Google LLC v. Dmitry Starovikov

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------- X : GOOGLE LLC, : : Plaintiff, : : 2 1 c v 1 0 2 6 0 (DLC) -v- : : OPINION AND ORDER DMITRY STAROVIKOV, ALEXANDER FILIPPOV, : and DOES 1–15, : : Defendants. : : -------------------------------------- X APPEARANCES: For plaintiff: Andrew Zenner Michaelson Kathleen Elizabeth McCarthy Laura Elizabeth Harris King & Spaulding LLP (NYC) 1185 Avenue of the Americas New York, NY 10036

Bethany Rupert King & Spalding 1180 Peachtree Street NE Atlanta, GA 30309

David Paul Mattern Sumon Dantiki King & Spalding LLP (DC) 1700 Pennsylvania Avenue, N.W. Washington, DC 20006

For Defendants: Igor B. Litvak The Litvak Law Firm, PLLC 1733 Sheepshead Bay Road Suite 22 Brooklyn, NY 11235 DENISE COTE, District Judge: Defendants Dmitry Starovikov and Alexander Filippov (the “Defendants”) have moved to reconsider monetary and default

judgment sanctions imposed upon them and their attorney, Igor Litvak, in an Opinion of November 15. Although the Defendants and Litvak attempt to explain their conduct during the litigation, none of their explanations undermines the basis for sanctions: that the Defendants mispresented their employment status; that their attorney failed to correct and continued to exploit this misrepresentation in order to seek discovery against Google while avoiding discovery against the Defendants; and that the Defendants leveraged their ability to shut down the Glupteba botnet in order to extort money from Google. Accordingly, the motion for reconsideration is denied. Background

This Court presumes familiarity with its prior Opinion issuing sanctions against the Defendants and Litvak. See Google LLC v. Starovikov, 21CV10260 (DLC), 2022 WL 16948296 (S.D.N.Y. Nov. 15, 2022). Google filed this lawsuit on December 2, 2021, alleging that the defendants operate the Glupteba botnet, a network of infected computers programmed to execute commands issued by a remote server (a “C2 Server”). Google alleged that the defendants used this botnet to harvest personal data from infected computers and hijack them for criminal ends (a scheme referred to as the “Glupteba Enterpise”). The Complaint identifies several organizations alleged to form the Glupteba Enterprise, including Valtron LLC (“Valtron”). Unlike

conventional botnets, which hardcode the address of the C2 servers into the code of their malware, the Glupteba botnet broadcasts the addresses of its C2 servers on the blockchain. This makes the botnet harder to disrupt –- even if existing C2 servers are taken down, the Glupteba Enterprise can always set up more, and post their addresses on the blockchain. On December 7, 2021, this Court issued a temporary restraining order allowing Google to disrupt the Glupteba botnet, and to use alternative methods to effect service on the defendants. Google attempted service, but no defendant responded. Google then requested an entry of default, and moved for default judgment against the defendants. The temporary

restraining order was converted into a preliminary injunction on December 16, 2021. On February 24, 2022, Litvak submitted a letter on behalf of the Defendants requesting that the default against them be vacated. Accompanying their brief to vacate the default, the Defendants each submitted identical declarations stating: “I work for Valtron as a software engineer.” In an Opinion of April 27, the Court vacated the default entered against the Defendants, finding that Google had not been prejudiced by the delay because the parties could still “conduct expeditious and targeted discovery to ensure they can quickly obtain the evidence they need, without inhibiting Google’s efforts to

disrupt the Glupteba botnet.” Google LLC v. Starovikov, 21CV10260 (DLC), 2022 WL 1239656, at *10 (S.D.N.Y. Apr. 27, 2022). After the default was vacated, the parties began to discuss a discovery plan. On May 17, Google shared with Litvak a proposed plan indicating that Google intended to request electronic devices that the Defendants used in connection with their business. On May 20, Litvak responded by proposing discovery of Google’s electronic devices, and limiting discovery of the Defendants’ devices to those “over which the Defendants have actual physical control and possession.” Google rejected these modifications on May 31, taking out any reference to a

device exchange. But Litvak replied that he liked the initial version better, and asked to keep it. The Court held a Rule 16 conference on June 1. During that conference, Google expressed frustration that the Defendants were unwilling to agree on a location at which they could be deposed, and that they refused to consent to a permanent injunction prohibiting them from engaging in unlawful activity without explaining the reasons for that refusal. By that time, Google had withdrawn its claim for damages, and only the claim for injunctive relief remained to be litigated. Litvak explained that the Defendants did not believe they were engaged in any unlawful activity, but that they were unwilling to

consent to a permanent injunction because Google’s use of the preliminary injunction had disrupted their legitimate business activities. Litvak also expressed that the Defendants were willing to be deposed in any country to which they could travel and obtain a visa. Shortly after the conference, however, Litvak revealed that the Defendants lacked passports, and that they had concerns about being deposed in a country from which they might be extradited. The Defendants served their initial disclosures on June 17. The disclosures identified seven individuals with potentially discoverable information at Valtron’s office address, but did not provide their surnames. Additionally, the Defendants

refused to provide any electronic devices, stating that any such devices were in Valtron’s possession, not theirs. As Google continued to press the Defendants to turn over any devices to which they had access, the Defendants clarified on July 19 that they no longer worked at Valtron, and therefore no longer had access to any discoverable devices. The Court held a conference on July 29 to address the deficiencies in the Defendants’ initial disclosures. At the conference, the Defendants were ordered to submit a letter responding to Google’s questions about their knowledge of or access to discoverable information. In a letter of August 8, Litvak stated that the Defendants had left their jobs at Valtron

in December of 2021, that they returned their work laptops to Valtron in mid-January of 2022, and that he had learned of this on May 20. In letters of August 12, the parties also requested sanctions against each other. The motions for sanctions became fully briefed on September 23. On September 6, while the parties’ cross-motions for sanctions were being briefed, Litvak emailed Google that his clients were willing to discuss settlement. The parties held a call on September 8, during which Litvak explained that the Defendants would be willing to provide Google with the private keys for the Bitcoin accounts associated with the Glupteba botnet, and that the Defendants would promise not to engage in

the alleged criminal activity in the future. In exchange, the Defendants demanded Google’s agreement not to report them to law enforcement, a payment of $1 million per defendant, and $110,000 in attorney’s fees. Google rejected the demand and reported it to law enforcement. The Court granted Google’s motion for sanctions and denied the Defendants’ motion for sanctions in an Opinion of November 15. Google LLC, 2022 WL 16948296, at *16. The Opinion found that Litvak failed to disclose that the Defendants had left Valtron after he purportedly learned that they had on May 20, and that the Defendants instead continued to exploit this misunderstanding by attempting to negotiate an exchange of

devices that they knew would not be reciprocal. Id. at *7–8. The Opinion also found that the Defendants likely knew about the litigation before they claimed to have learnt about it in mid- January, and that their refusal to turn over any electronic devices showed that they had no intention to participate in discovery in good faith. Id. at *8–10. Finally, the Defendants’ unwillingness to consent to a permanent injunction, combined with their willingness to shut down the Glupteba botnet in exchange for money, evinced an intention to use the litigation to profit off of their criminal scheme. Id. at *10. The Court therefore issued default judgments against the two Defendants, explaining that the default would likely never

have been vacated had the Defendants’ been honest about their willingness or ability to engage in discovery from the start. Id. at *11–12. And it imposed monetary sanctions against the Defendants and against Litvak for their “willful campaign to resist discovery and mislead the Court.” Id. at *13. The Defendants and Litvak moved to reconsider the Opinion on November 28. Discussion The standard for granting a motion for reconsideration is “strict.” Cho v. Blackberry Ltd., 991 F.3d 155, 170 (2d Cir.

2021) (citation omitted). A motion for reconsideration is “not a vehicle for relitigating old issues, presenting the case under new theories, securing a rehearing on the merits, or otherwise taking a second bite at the apple.” Analytical Surv., Inc. v. Tonga Partners, L.P., 684 F.3d 36, 52 (2d Cir. 2012) (citation omitted). “A party may . . . obtain relief only when the party identifies an intervening change of controlling law, the availability of new evidence, or the need to correct a clear error or prevent manifest injustice.” Cho, 991 F.3d at 170. The decision to grant or deny the motion for reconsideration rests within “the sound discretion of the district court.” Aczel v. Labonia, 584 F.3d 52, 61 (2d Cir. 2009) (citation

omitted). In their motion for reconsideration, the Defendants attempt to provide various explanations of their behavior and the conduct of their counsel throughout this litigation. Many of their arguments were raised in the briefing on the motion for sanctions, and therefore need not be reconsidered here. Regardless, nothing in the Defendants’ motion challenges the facts underlying the November 15 Opinion’s findings, or the basis for its imposition of sanctions. I. Misconduct The Defendants first argue that they only misrepresented once, in the declarations submitted in connection with their motion to vacate the default, that they were current employees

of Valtron. This argument was raised in the parties’ briefs on their cross-motions for sanctions, and was addressed in the November 15 Opinion. Google LLC, 2022 WL 16948296, at *7–8. It therefore need not be reconsidered here. As the November 15 Opinion explained, the Defendants’ statements after May 20, such as those labeling Filippov a “Valtron Software Engineer” or referring to their “prospective relationship with their employer,” must be understood in the context of the Defendants’ earlier statements that they “work at Valtron as a software engineer.” The Defendants knew when they made each of these statements that Google would have believed that they were currently employed at Valtron, and that these statements would

be taken to refer to a present employment. Similarly, the Defendants did not vitiate their misrepresentation when they said they “worked” at Valtron in their brief on their motion to vacate the default. Though phrased in the past tense, the statement in the brief was made in reference to the period described in the Complaint, and was made at a time when Litvak purportedly still believed that the Defendants continued to work at Valtron. The Defendants cannot argue that the statement makes clear that they had left Valtron when, by his own admission, Litvak believed that they still worked at Valtron when he wrote it.

The Defendants also attempt to justify their settlement demand to Google. Each of the Defendants’ arguments was already addressed in the November 15 Opinion, and therefore need not be reconsidered. Id. at *10. The Defendants argue that they have no access to the private keys of the Glupteba botnet’s Bitcoin accounts until Valtron provides them, and that Valtron will not provide them unless a settlement is reached. But the Defendants also insist that their offer to turn over the private keys is not contingent on any payment. The Defendants cannot insist that they did not make the offer of private keys contingent on a money payment, while at the same time arguing that the private keys could only be obtained as a result of a settlement, and

demanding money as a condition of settlement. Moreover, the Defendants refused to consent to the permanent injunction prohibiting criminal activity but could not provide a coherent explanation for that refusal, as the November 15 Opinion explained. Id. at *10. Then, in their settlement discussions with Google, they offered their consent to such an injunction, again contingent on a payment. Litvak also argues that he never misrepresented the Defendants’ willingness or ability to engage in discovery. The November 15 Opinion, however, recounts multiple instances in which the Defendants suggested to Google that they would have discovery to produce, and then refused to provide any discovery

when asked, raising myriad objections that they had not previously voiced. Id. at *3–4. Litvak stated at the June 1 conference that the Defendants would be willing to attend a deposition in a country to which they could get a visa and travel. But after that conference, they expressed concerns about extradition, and revealed that they had no passports. The Defendants have offered to produce the private keys associated with the Glupteba botnet’s Bitcoin accounts as part of a settlement, while refusing to turn over the private keys in discovery. And the Defendants repeatedly suggested to Google that they have discoverable electronic devices to produce, while refusing to produce any such devices when pressed. All of this

misconduct was discussed in the November 15 Opinion, id. at *6– 10, and the Defendants have raised no new arguments to excuse it. The Defendants’ inconsistency on the availability of discoverable electronic devices or electronically stored information is particularly suggestive of bad faith. In their initial disclosures, the Defendants refused to identify any discoverable electronic devices. And in response to Google’s questions after the July 29 conference, the Defendants refused to identify any device except their work laptops and claimed that those laptops had been turned over to Valtron.1 The Defendants also refused to explain what efforts they took to

preserve discovery, despite the Court’s Order that they answer Google’s questions regarding their “knowledge of or access to discoverable information.” After the Court observed in the Opinion of November 15 that the Defendants’ cellphones likely “contain a wealth of information relevant to this litigation,” id. at *9, in their briefing on the present motion for reconsideration, the Defendants now state that they have smartphones which they would have been willing to turn over had the Court ordered it. Litvak asserts that he never intentionally exploited the misrepresentation regarding the Defendants’ employment status, because he explained to Google that the Defendants had no

electronic information to produce as soon as the issue became relevant during their discussions of electronic discovery on June 27. But, by Litvak’s own admission, he knew at least by May 20 that the Defendants were taking the position that they no longer had access to their work laptops, and he did not disclose

1 Despite being required to identify “each device that you used in 2021 or 2022,” including those owned by Valtron, a third party, or owned personally, on August 8, 2022, each of the Defendants identified only one device, a MacBook Pro, that they asserted had been returned to Valtron. this to Google by May 31, when the parties negotiated a discovery plan that could involve an exchange of electronic devices. Litvak even proposed language limiting any device

exchange to devices over which the Defendants had “actual physical control and possession.” This conduct evinces an attempt to entice Google into agreeing to ostensibly reciprocal discovery, while ensuring that the Defendants would not have to turn over discoverable information themselves. Finally, the Defendants insist that they did not participate in, and did not know about, the operation of servers associated with the Glupteba botnet. But the Defendants have also repeatedly attempted to leverage their access to the botnet and to these servers as part of their litigation strategy. At the June 1 Conference, Litvak explained that the Defendants were unwilling to consent to a permanent injunction, because Google’s

disruption of the servers harmed the Defendants’ business activities.2 And in their September 8 settlement demand, the

2 Although the June 1 conference took place after the date at which Litvak purportedly learned that the Defendants no longer worked at Valtron, Litvak did not disclose this at the conference. Nevertheless, Litvak stated at the conference that the Defendants refused to consent to a permanent injunction in part because Google’s takedown of domain names disrupted their business activities. This representation suggests that the Defendants continued to have access to servers that Google believed were associated with the botnet. But the Defendants never identified any such information in their initial disclosures, or in response to Google’s discovery requests. Defendants offered to provide the private keys to the botnet’s Bitcoin accounts in exchange for $2 million plus attorneys’ fees. If the Defendants had access to or knowledge of these

servers or accounts, then they were required to provide that information in discovery. If not, then they could not rely on that access or knowledge in their representations to Google and to the Court. In either case, the Defendants committed sanctionable misconduct. II. Sanctions The Defendants argue that, even if they or Litvak committed misconduct, the Court erred in sanctioning them. “If a party fails to obey an order to provide or permit discovery, the district court may impose sanctions, including rendering a default judgment against the disobedient party.” Guggenheim Capital, LLC v. Birnbaum, 722 F.3d 444, 450 (2d Cir. 2013) (quoting Fed. R. Civ. P. 37(b)(2)(A)(vi)). In determining what

sanctions are warranted, a court should consider “(1) the willfulness of the non-compliant party; (2) the efficacy of lesser sanctions; (3) the duration of the noncompliance; and (4) whether the non-compliant party had been warned that noncompliance would be sanctioned.” Id. at 451; see also Funk v. Belneftekhim, 861 F.3d 354, 366 (2d Cir. 2017). Entry of a default is an extreme sanction, and may be appropriate “when a court finds willfulness, bad faith, or any fault on the part of the noncompliant party.” Guggenheim Capital, LLC, 722 F.3d at 451 (citation omitted). Additionally, courts have the inherent power to “sanction a

party . . . to deter abuse of the judicial process and prevent a party from perpetrating a fraud on the court.” Yukos Capital S.A.R.L. v. Feldman, 977 F.3d 216, 235 (2d Cir. 2020). Federal courts may therefore issue monetary sanctions against a party for that party’s “bad faith, vexatious, or wanton” misconduct. Int’l Techs. Marketing, Inc. v. Verint Sys. Ltd., 991 F.3d 361, 368 (2d Cir. 2021) (citation omitted). The imposition of monetary sanctions on an attorney acting on behalf of litigants generally requires a finding of bad faith. See United States v. Seltzer, 227 F.3d 36, 41–42 (2d Cir. 2000). The Federal Rules of Civil Procedure also authorize monetary sanctions for misconduct during discovery. See Fed. R.

Civ. P. 26(g) (allowing monetary sanctions, including the “reasonable expenses” and “attorney's fees” incurred as a result of an incomplete or incorrect initial disclosure); Fed. R. Civ. P. 37(b)(2)(C) (allowing monetary sanctions for refusal to obey a discovery order); 37(c)(1)(A) (allowing monetary sanctions for refusal to provide information in an initial disclosure); 37(f) (allowing the court to require payment of “reasonable expenses, including attorney's fees” if a party “fails to participate in good faith in developing and submitting a proposed discovery plan.”). Monetary sanctions may also be awarded against a party that participates in a Rule 16 conference in bad faith. See Liebowitz v. Bandshell Artist Mgmt., 6 F.4th 267, 290 & n.28 (2d

Cir. 2021) (quoting Fed. R. Civ. P. 16(f)). A. Sanctions against the Defendants Litvak argues that sanctions should not have been imposed on him or on the Defendants, because the Court should have first considered lesser sanctions, such as admonishment. But the November 15 Opinion considered lesser sanctions, and determined that they would not suffice. As the Opinion explained, the Defendants likely would not have made it past default judgment but for their misconduct. Google LLC, 2022 WL 16948296, at *12. A sanction of default judgment and reasonable attorneys’ fees was therefore necessary to “restore the prejudiced party to the same position [it] would have been in” but for the Defendants’ and Litvak’s misconduct. West v. Goodyear Tire & Rubber Co.,

167 F.3d 776, 779 (2d Cir. 1999). Litvak also cites Bobal v. Rensselaer Polytechnic Institute, 916 F.2d 759, 764 (2d Cir. 1990), for the proposition that sanctions terminating a case may not be issued without a warning that terminating sanctions will be imposed. But Bobal involved a pro se litigant who was sanctioned because she refused to attend certain depositions and conferences. Id. at 762. The Defendants, by contrast, are represented by an attorney, who is required to be aware of his discovery obligations and his ethical obligations as an officer of the court. Moreover, their misconduct consists not just of a

passive failure to satisfy court-imposed deadlines, but an active campaign of misrepresentations and evidence spoliation. Finally, the Court issued an Order on June 3 expressing concern that Litvak was not being candid with the Court and that Defendants were not participating in the litigation in good faith. And the Court further expressed concern in a July 29 conference that Litvak had attempted to negotiate a device exchange at a time he knew there were no devices within his clients’ possession. Nevertheless, the Defendants persisted in resisting discovery and in attempting to profit off the Glupteba Enterprise. These warnings, in light of the extensive bad faith misconduct on the part of the Defendants and their attorney, are

more than adequate to justify the sanctions imposed. See Guggenheim Capital, LLC, 722 F.3d at 451. B. Sanctions against Litvak Litvak argues that Court should not have imposed monetary sanctions on him, because he never acted in bad faith. Litvak insists that he genuinely believed that the Defendants worked at Valtron at the time he submitted declarations stating that they did, and that he corrected this misrepresentation as soon as it became relevant. He also asserts that he informed the Defendants about their discovery obligations when he was hired, and argues that he therefore should not be held responsible for any spoliation of discoverable evidence.

Each of these arguments was addressed repeatedly in the November 15 Opinion, and therefore need not be reconsidered here. Id. at *6–13. The Opinion identified numerous instances in which Litvak made misrepresentations or resisted discovery in bad faith. Litvak claims to have learned on May 20 that the Defendants left Valtron in 2021 and had returned their work laptops. Yet after that date, Litvak stated in a brief that Google’s complaint threatened their business relationship with Valtron, represented at a conference that Google’s shutdown of the Glupteba botnet’s servers was disrupting the Defendants’ business activities, attempted to negotiate a device exchange that would leave the Defendants without any electronic devices

to turn over, and described Filippov as a Valtron software engineer in the Defendants’ initial disclosures. Litvak has also participated in the Defendants’ extortionate settlement demands, requesting payment of attorney’s fees to reimburse the Defendants in exchange for helping to shut down the Glupteba botnet. This bad-faith conduct is more than sufficient to justify the imposition of monetary sanctions. Litvak also argues that the November 15 Opinion should not have found his discovery preservation efforts insufficient without a hearing or some further inquiry through which he could explain his preservation efforts. Litvak did not request a hearing in his briefing on the parties’ cross-motions for

sanctions. And regardless, Litvak has had multiple opportunities to explain his conduct, at conferences, in briefing and in his declaration submitted in connection with the cross-motions for sanctions, and in connection with the motion for reconsideration. Indeed, Litvak declined to respond to Google’s request for information about his discovery preservation efforts, even though the Court had ordered Litvak to respond to Google’s questions about the Defendants’ “knowledge of or access to discoverable information.” Nor did Litvak take these opportunities to identify an issue of material fact that would necessitate a hearing. Litvak has therefore been provided with a sufficient opportunity to be heard on this

issue. See In re 60 E. 80th St. Equities, Inc., 218 F.3d 109, 117 (2d Cir. 2000). Moreover, even if Litvak had carefully explained to his clients their obligation to preserve discoverable evidence -- an unlikely occurrence, as he claims his clients did not reveal until months into the case that they had essentially no evidence to produce -- this would not excuse the multiple other instances of Litvak’s bad faith misconduct throughout the course of this litigation. Litvak argues that the amount of monetary sanctions imposed is excessive, because he is a sole practitioner with limited financial means, and because his personal and family

circumstances would make sanctions especially burdensome. But the November 15 Opinion awarded monetary sanctions only in the amount of attorneys’ fees and expenses that Google had incurred since the Defendants’ appearance in the case. Id. at *16. Awards of reasonable expenses are not only permissible under the Court’s inherent powers, but required by the rules of Civil Procedure for certain bad faith violations. See Liebowitz, 6 F.4th at 291 (citing Fed. R. Civ. P. 16(f)); see also Fed. R. Civ. P. 37(a)(5)(A). As the November 15 Opinion explained, the Defendants’ misconduct has been ongoing since their entry into the litigation, and the default against them would likely not have been vacated but for that misconduct. Google LLC, 2022 WL

16948296, at *13. An award of attorneys’ fees is therefore necessary to compensate Google for the harm caused by the Defendants’ and Litvak’s misconduct. Litvak has cited no authority to suggest that monetary sanctions must be reduced according to an attorney’s financial means, and the attorney’s means and personal circumstances are not among the factors generally considered when imposing sanctions or bad faith misconduct. See Int’l Techs. Marketing, Inc., 991 F.3d at 368. These sanctions are designed to compensate Google for the harm it suffered as the result of misconduct, not to punish Litvak or the Defendants. See Liebowitz, 6 F.4th at 289-90 (distinguishing between “compensatory” and “punitive” sanctions). The sanctions are payable to the opposing party, rather than to the Court. Nonetheless Litvak and the Defendants will be given an opportunity to resolve the amount of sanctions to be imposed before briefing on that amount is due. A separate order will refer the parties for settlement discussions. This will also give the Defendants the opportunity to demonstrate that their offer to provide the private keys to the Glupteba botnet’s Bitcoin accounts is not contingent on a payment of $2 million, and otherwise to amelicrate the sanctions. Finaliy, to the extent that Litvak believes his financial means or personal circumstances are relevant, he may submit evidence on those issues in connection with the briefing on the amount of sanctions to be imposed. Conclusion The Defendants’ and Litvak’s November 28, 2022 motion for reconsideration is denied.

Dated: New York, New York December 5, 2022

NISE COTE United Ae District Judge