Google LLC v. Saeed

Background

Google filed claims under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Lanham Act, and New York common law for tortious interference with business relationships. Google alleged that Zubair Saeed, Raheel Arshad, Mohammad Rasheed Siddiqui, and Does 1 through 15 participated in or operated a malware distribution enterprise involving CryptBot, a botnet, and websites distributing cracked software.

The court found that it had federal-question and supplemental jurisdiction and that personal jurisdiction and venue were proper. It found that the complaint pleaded facts with the specificity required by the Federal Rules and stated claims under the statutes and tort theory identified by Google.

Temporary Restraining Order

Google sought an emergency temporary restraining order and an order requiring the defendants to explain why a preliminary injunction should not issue. The court found that Google satisfied the four temporary-restraining-order factors: immediate and irreparable harm, a likelihood of success on the merits or a substantial question about the merits, a balance of hardships favoring Google, and a public interest supporting the order.

The court found that the alleged enterprise had infected approximately 672,220 CryptBot victim devices in the United States during the preceding year. It also found that the conduct threatened Google platforms and users, damaged Google’s goodwill and reputation, and created confusion about the source of malware distributed through software bearing Google marks.

The court found that Google was likely to succeed on its Computer Fraud and Abuse Act claim because the defendants allegedly accessed computers without authorization, infected them with malware, and obtained account credentials for sale. It found likely success on Google’s Lanham Act claims because the defendants allegedly used copies or counterfeits of Google marks in connection with distributing altered software and malware. The court also found likely success on Google’s RICO claims, including that the defendants formed an enterprise, engaged in a pattern of racketeering activity, and injured Google’s business or property. It further found likely success on the tortious-interference claim.

Scope of the Order

The order temporarily restrained the defendants and others acting with them, after receiving actual notice, from activities including sending malicious code to Google users’ computers; designing malware targeting Google Chrome; deploying or operating the botnet; compromising computers and networks; stealing credentials, cookies, and other information; selling access to Google user accounts; using Google marks or misleading representations; and creating or maintaining websites distributing cracked or pirated software.

The order also restricted the use or control of domains identified in the complaint, blocked transfers of the defendants’ money and assets without court approval, and allowed Google to amend an appendix to identify additional domains. Google was required to post a $75,000 bond.

The court authorized Google to serve the order by mail, email, text message, and through the Internet Corporation for Assigned Names and Numbers because it found traditional service methods would be futile. Google could also serve the order on service providers connected to the identified domains. Those providers were directed to take reasonable steps to identify and block related Internet traffic, disable or suspend specified services, preserve evidence, provide identifying information, and prevent circumvention of the order.

Hearing and Disposition

Judge Valerie Caproni issued the order without advance notice because the court found that notice could allow the defendants to move their infrastructure to new domains or servers. The defendants were ordered to appear on May 4, 2023, to show cause why a preliminary injunction should not issue. The temporary restraining order remained valid for 14 days. The order granted temporary relief but did not finally decide liability on Google’s claims.