Google LLC v. Dmitry Starovikov

Background

Google alleged that the defendants controlled the Glupteba botnet, a network of malware-infected private computers controlled through command-and-control servers. According to the complaint, the defendants used the botnet to collect and sell personal and financial information, place disruptive advertisements on infected computers, mine cryptocurrency, and route third-party internet traffic through infected computers to hide its source.

Google brought claims under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, trademark and unfair-competition law, tortious interference with a business relationship, and unjust enrichment. The court had previously denied default judgment against the named defendants, Dmitry Starovikov and Alexander Filippov, and vacated the entry of default against them. The court had also denied an earlier request for default judgment against the Doe defendants because they had not yet been served and no certificate of default had been issued.

Google later obtained a certificate of default after submitting evidence that it had served the Doe defendants by email, text message, internet publication, and WhatsApp message. Google then moved for default judgment, seeking an injunction preventing the Doe defendants from continuing the alleged unlawful activities. The named defendants opposed the motion.

Prejudice to the Named Defendants

The named defendants argued that the court could not enter default judgment against the Doe defendants before deciding the liability of all defendants. The court considered the rule from Frow v. De La Vega, which can restrict a judgment against defaulting defendants when their liability necessarily depends on the liability of other defendants. It explained that the Second Circuit has said that rule is likely limited to situations involving dependent liability or relief that must be consistent among defendants.

The court found no such problem here. Google sought only an injunction against the Doe defendants on this motion, not an award holding all defendants jointly and separately responsible for damages. The named defendants did not explain what inconsistency or prejudice would result from an injunction against the Doe defendants alone. The court therefore held that the Frow rule did not prevent default judgment.

Service of Process

The named defendants also argued that the Doe defendants had not been properly served. The court rejected that argument. Under Federal Rule of Civil Procedure 4(f)(3), a person in a foreign country may be served by a method the court orders if an international agreement does not prohibit it. Due process also requires service methods reasonably calculated to inform interested parties about the lawsuit and give them an opportunity to object.

Google had published information about the lawsuit on a publicly accessible website and sent messages to email addresses and phone numbers associated with accounts used to register domains linked to the Glupteba botnet. Twenty-two of twenty-six messages were successfully delivered, and three of four WhatsApp recipients read their messages. The court held that Google had used all available contact information and that the relevant question was whether the methods were reasonably calculated to provide notice, not whether every Doe defendant actually received notice.

The court also rejected the argument that Google had to conduct additional discovery to identify the Doe defendants. It held that Google was not required to take every possible step to identify them after using service methods reasonably calculated to provide notice. The court concluded that service satisfied Rule 4(f)(3) and the Due Process Clause.

Liability

For a defaulting defendant, the court accepts the complaint’s factual allegations as true, but it must still determine whether those allegations establish legal liability. The court had previously found that Google’s complaint stated valid causes of action. It concluded that the complaint stated those claims against the Doe defendants as well as against the named defendants, and that the named defendants had offered no explanation why the allegations against the Doe defendants were insufficient. The court therefore found that Google had adequately established the Doe defendants’ liability for purposes of default judgment.

Final Judgment and Disposition

Under Federal Rule of Civil Procedure 54(b), a court may enter final judgment against fewer than all parties when it expressly finds that there is no just reason for delay. The court made that finding here. It relied on the default, which established that the Doe defendants participated in the alleged continuing criminal enterprise harming Google and its users, and on its conclusion that the claims against the Doe defendants were factually separable from the claims against the named defendants. It also found that the named defendants would not be prejudiced.

The court granted Google’s July 19, 2022 motion for default judgment against the Doe defendants. The opinion states that a separate order issuing the judgment would accompany it.