United States v. Yevgeniy Nikulin

• Court: Court of Appeals for the Ninth Circuit
• Decided: December 22, 2021
• Docket: 20-10322
• Status: Unpublished

Opinion

FILED NOT FOR PUBLICATION DEC 22 2021 UNITED STATES COURT OF APPEALS MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 20-10322

Plaintiff-Appellee, D.C. Nos. 3:16-cr-00440-WHA-1 v. 3:16-cr-00440-WHA

YEVGENIY ALEKSANDROVICH NIKULIN, AKA Chinabig01, AKA MEMORANDUM* dex.007, AKA itBlackHat, AKA valeriy.krutov3,

Defendant-Appellant.

Appeal from the United States District Court for the Northern District of California William Alsup, District Judge, Presiding

Argued and Submitted December 10, 2021 San Francisco, California

Before: MURGUIA, Chief Judge, and IKUTA and VANDYKE, Circuit Judges.

Defendant Yevgeniy Nikulin appeals a $1,734,000 restitution order and an

88-month sentence imposed following his convictions for various offenses based

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. on computer intrusions affecting the companies LinkedIn, Formspring, and

Dropbox. We have jurisdiction under 28 U.S.C. § 1291.

Even assuming plain error review applies, the district court plainly erred in

awarding $1,734,000 in restitution based on the victims’ non-itemized, conclusory

summaries of their loss in unsworn letters. See United States v. Waknine, 543 F.3d

546, 556–57 (9th Cir. 2008); United States v. Tsosie, 639 F.3d 1213, 1221–23 (9th

Cir. 2011). Although trial testimony and logs submitted at trial showed the extent

of the victims’ responses to the computer intrusions, that evidence did not provide

a basis for determining the costs incurred by the victims in mounting those

responses. Because neither the victims’ letters nor other evidence submitted by the

government satisfied the requirement that the government provide “a complete

accounting of the losses to each victim” to “the extent practicable,” 18 U.S.C.

§ 3664(a), or provide “evidence or proof that all costs incurred were directly

related to” Nikulin’s offenses, Waknine, 543 F.3d at 556, the evidence was

insufficient to support a restitution award, id.

The district court’s conservative estimate that the victims’ losses exceeded

$550,000 based on evidence regarding the size of the victim companies, the nature

of their responses to the computer intrusions, and their statements of costs

associated with their responses, was a “reasonable estimate of loss, given the

2 available information.” United States v. Tadios, 822 F.3d 501, 503 (9th Cir. 2016)

(citation omitted). Therefore, the district court did not err in applying a 14-level

sentencing enhancement under § 2B1.1 of the Guidelines. U.S.S.G. § 2B1.1.

Because the district court’s conservative estimate was supported by clear and

convincing evidence, any error in the district court’s standard of review was

harmless. See United States v. Wijegoonaratna, 922 F.3d 983, 990–91 (9th Cir.

2019).

Finally, the district court did not err in admitting evidence that the owner of

the chinabig01@gmail.com email address committed a fourth, uncharged computer

intrusion against the company Automattic. The evidence was admissible under

Rule 404(b) of the Federal Rules of Evidence to show identity, both because it

tended to prove that the hacker in the charged offenses was the person who

controlled chinabig01@gmail.com, and because it tended to establish Nikulin’s

distinctive modus operandi. See United States v. Romero, 282 F.3d 683, 688 (9th

Cir. 2002). Because the district court addressed any prejudice from this evidence

by giving a limiting jury instruction, the district court did not err in determining

3 that the evidence’s probative value outweighed any potential prejudice. See Fed.

R. Evid. 403; Hayes v. Ayers, 632 F.3d 500, 514 (9th Cir. 2011).1

AFFIRMED in part; REVERSED in part.2

1 The government filed a motion to supplement the record with (1) a letter providing notice of the government’s intent to admit evidence of the Automattic intrusion under Rule 404(b) and (2) a message and attachment from defense counsel proposing a jury instruction to address that evidence (Dkt. 24). This motion is granted. 2 Each party will bear its own costs on appeal. 4