Case Document 1 Filed 01/10/19 Page 1 of 14 Presented to the Court by the foreman of the Grand Jury in Open Court, in the presence of the Grand Jury and FILED in the US. DISTRICT COURT at Seattle, Washington. I0 ,7 20 "y Clerk M.M Deputy UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE UNITED STATES OF AMERICA, - NO.C 1 9 0 0 '7 Plaintiff, INDICTMENT v. HO JUN IA, a/k/a Matthew Ho, a/k/a ?Pre?nity,? a/k/a ?Ethereum Vendor,? Defendant. The Grand Jury charges that: 1. For purposes of this Indictment: a. The defendant, HO JUN JIA, also known as Matthew HO (hereinafter, is a resident and citizen of the Republic of Singapore. b. Amazon.com, Inc. (hereinafter, ?Amazon?_?) is an eleCtronic commerce, cloud computing, and consumer electronic device company headquartered in Seattle, Washington, within the Western District of Washington. 0. Amazon Web Services (hereinafter, is a subsidiary of Amazon that provides on?demand cloud computing platforms to individuals, companies Indictment - UNITED STATES ATTORNEY - United States v. H0 1 . 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553?7970 KCCase Document 1 Filed 01/10/19 Page 2 of 14 and governments, on a paid subscription basis. AWS provides subscribers with access to a variety of computing services and differing levels of storage and computing power through the Internet. AWS operates out of Seattle, Washington, within the Western District of Washington. (1. ?Victim-1? is a resident of the state of California and is the co- founder of a video game developer and eSports tournament organizer based in Los Angeles, California (hereinafter, - e. ?Victim-2? is a resident of the state of Texas. f. ?Victim-3? is a resident and citizen of a foreign country and believed to be the co?founder and an executive of a technology company in the Republic of India. g. Cloud Computing is the practice of using a network of remote servers hosted on the Internet, commonly referred to as ?the cloud,? to store, manage, and process data, rather than a local server or a personal computer. I h. is a digital currency or asset that employs or techniques to secure and verify the transfer of funds and to regulate the generation of additional units of currency. operate independently of a central bank system and typically work through distributed ledger technology, a public and decentralized ledger commonly referred to as a ?blockchain,? that serves as a public ?nancial transaction database. Examples of decentralized include Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), ansh (ZEC), Dash (DASH), Ripple (XRP), and Monero (XMR), among many others. i. mining is the process by which transactions are veri?ed and added to the public ledger, the blockchain, and also the means through which new units are generated and released. Generally speaking, transactions are veri?ed and assembled into ?blocks? through the creation of hashes that ful?ll certain requirements, which are then appended to the blockchain. Those that carry out the task of verifying ?blocks? of legitimate transactions, often referred to as ?miners,? are rewarded with an amount of that With the Indictment UNITED STATES ATTORNEY United States v. H0 2 70? STEWART STREET, SUITE 522? SEATTLE, WASHINGTON 98101 (206)553-7970 Case Document 1 Filed 01/10/19 Page 3 of 14 growth and increased prevalence and valuation of successful mining operations have required and. consumed increasingly large amounts of computing power and hardware. COUNTS 1 - 8 (Wire Fraud) A. Overview 2. The defendant, HO JUN JIA, a/k/a Matthew HO, operated a large-scale mining operation, propelled predominantly, if not exclusively, through fraud and identity theft. HO, a resident and citizen of Singapore, engaged in a sophisticated fraud scheme that involved the use of stolen personal and ?nancial information of individual victims, including U.S. citizens, and a web of fraudulently registered accounts at various online service providers, such as Amazon and AWS, to gain access to immense amounts of computer processing power and storage, which he used to mine various Through such mining activity, HO acquired such as Bitcoin and Ethereum, which he in turn sold and exchanged for traditional funds through online vendor websites. 3. More speci?cally, as discussed in more detail below, beginning in late 2017, which followed the surge in popularity of HO used victims? personal and stolen credit card information, along with phony email addresses, which he created, designed to spoof the authentic email account of identity-theft victims, to open accounts and to obtain access to cloud computing services. HO employed social engineering techniques to trick providers into approving heightened privileges and bene?ts, including elevated levels of cloud computing services and deferred billing . accommodations, and to de?ect inquiries from service providers regarding questionable data usage and mounting unpaid subscription balances. 4. For instance, in October and November 2017, H0 opened numerous accounts at Amazon (retail), AWS and Google Cloud Services in the name of Victim-l, a resident of California, using Victim-1?s personal information, including his name, Indictment - UNITED STATES ATTORNEY United States v. H0 3 - 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 4 of 14 address, and credit card information, along with a seemingly authentic email account and California state driver?s license. By associating with Victim-1?s company, Company-1, a legitimate and sizeable AWS customer, and through social engineered communications and additional deceptive tactics, HO gained access to a premium suite of cloud computing services and, for a brief period, was one of largest consumer of data usage by volume. 5. HO also created a ?ctitious individual to communicate with AWS ostensibly on Victim-1?s behalf, designed to legitimize the abnormm cloud computing usage. For instance, HO registered an online domain designed to spoof the name of another video game developer based in Los Altos, California (hereinafter, ?Company?2?) recently acquired by Company?1 (Victim-1?s company). Using that spoofed domain, HO then created an email account for a non-existent person, ?Daniel Piers,? which he used to communicate with AWS regarding billing issues and account maintenance ostensibly on Victim-1?s behalf. The exploitation of company?1 and Company-2 illustrates . sophistication and use of social engineering to perpetuate the fraud scheme. 6. HO used the fraudulently-created cloud services accounts and computing power and data storage primarily, if not exclusively, as part of a large-scale mining operation, which he supported through additional third-party services similarly acquired through fraud and the use of victim information. Through such mining activity, HO acquired to enrich himself. 7. HO registered and managed various accounts on marketplace websites, such as localbitcoinscom and localethereumcom. Through these sites, and using monikers, to include ?Pre?nity? and ?Ethereum HO sold and exchanged including Bitcoin and Ethereum obtained through the aforementioned mining activity, for traditional funds. HO also used social media, such as Facebook, to solicit interest in and to advertise the fluctuations in price and exploit the growing attention to and popularity of and virtual currency markets. Indictment UNITED STATES ATTORNEY United States H0 4 700 STEWART STREET, SUTTE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 5 of 14 8. In furtherance of the scheme, HO consumed more than $5 million in unpaid cloud computing services. Portions hundreds of thousands of dollars) of past due balances were charged to victim credit cards, some of which the accountholder paid before the fraud and compromise of the credit card account were discovered. B. Scheme and Arti?ce to Defraud 9. The allegations set forth in Paragraphs 1 through 8 of this Indictment are re-alleged and incorporated as if fully set forth herein. 10. Beginning at a time unknown, but no later than October 2017, and continuing until at least February 2018, at Seattle, within the Western District of Washington, and elsewhere, the defendant, HO JUN IA, a/k/a Matthew HO, and others known and unknown to the Grand Jury, devised and intended to devise a scheme and arti?ce to defraud and to obtain money and property by means of materially false and fraudulent pretenses, representations and promises. ll. 1 The essence of the scheme and arti?ce to defraud was to use stolen personal and ?nancial information to open accounts in the names of others, without authorization, in order to obtain things of value, including computing and data storage services. The scheme and arti?ce to defraud also involved the use of computing services to engage in a coordinated mining operation to generate units, a thing of value, which were then sold and exchanged for traditional government?issued currency. The object of the scheme and artifice to defraud, at bottom, was to achieve ?nancial enrichment through fraud and deception. C. Manner and Means 12. The manner and means of the scheme and arti?ce to defraud included the conduct described herein and the following: HO, either personally or through an accomplice, obtained personally identi?able information and ?nancial information belonging to others, including, but not limited to, Victim-l, Victim-2, and Victim?3, without their knowledge or permission. Indictment - UNITED STATES ATTORNEY United States v. H0 5 700 STEWART STREET, SUITE5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 6 of 14 b. HO created phony email accounts, typically at Google @grhailcom) or at unique domains that he registered and managed, designed to spoof authentic email accounts, including those of identity-theft Victims. The fake email accounts were intended and used, in conjunction with additional information, to deceive and to obtain services and items of value. By way of example, i. On about October 19, 2017, H0 created an email account in the name of Victim-1, namely, _@gmail.com, that incorporated Victim?1?s ?rst initial and full last name (hereinafter, the Email Account?). ii. On about November 18, 2017, H0 created an email account in the name of Victim-2, namely, _@gmail.com, that incorporated Victim- 2?s ?rst and last name (hereinafter, the Email Account?). I On about November 24, 2017, H0 created an email account in the name of Victim-3, namely, _@gmailcoin, that incorporated Victim-3?s ?rst and last name (hereinafter, the Email Account?). 0. HO used personal and ?nancial information of others to open multiple retail accounts at Amazon. HO then attempted to purchase things of value, including instrumentalities of the scheme, using victim credit cards and accumulated membership rewards points. By way of example, i. On about October 19, 2017, H0 opened an Amazon retail account in the name of Victim-1, using another email address incorporating Victim-1?s ?rst and last name at a domain HO registered and managed, namely, _@corestratos.com, and Victim-1?s American Express credit card information. On the same date, HO attempted to purchase computer-related items through this account, using Victim-1?s credit card. I ii. On about October 20, 2017, H0 opened another Amazon retail accOunt in the name of Victim-l, using the V1 Email Account, Victim-1?s credit card information, and the address of a property located in Santa Monica, California, Indictment UNITED STATES ATTORNEY United States v. H0 6 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553?7970 Case Document 1 Filed 01/10/19 Page 7 of 14 owned by Victim-1. On the same date, HO attempted to purchase a computer-related item through this account, using Victim-1?s credit card. On about November 4, 2017, H0 opened yet another Amazon retail account in the name of Victim- 1 again using the V1 Email Account and Victim-1?s- credit card information and Santa Monica, California address. On about November 6, 2017, H0 attempted to purchase a Bitcoin mining contract through this account, using Victim-1?s credit card. I d. HO used personal and ?nancial. information of others to open multiple accounts for cloud computing services at providers such as AWS and Google. HO, thrOugh use of social engineering and other deceptive tactics, sought elevated access and privileges related to data storage and usage. By way of example, i. On about November 1, 2017, HO opened a cloud services account with Google Cloud Services in the name of Victim?1, using the V1 Email Account and Victim-1?srcredit card information and Santa Monica, California address. ii. On about November 2, 2017, H0 opened a cloud services account with AWS in the name of Victim?1, using the V1 Email Account, Victim-1?s credit card information and Santa Monica, California address. On about November 4, 2017, as veri?cation for the AWS account opened in Victim-1?s name, HO submitted to AWS copies of an account statement for Victim-1?s credit card and a fake California driver?s license bearing Victim- l?s name and photograph. 1 iv. On November 20, 2017, HO, through use of the V1 Email Account, requested and obtained access for elevated privileges fOr the AWS account in Victim-1?s name. v. On about November 18, 2017, H0 opened a cloud services account with AWS in the name of Victim-2, using the V2 Email Account and Victim?2?s Visa credit card information and address in Haltom City, Texas. Indictment UNITED STATES ATTORNEY United States v. H0 7 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553?7970 Case Document 1 Filed 01/10/19 Page 8 of 14 vi. On about November '24, 2017, H0 opened a cloud services account with AWS in the name of Victim-3, using the V3 Email Account, Victim-3?s Visa credit card information, and an address in Singapore. Vii. On about November 29, 2017, as veri?cation for the AWSI account opened in Victim?3?s name, HO submitted to AWS a copy of a bank statement of another person. e. HO also secured services and contracts from third?party vendors in relation to mining activity. For instance, on about October 20, 2017, H0 registered an account with CCG Mining, a company that provides and blockchain consulting services, in Victim-1?s name and using the V1 Email Account. HO then used the account to acquire information and services related to the mining, marketing, and sale of all using Victim-1?s identity, in furtherance of his fraudulent scheme. f. HO used the fraudulently obtained computing power and data storage and related services obtained through the cloud service providers primarily, if not exclusively, to mine As a result, HO earned and acquired units of such as Bitcoin and Ethereum, which he transferred into wallets he maintained. g. HO registered domains and emails and created ?ctitious individuals to communicate with service providers ostensibly on the accountholderi?s behalf. For instance, on about January 18, 2018, H0 created a web domain designed to spoof Company-2 and an email account for ?Daniel Piers,? which he used to communicate with AWS representatives about a billing arrangement for the AWS account opened in the name of Victim?1. h. HO, without authorization, authorized and caused payments for goods and services on the victim credit cards. By way of example, i. Beginning on about November 4, 2017, and on numerous dates thereafter, at least 16 payments in varying amounts, totaling roughly $240,000, Indictment UNITED STATES ATTORNEY United States H0 8 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 9 of 14 were charged to Victim?1?s credit card toward the balance owed on the Google Cloud Services account opened in the name of Victim-1. Such payments to Google include, but are not limited to, two payments totaling $40,000 on about February 20, 2018; two payments totaling $40,000 on about February 21, 2018; and three attempted charges totaling $105,000 on about February 22, 2018. ii. On about December 3, 2017, a payment in the amount of $135,861.12 was charged to Victim-1?s credit card toward the balance owed on the AWS account opened in the name of Victim-1. i. HO advertised, sold, and exchanged such on various marketplace websites, such as localbitcoinscom and localethereum.com, in order to obtain traditional funds. To conceal his true identity, HO used online monikers, such as ?Pre?nity? and ?Ethereum Vendor,? reSpectively. j. HO also used social media and online services to solicit interest in and to advertise the ?uctuations in price and exploit the growing attention to and popularity of and virtual currency markets. For instance, on about December 8, 2017 HO pested on Facebook the message: levels are at all time low since march when ETH cost around $36. your move?? D. Execution of Scheme and Arti?ce to Defraud 13. On or about the dates set forth below, at Seattle, within the Western District of Washington, and elsewhere, the defendant, HO JUN IA, a/k/a Matthew HO, and others known and unknown to the Grand Jury, having devised a scheme and arti?ce to. defraud, and to obtain money. and property by means of materially false and fraudulent pretenses, representations, and promises, did knowingly transmit and cause to be transmitted writings, signs, signals, pictures, and sounds, for the purpose of executing such scheme, by means of wire communication in interstate and foreign commerce, including the following transmissions, each of which caused the transmission of an electronic signal between the state of Washington and a location outside of the state of Washington, and each of which constitutes a separate count of this Indictment: Indictment UNITED STATES ATTORNEY United States V. H0 9 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 r?A.i?a J?l r?I r?t i?n Case Document 1 Filed 01/10/19 Page 10 of 14 1 11/2/2017 Registration of AWS account in name of Victim-1 Submission of American Express credit card statement 2 11/4/2017 . . . . . and driver 5 license 1n the name of 3 11/18/2017 Registration of AWS account in name of Victim-2 4 11/20/2017 Communlcatlon w1th AWS regardmg cloud serv1ces privrleges for account 1n the name of 5 11/24/2017 Registration of AWS account in name of Victim?3 6 1 1 /3 0 /2017 Commumcation w1th AWS serVICe . for account in the name of Victlm-l Payment to AWS account in the name of Victim-1 7 . . . . 12/3/2017 charged to credlt card 8 1/18/2018 Generation and communication of payment - instructions for AWS account in the name of Victim-1 All in Violation of Title 18, United States Code, Sections 1343 and 2. . (Access Device Fraud) 14. The allegations set forth in Paragraphs 1 through 12 of this Indictment are re-alleged and incorporated as if fully set forth herein.- 15. On or about the dates set forth below, at Seattle, within the Western District of Washington, and elsewhere, the defendant, HO JUN IA, a/k/a Matthew HO, and others known and unknown to the Grand Jury, knowingly and with intent to defraud, used and traf?cked in an unauthorized access device, as described below, and other means of account access that can be used, alone and in conjunction with another access device, to obtain a thing of value, and by such conduct, obtained things of value worth $1,000 or more during a one-year period; said activity affecting interstate and foreign commerce. Indictment 1 UNITED STATES ATTORNEY United States v. H0 10 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 11 of 14 ?as 35:12-33. 9 1 0/19/201 7 VictIm-l credt card 1nforrnation to Amazon) 11 11/18/2017 11535? All in Violation of Title 18, United States Code, Sections 1029(a)(2) and and 2. (Aggravated Identity Theft) 16. The allegations set forth in Paragraphs 1 through 15 of this Indictment are re?alleged and incorporated as if fully set forth herein. 17. On multiple dates, beginning on or about October 19, 2017, and including November 2, 2017, and continuing until January 2018, at Seattle, within the Western District of Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, did knowingly transfer, possess, and use, Without lawful authority, a means of I identi?cation of another person, to wit: the name, address, and credit card information of Victim?1, a real person, during and in relation to a felony violation enumerated in 18 U.S.C. 1028A(a), that is, wire fraud, in Violation of 18 U.S.C. 1343, as charged a Counts and access device?fraud, in?violation of 18 U.S.C. 1029, as charged in Counts 9 and 10, knowing that the means of identi?cation belonged to another actual person. I All in Violation of Title 18, United States Code, Sections 1028A(a) and 2. Indictment - UNITED STATES ATTORNEY United States v. H0 1 1 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 12 of 14 COUNT 14 (Aggravated Identity Theft) 18. The allegations set forth in Paragraphs 1 through 15 of this Indictment are re-alleged and incorporated as if fully set forth herein. 19. On or about November 18, 2017, at Seattle, within the Western District of Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, did knowingly transfer, possess, and use, without lawful authority, a means of identi?cation of another person, to wit: the name, address, and credit card information of Victim-2, a real person, during and in relation to a felony violation enumerated in 18 U.S.C. 1028A(c), that is, wire fraud, in violation of 18 U.S.C. 1343, as charged in Count 3, and access device fraud, in violation of 18 U.S.C. 1029, as charged in Count 11, knowing that the means of identi?cation belonged to another actual person. All in violation of Title 18, United States Code, Sections 1028A(a) and 2. FORFEITURE ALLEGATION 20. The allegations contained in Counts 1 through 8 of this Indictment are hereby realleged and incorporated by reference for the purpose of alleging forfeitures pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c). Upon conviction of any of the offenses charged in Counts 1 through 8, the defendant shall forfeit to the United States any property, real or personal, which constitutes or is derived from proceeds traceable to such offenses, including but not limited to a judgment for a sum of money representing the property described in this paragraph. 21. The allegations contained in Counts 9 through 12 of this Indictment are hereby realleged and incorporated by reference for the purpose of alleging forfeitures pursuant to Title 18, United States Code, and 1029(c)(1)(C), and Title 28, United States Code, Section 2461(c). Upon conviction of any of the offenses charged in Counts 9 through 12, the defendant shall forfeit to the United States any property, real or personal, which constitutes or is derived from proceeds traceable to such $223336, H, ,2 v??l?ii?f??ii?g?i?io SEATTLE, WASHINGTON 98101 (206) 553-7970 I?i r?n i?A r?l-I?I pun 3?1 Case Document 1 Filed 01/10/19 Page 13 of 14 offense, and shall also forfeit any personal property used or intended to be used to commit such offense, including but not limited to a judgment fora sum of money representing the property described in this?paragraph. (Substitute Assets) 22. If any of the property described above, as a result of any act or omission of the defendant: a. b. d. e. Indictment United States 12. H0 - 13 cannot be located upon the exercise of due diligence; has been transferred or sold to, or deposited with, a third party; has been placed beyond the jurisdiction of thecourt; has been substantially diminished in value; or has been commingled with other property which cannot be divided Without dif?culty, UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case Document 1 Filed 01/10/19 Page 14 of 14 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21 United States Code Section 853(p), as incorporated by Title 28 United States Code, Section 2461(c). A TRUE BILL: DATED: 10 20]? (Signature of creperson redacted pursuant to policy ofthe JudiCial Conference) FOREPERSON METTE L. Es ,United States At rney 13 (LC 14 ANDREW c. FRIEDMAN Assistant United States Attorney 17 18 Assistant United States Attorney If Indictment UNITED STATES ATTORNEY United States 12. H0 14 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553?7970