Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 1 of 34 PageID #: 48 iNCL'^ vK'o OFFICE korman, j. U.S. DISTRi Tr OCoRT E.D.N.Y ^ NOV 27 2018 RMT:SK/AFM/MTK GOLD, MJ. F. #2016R02228 BROOKLYM OFFICE UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK X I NDICTMENT UNITED STATES OF AMERICA CH^r.lp. - against - (T. 18, U.S.C., §§ 37lT98T(a)TT5(C), 982(a)(1), 982(a)(2)(B), 982(b)(1), 1028A(a)(l), 1028A(b), 1028A(c)(4), 1030(a)(2), 1030(a)(4), 1030(a)(5), 1030(b), 1030(c)(2)(A), 1030(c)(2)(B), 1030(c)(3)(A), 1030(c)(4), 1030(i)(l), 1030(0(2), 1343,1349,1956(h), 1957(a), 2 and 3551 et seq.: T. 21, U.S.C., § 853(p); T. 28, U.S.C., § 2461(c)) ALEKSANDR ZHUKOV, BORIS TIMOKHIN, MIKHAIL ANDREEV, DENIS AVDEEV, DMITRY NOVIKOV, SERGEY OVSYANNIKOV, ALEKSANDRISAEV and YEVGENIY TIMCHENKO, Defendants. X THE GRAND JURY CHARGES: INTRODUCTION At all times relevant to this Indictment, unless otherwise indicated: 1. Individuals and businesses("publishers") were able to provide free content on the intemet—such as websites, search engines, translation services, video playback services and global mapping services—because advertisers paid for the opportunity to show advertisements(sometimes referred to as "ads") alongside that content. 2. The digital advertising industry was made up of a chain ofspecialized businesses. Publishers commonly used entities called supply-side platforms("SSPs")to conduct auctions that sold the advertising space on their sites. These auctions commenced Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 2 of 34 PageID #: 49 as soon as an internet user accessed a website and concluded within milliseconds, before the webpage displayed to the user. Businesses seeking to promote their goods and services online ("brands")commonly used entities called demand-side platforms("DSPs")to bid in these auctions and thereby had their advertisements placed on webpages that real human internet users were browsing. Brands commonly paid for advertising on a lump-sum basis, and publishers commonly received payment based on how many times users clicked on or viewed advertisements(sometimes referred to as "impressions"). The entities in between the brands and the publishers—the DSPs, SSPs and ad networks that connected SSPs with publishers—charged fees along the way. 3. The defendants in this case used sophisticated computer programming and infrastructure spread around the world to exploit the digital advertising industry through fraud. They represented to others that they ran legitimate ad networks that delivered advertisements to real human internet users accessing real internet webpages. In fact, the defendants faked both the users and the webpages: in each of the charged schemes,they programmed computers they controlled to load advertisements on fabricated webpages, via an automated program, in order to fraudulently obtain digital advertising revenue. 4. In one iteration—a datacenter-based scheme referred to in the ad industry as "Methbot"—the defendants used computers they controlled that they had rented from commercial datacenters in Dallas, Texas, and elsewhere. 5. In another iteration—a botnet-based scheme referred to in the ad industry as "3ve.2 Template A"—the defendants used computers to which they had gained unauthorized access (i.e. that had been "hacked"), including computers belonging to Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 3 of 34 PageID #: 50 individuals and businesses in the United States and elsewhere, including in the Eastern District of New York. 1. The Defendants 6. The defendant ALEKSANDR ZHUKOV was a citizen of the Russian Federation. He led the development ofthe datacenter-based scheme. ZHUKOV served as the chief executive officer of Ad Network #1,the identity of which is known to the Grand Jury. Ad Network #1 was a private corporation owned by ZHUKOV with offices in the Russian Federation and the Republic of Bulgaria. It purported to assist customers with delivering advertisements to real human internet users via its ad network. 7. The defendant BORIS TIMOKHIN was a citizen ofthe Russian Federation and worked for Ad Network #1. TIMOKHIN handled programming aspects of the datacenter-based scheme. 8. The defendant MIKHAIL ANDREEV was a resident of the Russian Federation and the Ukraine and worked for Ad Network #1. ANDREEV handled programming aspects ofthe datacenter-based scheme. 9. The defendant DENIS AVDEEV was a citizen of the Russian Federation and worked for Ad Network #1. AVDEEV handled technical and business aspects ofthe datacenter-based scheme. 10. The defendant DMITRY NOVIKOV was a resident ofthe Russian Federation and worked for Ad Network #1. NOVIKOV handled administrative and coordination aspects ofthe datacenter-based scheme. 11. The defendant SERGEY OVSYANNIKOV was a citizen of the Republic of Kazakhstan. He led the development ofthe botnet-based scheme and provided Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 4 of 34 PageID #: 51 technical assistance to the operators ofthe datacenter-based scheme. OVSYANNIKOV served as a principal and owner of Ad Network #2,the identity of which is known to the Grand Jury. Ad Network #2 was a private corporation owned by OVSYANNIKOV and ALEKSANDRISAEV with a registration address in Edinburgh, Scotland. It purported to assist customers with delivering advertisements to real human internet users via its ad networks. 12. The defendant ALEKSANDR ISAEV was a citizen of the Russian Federation and served as a principal, owner and chief executive officer of Ad Network #2. ISAEV handled business and contracting aspects ofthe botnet-based scheme. 13. The defendant YEVGENIY TIMCHENKO was a resident ofthe Republic of Kazakhstan and worked at Ad Network #2. TIMCHENKO handled logistical and administrative aspects ofthe botnet-based scheme. II. The Schemes to Defraud A. The Datacenter-Based Scheme 14. In or about September 2014,ZHUKOV,TIMOKHIN,ANDREEV, AVDEEV and NOVIKOV (collectively, the "Methbot defendants")launched a digital advertising fraud scheme under the guise of operating Ad Network #1. Ad Network #1 had business arrangements with other advertising networks that enabled it to receive payment in return for placing advertising placeholders("ad tags") with publishers on behalf ofthose advertising networks. Rather than place these ad tags on real publishers' webpages, however,ZHUKOV and others rented more than 1,900 computer servers located at commercial datacenters in Dallas, Texas, and elsewhere, and used those datacenter computer servers to simulate humans viewing ads on fabricated webpages. By these means,the Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 5 of 34 PageID #: 52 Methbot defendants caused thousands of datacenter computer servers to load fabricated webpages, offer up the advertising space on the fabricated webpages for bidding, and load advertisements on the fabricated webpages through an automated computer program. This activity (the "fraudulent ad traffic") was not viewed by any real human internet users. 15. ZHUKOV and others programmed the datacenter computer servers to load fabricated webpages—that is, mostly blank webpages containing a blank space for an ad—that purported to be located at the domains of well-known publishers. ZHUKOV researched lucrative domains to fabricate and ran online searches for the "top 10000 domains" and "top 100k domains." ZHUKOV then sent TIMOKHIN "new domains to try," deliberately targeting "the top USA desktop domains" for businesses in the United States. In this way,the Methbot defendants fabricated (or "spoofed") more than 250,000 webpages distributed across more than 5,000 domains associated with online publishers, including the domains ofthousands of businesses in the United States and multiple businesses in the Eastern District of New York. 16. TIMOKHIN,ANDREEV and others also programmed the datacenter computer servers to simulate the internet activity of real human internet users when loading the fabricated webpages, in order to deceive SSPs and others in the digital advertising industry and to evade fraud detection software widely used in the industry. They developed programming code that caused the datacenter computer servers to operate an automated browser, click on online advertisements a randomly determined number oftimes, simulate a mouse moving around and scrolling down a webpage, control and monitor video playback, and falsely appear to be signed into popular social media services. The programming code Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 6 of 34 PageID #: 53 contained explicit references to "Meth" and "Fake," including "MethBrowser," "MethFlashObjects,""FakeClient" and "FakedPixel." 17. In furtherance of their fraudulent scheme,the Methbot defendants communicated with one another about the development ofthis programming code using an online project management platform. For example: (a) On or about October 25,2014, ANDREEV circulated programming code and stated that it was designed to ensure that signals coming from the datacenter computer servers had the correct'"browser' parameters." (b) On or about October 28, 2014, NOVIKOV instructed TIMOKHIN to carry out "research about how to make 'mouse moves and scroll more realistic/meaningful"' on the datacenter computer servers. ZHUKOV similarly instructed TIMOKHIN to address the "lack of mouse move," an undertaking that continued over the following year. TIMOKHIN researched methods for simulating mouse movements by,for example, running an online search for "actionscript simulate mouse click." (c) On or about October 28, 2014, NOVIKOV discussed "[ejmulating 'video watch'" on the datacenter computer servers and cautioned that "[t]he videos need to be clicked on and watched for 60-90 seconds." This was because advertisers often would not pay for a video impression unless they knew that the user had watched the video for a substantial amount oftime. (d) On or about November 21,2014, ANDREEV circulated programming code and stated that it was designed to set the datacenter computer servers'"IP Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 7 of 34 PageID #: 54 address time zone" to "EST"—^Eastern Standard Time—^"by default." Earlier that day, ANDREEV had run an online search for "new york timezone." (e) On or about December 1, 2014, ANDREEV circulated programming code designed to cause the datacenter computer servers to automatically start and stop an online video player, and stated,"Basically this is how it is possible to generate the events." (f) In a to-do list dated June 25,2015,ZHUKOV instructed TIMOKHIN to cause the datacenter computer servers to appear to be signed into Facebook: "add authorization for Facebook [] users. There is Google, twitter too;[but] no FB (There should be approximately 40% ofthem.)" (g) On or about August 4,2015,ZHUKOV stated that he intended to research the fraud detection software deployed by certain U.S. cybersecurity firms and "check [] out [their] filter for the possibility offucking them over." 18. On or about October 16, 2016, after discovering that the signals coming from the datacenter computer servers did not register as fraudulent with a certain U.S. cybersecurity firm,ZHUKOV boasted to TIMOKHIN that their scheme was "magnificent." On or about December 10, 2016,ZHUKOV sent an email to a potential business partner in which he offered "100% USA traffic" that could pass through "filters" from various U.S. cybersecurity firms and amounted to "20-50 millions [sic] impressions daily." 19. To further deceive SSPs and others in the digital advertising industry into believing that the datacenter computer servers were genuine human users,ZHUKOV and others leased more than 650,000 Internet Protocol("IP") addresses from various IP Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 8 of 34 PageID #: 55 8 address leasing companies and assigned multiple IP addresses to each ofthe datacenter computer servers. ZHUKOV,AVDEEV and others then created false entries for the datacenter computer servers in a global register ofIP addresses. These false entries made it appear that the datacenter computer servers controlled by the Methbot defendants were residential computers belonging to individual human internet users who were subscribed to various residential internet service providers. For example: (a) Several ofthe false IP address registry entries misappropriated or mimicked the corporate identities of at least six major U.S. internet service providers, including at least one provider with offices in the Eastern District of New York. ZHUKOV maintained a list ofthese and other false corporate names in his cloud storage account. None ofthe IP addresses registered in the respective U.S. internet service providers' real or mimicked names was actually in their possession, custody or control. In this way,the Methbot defendants sought to make it appear to SSPs and others that the computers in question belonged to customers ofthese internet service providers, rather than being located in datacenters. (b) For the same reason, the Methbot defendants also incorporated false usage and location information into the IP address registries. For example, on or about May 13,2016, AVDEEV directed an IP leasing company to change the "Usage type" for approximately 261,000 leased IP addresses from "commercial" or "datacenter" to "ISP" (internet service provider), ascribe a more diverse set of cities and states to the leased IP addresses, and reduce the number of leased IP addresses associated with certain small cities to more realistic levels commensurate with their populations. In this way,the Methbot Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 9 of 34 PageID #: 56 defendants sought to make it appear to SSPs and others that the computers in question belonged to real human internet users located in homes and businesses around the country. 20. The Methbot defendants thus created the illusion that real human internet users were visiting real internet webpages. ZHUKOV and others solicited bids on the opportunity to show advertisements to those purported users. In response, DSPs bid on those opportunities. The winning DSPs made payments to SSPs(using money provided by brands)in return for the purported impressions, and the SSPs transferred those payments to advertising networks to be passed along the chain ofintermediaries described above. 21. OVSYANNIKOV collaborated with the Methbot defendants to knowingly obtain fraudulent ad traffic for his own companies. OVSYANNIKOV did business with the Methbot defendants, purchased fraudulent ad traffic from the Methbot defendants and provided the Methbot defendants with technical advice and assistance to ensure that the fraudulent ad traffic passed as real. For example, on or about October 22, 2014, OVSYANNIKOV instructed NOVIKOV that the datacenter computer servers' automated browsers needed to include "accept-language" in their headers—vindicating the purported user's preferred language—to evade fraud detection software. Similarly, in or about November 2014, OVSYANNIKOV discussed the concept of"mouse move" with the Methbot defendants. 22. Over the course ofthe scheme,the Methbot defendants falsified billions of ad impressions. Hundreds of brands and ad agencies around the world, including many in the United States and at least one with offices in the Eastern District of New York, Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 10 of 34 PageID #: 57 10 collectively paid more than $7 million in advertising fees for fraudulent ad traffic. The Methbot defendants, in turn, reaped millions of dollars in revenue. 23. The Methbot defendants recorded the revenue from the datacenter- based scheme—which amounted to 10s ofthousands of dollars daily—using an online control panel that tracked the millions of bids solicited by the datacenter computer servers each day and the millions of resulting ad impressions falsified each day. For example, during a single day in October 2016,the Methbot defendants recorded more than $56,000 in revenue from placing more than 442 million fraudulent bid requests and falsifying more than 16 million ad impressions. 24. The Methbot defendants re-invested some ofthe proceeds from the datacenter-based scheme to perpetuate the fraud, and they concealed other proceeds by transferring them to other companies. For example,ZHUKOV directed payments from ad networks to a corporate bank account located in the Czech Republic, which he then used to pay for servers and IP addresses used in the scheme. ZHUKOV also redirected $5.4 million from the account to a corporate bank account located in New Zealand. 25. On or about December 20,2016, researchers at a private cybersecurity firm based in New York City publicly revealed the operation ofthe datacenter-based scheme in a white paper titled "The Methbot Operation." 26. The Methbot defendants reacted to the publication of the white paper by attempting to delete evidence. They deleted all of their communications from the online project management platform that they used to develop the scheme, and they deleted more than 26,000 emails from an email account identified in the white paper, which was the Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 11 of 34 PageID #: 58 11 registration email account for more than 1,400 IP addresses used in the scheme. TIMOKHIN also deleted more than 96,000 emails from his own email account, which contained explicit discussions ofthe scheme and referenced more than 15,500 IP addresses used in the scheme. 27. In the days after the publication ofthe white paper, ANDREEV researched whether he had been publicly associated with the scheme; for example, ANDREEV ran online searches for "russian hackers methbot" and "mikhail andreev methbot." In communications with associates, ANDREEV privately acknowledged his association with the scheme, speculated that he was "being investigated by the FBI," admitted to writing code for the scheme "[a]t the initial stage" and explained that "[t]he companies that get fooled consider it fraud." B. The Botnet-Based Scheme 28. In or about December 2015, OVSYANNIKOV,ISAEV and TIMCHENKO (collectively, the "Eve 2A defendants") launched another digital advertising fraud scheme under the guise of operating Ad Network #2. 29. Ad Network #2 had business arrangements with other advertising networks that enabled it to receive payment in return for placing ad tags with publishers on behalf ofthose advertising networks. Rather than place these ad tags on real publishers' webpages, however. Ad Network #2 obtained access to a network of computers that had been hacked with malware(a "botnet") and used those infected computers—without their true owners' knowledge or permission—to load ads on fabricated webpages. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 12 of 34 PageID #: 59 12 30. At a single point in time, OVSYANNIKOV and others accessed more than 1.7 million infected computers, including approximately 1 million in the United States and more than 1,500 at residences and businesses in the Eastern District of New York. The overall number ofinfected computers over the course ofthe scheme was much larger. 31. OVSYANNIKOV and others caused the infected computers to load fabricated webpages—^in this instance, mostly blank webpages containing an intemal placeholder for an ad and embedded with computer code instructing the browser to load a video player—that purported to be articles and other content on the domains of well-known publishers. OVSYANNIKOV and TIMCHENKO researched domains to fabricate, deliberately targeting domains for businesses in the United States, and placed promising domains on a running list titled '*New companies for spoofing." OVSYANNIKOV also maintained lists of domains in his cloud storage account and on servers that he controlled. The domains included more than 86,000 domains associated with online publishers, including the domains ofthousands of businesses in the United States and multiple businesses in the Eastern District of New York. 32. To carry out the scheme, OVSYANNIKOV,TIMCHENKO and others developed an elaborate infrastructure of command-and-control servers and other servers designed to provide instructions, resources and means of obfuscation to the infected computers. These servers were located in the United States and around the world, including in Missouri, California, New Jersey and the Netherlands. TIMCHENKO deliberately chose certain U.S. service providers because they had the "coolest processors" and a "larger" cache (for temporary data storage)than competing providers. OVSYANNIKOV maintained a Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 13 of 34 PageID #: 60 13 collaborative spreadsheet in his cloud storage account titled "[Ad Network] Structure. Hosting and Domains" that set out this infrastructure and listed many of the servers involved in the scheme(including several designated as repositories of"spoof webpages). TIMCHENKO had access and editing privileges to the spreadsheet; ISAEV had read-only access to the spreadsheet. 33. The Eve 2A defendants' servers performed various functions: (a) The infected computers communicated with the "Redirect Servers," which provided them with instructions to connect to the "Fraudulent Content Servers." (b) The Fraudulent Content Servers(including those described by OVSYANNIKOV in his spreadsheet as repositories of"spoof webpages)supplied infected computers with fabricated webpages purporting to be located at the spoofed domains. The infected computers loaded the fabricated webpages on hidden browsers that were invisible to the computers' true owners. The infected computers then downloaded digital video players for use in "watching" video advertisements in the relevant ad spaces on the fabricated webpages. (c) The infected computers again communicated with the Redirect Servers, which supplied them with ad tags and caused them to contact SSPs and offer up the advertising space on the fabricated webpages for bidding. During this process, the infected computers sent the SSPs information including, among other things, their IP addresses, the webpage addresses for the fabricated webpages,the dimensions ofthe places in which the advertisements would play, and the technical specifications ofthe video players. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 14 of 34 PageID #: 61 14 (d) The Redirect Servers meanwhile communicated with "Backend Servers" thousands oftimes per hour. The Backend Servers contained lists of online publishers' domains, as well as computer code designed to respond to incoming communications with domains to be spoofed and ad tags containing instructions to contact an SSP. The Backend Servers also contained computer code designed to vet the IP addresses ofinfected computers to check and record whether the computers already had been flagged by cybersecurity companies as associated with digital advertising fraud. (e) Over the course ofthe scheme,the Eve 2A defendants' servers connected with over 15 million IP addresses worldwide. 34. OVSYANNIKOV explained the resulting system to his co-conspirators in a communication on April 20, 2016. "[Y]ou give me a company," he began, and then provided a web address that included a major U.S. retailer's domain; he continued,"the hot takes that link [and] sets itself accordingly" so that the "spoofed domain" would be "[retailer].com" and the "host ip" would be "www2," OVSYANNIKOV's nickname for one ofthe Fraudulent Content Servers. 35. By these means,the Eve 2A defendants caused millions ofinfected computers around the world to surreptitiously download fabricated webpages, offer up the advertising space on the fabricated webpages for bidding, and load advertisements on the fabricated webpages. All the while, the infected computers' true owners saw none ofthis activity. Thus,the advertisements were not viewed by any real human internet users. 36. To evade fraud detection software, the Eve 2A defendants vetted the information emitted from their hots. They developed programming code designed to check and record whether the IP address and other identifying characteristics of a particular hot had Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 15 of 34 PageID #: 62 15 already been flagged by cybersecurity companies as associated with digital advertising fraud. Over the course of approximately four months, they employed the code to vet more than 9.7 million IP addresses worldwide, including more than 4 million in the United States and more than 8,300 in the Eastern District of New York. OVSYANNIKOV cautioned others not to direct traffic from hots that had already been flagged by cybersecurity companies to SSPs that were relying on those cybersecurity companies. 37. The Eve 2A defendants thus created the illusion that real human internet users were visiting real internet webpages. OVSYANNIKOV and others solicited bids on the opportunity to show advertisements to those purported users. In response, DSPs bid on those opportunities. The winning DSPs made payments to SSPs(using money provided by brands)in return for the purported impressions, and the SSPs transferred those payments to advertising networks to be passed along the chain of intermediaries described above. 38. The Eve 2A defendants recorded the revenue from the botnet-based scheme using various spreadsheets that tracked the millions of bids solicited by the infected computers each day and the millions ofresulting ad impressions falsified each day. 39. Over the course ofthe scheme,the Eve 2A defendants falsified billions of ad impressions. Hundreds of brands and ad agencies around the world, including many in the United States and at least one with offices in the Eastern District of New York, collectively paid 10s of millions of dollars in advertising fees for these falsified ad impressions. The Eve 2A defendants, in turn, reaped 10s of millions of dollars in revenue. For example,from January 2016 through May 2017,the Eve 2A defendants received more than $29 million in revenue from the scheme. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 16 of 34 PageID #: 63 16 40. The Eve 2A defendants re-invested some ofthe proceeds from the botnet-based scheme to perpetuate the fraud. For example, OVSYANNIKOV and ISAEV directed payments from ad networks to corporate bank accounts in the Czech Republic and Switzerland, at least one of which they then used to pay for servers used in the scheme. 41. The Eve 2A defendants sought to conceal other proceeds by layering the funds amongst various shell companies, each of which contained no public website or outward-facing business. For example: (a) On or about December 1, 2016, OVSYANNIKOV obtained a list of"high filling" publishers' domains from an employee of an ad network, who requested that OVSYANNIKOV "increase [his] traffic." The next day,TIMCHENKO added 10 of the domains to the running list of"New companies for spoofing." In or about March 2017, the ad network paid more than $340,000 into Ad Network #2's bank account in the Czech Republic, with the notation "December revenue," as payment for advertising traffic. Funds were subsequently wired from Ad Network #2's account to shell entities, including an entity controlled by OVSYANNIKOV and another entity that in turn wired the funds directly to ISAEV. None ofthese entities had any public website or outward-facing business. (b) In or around and between July 2016 and May 2017, Ad Network #2's account also wired approximately $1.2 million into accounts in Switzerland, held in the name of an entity controlled by OVSYANNIKOV. This entity, too, lacked any public website or outward-facing business. 42. On or about October 22, 2018,foreign law enforcement authorities arrested OVSYANNIKOV in Kuala Lumpur, Malaysia. OVSYANNIKOV sought to notify Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 17 of 34 PageID #: 64 17 his co-conspirators of his arrest, and ISAEV and TIMCHENKO subsequently deleted the contents of their email accounts and online cloud storage accounts used in the scheme. III. The Victims 43. The datacenter-based scheme and the botnet-based scheme victimized numerous players in the digital advertising industry. 44. The schemes victimized brands who sought opportunities to advertise their goods and services to real human internet users but lost those opportunities and instead paid for advertisements automatically loaded by computers. 45. The schemes victimized online publishers by creating false and fraudulent webpages purporting to be located at real publishers' domains, stealing the publishers' identities and misappropriating those identities for a fraudulent purpose, undermining the reputation and credibility ofthose publishers in the ad market and reducing the revenues that the actual publishers would otherwise earn. 46. The schemes victimized ad platforms—the SSPs and DSPs—by misusing these clearinghouses of ad traffic for fraud. 47. The datacenter-based scheme victimized internet service providers by stealing their corporate identities for the purpose ofregistering IP addresses with false information. 48. The botnet-based scheme victimized individuals and businesses whose computers were used, without their knowledge or authorization, to perpetrate the fraud. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 18 of 34 PageID #: 65 18 COUNT ONE (Wire Fraud Conspiracy—^Datacenter-Based Scheme) 49. The allegations contained in paragraphs one through 27 and 43 through 47 are realleged and incorporated as though fully set forth in this paragraph. 50. In or about and between September 2014 and December 2016, both dates being approximate and inclusive, within the Eastern District ofNew York and elsewhere, the defendants ALEKSANDR ZHUKOV,BORIS TIMOKHIN, MIKHAIL ANDREEV,DENIS AVDEEV,DMITRY NOVIKOV and SERGEY OVSYANNIKOV, together with others, did knowingly and intentionally conspire to devise a scheme and artifice to defraud brands, ad platforms and others in the digital advertising industry, and to obtain money and property from brands, ad platforms and others in the digital advertising industry by means of materially false and fraudulent pretenses, representations and promises, and for the purpose of executing such scheme and artifice, to transmit and cause to be transmitted by means of wire communication in interstate and foreign commerce, writings, signs, signals, pictures and sounds,to wit: electronic communications to computers and servers in the United States and elsewhere, emails and other online communications and monetary transfers, contrary to Title 18, United States Code, Section 1343. (Title 18, United States Code, Sections 1349 and 3551 et seq.I COUNT TWO (Wire Fraud—^Datacenter-Based Scheme) 51. The allegations contained in paragraphs one through 27 and 43 through 47 are realleged and incorporated as though fully set forth in this paragraph. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 19 of 34 PageID #: 66 19 52. In or about and between September 2014 and December 2016, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants ALEKSANDR ZHUKOV,BORIS TIMOKHIN,MIKHAIL ANDREEV,DENIS AVDEEV,DMITRY NOVIKOV and SERGEY OVSYANNIKOV, together with others, did knowingly and intentionally devise a scheme and artifice to defraud brands, ad platforms and others in the digital advertising industry, and to obtain money and property from brands, ad platforms and others in the digital advertising industry by means of materially false and fraudulent pretenses, representations and promises, and for the purpose of executing such scheme and artifice, did transmit and cause to be transmitted by means of wire communication in interstate and foreign commerce, writings, signs, signals, pictures and sounds, to wit: electronic communications to computers and servers in the United States and elsewhere, emails and other online communications and monetary transfers. (Title 18, United States Code, Sections 1343,2 and 3551 et SQq.) COUNT THREE (Money Laundering Conspiracy—Datacenter-Based Scheme) 53. The allegations contained in paragraphs one through 27 and 43 through 47 are realleged and incorporated as though fully set forth in this paragraph. 54. In or about and between September 2014 and December 2016, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants ALEKSANDR ZHUKOV,BORIS TIMOKHIN,MIKHAIL ANDREEV,DENIS AVDEEV and DMITRY NOVIKOV,together with others, did knowingly and intentionally conspire to: Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 20 of 34 PageID #: 67 20 (a) transport, transmit and transfer monetary instruments and funds from a place in the United States to and through a place outside the United States and to a place in the United States from and through a place outside the United States,(i) with the intent to promote the carrying on ofone or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, contrary to Title 18, United States Code, Section 1956(a)(2)(A); and (ii) knowing that the monetary instruments and funds involved in the transportation, transmission and transfer represented the proceeds ofsome form of unlawful activity, and knowing that such transportation, transmission and transfer was designed in whole and in part to conceal and disguise the nature, location, source, ownership and control ofthe proceeds of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, contrary to Title 18, United States Code, Section 1956(a)(2)(B)(i); and (b) engage in one or more monetary transactions within the United States involving property of a value greater than $10,000 that was derived from one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, knowing that the funds were the proceeds ofsome unlawful activities and were in fact proceeds of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, contrary to Title 18, United States Code, Section 1957(a). (Title 18, United States Code, Sections 1956(h) and 3551 et seq.) Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 21 of 34 PageID #: 68 21 COUNT FOUR (Engaging in Monetary Transactions in Property Derived from Specified Unlawful Activity—Datacenter-Based Scheme) 55. The allegations contained in paragraphs one through 27 and 43 through 47 are realleged and incorporated as though fully set forth in this paragraph. 56. In or about and between September 2014 and December 2016, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants ALEKSANDR ZHUKOV,BORIS TIMOKHIN,MIKHAIL ANDREEV,DENIS AVDEEV and DMITRY NOVIKOV,together with others, did knowingly and intentionally engage in one or more monetary transactions within the United States involving property of a value greater than $10,000 that was derived from one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, knowing that the funds were the proceeds ofsome unlawful activities and were in fact proceeds of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349. (Title 18, United States Code, Sections 1957(a),2 and 3551 et seq.) COUNT FIVE (Wire Fraud Conspiracy—Botnet-Based Scheme) 57. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 58. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 22 of 34 PageID #: 69 22 defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and intentionally conspire to devise a scheme and artifice to defiraud brands, ad platforms and others in the digital advertising industry, and to obtain money and property from brands, ad platforms and others in the digital advertising industry by means of materially false and fraudulent pretenses, representations and promises, and for the purpose of executing such scheme and artifice, to transmit and cause to be transmitted by means of wire communication in interstate and foreign commerce, writings, signs, signals, pictures and sounds, to wit: electronic communications to computers and servers in the United States and elsewhere, emails and other online communications and monetary transfers, contrary to Title 18, United States Code, Section 1343. (Title 18, United States Code, Sections 1349 and 3551 et seq.l COUNT SIX (Wire Fraud—Botnet-Based Scheme) 59. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 60. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDR ISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and intentionally devise a scheme and artifice to defraud brands, ad platforms and others in the digital advertising industry, and to obtain money and property from brands, ad platforms and others in the digital advertising industry by means of materially false and fraudulent pretenses, representations and promises, Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 23 of 34 PageID #: 70 23 and for the purpose of executing such scheme and artifice, did transmit and cause to be transmitted by means of wire communication in interstate and foreign commerce, writings, signs, signals, pictures and sounds, to wit: electronic communications to computers and servers in the United States and elsewhere, emails and other online communications and monetary transfers. (Title 18, United States Code, Sections 1343,2 and 3551 et seq.^ COUNT SEVEN (Aggravated Identity Theft—Botnet-Based Scheme) 61. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 62. In or about and between December 2015 and October 2018,both dates being approximate and inclusive, within the Eastem District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, during and in relation to the crimes charged in Counts Five and Six, did knowingly and intentionally transfer, possess and use, without lawful authority, one or more means ofidentification of other persons, to wit: IP addresses and other information, knowing that these means of identification belonged to said persons. (Title 18, United States Code, Sections 1028A(a)(l), 1028A(b), 1028A(c)(4), 2 and 3551 et seq.i Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 24 of 34 PageID #: 71 24 COUNT EIGHT (Conspiracy to Commit Computer Intrusions—^Botnet-Based Scheme) 63. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 64. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastem District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and willfully conspire to: (a) intentionally access one or more computers without authorization and exceed authorized access, and thereby to obtain information from one or more protected computers for the purpose of commercial advantage and private financial gain, and in furtherance of criminal and tortious acts in violation ofthe laws ofthe United States and any State, and the value ofthe information obtained exceeded $5,000, contrary to Title 18, United States Code, Sections 1030(a)(2), 1030(b), 1030(c)(2)(A) and 1030(c)(2)(B); (b) with intent to defraud access one or more protected computers without authorization, and exceed authorized access, and by means ofsuch conduct to further the intended fraud and obtain something of value, to wit: the use of a computer, information and United States and foreign currency, contrary to Title 18, United States Code, Sections 1030(a)(4), 1030(b) and 1030(c)(3)(A); and (c) (i) knowingly cause the transmission of a program, information, code and command,and as a result ofsuch conduct, intentionally cause damage without authorization affecting 10 or more protected computers during a one-year period; and (ii) intentionally access one or more protected computers without authorization, and as a result of Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 25 of 34 PageID #: 72 25 such conduct, recklessly cause damage affecting 10 or more protected computers during a one-year period, contrary to Title 18, United States Code, Sections 1030(a)(5), 1030(b) and 1030(c)(4). 65. In furtherance ofthe conspiracy and to effect its objects, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV, ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, committed and caused to be committed, among others, the following: OVERT ACTS (a) On or about April 20,2016, OVSYANNIKOV sent an online message to his co-conspirators explaining how computers in the botnet would be instructed to spoof a domain. (b) On or about August 8,2016,ISAEV sent an invoice to an ad network for advertising services. (c) On or about February 27,2017,TIMCHENKO logged in to the administrative panel of one ofthe Fraudulent Content Servers. (d) On or about May 17,2018, OVSYANNIKOV,ISAEV and TIMCHENKO,together with others, caused an infected computer belonging to a business in Blue Point, New York,to surreptitiously download a fabricated webpage, offer up the advertising space on the fabricated webpage for bidding and load an advertisement on the fabricated webpage for a nonprofit hospital located in West Islip, New York, all without the knowledge or permission ofthe infected computer's true owner. (Title 18, United States Code, Sections 371 and 3551 et seq.") Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 26 of 34 PageID #: 73 26 COUNT NINE (Computer Intrusion and Obtaining Information—^Botnet-Based Scheme) 66. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 67. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and intentionally access, and attempt to access, one or more computers without authorization and exceed authorized access, and thereby did obtain information from one or more protected computers for the purpose of commercial advantage and private financial gain, and in furtherance of criminal and tortious acts in violation ofthe laws ofthe United States and any State, and the value ofthe information obtained exceeded $5,000. (Title 18, United States Code, Sections 1030(a)(2), 1030(b), 1030(c)(2)(A), 1030(c)(2)(B), 2 and 3551 et seq.l COUNT TEN (Computer Intrusion in Furtherance of Fraud—^Botnet-Based Scheme) 68. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 69. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDR ISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and with intent to defraud access, and Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 27 of 34 PageID #: 74 27 attempt to access, one or more protected computers without authorization, and exceed authorized access, and by means ofsuch conduct did further the intended fraud and obtain something of value, to wit: the use of a computer, information and United States and foreign currency. (Title 18, United States Code, Sections 1030(a)(4), 1030(b), 1030(c)(3)(A), 2 and 3551 et seq.^ COUNT ELEVEN (Computer Intrusion and Causing Damage—Botnet-Based Scheme) 70. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 71. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastem District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDR ISAEV and YEVGENIY TIMCHENKO,together with others, did:(i) knowingly cause the transmission ofa program, information, code and command,and as a result ofsuch conduct, intentionally cause damage without authorization affecting 10 or more protected computers during a one-year period; and (ii) intentionally access a protected computer without authorization, and as a result of such conduct, recklessly cause damage affecting 10 or more protected computers during a one-year period. (Title 18, United States Code, Sections 1030(a)(5), 1030(b), 1030(c)(4), 2 and 3551 et seq.) Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 28 of 34 PageID #: 75 28 COUNT TWELVE (Money Laundering Conspiracy^—Botnet-Based Scheme) 72. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fiilly set forth in this paragraph. 73. In or about and between December 2015 and October 2018, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and intentionally conspire to: (a) transport, transmit and transfer monetary instruments and funds from a place in the United States to and through a place outside the United States and to a place in the United States from and through a place outside the United States,(i) with the intent to promote the carrying on of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5), contrary to Title 18, United States Code, Section 1956(a)(2)(A); and (ii) knowing that the monetary instruments and funds involved in the transportation, transmission and transfer represented the proceeds ofsome form of unlawful activity, and knowing that such transportation, transmission and transfer was designed in whole and in part to conceal and disguise the nature, location, source, ownership and control ofthe proceeds of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code,Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 29 of 34 PageID #: 76 29 intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5), contrary to Title 18, United States Code, Section 1956(a)(2)(B)(i); and (b) engage in one or more monetary transactions within the United States involving property of a value greater than $10,000 that was derived from one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5), knowing that the funds were the proceeds ofsome unlawful activities and were in fact proceeds of one or more specified unlawful activities, to wit: wire fraud,in violation of Title 18, United States Code, Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5), contrary to Title 18, United States Code, Section 1957(a). (Title 18, United States Code, Sections 1956(h) and 3551 et seg.) COUNT THIRTEEN (Engaging in Monetary Transactions in Property Derived from Specified Unlawful Activity—Botnet-Based Scheme) 74. The allegations contained in paragraphs one through 13 and 28 through 46 and 48 are realleged and incorporated as though fully set forth in this paragraph. 75. In or about and between December 2015 and October 2018,both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants SERGEY OVSYANNIKOV,ALEKSANDRISAEV and YEVGENIY TIMCHENKO,together with others, did knowingly and intentionally engage in one or more monetary transactions within the United States involving property of a value greater than Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 30 of 34 PageID #: 77 30 $10,000 that was derived from one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code, Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5), knowing that the funds were the proceeds ofsome unlawful activities and were in fact proceeds of one or more specified unlawful activities, to wit: wire fraud, in violation of Title 18, United States Code,Section 1343, wire fraud conspiracy, in violation of Title 18, United States Code, Section 1349, and computer intrusion, in violation of Title 18, United States Code, Sections 1030(a)(2),(a)(4) and (a)(5). (Title 18, United States Code, Sections 1957(a), 2 and 3551 et seq.) CRIMINAL FORFEITURE ALLEGATION AS TO COUNTS ONE.TWO.FIVE AND SIX 76. The United States hereby gives notice to the defendants charged in Counts One, Two,Five and Six that, upon their conviction ofsuch offenses, the government will seek forfeiture in accordance with Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), which require any person convicted of such offenses to forfeit any property, real or personal, constituting or derived from proceeds obtained directly or indirectly as a result ofsuch offenses. 77. If any ofthe above-described forfeitable property, as a result of any act or omission ofthe defendants: (a) cannot be located upon the exercise of due diligence; (b) has been transferred or sold to, or deposited with, a third party; (c) has been placed beyond the jurisdiction of the court; Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 31 of 34 PageID #: 78 31 (d) has been substantially diminished in value; or (e) has been commingled with other property which cannot be divided without difficulty; it is the intent ofthe United States, pursuant to Title 21, United States Code, Section 853(p), to seek forfeiture of any other property ofthe defendants up to the value ofthe forfeitable property described in this forfeiture allegation. (Title 18, United States Code, Section 981(a)(1)(C); Title 21, United States Code, Section 853(p); Title 28, United States Code, Section 2461(c)) CRIMINAL FORFEITURE ALLEGATION AS TO COUNTS THREE.FOUR.TWELVE AND TfflRTEEN 78. The United States hereby gives notice to the defendants charged in Counts Three, Four, Twelve and Thirteen that, upon their conviction ofsuch offenses, the government will seek forfeiture in accordance with Title 18, United States Code, Section 982(a)(1), which requires any person convicted ofsuch offenses to forfeit any property, real or personal, involved in such offenses, or any property traceable to such property. 79. If any ofthe above-described forfeitable property, as a result of any act or omission of the defendants: (a) cannot be located upon the exercise of due diligence; (b) has been transferred or sold to, or deposited with, a third party; (c) has been placed beyond the jurisdiction of the court; (d) has been substantially diminished in value; or (e) has been commingled with other property which cannot be divided without difficulty; Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 32 of 34 PageID #: 79 32 it is the intent ofthe United States, pursuant to Title 21, United States Code, Section 853(p), as incorporated by Title 18, United States Code, Section 982(b)(1), to seek forfeiture of any other property ofthe defendants up to the value ofthe forfeitable property described in this forfeiture allegation. (Title 18, United States Code, Sections 982(a)(1) and 982(b)(1); Title 21, United States Code, Section 853(p)) CRIMINAL FORFEITURE ALLEGATION AS TO COUNTS EIGHT THROUGH ELEVEN 80. The United States hereby gives notice to the defendants charged in Counts Eight through Eleven that, upon their conviction ofsuch offenses, the government will seek forfeiture in accordance with Title 18, United States Code, Sections 982(a)(2)(B) and 1030(i)(l), which require any person convicted of such offenses to forfeit any property constituting, or derived from,proceeds obtained directly or indirectly as a result ofsuch offenses, and such person's interest in any personal property that was used or intended to be used to commit or to facilitate such offenses, including but not limited to the following domain names: (a) adzos.com; (b) clickandia.com (c) webvideocore.com; (d) clickservers.net; (e) clickmediallc.net; (f) mobapptrack.com; and (g) rtbclick.net. Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 33 of 34 PageID #: 80 33 81. If any ofthe above-described forfeitable property, as a result of any act or omission ofthe defendants: (a) cannot be located upon the exercise of due diligence; (b) has been transferred or sold to, or deposited with, a third party; (c) has been placed beyond the jurisdiction ofthe court; (d) has been substantially diminished in value; or (e) has been commingled with other property which cannot be divided without difficulty; it is the intent ofthe United States, pursuant to Title 21, United States Code, Section 853(p), as incorporated by Title 18, United States Code, Sections 982(b)(1) and 1030(i)(2), to seek forfeiture of any other property ofthe defendants up to the value ofthe forfeitable property described in this forfeiture allegation. (Title 18, United States Code, Sections 982(a)(2)(B), 982(b)(1), 1030(i)(l) and 1030(i)(2); Title 21, United States Code,Section 853(p)) A TRUE BILL FORBPBRSON RICHARD P. DONOGl UNITED STATES ATTORNEY EASTERN DISTRICT OF NEW YORK THE UNITED STATES OF AMERICA CRIMINAL DIVISION EASTERN District of NEW YORK UNITED STATES DISTRICT COURT INDICTMENT TIMCHENKO, Defendants. ALEKSANDR ZHUKOV,BORIS TIMOKHIN,MIKHAIL ANDREEV,DENIS AVDEEV,DMITRY NOVIKOV,SERGEY OVSYANNIKOV,ALEKSANDR ISAEV and YEVGENIY No. Bail, $ of A.D.20 day, Saritha Komatireddy, Alexander Mindlin, Michael Keilty, Assistant US,Attorneys(718)254-7000 Filed in open court this Clerk (T. 18, U.S.C., §§ 371, 981(a)(1)(C), 982(a)(1), 982(a)(2)(B), 982(b)(1), 1028A(a)(l), 1028A(b), 1028A(c)(4), 1030(a)(2), 1030(a)(4), 1030(a)(5), 1030(b), 1030(c)(2)(A), 1030(c)(2)(B), 1030(c)(3)(A), 1030(c)(4), 1030(i)(l), 1030(i)(2), 1343, 1349, 1956(h), 1957(a), 2 and 3551 et scfl.; T. 21, U.S.C., § 853(p); T. 28, U.S.C., § 2461(c)) JUN. 85 FORM DBD-34 F.#: 2016R02228 Case 1:18-cr-00633-ERK Document 8 Filed 11/27/18 Page 34 of 34 PageID #: 81