



sewerage,

5) On another conviction

6) Awaiting trial on othercharges
If answer to (6) is "Yes", show name of institution

If "Yes"
give date
?led
Month/Danyear

 

Has detainer I: Yes
been ?led? No

DATE OF 
ARREST

 

if Arresting Agency Warrant were not

DATE TRANSFERRED Montthay/Year
TO U.S. CUSTODY

 

 

 

ADDITIONAL INFORMATION OR COMMENTS

DateiTime:

 

This report amends A0 25? previously submitted

 

Bail Amount: 0

Where defendant previously apprehended on complaint, no new summons or
warrant needed, since Magistrate has scheduied arraignment

Before Judge:



 

 

A0 257 (Rev. ens)

Case DocumenEs, 93;: 

 

 

 

DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN US. DISTRICT COURT

 

 

BY: COMPLAINT INFORMATION INDICTMENT

CHARGED 

 

Count One: (18 U.S.C. 1030(b) Conspiracy to Violate El Petty
18 U.S.C. 1030(all7liB] and (Cli3llAll .
MInor
Count Two: (18 U.S.C. IO3UIBII7IIB) and (edits), 2 Misde-
ExtortIOn InvoIvIng Computers) meanor
Felony

PENALTY: Counts One and Two: 5 years' imprisonment, 3 years' supervise
release. ?ne, $100 special assessment

Name of District Court, and/or JudgelMagistrate Location

NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

 

 

DEFENDANT - U.S

VASILE MEREACRE

10'3?? I353 4 8 LH 

DEFENDANT 

 

 

 

 

PROCEEDING
Name of Complaintant Agency, or Person Title, if any)

 

Special Agent Jeffrey Miller, FBI

 

person is awaiting trial in another Federal or State Court,
give name of court

 

this personlproceeding is transferred from another district
per (circle one) 20. 21. or 40. Show District

 

this is a reprosecution of
[j charges previously dismissed

which were dismissed on motion SHOW

of DOCKET NO
us. ATTORNEY DEFENSE 

this prosecution relates to a
pending case involving this same
defendant MAGISTRATE
prior proceedings or appearance(s)
before US. Magistrate regarding this
defendant were recorded under

 

CASE NO.
Name and Of?ce of Person

Furnishing Information on this form ALEX 6- TSE (Acting USA)
US. Attorney Other US. Agency

 

Name of Assistant US.

Attorney (if assigned) SUSAN KNIGHT

 

 

PROCESS:
SUMMONS [1 NO WARRANT

If Summons, complete following:
[3 Arraignment Initial Appearance

Defendant Address:

 

Comments:

 

IS NOT IN CUSTODY
Has not been arrested. pending outcome this proceeding.
1) if not detained give date any prior
summons was served on above charges .

2) Is a Fugitive

IDistrict)



3) Is on Bail or Release from 

IS IN CUSTODY Ads 0 2 20I8
4) On this Charge 0 WSAN 30


5) On another conviction

?iederg?

State
6) Awaiting trial on othercharges

If answer to (6) is "Yes", show name of institution

If "Yes"
give date
?led


 

Has detainer CI Yes
been ?led? CI No

DATE OF .
ARREST

 

if Arresting Agency Warrant were not

DATE TRANSFERRED Month/DewY ear
TO US. CUSTODY

 

 

 

ADDITIONAL INFORMATION OR COMMENTS

Datefi?ime:

 

This report amends A0 257 previously submitted

 

Bail Amount: 0

Where defendant pre viousiy apprehended on complaint, no new summons or
warrant needed, since Magistrate has scheduled arraignment

Before Judge:

 

 

 

Case 5:18-cr-00348-LHK Document 1-1 Filed 08/02/18 Page 1 of 1

OnOER

United States District Court
Northern District of California

CRIMINAL COVER SHEET

'Af.

Instructions: Effective January 3, 2012, this Criminal Cover Sheet must be completed and submitted, along with the
Defendant Information Form, for each new criminal case.

Case Name:

USA V. Brandon Charles Glover and Vasile Merea

CR 18 "TO 4 8

Total Number of Defendants:

Is This Case Under Seal?

2-7

JZl

8 or more

n

Yes

No JIL

Does this case involve ONLY charges under 8 U.S.C. § 1325 and/or 1326?
Yes

n

No

m

Venue (Per Crim. L.R. 18-1):

SF I I OAK _CL

SJ [7] EUR I I MON I I

Is any defendant charged with a death-penalty-eligible crime?

Yes

I I

No

I/1

Is this a RICO Act gang case?

Yes

I I

Assigned AUSA (Lead Attorney):

Susan Knight

Date Submitted:

No

m

August 2, 2018

Comments:

Clear Form

July 2013

NC