Google LLC v. Dmitry Starovikov

Background

Google moved for default judgment and a permanent injunction against Dmitry Starovikov, Alexander Filippov, and Doe Defendants 1–15. The order’s liability findings focus on the Doe Defendants, whom the court described as participants in the Glupteba botnet enterprise. The court found that the Doe Defendants had been properly served by email, text message, WhatsApp, and publication on a public website, and that they had actual notice of the case. They failed to answer, appear, or otherwise defend. The Clerk entered default under Federal Rule of Civil Procedure 55(a) on June 10, 2022.

Jurisdiction and Liability Findings

The court found federal-question jurisdiction over Google’s claims under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, and the Lanham Act. It also found jurisdiction over related state-law claims and personal jurisdiction over the Doe Defendants based on their alleged distribution of malware and commands to infected computers in New York, among other facts stated in the order.

Because of the default, the complaint’s factual allegations were treated as admitted, and the court also relied on evidence in Google’s supporting papers. The court found the Doe Defendants liable for:

- violating the Racketeer Influenced and Corrupt Organizations Act by participating in and managing an enterprise that spread malware, operated a botnet, and engaged in a pattern of racketeering activity; - violating the Computer Fraud and Abuse Act by intentionally accessing thousands of protected computers without authorization, infecting them with malware, and obtaining information such as account credentials and URL history; - violating the Electronic Communications Privacy Act by breaking into Google users’ accounts and obtaining unauthorized access to emails and other communications stored on Google’s servers; - violating the Lanham Act by using Google’s YouTube trademark in a website and landing page in ways likely to confuse consumers and by falsely marketing malware as software for downloading YouTube videos; and - committing tortious interference with business relationships and unjust enrichment under New York common law.

Permanent Injunction

The court applied the factors for a permanent injunction: likely irreparable harm, inadequate monetary remedies, the balance of hardships, and the public interest. It found that all four factors favored Google. The court cited the botnet’s alleged infection of more than one million devices, continuing threats to Google users and internet security, harm to Google’s goodwill and reputation, and the risk of additional attacks and theft of account information.

Disposition and Scope of the Order

Judge Denise Cote granted Google’s motion for default judgment and entry of a permanent injunction. The court entered judgment in Google’s favor and against the Doe Defendants. It permanently restrained the Doe Defendants and their officers, agents, employees, attorneys, and others acting with them who receive actual notice from, among other things:

- accessing Google or customer computers without authorization or sending them malicious code; - configuring, deploying, operating, or facilitating the Glupteba botnet; - attacking computers or networks, stealing or monitoring information, and selling access to Google customer accounts; - creating websites that falsely suggest an association with Google or YouTube; - infringing or misusing Google trademarks; - using financial accounts, cryptocurrency accounts, or card-processing accounts to further unlawful schemes; and - undertaking similar activities that harm Google, its customers, or the public.

The injunction applies anywhere in the world. A violation may be treated and prosecuted as contempt of court after the restrained parties receive notice. The order also permits Google to serve it on domain registrars, name servers, hosting providers, internet-service providers, and other service providers connected to identified domains and internet addresses. Those providers may be required to block traffic, disable or suspend services, prevent circumvention, preserve related systems and evidence, and provide information sufficient to identify and contact the operators. The opinion does not state a monetary award.