Google LLC v. Dmitry Starovikov

Background

Google sought injunctive and other relief against Dmitry Starovikov, Alexander Filippov, and Does 1 through 15 based on their alleged participation in and operation of the Glupteba Enterprise. Google alleged that the Enterprise controlled a botnet affecting more than one million devices, distributed malware to infect additional devices, accessed Google users’ accounts and computers, and carried out criminal schemes. The opinion states that Google had previously obtained a temporary restraining order and an order requiring the defendants to explain why a preliminary injunction should not issue.

Google asserted claims under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and common-law theories of unfair competition and unjust enrichment.

Court’s Findings

The court found that it had federal-question jurisdiction over Google’s federal claims and supplemental jurisdiction over the state-law claims. It also found personal jurisdiction and venue proper based on alleged malware distribution, commands sent to infected computers, harm in New York, and other facts described in the order.

The court found that the complaint stated claims with the required specificity. For preliminary-injunction purposes, it concluded that Google had established irreparable harm, a likelihood of success on the merits or at least a substantial question on the merits, a balance of hardships favoring Google, and a public interest in granting relief.

The court’s merits-related findings included the following:

- Computer Fraud and Abuse Act: The court found that Google was likely to succeed on its claim that the defendants intentionally accessed protected computers without authorization, infected them with malware, and obtained information such as account credentials and URL history. - Electronic Communications Privacy Act: The court found that Google was likely to succeed on its claim that the defendants deliberately accessed Google users’ accounts and obtained unauthorized access to emails and other communications stored on Google servers. - Lanham Act: The court found that the defendants used Google’s YouTube mark in a domain name and on a landing page in a way likely to confuse consumers, including by marketing malware as software for downloading YouTube videos. - RICO: The court found that the defendants operated an enterprise with a shared purpose of spreading malware and building a botnet for profit. It also found a likely pattern of racketeering activity, including alleged computer fraud, wire fraud, identity fraud, and access-device fraud, and found that Google suffered business or property injury. - State-law claims: The court found that Google was likely to succeed on its New York common-law claims for tortious interference with business relationships and unjust enrichment.

Preliminary Injunction

The order restrained and enjoined the defendants, their agents, employees, attorneys, and others acting with them who received actual notice. The restraints applied anywhere in the world and prohibited, among other things:

- intentionally accessing or sending malicious code to Google’s and Google customers’ computers without authorization; - sending malicious code to configure, deploy, or operate a botnet; - attacking or compromising Google users’ computers and networks; - stealing or extracting information, credentials, or cookies; - creating websites falsely suggesting an association with Google or YouTube; - operating, supporting, or facilitating the Glupteba botnet; - monitoring Google or its customers and selling access to customer accounts; - using or infringing Google’s trademarks or making false or deceptive designations; and - using domains, financial accounts, or other assets connected to the alleged enterprise or its activities.

The court also preliminarily barred the transfer, disposal, or concealment of defendants’ money, property, and other assets without court approval. Google was permitted to serve the order on domain registrars, hosting providers, internet service providers, and other service providers and request reasonable steps to identify or block traffic, disable or suspend services, prevent circumvention, preserve evidence, and provide information sufficient to identify people controlling the relevant domains and internet addresses.

Google’s submission of a $75,000 bond satisfied the bond requirement, and the court required Google to file a status report on January 31, 2022.