Google LLC v. Dmitry Starovikov

Background

Google alleged that Dmitry Starovikov and Alexander Filippov controlled the Glupteba botnet, a network of malware-infected computers. According to the complaint, the botnet stole Google account information, sold access to infected devices and stolen accounts, used stolen credit cards to obtain Google services without full payment, displayed disruptive advertisements, and mined cryptocurrency. Google brought claims under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, trademark and unfair-competition law, and state-law theories of tortious interference and unjust enrichment.

The court issued a temporary restraining order and later converted it into a preliminary injunction. Google reported that it had disabled many command-and-control servers and related domains and accounts. The Clerk entered a default against Starovikov and Filippov on February 8, 2022. Google then moved for default judgment. The defendants moved to set aside the default and dismiss the case.

Setting Aside the Default

Under Federal Rule of Civil Procedure 55(c), a court may set aside an entry of default for good cause. The court considered whether the default was willful, whether the defendants had potentially meritorious defenses, and whether setting aside the default would prejudice Google.

The court declined to find a willful default. The defendants submitted declarations stating that they had not received the lawsuit papers by mail or email and did not learn of the case until January 2022, when a friend showed them a news report. Alexander Filippov said he might have received a text message but deleted it because it appeared suspicious. After learning of the lawsuit, the defendants translated the complaint and retained a Russian-speaking lawyer. Their lawyer appeared on February 10 and sought to vacate the default on February 24, shortly after the Clerk entered it. Although Google argued that the defendants likely knew about the case earlier, the court found that actual notice remained disputed and that the defendants acted promptly after the default.

The defendants also submitted declarations disputing Google’s allegations. They acknowledged working for Valtron and working on at least some websites that Google associated with the alleged scheme, but denied knowing about or controlling the alleged criminal activity. They also said they did not intend to target users in the United States and that participation in their services was legitimate and voluntary. The court found these statements sufficient to raise factual questions that required resolution later in the case.

The court concluded that Google would not be unduly prejudiced by setting aside the default. Google could continue using the preliminary injunction, and the parties could conduct focused discovery to preserve and obtain evidence. The defendants’ motion to set aside the entry of default was therefore granted, and Google’s motion for default judgment against Starovikov and Filippov was denied.

Defendants’ Motion to Dismiss

The court denied the defendants’ motion to dismiss. It rejected their arguments concerning personal jurisdiction, service of process, forum non conveniens, and failure to state a claim as grounds for setting aside the default or dismissing the case.

For personal jurisdiction, the court held that Google had alleged sufficient connections between the defendants and New York. Google alleged that the botnet infected more than one million devices, including at least thousands in New York City, and that the defendants intentionally infected New York devices and continued issuing them commands. The court also concluded that the defendants had not shown that exercising jurisdiction in New York would be unreasonable merely because they were residents of Russia or because Russia might have an interest in the dispute.

For service of process, the court found that Google’s attempts to serve the defendants by mail, email, text message, WhatsApp, and other court-authorized methods were reasonably calculated to notify them. The court stated that actual receipt was not required and noted that Filippov’s declaration indicated that he likely received service by text message.

The court rejected the argument that the case should be dismissed in favor of Russia under the doctrine of forum non conveniens, which allows a court to decline a case when another forum is substantially more appropriate. The defendants did not show that Russia was an adequate alternative forum or that litigation there would be more convenient. The court also found that the United States had a significant interest in the dispute because Google alleged that United States residents were harmed and United States laws were violated.

The court further found that Google’s complaint plausibly stated its claims. It held that Google alleged sufficient facts for its Racketeer Influenced and Corrupt Organizations Act claims, including allegations that the defendants operated and managed the alleged enterprise and agreed to its general criminal objective. The court also concluded that Google alleged domestic injuries sufficient for its RICO claims, despite the defendants’ argument that much of the conduct occurred abroad. The court rejected the defendants’ challenges to the Electronic Communications Privacy Act, trademark, unfair-competition, unjust-enrichment, and tortious-interference claims because those challenges disputed Google’s factual allegations rather than showing that the claims were legally insufficient.

Doe Defendants and Disposition

Google also sought default judgment against Does 1–15. The court denied that request because Google had not shown that the unidentified defendants were served; the certificate of default identified only Starovikov and Filippov as served.

Judge Denise Cote’s final order granted the defendants’ March 14 motion to set aside the entry of default, denied their March 14 motion to dismiss, and denied Google’s March 25 motion for default judgment.