Case 3:19-cv-04753-AET-TJB Document 9 Filed 02/12/19 Page 1 of 2 PageID: 970 State of New Jersey PHILIP D. MURPHY GURBIR S. GREWAL Governor OFFICE OF THE ATTORNEY GENERAL DEPARTMENT OF LAW AND PUBLIC SAFETY DIVISION OF LAW SHEILA Y. OLIVER 25 MARKET STREET MICHELLE L. MILLER Lt. Governor PO Box 112 Attorney General Director TRENTON, NJ 08625-0112 February 12, 2019 The Honorable Anne E. Thompson Clarkson S. Fisher Building & U.S. Courthouse 402 East State Street Trenton, NJ 08608 Re: Defense Distributed, et al. v. Gurbir Grewal Civ. No. 19-cv-4753 Dear Judge Thompson: In advance of tomorrow’s phone conference regarding scheduling in Defense Distributed v. Grewal, Case No. 3:19-cv-04753, Defendant Attorney General Gurbir Grewal submits this letter to provide important information bearing on Plaintiffs’ application for a Temporary Restraining Order (TRO) and on the timeline for responding. The Attorney General’s Division of Criminal Justice (DCJ) has concluded that a key document supporting Plaintiff’s TRO application—a “takedown notice” purportedly sent by DCJ to CloudFlare, Inc., which hosts one of the plaintiff’s websites, CodeIsFreeSpeech.com—was not in fact issued by DCJ, and appears to have been issued by some entity impersonating the Attorney General’s Office. We are including a certification that details our office’s investigation so far. In addition, we have referred the matter to the U.S. Attorney’s Office for the District of New Jersey. By way of background, after one of the plaintiffs sought to disseminate electronic files for the direct three-dimensional (3D) printing of firearms—making dangerous and untraceable guns available to anyone that has access to a 3D printer, including terrorists, domestic abusers, felons, and anyone else disqualified from gun ownership—the New Jersey Legislature took action. The state’s law, enacted in November 2018, restricts the distribution of [1] digital instructions [2] in the form of computer-aided design (CAD) files or other code or instructions stored and displayed in electronic format as a digital model [3] that may be used to program a 3D printer to manufacture or produce a firearm, firearm receiver, magazine, or firearm component. See N.J. Stat. Ann. §2C:39-9(l)(2). Plaintiffs are seeking a TRO to enjoin enforcement of this law. HUGHES JUSTICE COMPLEX • TELEPHONE: (609) 376-3232 • FAX: (609) 292-0690 New Jersey Is An Equal Opportunity Employer • Printed on Recycled Paper and Recyclable Case 3:19-cv-04753-AET-TJB Document 9 Filed 02/12/19 Page 2 of 2 PageID: 971 February 12, 2019 Page 2 In Plaintiffs’ Complaint, and again in their Motion for a Temporary Restraining Order and Preliminary Injunction, Plaintiffs demand an immediate injunction because Defendant purportedly “issued a takedown demand and threat of prosecution against Cloudflare,” the service provider for one of the plaintiff’s websites, CodeIsFreeSpeech.com. See ECF Dkt. 1-0, ⁋⁋ 92-94; Dkt. 1-8 at 17 (“Doubts about whether or not Grewal will apply the new speech crime to Defense Distributed’s CAD files were put to rest on February 2, 2019, when he did just that. In a takedown notice directed at CodeIsFreeSpeech.com, Grewal expressly identified CAD files that Defense Distributed had first published and declared them to be ‘3D printable firearms in violation of [§ 3(l)(2)].’”). Plaintiffs rely on this notice to allege that Defendant is trying “to compel the complete and total suppression of the political speech at CodeIsFreeSpeech.com.” Dkt. 1-8 at 17. Plaintiffs highlight that the purported takedown notice not only demands removal of CAD files that may be used to manufacture firearms, but also removal of “links to other advocacy websites and their educational and political resources, links to political tee shirts, and even the very text of the United States Constitution itself.” Dkt. 1-8 at 17. (The purported takedown notice can be found at Dkt. 1-7, Ex. F, and at Dkt. 1-11, Declaration of Brandon Coombs, ⁋⁋ 15-17.) As noted, we have no reason to believe the Attorney General’s Office filed this takedown notice with Cloudflare, and our investigation thus far demonstrates the office did not do so. We have conferred with all relevant parties within the Attorney General’s Office—including DCJ and the New Jersey State Police—and there is no evidence that anyone within the Office authorized its filing. In an effort to determine who, in fact, issued the notice, DCJ assigned two investigators to review the matter, who obtained the IP address of the device used to submit the notice to Cloudflare, and learned that the IP address is associated with a server located in the Slovak Republic. This IP address is not connected to DCJ, nor would DCJ use this type of proxy server for routine communications with third parties. The Attorney General’s Office will continue to investigate who used the proxy address to file an abuse report purportedly from the Division of Criminal Justice. The Attorney General’s Office has also referred the matter to the U.S. Attorney’s Office for the District of New Jersey. We would be happy to provide more information at, or after, tomorrow’s phone conference. Respectfully submitted, GURBIR S. GREWAL ATTORNEY GENERAL OF NEW JERSEY By: /s Glenn J. Moramarco Glenn J. Moramarco Assistant Attorney General Case 3:19-cv-04753-AET-TJB Document 9-1 Filed 02/12/19 Page 1 of 3 PageID: 972 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY Defense Distributed, Second Amendment Foundation, Firearms Policy Coalition, Inc., Firearms Policy Foundation, The Calguns Foundation, California Association of Federal Firearms Licensees, Inc., and Brandon Combs CIVIL ACTION NO.: 19-CV-04753 DECLARATION OF KEVIN MADORE Plaintiffs, v. Gurbir S. Grewal, Attorney General of the State of New Jersey, Defendant. I, Kevin Madore, declare as follows: 1. I am a Detective and have been employed by the New Jersey Division of Criminal Justice (DCJ) for two and a half years. I am currently assigned to the Financial and Computer Crimes Bureau, Computer Crimes Unit. My responsibilities include forensic analysis on seized items such as computers and cellular devices and advanced investigations of potential criminal activities that occur on the dark web and/or that involve crypto currency or the use of V.P.N./proxy servers. As part of my duties, I received training in the areas of Computer/Cellphone forensic examinations, dark web investigations, and Network intrusion investigations. I currently have thirteen years of related experience in the field, previously working in a county prosecutor’s office and private industry. Case 3:19-cv-04753-AET-TJB Document 9-1 Filed 02/12/19 Page 2 of 3 PageID: 973 2. On Thursday, February 7, 2019, I received an email from DCJ Lieutenant Edward Augustyn regarding the website codeisfreespeech.com. Codeisfreespeech.com is hosted1 by the company Cloudflare, Inc. (Cloudflare). 3. I learned that on February 2, 2019, a complaint was sent to Cloudflare via a web form that demanded codeisfreespeech.com remove certain files from their website. The author of the complaint supplied the email address “dcjtipline@njdcj.org,” the name “New Jersey Office of the Attorney General,” and the telephone number of “609-984-6500.” This phone number and email address are publicly available on the DCJ website. 4. On Friday, February 8, 2019, another DCJ Detective and I were assigned to investigate the origin of the complaint. 5. On Friday, February 8, 2019, I requested Internet Protocol (I.P.)2 logs from Cloudflare regarding the complaint. Cloudflare responded to that request the same day and provided information regarding the I.P. address that sent the notice. Cloudflare identified that this I.P. address was affiliated with a company based in the Slovak Republic. 6. Using IPlocation.net, an open source website that is commonly used (including by DCJ) to geolocate I.P. addresses, I learned that the I.P. address resides in the Slovak Republic. Using other open source tools, I confirmed that the geolocation was the Slovak Republic. Also, I confirmed that this I.P. address is reserved for that provider based in the Slovak Republic. 7. Based upon this investigation, as well as my training and experience, the complaint sent to Cloudflare regarding codeisfreespeech.com did not originate from the New Jersey Office of Attorney General or its Division of Criminal Justice. 1 Web hosting is a service that allows organizations and individuals to post a website or web page onto the Internet. An Internet Protocol address is a numerical label assigned to every device that connects to a computer network and uses the Internet Protocol for communication. 2 Case 3:19-cv-04753-AET-TJB Document 9-1 Filed 02/12/19 Page 3 of 3 PageID: 974 8. I declare under penalty of perjury that the foregoing is true and correct. /s/ Kevin Madore Detective Kevin Madore N.J. Division of Criminal Justice