z 91(Rev. 11/11) Criminal Ccnq>Iaint United States District Court fortiie ' / I^orthem District of California / AU6 -9 2019 SUSAN Y. SOONQ aERK,U.S. DISTRICT COURT United States ofAmerica mm DISTRICT OF CALIFOF^;^ V. 3 Case No. Shariq HASHME 13 1 Defemlantfs) CRIMINAL COMPLAINT 1,the complainant in this case,state tiiat&e following is true to the best of my knowledge and belief. Onorabout thedate(s) of Febmary 26,2019to July 11,2019 inthecounty of Northern Districtof CaHfomla San Francisco inthe , the defendant(s) violated: OffenseDescription Code Section 18 U.S.C. §§ 1030(a)(5)(A), (c)(4) (B)(1), and (c)(4)(A)(l)(l) Intentional Damage to a Protected Computer Maximum 10 years terni of Imprisonment; maximum fine of $250,000; maximum term of supervised release of 3year^; mandatory $100 sp^al assessment This ciiminal complaint is based on these facts: See attached affidavit of Special Agent Robbie J. Robertson of the Federal Bureau of Investlgatlon fif Continued onthe attached sheet i/a/non/ 's signature Approved as to form • AUSAEric Robbie J. Rotaertson, FBI Special Agent Printed name and title Swom to before me and signed in my presence. Date: City and state: ^ ^'2p\ San Francisco, California Judge's Hon. Elizabeth D. Laporte, U.S. Magistrate Judg« Prin ted name and title AFFIDAVIT OF FBI SPECIAL AGENT ROBBIE J. ROBERTSON IN SUPPORT OF A CRIMINAL COMPLAINT 1, Robbie J. Robertson, Special Agent of the Federal Bureau of investigation being duly sworn, hereby declare as follows: AGENT BACKGROUND AND BASES FOR STATEMENTS 1. I am a Special Agent with the FBI assigned to investigate cyber-crime, and have been so employed since September 2017. My training included attending FBI new agent basic training during which I received instruction on various aspects of federal investigations. Since May 2019, I have been assigned to investigate high technology and cyber-crime and have been involved in investigations of alleged computer-related and intellectual property offenses, including computer intrusions, traf?cking in counterfeit goods, wire fraud, internet extortion, and other criminal matters. As an FBI agent, I am authorized to investigate violations of United States law and am a law enforcement of?cer with the authority to exectyite warrants issued under the authority of the United States. Prior to my current position as a Sp cial Agent with the FBI, I obtained a Bachelor of Science degree in Information Technology. Du 'ng my career as a Special Agent of the FBI, I have received training and possess actual perience relating to federal criminal procedures and federal statutes. I have also received 3 ecialized training and instruction in the ?eld of investigation in computer-related crimes. I have had the opportunity to conduct, coordinate, and participate in numerous investigations relating, to computer-related crimes. I have participated in the execution of numerous search warrants and arrest warrants conducted by the FBI. 2. The statements contained in this af?davit are based, in part, on my training, years of investigative experience, and my personal participation in this investigation. The statements contained in this af?davit are sometimes based on information provided by other FBI Special Agents, other government agencies, as well as information derived fronj interviews of victim companies. 3. Because this af?davit is submitted for the limited purpose of securing an arrest warrant, I have not included each and every fact known to me that supports probable cause. This af?davit does not purport to set forth all of my knowledge of, or investigation into, this matter. I have summarized information, including information received from law enforcement agents and of?cers, documents, and records. I have set forth those facts that I believe are suf?cient to support the issuance of the requested arrest warrant. I am not relying on facts not set forth herein to support my conclusionthe agents participating in the investigation ?f Shariq Hashme for offenses relating to the unauthorized access and damage to computers belonging to Company A, a San Francisco, California-based data analySis company. 5. As part of that ongoing FBI investigation, I make this af idavit in support of an application by the United States of America for a complaint and arrest warrant for HASHME. 6. As set forth herein, there is probable cause to believe that HASHME knowingly caused the transmission of a program, information, code, and command, and as a result of such conduct, intentionally caused damage without authorization, to a protected computer, and thereby caused loss to one or more persons during a one-year period affecting protected computers aggregating at least $5,000 in value, in violation of Title 18,.United States Code, Sections 1030(a)(5)(A) and APPLICABLE STATUTES 7. Under Title 18, United States Code, Section 1030(a)(5)(A), it is unlaw?Jl for an individual to ?knowingly cause[] the transmission of a program, information, code, or command, I and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.? A protected computer is a computer that is used in or affecting interstate or foreign commerce. See 18 U.S.C. 1030(e)(2)(B). The term ?damage? means Tny impairment to the integrity or availability of data, a program, a system, or information. See 18 U.S.C. 1030(e)(8). 8. Under Title 18, United States Code Sections and the penalty for a violation of 18 U.S.C. 1030(a)(5)(A) is a ?ne and imprisonment of not more than ten years if the offense caused loss to 1 orlmore persons during any 1-year period aggregating at least $5,000 in value; (ii) the modi?cation or impairment or potential modi?cation or impairment, of the medical examination, diagnosis, treatment, or care of or more individuals; physical injury to any person; (iv) a threat to public health or safety; damage affecting a computer used by or for an entity of the United Stat+s Government in furtherance of the administration of justice, national defense, or national security; or (vi) damage affecting 10 or more protected computers during any l-year period. FACTS SUPPORTING PROBABLE CAUSE Summary 9. Beginning at least as early as on or about February 26, 2:019, continuing through and including on or about July 11, 2019, Shariq HASHME repeatedly Tmected to and caused transmissions to Company A?s internal payment database to surreptitioUsly alter its data and contents without authorization in order to divert at least approximately $40,000 in payments to accounts controlled by HASHME. 10. who was employed as an engineer at Compa?iiy A, is an individual that resided in 2019 in San Francisco, California before on or about April If, 2019, and outside the United States a?er on or about that date. HASHME worked for Company A as an employee then later as a non-employee contractor during this time. Background of Investigation 11. Company A is a San Francisco, California-based data analysis company. 12. PayPal is a web-based ?nancial services provider based iL Mountain View, California. 13. On May 8, 2019, representatives of Company A contacted the San Francisco Division of the FBI to report a criminal cyber incident. According to representatives of the company, they discovered their internal payment database, contained ithheir back-end computer network infrastructure, had been compromised in late April 2019. J: 15. Company A reported that during this cyber incident, an ndividual connected ?to its internal payment database and altered payments that were originally directed to legitimate employees to divert them to a PayPal account linked to ?Bruno.Day.19 8@outlook.com?