Google LLC v. Dmitry Starovikov, et al., No. 1:2021cv10260 - Document 129 (S.D.N.Y. 2022)
Court Description: OPINION AND ORDER: re: 92 MOTION for Default Judgment as to Does 1-15 filed by Google LLC. Google's July 19, 2022 motion for default judgment against the Doe Defendants is granted. A separate Order issuing the judgment will accompany this Opinion. (Signed by Judge Denise L. Cote on 9/30/2022) (ama)
Download PDF
<![CDATA[
Google LLC v. Dmitry Starovikov, et al. Doc. 129 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 1 of 11 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------- X : : GOOGLE LLC, : Plaintiff, : : -v: : DMITRY STAROVIKOV, ALEXANDER FILIPPOV, : : and DOES 1–15, : Defendants. : : -------------------------------------- X 21cv10260 (DLC) OPINION AND ORDER APPEARANCES: For plaintiff: Andrew Zenner Michaelson Kathleen Elizabeth McCarthy Laura Elizabeth Harris King & Spaulding LLP (NYC) 1185 Avenue of the Americas New York, NY 10036 Bethany Rupert King & Spalding 1180 Peachtree Street NE Atlanta, GA 30309 David Paul Mattern Sumon Dantiki King & Spalding LLP (DC) 1700 Pennsylvania Avenue, N.W. Washington, DC 20006 For defendants: Igor B. Litvak The Litvak Law Firm, PLLC 1733 Sheepshead Bay Road Suite 22 Brooklyn, NY 11235 Dockets.Justia.com Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 2 of 11 DENISE COTE, District Judge: Google LLC (“Google”) has brought claims against the defendants for operating a botnet to steal and exploit Google users’ personal information. Google now moves for the entry of default judgment against defendants Does 1–15 (the “Doe Defendants”). For the following reasons, Google’s motion is granted. Background This Court presumes familiarity with its prior Opinion in this action denying default judgment against the named defendants, and summarizes only the facts necessary to resolve this motion. See Google LLC v. Starovikov, 21CV10260, 2022 WL 1239656 (S.D.N.Y. Apr. 27, 2022). As alleged in the complaint, the defendants control the Glupteba botnet, a network of private computers infected with malware. This malware hijacks the infected computers, instructing them to execute commands issued by a command-and-control server (also called a “C2 server”), which controls the computers that are part of the botnet. Google alleges that the defendants use the Glupteba botnet to further several unlawful schemes. In particular, the defendants use the botnet to harvest personal and financial information from the infected computers, which they then sell; the defendants use the botnet to place disruptive ads on the infected computers; the defendants use the infected computers to 2 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 3 of 11 mine cryptocurrency; and the defendants use the infected computers as proxies, directing third-party internet traffic through them to disguise its origins. Google filed the present lawsuit on December 2, 2021, bringing claims for violation of the Racketeer Influenced and Corrupt Organizations (“RICO”) Act, the Computer Fraud and Abuse Act (“CFAA”), the Electronic Communications Privacy Act (“ECPA”), trademark and unfair competition law, and for tortious interference with a business relationship and unjust enrichment. Along with the complaint, Google requested a temporary restraining order enjoining the defendants from their alleged unlawful activities, and permitting Google to request that entities providing services to domains and IP addresses associated with the Glupteba botnet take reasonable best efforts to disrupt the botnet. The temporary restraining order was issued on December 7, granting the requested relief, and authorizing Google to use alternative service “via mail, email, text, and/or service through ICANN.” The temporary restraining order was converted into a preliminary injunction on December 16 after no defendant made an appearance to challenge it. On February 7, 2022, Google requested an entry of default against defendants Starovikov and Filippov (the “Named Defendants.”). Default was entered against the Named Defendants on February 8. On March 1, the Named Defendants appeared at a 3 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 4 of 11 conference, expressing their intention to move to vacate the entry of default against them. On April 27, this Court denied Google’s motion for default judgment and vacated the entry of default against the Named Defendants. See id. at *10. Google’s motion for default judgment against the Doe Defendants was also denied, because the Doe Defendants had not yet been served, and because no certificate of default had issued against them. Id. Google requested a certificate of default against the Doe Defendants on June 9. Accompanying its request, Google submitted a certificate of service stating that the Doe Defendants were served by email, text message, internet publication, and WhatsApp message, as authorized by the temporary restraining order. Default was entered against the Doe Defendants on June 10. On July 19, Google moved for default judgment against the Doe Defendants, requesting an injunction preventing the Doe Defendants from carrying on their alleged unlawful activities. The Named Defendants opposed the motion on August 5. The motion became fully submitted on August 12. Discussion Issuing default judgment against a defendant is a two-step process: “first, the entry of a default, and second, the entry of a default judgment.” City of New York v. Mickalis Pawn Shop, 4 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 5 of 11 LLC, 645 F.3d 114, 128 (2d Cir. 2011); Fed. R. Civ. P. 55(a)– (b). The clerk must, upon request, enter a default against a party who has “failed to plead or otherwise defend.” Fed. R. Civ. P. 55(a); Bricklayers & Allied Craftworkers Local 2, Albany, N.Y. Pension Fund v. Moulton Masonry & Const., LLC, 779 F.3d 182, 186 (2d Cir. 2015). The entry of default establishes the liability of the defaulting party. Mickalis Pawn Shop, LLC, 645 F.3d at 128. I. Prejudice to the Named Defendants The Named Defendants argue that default judgment cannot be entered against the Doe Defendants until the liability of all defendants has been adjudicated. In support of their argument, the Named Defendants cite the Supreme Court’s decision in Frow v. De La Vega, 82 U.S. 552, 554 (1872), which held that a default judgment could not be entered against defaulting defendants in a fraud conspiracy when the liability of the remaining defendants had yet to be determined. The Second Circuit, however, has held that Frow is likely inapplicable since the adoption of Rule 54(b), which permits the entry of a final judgment against only some defendants when there is “no just reason for delay.” Fed. R. Civ. P. 54(b); Int’l Controls Corp. v. Vesco, 535 F.2d 742, 746 n.4 (2d Cir. 1976). “[A]t most, Frow controls in situations where the liability of one defendant necessarily depends upon the 5 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 6 of 11 liability of the others.” Int’l Controls Corp., 535 F.2d at 746 n.4; see also Charles Alan Wright, Arthur R. Miller & Mary Kay Kane, 10A Federal Practice and Procedure § 2690 (4th ed. 2022) (the Frow rule applies “when the liability is joint and several,” or when “it is necessary that the relief against the defendants be consistent.”). The Named Defendants argue that relief must be consistent among the defendants, because Google requests the same relief against them as they request against the Doe Defendants, and because Google alleges that all defendants, without distinction, operate the Glupteba botnet and associated criminal scheme. But the Named Defendants do not explain what inconsistency or prejudice would arise if Google were to obtain a default judgment against the Doe Defendants and not them. Google does not seek, on this motion, to hold the defendants jointly and severally liable for any damages. It requests only an injunction prohibiting the Doe Defendants from engaging in the kind of unlawful activity alleged in the Complaint. The Named Defendants will not be prejudiced if such an injunction issues against only the Doe Defendants. Indeed, the Named Defendants have repeatedly disclaimed any participation in this activity. Accordingly, the rule announced in Frow does not preclude default judgment against the Doe Defendants. 6 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 7 of 11 II. Service Even if the Named Defendants had an interest in opposing a default judgment against the Doe Defendants, however, the Named Defendants have not shown that default judgment against the Doe Defendants is unwarranted. The Named Defendants argue that default judgment cannot be awarded against the Doe Defendants because the Doe Defendants were not properly served. For the same reasons as expressed in the April 27 Opinion, however, the Doe Defendants have been adequately served. 1239656, at *5. Google LLC, 2022 WL An individual in a foreign country may be served by any “means not prohibited by international agreement, as the court orders.” Fed. R. Civ. P. 4(f)(3). Additionally, under the Due Process Clause, service must be “reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.” Oneida Indian Nation of N.Y. v. Madison County, 665 F.3d 408, 428 (2d Cir. 2011) (quoting Jones v. Flowers, 547 U.S. 220, 226 (2006)). Google served the Doe Defendants by publishing information about the lawsuit at https://www.serviceofprocess.xyz/glupteba, by text message, by email, and by WhatsApp message. The email addresses and phone numbers were associated with accounts used to register domain names associated with the Glupteba botnet. Twenty-two of the twenty-six messages sent were successfully 7 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 8 of 11 delivered, and three of the four recipients of WhatsApp messages read the message that was sent to them. The Named Defendants object that these phone numbers and email addresses were not reasonably calculated to reach the Doe Defendants because there was no showing that the Doe Defendants used that contact information. But Google gathered this contact information from accounts used to register domains associated with the Glupteba botnet. The Doe Defendants therefore used the contact information for at least that purpose. The Named Defendants speculate that some of the Doe Defendants may not have received notice because their email addresses may have been deactivated, and because four of the twenty-six text messages sent failed to deliver. But this argument regarding whether the Doe Defendants received actual notice does not speak to the relevant inquiry, which is whether the methods for service of process were “reasonably calculated” to provide notice. Id.; see also Mennonite Bd. Of Missions v. Adams, 462 U.S. 791, 798 (1983) (“constructive notice” is sufficient when the defendant is not “reasonably identifiable.”). Google’s attempts at service of process satisfy this standard. It posted information about the action on a publicly accessible website, and served the Doe Defendants electronically via all the contact information it had available to it. Other District Courts have found such service against 8 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 9 of 11 unidentified defendants alleged to have disseminated malware sufficient to support default judgment. See, e.g., Microsoft Corp. v. Does 1–2, 20CV01217, 2021 WL 4260665, at *2 (E.D.N.Y. Sept. 20, 2021); Microsoft Corp. v. Does 1–51, 17CV04566, 2018 WL 3471083, at *1 (N.D. Ga. June 18, 2018). Finally, the Named Defendants argue that Google could identify the Doe Defendants through discovery, suggesting that Google request information about the Doe Defendants from other entities, including Valtron, the company at which the Named Defendants worked. But Google is not required to take every possible measure to identify the Doe Defendants, so long as it has pursued methods of service “reasonably calculated” to provide them notice. See Mennonite Bd. of Missions, 462 U.S. at 798 n.4 (declining to require “extraordinary efforts to discover the identity and whereabouts of a [party] whose identity is not in the public record.”). Nor have the Named Defendants provided any reason to think that additional discovery would help identify the Doe Defendants. Indeed, when Google sought information about other employees of Valtron from the Named Defendants in discovery, the Named Defendants provided little more than the first names of several other individuals. Accordingly, Google’s efforts at service are sufficient to satisfy Fed. R. Civ. P. 4(f)(3) and the Due Process Clause. 9 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 10 of 11 III. Liability Finally, the Named Defendants argue that Google is not entitled to default judgment against the Doe Defendants because it has not established the Doe Defendants’ liability. A court must accept all factual allegations against a defaulting defendant as true. Cir. 2009). Finkel v. Romanowicz, 577 F.3d 79, 84 (2d Before issuing a default judgment, however, the court “is also required to determine whether the . . . allegations establish . . . liability as a matter of law.” Id. The April 27 Opinion found that Google’s complaint stated valid causes of action. Google LLC, 2022 WL 1239656, at *7–10. The Named Defendants nevertheless argue that Google has not established liability against the Doe Defendants, because the April 27 Opinion applies only to the Named Defendants, not the Doe Defendants. The complaint states valid causes of action against the Doe Defendants as well as the Named Defendants, and the Named Defendants have not provided any argument to explain why Google’s allegations against the Doe Defendants are insufficient. Accordingly, Google has sufficiently established the Doe Defendants’ liability. IV. Final Judgment When an action involves multiple parties, a court may enter final judgment against a subset of the parties, but “only if the court expressly determines that there is no just reason for 10 Case 1:21-cv-10260-DLC Document 129 Filed 09/30/22 Page 11 of 11
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
