Case Document 17 Filed 03/01/18 Page 1 of 21 Presented to the Court by the foreman of the Grand Jury in open Court, in the presence of the Grand Jury and FILED in the US. ?k DISTRICT COURT at Seattle, Washington. Judge 0 - asm I [go/d) UNITED COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE UNITED STATES OF AMERICA, I NO. Pla?m?ff? SECOND SUPERSEDING v. - INDICTMENT MUHAMMAD FAHD and JIWANI, Defendants. The Grand Jury charges that At all times material to this Second Superseding Indictment: 1. Mobility LLC (hereinafter, was a company with headquarters in Atlanta, Georgia, and of?ces throughout the United States, including a customer service call center in Bothell, Washington. 2. sold cellular telephones and Offered voice and data plans for use with the phones on the wireless network. phones and wireless services were sold through authorized dealers and retailers acrOSs thecountry. 3. I New cellular phones, such as iPhones, cost hundreds of dollars, with many top-end models costing over $500. To make phones more affordable, either subsidized the purchase cost of phones" or provided an option to purchase phones under UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 700 STEWART STREET, SUITE 5220 CR1 7-02 QORSL SEATTLE, WASHINGTON 98101 (206) 553-7970 p?a NAN t?d r?l t?I I?d l-I-l t?a t?A and Case Document ?17 Filed 03/01/18 Page 2 of 21 an interest-free installment plan. To be eligible for either option, customers needed to agree to enter into long-term service contracts that bound them to wireless network. I i 4. used proprietary locking software on phones that prevented the phones from being used" "on any wireless network other than the network 7 unless and until the phones were ?unlocked.? I 5. ?Unlocking? a phone disabled the proprietary locking software and thereby allowed the phone to be used on multiple carrier systems rather than exclusively with 6. The Wireless Customer Agreement between and each of its customers provided that would unlock the customer?s phone upon the satisfactiOn of certain criteria, such as when the customer had satis?ed the terms of his or her Service contract and/ or installment ?plan. I 7. Unlocked phones were a valuable commodity because they could be resold and used On any other compatible network around the world. If an customer?s phone was unlocked with or without authorization, that Customer could switch to another carrier. If this happened, would be deprived of the remaining value of the customer?s service contract and, if applicable, remaining payments under the customer?s installment plan. 8. When phones were unlocked fraudulently without authorization and customers switched service to other carriers, the fraudulent transactions deprived of the stream of payments that were due under the service contracts and installment plans. i 9. employees at Mobility Customer Care call center in Bothell, Washington, had access to computer systems to assist customers with service and billing issues. Among other things, employees at the call center had the ability to submit unlock requests on behalf of eligible customers. UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 2 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 17 Filed 03/01/18 Page 3 of 21 10. employees used a variety of internal computer programs at to process unlock requests. Access to the systems was limited to authenticated users connected to internal and protected corporate network. 11. unlocking systems permitted employees with proper authorization and network credentials to, in appropriate circumstances, send requests to unlock the phones of customers. 12. Malware was malicious computer code running on a computer that was not authorized by the owner/authorized user of that computer. Malware could be designed to do a variety of things, including logging every keystroke on a computer, stealing information or? ?user credentials? (passwords or usernames), and executing unauthorized commands without the consent of the authorized user. COUNT 1 (Conspiracy to Commit WireFraud) 13. The allegations contained in Paragraphs 1 through 12 of this Second Superseding Indictment are re?alleged and incorporated as if fully set forth herein. I. THE OFFENSE 14. Beginning at a date unknown, but no later than April 2012, and continuing through in or about September 2017, at Bothell, within the Western District of I Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHU LAM others known and unknown to the Grand Jury, did knowingly and intentionally, agree and conspire to devise and execute and attempt to execute, a scheme and arti?ce to'defraud, and for obtaining money and property by means of materially - false and fraudulent pretenses, representations, and promises; and in executing and attemptingto execute this scheme and arti?ce, to knowingly-cause to be transmitted in interstate and foreign commerce, by means of wire communication, certain signs, signals 1 . UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 3 70st) STREET, $131531? - BATTLE, ASHENGTON 0290RSL . (206) 553-7970 Case Document 17 Filed 03/01/18 Page 4 of 21 and sounds as further described below, in-Violation of Title 18, United States Code, Section. 1343. i - II. THE OBJECT OF THE CONSPIRACY 7 15. The object of the conspiracy was to gain access to protected internal Computers without authorization, and in excess of authorization, by bribing employees to submit fraudulent and unauthorized cellphone unlocking requests through internal protected computer network through, among other means, the installation of malware and unauthorized hardware on internal network. The 'object further was to sell to members of the public the resulting ability fraudulently to unlock phones, so that the members of the public could stop using wireless services and thereby deprive of the stream of payments it was owed under the customers? service contracts and installment plans. 111. AND MEANS OF THE CONSPIRACY A. Overview of the Conspiracy . 16. It was part "of the conspiracy that MUHAMMAD FAHD, GHULAM IWANI and others known and unknownto the Grand Jury, gained unauthorized access to internal protected computers through a variety of methods, including by bribing employees (hereinafter ?insiders?) call center in Bothell, Washington, to use their network credentials and exceed their authorized access to computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on systems. 17. From In or about April 2012 to in or about April 2013, MUHAMMAD FAHD, and others known and unknown to the Grand Jury, transmitted instructions to the insiders via the wires in interstate and foreign commerce, including lists of cellular telephone international mobile equipment identity numbers for the insiders to submit for fraudulent and unauthorized unlocking. UNITED STATES ATTORNEY SECOND SUPERSEDING INDICTMENTIFAHD, ET AL. 4 7'00 STEWART STREET, SUITE 5220 CR17 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 17 Filed 03/01/18 Page 5 of 21 18. From in or about April 2013 to in or about October 2013, MUHAMMAD FAHD, GHULAM IWANI and others known and unknown to the Grand Jury, bribed insiders to plant malware on internal protected computers for the purpose of gathering con?dential and proprietary information on how computer network and software applications functioned. 19. Using information gathered by this malware about computer network and software applications, MUHAMMAD AHD, and others known and unknown to the Grand Jury, created additional malware designed to interact with internal protected computers and process fraudulent and unauthorized unlOck requests submitted over the wires in interstate commerce from remOte servers controlled by members of the conspiracy. . i 20; The malware MUHAMMAD AHD, and others known and unknown to the Grand Jury, planted on internal protected computers used network credentials that belonged to actual employees, including co-conspirators and others, to allow MUHAMMAD FAHD, and others knownand unknown to the Grand Jury, to log into internal protected computers under false pretenses and to process fraudulent and unauthorized unlock requests. 21. 7 From in or about November 2014 to in or about September 2017, MUHAMMAD FAHD, GHULAM JIWANI. and others known and unknown to the Grand Jury, bribed insiders to use their access to physical work space to install unauthorized computer hardware devices, including-wireless access points designed to provide the conspiracy With unauthorized access to internal protected computers and facilitate the automated process of submitting fraudulent and unauthorized unlOck requests on behalf of the conspiracy. 22. The unauthorized computer hardWare devices, like the malWare, used network credentials that belonged to actual employees, including co-conspirators and others, and allowed MUHAMMAD FAHD, and'others known and unknown to the - UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 5 700 STEWART STREET. SUITE 5220 CR17-0290RSL SEATTLE, WASHINGTON 98101 (206) 553?7970 45 MN C3000 \l -b D.) Case Document 17 Filed 03/01/18 Page 6 of 21 Grand Jury, to log into internal protected computers under false pretenses and to process fraudulent and unauthorized unlock requests. . 23. During the course of the conspiracy, FAHD, GHULAM IWANI, and other co-conspirators Who Were not associated with paid more than $1,000,000 in bribes to insiders who joined the conspiracy. MUHAMMAD FAHD, GHULAM JIWANI, and other co-conspirators paid these bribes to induce the insiders to unlock cellular phones without authorization, including by installing malware and unauthorized hardware on computer systems. 24. During the course of the conspiracy, the conspirators caused more than 2,000,000 cellular telephones fraudulently to be unlocked by through the insiders? submission of fraudulent unlocking requests and through the conspirators? use of malware and hardware installed on systems by the insiders to conduct unauthorized unlocks. B. Defendant MUHAMMAD Participation in the Conspiracy 25. It was part of the conspiracy that MUHAMMAD FAHD, doing business as Endless Trading FZE (aka Endless Trading FZC), Endless Connections Inc. ,and iDevelopment Co. recruited insiders at who were Willing to take bribes to work on behalf of the conspiracy. 26. MUHAMMAD FAHD contacted the insiders at Via telephone, Facebook, and other communication channels 1n interstate and foreign commerce and offered to pay them to unlock cell phones. MUHAMMAD FAHD instructed the insiders to obtain pre-paid cellular phones and anonymous online email accounts to communicate . with him. . . 27. FAHD also instructed the insiders to create shell companies and open business banking accounts in the names of the shell companies to receive payments for their work on behalf of the conspiracy. UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL.- 6 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 r?A i?d r?t 00 Lib.) i?a - Case Document 17 Filed 03/01/18 Page 7 of 21 28. FAHD obtained lists of IMEI numbers for cellular telephones from co-conspirators, and others, who operated businesses that offered unlocking Services to customers for a fee I - 29. Beginning in or about August 2012, MUHAMMAD FAHD and GHULAM JIWANI sent lists of IMEI numbers for Cellular telephones via the wires in interstate and foreign commerce to the insiders with instructions to submit unauthorized unlock requests for the IMEIs using their access to protected internal computer network. 30. Beginning in or aboutApril 2013, MUHAMMAD FAHD sent malware to the insiders via the wires in interstate and foreign commerce and instructed them to install the malware on computer network. The malware was designed to gather con?dential and proprietary information regarding the structure and functioning of internal protected computers and applications 31. Using information collected by the malware, MUHAMMAD FAHD, and others known and unknoWn to the Grand Jury, created additional malware designed to facilitate the transmission of commands via the wires in interstate and foreign commerce from a remote server to protected internal computer network and to submit unauthorized unlock requests. 32. - MUHAMMAD FAHD sent the insiders multiple versions of the unlocking malware to test and perfect the malware on behalf of the conspiracy. Once the malware was perfected, MUHAMMAD FAHD instructed the insiders to plant the unlocking malware on internal protected computers and to run the unlocking malware while they were atiwork. The unlocking malware used valid network credentials that belonged to co-conspirators and others, without authorization, to interact with internal protected computer network and process automated unauthorized unlock requests submitted from an external server. 33. In or about October 2013, discovered the unlocking malware and identi?ed several insiders who were operating the unlocking malWare at MUHAMMAD UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. 7 I 700 STEWART STREET SUITE 5220 CR1 7-0290RSL SEATTLE, WASHINGTON 98101 (206) 553~7970 Case Document 17 Filed 03/01/18 Page 8 of 21 direction. Those insiders subsequently left after being approached by investigatorsresult, beginning in or about November FAHD recruited new insiders at willing to accept bribes to Work on behalf of the conspiracy. 35. MUHAMMAD FAHD and others known and unknown to the Grand Jury, began programming hardware devices designed to facilitate unauthorized access to internal protected network for the purpose of processing unauthorized unlock requests. 36. MUHAMMAD AHD provided the hardware devices to co-conspirators including current andformer insiders who tested the devices. Upon perfecting the operation of the devices, MUHAMMAD FAHD provided the devices to insiders who plugged the devices into internal protected network without authorization to facilitate the unlocking of phones in furtherance of the conspiracy. 37. MUHAMMAD FAHD continued to pay insiders at to gain unauthorized access to internal protected computer network, and exceed their authorized access to protected internal Computer network to plant malware, install unauthorized hardware, and operate malware and unauthorized hardware on - protected internal computer network 'on behalf of the conspiracy through in or about September 2017. i I 7 C. Defendant GHULAM IWAN I?s Participation in the Conspiracy 38. It was part of the conspiracy that GHULAM JIWANI received lists of thousands of IMEIs from customers 'of the conspiracy and from co?conspirators that those customers wanted to have unlocked. The Customers and co-conspirators who provided - GHULAM IWANI such lists included customers and co-conspirators that sold cellular phone unlocking services to the public. - . '39. GHULAM JIWANI caused the lists of IMEIs to be submitted to the insiders so that the insiders could unlock the cellular phones. GHULAM IWANI UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL.- 8 - 700 STEWART STREET, SUITE 5220 CR17- 0290RSL SEATTLE, WASHENGTON 98101 - (206) 553-7970 Case Document 17 Filed 03/01/18 Page 9 of 21 subsequently received reports from the insiders showing. which IMEIs had been unlocked, and forwarded these to customers and co-conspirators. GHULAM IWANI I also negotiated and obtained payments from customers of the conspiracy. 40. GHULAM JIWANI made bribe payments to insiders at GHULAM JIWANI did so by causing payments to be transmitted by Western Union to the insiders. GHULAM IW ANI also did so by ?ying from Pakistan to the United States and delivering cash payments to the insiders or to persons who received the cash 4 payments on behalf of the insiders. 41. GHULAM IWANI facilitated and attended, a meeting between MUHAMMAD FAHD and one of the insiders. GHULAM JIWANI did so by arranging for the insider to travel from the State of Washington to Dubai, United Arab Emirates, 1n order to meet with MUHAMMAD FAHD and to receive paymentof a bribe from MUHAMMAD FAHD. All in violation of Title 18,'United States Code, Section 1349. - (Conspiracy to Violate the Travel Act and the Computer Fraud and Abuse Act) 42. The allegatiOns set forth in Count 1 of this Second are re-alleged and incorporated as if fully set forth herein. 1. THE OFFENSE 43. . Beginning at a date uncertain, but no later than April 2013, and continuing through 1n or about September 2017, at Bothell, within the Western District of Washington, and elsewhere, MUHAMMAD AHD, aka Frank Zhang, GHULAM IWANI, and others known and unknown to the Grand Jury, did knowingly and intentionally agree and conspire. to: a. use a facility 1n interstate and foreign commerce, namely the wires, with the intent to promote, manage establish, carry on and facilitate the promotion, UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 9 - 1 70: STEWARJISTREET, $11331?!? BATTLE, ASHINGTON CR17-0290RSL - (206) 553-7970 l?ll?lI-dl-I-i {Blur-?CD p?n 43 Case Document 17 Filed 03/01/18 Page 10 of 21 management, establishment and carrying on of an unlawful activity, that is, Commercial Bribery, in Violation of the Revised Code of Washington Section 9A.68.060, and thereafter performed and attempted to perform an act to distribute the proceeds of such unlawful, activity, and to promote, manage, establish and carry on, and to facilitate the I promotion, management, establishment and carrying on of, such'unlawful activity in violation of Title 18, United States Code, Section 1952(a)(1) and b. knowingly and with intent to defraud, access a protected computer without authorization and exceed authorized access to a protected computer, and by means of such conduct further the intended fraud and obtain anything of value exceeding $5,000.00 in any 1-year period in violation of Title 18, United States Code, Sections 1030(a)(4) and and I 0 c. knowingly cause the transmission of a program, information, code, and command, and as a result of such conduct, intentionally cause damage withOut authoriZation toa protected computer, and the offense caused loss to 1 or more persons I during any 1-year period aggregating at least $5,000 in value and damage affecting 10 or more protected computers during a l?year period, inviolation of Title 18, United States Code, Sections 1030(a)(5)(A) and II. THE OBJECT OF THE. CONSPIRACY 44. The object of the conspiracy is set forth 1n Paragraph 15 of this Second Superseding Indictment and 1s re?alleged and incorporated as if fully set forth herein. Through their conduct, the conspirators caused damages to protected computers, including impairment" to the integrity and availability of data, programs, systems, and information, and caused losses to for the costs of responding to the offense, conducting damage assessments, restoring data, programs, systems and information and lost revenue during any 1-year period in excess of $5,000.00. UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 10 . . 700 STEWART STREET: SUITE 5220 . SEATTLE, WASHINGTON 98101 (206) 553?7970 1-?l i?A 1?a?100?? ON Ell -P DJ Case Document 17 Filed 03/01/18 Page 11 of 21 THE MANNER AND MEANS OF THE CONSPIRACY 45. The manner and means of the conspiracy are set forth in Paragraphs 16 through 41 of this Second Superseding Indictment and are re- -a11eged and incorporated as if fully set forth herein. I IV. OVERT ACTS 46. In furtherance of the conspiracy, and to achieve the objects thereof, defendants MUHAMMAD FAHD, GHULAM JIWANI and others known and unknown to the Grand Jury, did commit and cause to be committed, the following overt acts, at Bothell, within the Western District of Washington and elsewhereabout April 11, 2013, MUHAMMAD FAHD opened a Yahoo account with the email address unlockoutlet@ymail.com; I b. In or about April 2013, MUHAMMAD FAHD provided two insiders (CC-2 and CC-3) who were employed at in Bothell, Washington, with malware; I . c. In or about April 2013, each of those insiders (CC2 and CC-3) installed the malware on internal protected network; d. On or about April 15,2013, a co? conspirator wired bribe payments in the amount of $11, 000. 00 to each of the two insiders and CC- 3) from California to Marysville, Washington, 1 e. On or about November 12,2014, MUHAMMAD FAHD sent a WhatApp message to GHULAM JIWANI instructing him to send a 000 bribe by Western Union to one insider (CC-2) and a $1,000 bribe by Western Union to another insider - f. On or about November 25, 2014, MUHAMMAD FAHD sent a router to an insider Via Federal Express from Dubai, United Arab I Emirates, to Washington; I UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 11 - 700 STEWART STREET, SUITE 5220 CR17-0290RSL SEATTLE, WASHINGTON 98101 - (206) 553-7970 00 \1 ON a?n Case Document 17 Filed 03/01/18 Page 12 of 21 g. In or about November 2014, the insider (CC-2) provided a router Con?gured to provide unauthorized access to internal pretected network to another insider to install on network; h. On or about August 9, 2015, MUHAMMADVFAHD and GHULAM -, IWANI traveled to Dubai, United Arab Emirates, from Karachi, Pakistan, to meet an insider (CC-2) and to deliver'a bribe payment to him; i. On or about February 26, 2015, GHULAM HWANI traveled to Houston, Texas, to deliver a bribe for an insider (CC-5). All in violation of Title 18, United States Code, Section 371. COUNTS3-6 (Wire Fraud) 47. The allegations set forth in Counts and 2 of this Second Superseding Indictment are re-alleged and incorporated as if fully set forth herein. 1. THE SCHEME 48. Beginning at a date uncertain, but no later than April 2012, and continuing through in or about September 2017, at Bothell, within the Western District of Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM IWANI, and others known and unknown to the Grand Jury, devised and intended to devise a scheme to defraud Mobility LLC, and to obtain money and property by means of materially false and fraudulent pretenses, representations and promises. I II. THE MANNER AND MEANS OF THE SCHEME 49. The manner and means of the scheme are Set forth in Paragraphs .16 through 41 of this Second Superseding Indictment and are re-alleged and incorporated as if fully set forth herein. UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 12 . 7080 STEWARVESTREET, $353120 - BATTLE, ASHINGTON 0290RSL 7 (206)553-7970 Case Document 17 Filed 03/01/18 Page 13 of 21 EXECUTION OF THE SCHEME 50.- On or about the dates set forth below, at Bothell, within the Western District of Washington, and elsewhere, MUHAMMAD FAHD, GHULAM JIWAN I, and others known and unknown to the Grand Jury, having devised a scheme and arti?ce to I defraud, and to obtain money and property by means of materially false and fraudulent pretenses, representations, and promises, did knowingly transmit and cause to be transmitted writings, signs, signals, pictures, and sounds, for the purpose of executing such scheme, by means of wire communication in interstate and foreign commerce, - including the following transmissions, with each such transmission constituting a separate count of this Second Superseding Indictment. Email from an insider (CC-3) at Bothell, Washington, to MUHAMMAD FAHD, outside the. State of . MUHAMMAD FAHD Washington, which then was GHULAM IWANI forwarded by MUHAMMAD- FAHD to GHULAM IWANI, reporting on the status of cellular telephone unlocks for a list cf cellular telephone IMEIs Email from MUHAMMAD FAHD from outside) the State of Washington, to an insider (CC-2) at Bothell, Washington, with attached malware and with instructions for installing the malware on computer system Western Union transfer of $4,052 from outside the State of 3_ April 6, 2013 4 April 19,2013 MUHAMMAD FAHD MUHAMMAD FAHD 5 . - . . November 13, 2014 GHUL AM JIWANI Washington to 4 - to pay a brlbe to an insider (CC-2). UNITED STATES ATTORNEY SECOND ET - 13 700 STEWART STREET, SUITE 5220 CR17-0290RSL SEATTLE, WASHINGTON 98101 (206) 553?7970 00 P-d Case Document 17 Filed 03/01/18 Page 14 of 21 E?mail from an msrder (CC-5) at Bothell, Washington, to MUHAMMAD FAHD, 6 January 8, 2015 MUHAMMAD FAHD outside the State of - Washington, containing photographs of the insider?s work computer screen All in Violation of Title .18, United States Code, Sections 1343 and 2. 9.92311 (Accessing a Protected Computer in Furtherance of Fraud) 51. The. allegations set forth in Counts I through 6 of this Second Superseding Indictment are re?alleged and incorporated as if fully set forth herein. 52. Beginning at a date uncertain, but no later than in or about April 2013, and continuing until in or around October 2013, at Bothell, Within the Western District of Washington and elseWhere, MUHAMMAD FAHD, aka Frank Zhang, and others known 1 and unknown to the Grand Jury, knowingly and with intent to defraud accessed protected computers without authorization. and exceeded authorized access and by means of such I conduct fUrthered the intended fraud and Obtained something of Value, speci?cally, the defendant and others downloaded and installed malware onto Mobility protected computers and executed the malware programs designed to facilitate fraudulent and unauthorized unlocking transactions on Mobility Wireless network and by means of such conduct furthered the-intended fraud and obtained things of value I exceeding $5,000.00 in any l-year period. All in violation of Title 18, United States Code, Sections 1030(a)(4) and and 2. I UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 14 700 STEWART 5220 - - SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 17 Filed 03/01/18 Page 15 of 21 . COUNTS (Intentional Damage to a Protected Computer) 53. The allegations set forth in Counts 1 through 7 of this Second Superseding Indictment are re-alleged and incorporated as if fully set forth herein. I 54. Beginning at a date uncertain, but no later than in or about April 2013, and continuing until in or around October 2013, at Bothell, within the Western District of Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others known and unlmown to the Grand Jury, knowingly caused the transmission of a program, information,icode, and command, speci?cally malicious code that was downloaded and installed on Mobility protected computers Without Mobility knowledge or consent, and as a result of such conduct, intentionally caused damage without authorization to protected computers, which damage caused losses to 1 or more persons during any 1-year period of at least $5,000.00 and affected 10 or more protected . computers during a 1 year period. All 1n violation of Title 18, United States Code, Sections 1030(a)(5)(A) and and 2. COUNT 9 I (Accessing a Protected Computer in Furtherance of Fraud) 55. The allegations set forth in Counts 1 through 8 of this Second SuperSeding Indictment are re?alleged and incorporated as if fully set forth herein. I 56. Beginning at a date uncertain, but no later. than in or about Noyember 2014, and continuing until in or around September 2017, at Bothell, within the Western District of Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others known and unknown to the Grand Jury, knowingly andwith intent to defraud accessed protected computers without authorization and exceeded authorized access and by means - of such conduct furthered the intended fraud and obtained something of value, specifically, the defendant and others installed malware and unauthorized hardware onto UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. 15 7 700 STEWART STREET: SWTE 5220 CR1 7-0290RSL - SEATTLE, WASHINGTON 98101 (206) 553-7970 NHCD OO 4} DJ HO 00 \10\ 1 La) Case Document 17 Filed 03/01/18 Page 16 of 21 Mobility protected computers designed to facilitate fraudulent and unauthorized unlocking transactions on Mobility 3 wireless network and by means of such conduct furthered the intended fraud and obtained things of value exceeding $5,000.00 in any 1-year period. All in violation of Title 18, United States Code, Sections 1030(a)(4) and and 2. i . onus?Tm . (Intentional Damage to a Protected Computer) 57. The allegations set forth in Counts 1 through 9 of this second Superseding Indictment are re?alleged and incorporated as if fully set forth herein. 7 58. I Beginning at a date uncertain, but no later than in or around November 2014, and continuing until in or around September 2017, at Bothell, Within the Western District of Washington and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, and others known and unknown to the Grand Jury, knowingly caused the transmission of a program, information, code, and command, through malware and unauthorized hardware that was installed on Mobility protected computers without Mobility knowledge or consent, and as a result of such conduct, intentionally caused damage without authorization to protected computers, which damage caused losses to 1 or more persons during any l?year-period of at least $5,000.00 and affected 10 or more protected computers during a 1 year period. All in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and and 2. UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 16 700 STEWART 5220 SEATTLE, WASHINGTON 98101 (206)553-7970 Case Document 17 Filed 03/01/18 Page 17 of 21 COUNTS 11-14 (Travel Act) 59. The allegations set forth in Counts 1 through 10 of this Second Superseding Indictment are re-alleged and incorporated as if fully set forth herein. 60. On or about the dates below, at Bothell, within the Western District Of Washington, and elsewhere, MUHAMMAD FAHD, aka Frank Zhang, GHULAM .JIWANI, and others known and unknown to the Grand Jury, used a facility in interstate andforeign commerce with the intent to distribute the proceeds, and to promote, manage, establish, carry on and facilitate the promotion, management, establishment and carrying" on, of an unlawful activity, that is:_ Commercial Bribery in violation of Revised Code of Washington Section 9A.68.060, and thereafter performed and attempted to perform an act to distribute the proceeds, and to promote, manage, establish and carry on and facilitate the promotion, management, establishment and carrying on, of such unlawful activity. Payment of $11,000, by wire transfer, from an account outside the State of Washington 11 April 15, 2013 MUHAMMAD FAHD to an account at Chase Bank within. the State of Washington to pay a bribe to an insider (CC-3) Payment of $4,052 by Western Union, from outside the State of MUHAMMAD FAHD, Washington, to an GHULAM JIWANT insider (CC-2) in . Washington, to pay a bribe to that insider . . Payment of $948 by. Western Union, from outside the State of MUHAMMAD FAHD Washington, to an GHULAM IWANI in Everett, Washington, to pay a bribe to that insider 12- November 13, 2014 13 . November13, 2014 UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 17 - 700 STEWART STREET, SUITE 5220' CR17-0290RSL . SEATTLE, WASHINGTON 98101 - (206) 553-7970 ooqmm-meHO?wooumm-waa?KO Case Document 17 Filed 03/01/18 Page 18 of 21 Purchase of tlcket for ?lght by an insider (CC-2), and Subsequent ?ight by that MUHAMMAD FAHD insider, by commercial airline GHULAM IWANI I from SeaTac, Washington, to 7 Dubai, United Arab Emirates, to meet MUHAMMAD FAHD, and GHULAM IWANI 14 August 10, 2015 All in'violation of Title 18, United States Code, Sections 1952(a)(1) and (3), and 2. FORFEITURE ALLEGATIONS 61. The allegations contained in Counts 1 through 14 of this Second Superseding Indictment are hereby re?alleged and incorporated by reference for the purpose of alleging forfeitures pursuant to Title 18, United States Code, Section Title 28, United States Code, Section 2461(c), Title 18, United States Code, Section and Title 18, United States Cede, Section 1030(i). 62. Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), upon conviction of a conspiracyto violate Title 18,1 United States Code, Section 1349, as set forth in Count 1, of avio1ation of Title 18 United States-Code, Section 1343, as set forth in Counts 3 thrOugh 6, the defendants shall forfeit to the United States of America, any property, real or personal, which constitutes or is derived from proceeds traceable to the charged offense. The property to be forfeited includes, but is not limited to, a sum of money representing the amount of proceeds the defendant obtained as a result of the charged offense. 63. Pursuant to Title 18, United States. Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), upon conviction of a conspiracy to violate Title 18, United States Code, Sections 1030(a)(4) and and Title 18, United States Code, Sections 1030(a)(5)(A) and in violation of Title 18, United States Code, UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL.- 18 700 STEWART STREET SUITE 5220 CR17 0290RSL SEATTLE, WASHENGTON 98101 (206) 553-7970 Case Document 17 Filed 03/01/18 Page 19 of 21 Section 371, as set forth in Count 2, the defendants shall forfeit to the United States of America any property, real or personal, which constitutes or is deriVed from proceeds traceable to the charged offense, and any personal property that was used or intended to be used to commit or to facilitate the commission of such offense. The property to be forfeited includes, but is not limited to, the following: a sum of money representing the amount of proceeds the defendant obtained as a result of the charged offense. 64. Pursuant to Title 1 8, United States Code, Section and Title 18, United States Code, Section. 1030(1), upon conviction of a violation of Title 18, United States Code, Sections 1030(a)(4) and as set forth in Counts 7 and 9, the defendant shall forfeit to the United States of America any property, real or persOnal, which" constitutes or is derived from proceeds traceable to the charged offense, and any personal property that was used or intended to be used to commit or to facilitate the commission of such offense. The property to be forfeited includes, but is not limited .to, the following: a sum of money representing the amount of proceeds the defendant I obtained as a result of the charged offense. 1 i 65. Pursuant to Title 18, United State-s Code, Section and Title 18, United States Code, Section 1030(i) upon conviction of a violation of Title 18, United States Code, Sections 1030(a)(5)(A) and as set forth in Counts 8' and 10, the defendant shall forfeit to the United States of America any property, real or personal, which constitutes or is derived from proceeds traceable to the charged offense; The property to be forfeited includes, but is not limited to, the following: a sum of money representing the amount of proCeeds the defendant obtained as a result of the charged offense. 66. Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States-Code, Section 2461(0), upon conviction of a Travel Act violation, in violation of Title 18, United States Code, Section 1) and (3), as set forth in Counts 11 through 14, the defendants shall forfeit to the United States of America any prOperty, real or personal, which constitutes or is derived from proceeds traceable to the UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. 19 .700 STEWART SUITE 5220 CR 1 7-0290RSL SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 17 Filed 03/01/18 Page 20 'of 21 charged offense. The property to be forfeited includes, but is not limited to, the following: a sum of money representing the amount of proceeds the defendant obtained as a result of the charged offense. 67. If any of the property described above, as a result of any act or omission of the defendants: a. cannot be located upon the exercise of due diligence; b. has been transferred 0r sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or c. has been commingled with other property which cannot be divided Without dif?culty, the United States of America shall be entitled to? UNITED STATES ATTORNEY SECOND SUPERSEDING ET AL. - 20 - 700 STEWART STREET, SUITE 5220 CR17-0290RSL SEATTLE, WASHINGTON 98101 (206) 553-7970 t?al?ti?Ir?ii?a . ax Case Document 17 Filed 03/01/18 Page 21 of 21 forfeiture of substitute property pursuant to Title '21, United States Code, Section 853(p), as incorporated by Title 28, United States I Code, Section 2461(c). A TRUE BILL: DATED: 7-01? (Signature of Foreperson redacted pursuant to the policy of the Judicial Conference) FOREPERSON so?, aw NNETTE L. HAYES nited States A ?orne ANDREW c. FRIEDMAN Assistant United States Attorney N18 FRANZE-N KAMURA Assi nt United State Attorney ANDREW S. PAK Trial Attorney Computer Crimes and Intellectual Property Section SECOND SUPERSEDING ET AL. 21 CR17-0290RSL - UNITED STATES ATTORNEY 700 STEWART STREET, 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970