Google LLC v. Saeed

Background

Google filed claims against Zubair Saeed, Raheel Arshad, Mohammad Rasheed Siddiqui, and Does 1–15. Google alleged that the defendants participated in and operated a “Malware Distribution Enterprise” that distributed malware, infected devices, controlled a botnet, distributed cracked software, stole account credentials and other information, and carried out criminal schemes. The asserted claims were under the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Lanham Act’s trademark provisions, and New York common law concerning interference with business relationships.

The court had previously issued a temporary restraining order requiring the defendants to show why a preliminary injunction should not issue. In this order, the court found that the complaint pleaded facts with the specificity required by the Federal Rules and stated claims under each asserted legal theory.

Court’s Findings

The court found that Google satisfied the requirements for a preliminary injunction: likely success on the merits or at least a substantial question about the merits, immediate and irreparable harm, a balance of hardships favoring Google, and consistency with the public interest.

The court found that the alleged botnet had infected approximately 672,220 CryptBot victim devices in the United States during the preceding year. It determined that the alleged conduct threatened the security of Google platforms and users, could allow further criminal uses of the botnet, and harmed Google’s trademarks, goodwill, and reputation.

On the Computer Fraud and Abuse Act claim, the court found that Google was likely to show that the defendants knowingly and intending to defraud accessed users’ computers without authorization, infected them with malware, and obtained information such as account credentials for sale to others. On the Lanham Act claims, the court found that the defendants’ alleged use of Google marks to distribute cracked software containing malware was likely to confuse users about the software’s source or affiliation. The court also found that Google was likely to succeed on its racketeering and tortious-interference claims.

Preliminary Injunction

The court ordered the defendants, their agents, and others acting with them who received actual notice to stop, anywhere in the world, from accessing protected computers without authorization; sending malicious code; designing malware targeting Google Chrome or its users; deploying or operating the botnet; compromising computers or networks; stealing information; stealing credentials or cookies; selling access to Google user accounts; and monitoring Google or its users.

The order also barred the restrained parties from creating websites falsely associated with Google, distributing cracked or pirated software, infringing or using Google marks, making deceptive designations or representations, or suggesting that their activities were sponsored by or affiliated with Google. It further prohibited use, transfer, control, or access to the domains identified in the complaint and restricted the use of financial accounts and assets to further the alleged schemes.

Google was permitted to serve the order on service providers connected to the identified domains and request reasonable steps to identify and block related traffic, disable associated systems, preserve evidence, identify the people or entities controlling the domains, and prevent circumvention. The order also temporarily restrained the transfer or concealment of the defendants’ money, property, and other assets after actual notice.

Other Orders and Disposition

The court found good cause for alternative service by mail, email, text, and service through the Internet Corporation for Assigned Names and Numbers. It held that Google’s previously submitted $75,000 bond satisfied the security requirement for the preliminary injunction and required no additional bond. Google was ordered to file a status report on June 15, 2023. The order stated that violations after actual notice could be considered and prosecuted as contempt of court.