Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 1 of 13 1 2 3 4 5 6 7 8 9 10 UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE 11 12 Plaintiff 13 14 NO. MJ19-0344 UNITED STATES OF AMERICA, UNITED STATES’ MEMORANDUM IN SUPPORT OF MOTION FOR DETENTION v. 15 16 17 PAIGE A. THOMPSON, Defendant. 18 19 The United States of America, by and through Brian T. Moran, United States 20 Attorney for the Western District of Washington, and Andrew C. Friedman and Steven T. 21 Masada, Assistant United States Attorneys for said District, files this memorandum in 22 support of its motion to detain Defendant Paige A. Thompson pending resolution of this 23 criminal matter. 24 25 I. INTRODUCTION On July 29, 2019, Defendant Paige A. Thompson, also known by the online alias 26 “erratic,” was arrested based on evidence that she had hacked into servers rented or 27 contracted by Capital One Financial Corporation (“Capital One”) from a cloud 28 computing company. The same day, she made her initial appearance in this Court, charged by complaint with Computer Fraud and Abuse, in violation of Title 18, United MEMORANDUM IN SUPPORT OF DETENTION - 1 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 2 of 13 1 States Code, Section 1030(a)(2). The United States filed a motion for pretrial detention. 2 That hearing, at the defense’s request, was continued until August 15, 2019. 3 The government understands that the United States Probation and Pretrial Services 4 Office (“Pretrial Services”) is recommending that Thompson be detained. The 5 government agrees with this recommendation. Thompson has a long history of 6 threatening behavior that includes repeated threats to kill others, to kill herself, and to 7 commit suicide by cop. Thompson’s threats have resulted in multiple calls to law 8 enforcement, and the entry of protection orders against Thompson. Thompson’s crime in 9 this case – major cyber intrusions that resulted in the theft of massive amounts of data 10 from what now appears to be more than 30 victim companies – only exacerbates the harm 11 that Thompson has done, and the threat she would pose if released. As a result, the Court 12 should order Thompson detained, both as a danger to the community, and as a risk of 13 non-appearance. 14 15 16 II. BACKGROUND A. Thompson’s Background Thompson has a long history of threatening and violent behavior – including 17 threats to kill others and herself, and to commit suicide by cop – that has resulted in 18 multiple calls to law enforcement, and the entry of protection orders against Thompson. 19 20 21 22 23 24 25 26 27  In October 2018, two individuals, a couple, sought protection orders against Thompson. As set forth in a police report and their petitions, attached as Exhibits 1, 2, and 3, Thompson harassed and stalked the couple over the course of seven years (from 2011 through 2018). The harassment, which included leaving notes and personal items at the petitioners’ residence, repeatedly contacting them through social media (including through newly-created accounts after the victims blocked earlier accounts), and sending what the victims felt were threatening text messages and emails, was so severe that it contributed to the couple moving. The King County District Court entered protection orders, attached as Exhibit 4 and 5, in favor of both the wife and husband, each for a term of five years, with the possibility of renewal for an additional term. 28 MEMORANDUM IN SUPPORT OF DETENTION - 2 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 3 of 13 1 2 3 4 5 6 7 8 9 10 11 12 13 14  In March 2019, police were called to Thompson’s residence after Thompson became violent with her housemates. According to the police report, attached as Exhibit 6, Thompson had become agitated. When a housemate tried to intervene, Thompson tried to strike the housemate. Notably, Thompson’s housemates reported that Thompson had threatened to retrieve a fake gun in the house and use it to commit “suicide by cop.” Thompson’s housemates also stated that Thompson had a history during the entire time that she lived at the house of getting “incredibly angry at a moment’s notice and becom[ing] destructive to property and assaultive” to others.  And, perhaps most concerning, in May 2019, police were called to Thompson’s residence after Thompson contacted an acquaintance at a California technology office, and threatened to travel to the company’s campus in California and to “shoot up” the office. According to the police report, attached as Exhibit 7, Thompson made this threat in a string of messages that concerned the friend enough that he reported it to the police. Significantly, at the time that she made this threat, Thompson had access to the weapons to commit such an act through her housemate – namely, the arsenal of assault rifles and other guns of her roommate, Park Quan (discussed further below). 15 16 17 18 19 Thompson’s threats have continued, on social media in recent months. For example, in June 2019, Thompson conveyed her readiness to “check the f-ck out,” and said that she had “nothing to lose,” but that she was “taking [her] time to pick off a few that deserve to go down”: 20 21 22 23 24 25 26 27 28 MEMORANDUM IN SUPPORT OF DETENTION - 3 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 4 of 13 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Thompson also recently has threatened people who call law enforcement about her, as 18 well as threatened to kill officers who respond to such calls: 19 20 21 22 23 24 25 26 27 In addition to this history of threats – and, perhaps, explaining in part the threats – 28 Thompson appears to have significant mental-health issues. According to one of the MEMORANDUM IN SUPPORT OF DETENTION - 4 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 5 of 13 1 victims of Thompson’s harassment, Thompson has longstanding mental-health issues. 2 See Exhibit 1. Indeed, Thompson herself has told others that she takes psychiatric 3 medications. See Exhibit 7. 4 Thompson also has been unemployed since 2016, has no known employment 5 prospects if released, and, according to Thompson’s housemates, is not welcome back at 6 her residence. 7 8 9 B. Thompson’s Crime 1. Thompson’s Theft of Capital One’s Data Thompson is charged with committing a massive data theft. Thompson was 10 arrested for, and currently is charged with, intruding into servers rented or contracted by 11 Capital One, and with stealing huge volumes of data from those servers. According to 12 Capital One, Thompson stole information in credit card applications of approximately 13 106 million people. Although some of the information (such as most Social Security 14 numbers) was encrypted, other information, such as applicants’ names, addresses, dates 15 of birth, and information about their credit history was not encrypted. Moreover, the data 16 included unencrypted Social Security Numbers and bank account numbers for smaller 17 numbers of customers (estimated at 120,000 of the former, and 77,000 of the latter, as of 18 the date of Thompson’s arrest). 19 The evidence that Thompson committed this crime is overwhelming. It includes 20 forensic evidence linking Thompson to the data theft, which resulted in this Court’s 21 issuance of a warrant to search Thompson’s residence. It includes the fact that the 22 government recovered data stolen from Capital One on a server recovered from 23 Thompson’s bedroom. And, it includes the fact that Thompson admitted to agents on the 24 morning of the search that she had committed this intrusion. 25 Thompson’s crime has done massive harm to Capital One. Capital One already is 26 the subject of 40 lawsuits in the United States, and eight more lawsuits in Canada. 27 Capital One has announced that it expects the incident to result in costs of between $100 28 and 150 million in 2019. See https://www.wsj.com/articles/capital-one-reports-dataMEMORANDUM IN SUPPORT OF DETENTION - 5 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 6 of 13 1 breach-11564443355 (dated July 30, 2019). (According to some estimates, the company 2 might ultimately face significantly more exposure. See, e.g., 3 https://fortune.com/2019/07/31/capital-one-data-breach-2019-paige-thompson-settlement 4 (dated July 31, 2019) (estimating costs of up to $500 million).) And, the company’s 5 stock price has dropped approximately 10% since the breach was announced, erasing 6 billions of dollars from the company’s market capitalization. 7 8 2. Thompson’s Theft of Other Company’s Data The government’s investigation over the last two weeks has revealed that 9 Thompson’s theft of Capital One’s data was only one part of her criminal conduct. The 10 servers seized from Thompson’s bedroom during the search of Thompson’s residence, 11 include not only data stolen from Capital One, but also multiple terabytes of data stolen 12 by Thompson from more than 30 other companies, educational institutions, and other 13 entities. That data varies significantly in both type and amount. For example, much of 14 the data appears not to be data containing personal identifying information. At this point, 15 however, the government is continuing to work to identify specific entities from which 16 data was stolen, as well as the type of data stolen from each entity. The government 17 expects to add an additional charge against Thompson based upon each such theft of data, 18 as the victims are identified and notified. 19 The government notes that Thompson has represented that she neither sold, nor 20 otherwise shared or disseminated any of the data that she stole (from Capital One or any 21 other victim), and that the copy of the data that the government recovered during the 22 search of Thompson’s residence is the only copy of the stolen data that she created. It is 23 too early to confirm that this is the case. The government is continuing its investigation, 24 which will take a significant amount of time and resources, given the immense amount of 25 forensic evidence to review. To date, however, the government has not uncovered any 26 evidence that would suggest Thompson’s statement that she neither sold, nor otherwise 27 disseminated, any of the data beyond the servers that the government recovered is untrue. 28 MEMORANDUM IN SUPPORT OF DETENTION - 6 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 7 of 13 1 3. Other Evidence Recovered from Thompson’s Residence. 2 Although Thompson’s residence originally was searched pursuant to a warrant 3 seeking evidence of Thompson’s cybercrimes, during the course of searching the 4 residence, agents found additional evidence relevant to the issue of Thompson’s 5 detention. Specifically, within the bedroom of Thompson’s roommate, Park Quan, 6 agents observed what can fairly be described as an arsenal of weapons, ammunition, and 7 explosive material, largely unsecured and accessible to his housemates, including 8 Thompson. Because Quan is a convicted felon, and not allowed to possess firearms, 9 agents obtained a follow-on search warrant to seize firearms and related items. 10 Pursuant to that warrant, agents seized 14 firearms, including assault rifles, a 11 sniper rifle, and hand guns. Some of the guns were loaded, including one with a high12 capacity magazine. At least one appears to be short-barreled. Also recovered were two 13 bump stocks, which are designed to be attached to semiautomatic firearms in place of 14 conventional stocks, enabling them to fire bullets more rapidly, mimicking a fully15 automatic weapon, two 37 mm “flare launchers,” which can be used to shoot a variety of 16 projectiles, and multiple high-capacity magazines. The fact that all of these weapons 17 were recovered in the bedroom adjacent to Thompson, most of them readily accessible to 18 her, is obviously of concern, given Thompson’s recurrent threats to commit violence 19 against herself and others. 20 21 III. DISCUSSION Thompson poses both a significant danger to the community and a risk of 22 nonappearance. Pretrial Services has indicated that it will recommend detention for 23 Thompson. The government agrees Thompson should be detained. 24 25 A. The Legal Standard 18 U.S.C. § 3142(f)(2)(A) provides that the court shall “hold a hearing to 26 determine whether any condition or combination of conditions . . . will reasonably assure 27 the appearance of [a defendant] and the safety of any other person and the community” 28 upon motion of the government in any “case that involves . . . a serious risk that such MEMORANDUM IN SUPPORT OF DETENTION - 7 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 8 of 13 1 person will flee.” If Thompson were released, there is a serious risk that she would fail to 2 appear for future proceedings, both because she might flee, and because she might follow 3 through on her repeated threats to harm herself (particularly now that she is facing 4 criminal prosecution and a substantial term of imprisonment). 5 6 7 8 9 At a detention hearing, 18 U.S.C. § 3142(g) provides that the court shall . . . take into account (1) the nature and circumstances of the offense charged; (2) the weight of the evidence against the person; (3) the history and characteristics of the person . . . and (4) the nature and seriousness of the danger to any person or the community that would be posed by the person’s release . . . . 10 11 12 B. Thompson Should be Detained as a Danger Each and every one of § 3142(g) factors counsels strongly for detention in 13 Thompson’s case. First, the nature and circumstances of the offense with which 14 Thompson is charged are tremendously serious. Thompson is charged with committing 15 one of the largest cyber intrusions and data thefts in history. (Although the Equifax 16 breach reportedly involved the theft of personal information of approximately 143 17 million people, Thompson’s intrusion dwarfs most other famous breaches. For instance, 18 the Target breach involved personal information of only approximately 41 million 19 people.) According to Capital One, Thompson’s intrusion involved the theft of 20 information of approximately 106 million customers. The threat or harm to those 21 individuals is massive. 22 And Capital One is only of the victims of Thompson’s criminal conduct. As noted 23 above, the evidence recovered from Thompson’s residence suggests that Thompson 24 intruded into servers operated, rented, or contracted by over 30 companies, educational 25 institutions, and other entities. Although not all of those intrusions involved the theft of 26 personal identifying information, it appears likely that a number of the intrusions did. 27 Moreover, even if it is true that the government recovered all of the stolen data, 28 the impact of Thompson’s crime will be immense. Capital One alone already has been MEMORANDUM IN SUPPORT OF DETENTION - 8 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 9 of 13 1 sued in 48 separate cases, has estimated that it will incur $100 to $150 million of 2 additional costs in 2019, and presumably will incur even higher costs before the 3 consequences of Thompson’s actions are fully resolved. Presumably, many of the other 4 victims of Thompson’s intrusions and thefts also will incur substantial costs. 5 Second, the weight of the evidence is overwhelming. Thompson openly boasted 6 about her exploits on various social media forums. 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Data that Thompson stole from Capital One, and other victims, was recovered from a server in Thompson’s bedroom. And, in a post-arrest statement, Thompson admitted to the data intrusion and theft of data from entities, including Capital One. Third, Thompson’s history and characteristics further weigh in favor of detention. Thompson has a long history of threats to kill others, to kill herself, and to commit suicide by cop. The threats are serious enough that they have resulted in multiple calls to law enforcement and restraining orders. The threats likely are related to, and intertwined with, what appears to be a significant history of mental health problems. In addition, Thompson lacks both a residence to which she could be released and employment to provide her structure and stability. Finally, Thompson’s release would pose an extremely serious danger to the community. It would pose such a danger on multiple levels. First, Thompson would pose a danger of violence. After repeated threats to kill others or herself, or to commit suicide by cop, Thompson clearly poses a physical danger. In today’s America, it is easy enough to obtain firearms, and there is every reason to be concerned that Thompson, who MEMORANDUM IN SUPPORT OF DETENTION - 9 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 10 of 13 1 repeatedly has threatened to kill, would obtain the means to carry out, and carry out, her 2 threats – particularly when confronted with the alternative of near-certain conviction and 3 imprisonment. 4 Second, Thompson would pose a technological danger. Thompson’s conduct 5 already almost certainly has caused hundreds of millions of dollars of damage. If 6 Thompson were released, if she does in fact have another copy of the stolen data, 7 Thompson could sell or disseminate it. And, even if she does not have another copy, 8 Thompson’s technical sophistication means that she could commit additional cyber 9 intrusions, thereby likely causing additional hundreds of millions of dollars of damage. 10 Both risks are of particular concern given Thompson’s instability. Regardless of what 11 Thompson might promise the Court, she previously has threatened to disseminate stolen 12 data containing tens of millions of people’s personal identifying information. See, e.g., 13 Twitter Post on page 9 (threatening to “distribute [Capital One’s] buckets”). There are no 14 reasonable assurances that she would not follow through on such a threat in the future. 15 The government presumes that Thompson’s counsel will argue that, if released, 16 Thompson would be under appropriate mental-health care, thereby mitigating the risk of 17 releasing Thompson. But, Thompson’s mental-health conditions are long-standing and 18 well-known to Thompson. And Thompson made the threats and committed the crimes 19 that counsel against her release, even while apparently receiving mental-health treatment. 20 There is no reason to believe that any mental-health treatment that Thompson might 21 receive while on release would be any more effective in reducing the danger that 22 Thompson would pose than her prior treatment. 23 Simply put, if Thompson is released, there is every reason to believe that 24 Thompson would resort to threats, violence, or cybercrime. And, if Thompson were 25 inclined to resort to violence, or to conduct future cyber intrusions, no condition or 26 combination of conditions could adequately prevent her from doing so. 27 28 MEMORANDUM IN SUPPORT OF DETENTION - 10 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 11 of 13 1 C. Risk of Flight 2 In addition to being a danger, Thompson also poses a risk of nonappearance. She 3 has a history of mental-health issues and of severely erratic and bizarre (and often 4 violent) behavior, despite her participation in treatment programs. Thompson can offer 5 no sound rationale why she would fair differently under court-imposed conditions. 6 Indeed, Thompson now faces very serious charges, overwhelming evidence, and a 7 significant sentence. The immense added stress caused by her current circumstances 8 presumably will only serve to intensify the unpredictability of her future actions. 9 Moreover, the risk that Thompson would flee, or otherwise fail to appear, cannot 10 be adequately addressed by court-imposed conditions of release. As courts repeatedly 11 have recognized, electronic monitoring has many uses, but it does not prevent flight. See, 12 e.g., United States v. Townsend, 897 F.2d 989, 994-95 (9th Cir. 1990) (“Nor does the 13 wearing of an electronic device offer assurance against flight occurring before measures 14 can be taken to prevent a detected departure from the jurisdiction.”) And there is no way 15 of ensuring that Thompson, who repeatedly has threatened to kill herself (including, 16 tangentially, at her initial appearance), and who so far has offered no solution to address 17 her recent history of such threats, would not, in fact, harm herself. 18 Like danger to others and the community, these concerns of nonappearance are 19 further aggravated by Thompson’s lack of employment and stable residence. Put simply, 20 Thompson’s risk of nonappearance further counsels for detention. 21 // 22 // 23 // 24 25 26 27 28 MEMORANDUM IN SUPPORT OF DETENTION - 11 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 12 of 13 1 2 IV. CONCLUSION In short, every one of the § 3142(g) factors weighs heavily in favor of detention. 3 No conditions that the Court can impose adequately could protect the community or 4 ensure Thompson’s appearance at future proceedings. As a result, the Court should order 5 Thompson detained. 6 DATED this 13th day of August, 2019. 7 Respectfully submitted, 8 BRIAN T. MORAN United States Attorney 9 10 // s // Andrew C. Friedman // s // Steven T. Masada 11 12 ANDREW C. FRIEDMAN STEVEN T. MASADA Assistant United States Attorneys 13 14 15 United States Attorney’s Office, 700 Stewart Street, Suite 5220 Seattle, Washington 98101-1271 Telephone: (206) 553-7970 Facsimile: (206) 553-0882 E-mail: Andrew.Friedman@usdoj.gov Steven.Masada@usdoj.gov 16 17 18 19 20 21 22 23 24 25 26 27 28 MEMORANDUM IN SUPPORT OF DETENTION - 12 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:19-mj-00344-MAT Document 13 Filed 08/13/19 Page 13 of 13 1 CERTIFICATE OF SERVICE 2 3 I hereby certify that on August 13, 2019, I electronically filed the foregoing with 4 the Clerk of Court using the CM/ECF system which will send notification of such filing 5 to the attorney of record for the defendant. 6 7 // s // Andrew C. Friedman ANDREW C. FRIEDMAN Assistant United States Attorney 8 9 United States Attorney’s Office 700 Stewart, Suite 5220 Seattle, Washington 98101-1271 Telephone: (206) 553-2277 Facsimile: (206) 553-0882 E-mail: Andrew.Friedman@usdoj.gov 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MEMORANDUM IN SUPPORT OF DETENTION - 13 United States v. Paige A. Thompson, No. MJ19-0344 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970