Google LLC v. Dmitry Starovikov

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF NEW YORK

-------------------------------------- X

:

GOOGLE LLC, :

:

Plaintiff, :

: 2 1 c v 1 0 2 6 0 (DLC)

-v- :

: OPINION AND ORDER

DMITRY STAROVIKOV, ALEXANDER FILIPPOV, :

and DOES 1–15, :

:

Defendants. :

:

-------------------------------------- X

APPEARANCES:

For plaintiff:

Andrew Zenner Michaelson

Kathleen Elizabeth McCarthy

Laura Elizabeth Harris

King & Spaulding LLP (NYC)

1185 Avenue of the Americas

New York, NY 10036

Bethany Rupert

King & Spalding

1180 Peachtree Street NE

Atlanta, GA 30309

David Paul Mattern

Sumon Dantiki

King & Spalding LLP (DC)

1700 Pennsylvania Avenue, N.W.

Washington, DC 20006

For defendants:

Igor B. Litvak

The Litvak Law Firm, PLLC

1733 Sheepshead Bay Road

Suite 22

Brooklyn, NY 11235

DENISE COTE, District Judge:

Google LLC (“Google”) has brought claims against the

defendants for operating a botnet to steal and exploit Google

users’ personal information. Google now moves for the entry of

default judgment against defendants Does 1–15 (the “Doe

Defendants”). For the following reasons, Google’s motion is

granted.

Background

This Court presumes familiarity with its prior Opinion in

this action denying default judgment against the named

defendants, and summarizes only the facts necessary to resolve

this motion. See Google LLC v. Starovikov, 21CV10260, 2022 WL

1239656 (S.D.N.Y. Apr. 27, 2022). As alleged in the complaint,

the defendants control the Glupteba botnet, a network of private

computers infected with malware. This malware hijacks the

infected computers, instructing them to execute commands issued

by a command-and-control server (also called a “C2 server”),

which controls the computers that are part of the botnet.

Google alleges that the defendants use the Glupteba botnet

to further several unlawful schemes. In particular, the

defendants use the botnet to harvest personal and financial

information from the infected computers, which they then sell;

the defendants use the botnet to place disruptive ads on the

infected computers; the defendants use the infected computers to

mine cryptocurrency; and the defendants use the infected

computers as proxies, directing third-party internet traffic

through them to disguise its origins.

Google filed the present lawsuit on December 2, 2021,

bringing claims for violation of the Racketeer Influenced and

Corrupt Organizations (“RICO”) Act, the Computer Fraud and Abuse

Act (“CFAA”), the Electronic Communications Privacy Act

(“ECPA”), trademark and unfair competition law, and for tortious

interference with a business relationship and unjust enrichment.

Along with the complaint, Google requested a temporary

restraining order enjoining the defendants from their alleged

unlawful activities, and permitting Google to request that

entities providing services to domains and IP addresses

associated with the Glupteba botnet take reasonable best efforts

to disrupt the botnet. The temporary restraining order was

issued on December 7, granting the requested relief, and

authorizing Google to use alternative service “via mail, email,

text, and/or service through ICANN.” The temporary restraining

order was converted into a preliminary injunction on December 16

after no defendant made an appearance to challenge it.

On February 7, 2022, Google requested an entry of default

against defendants Starovikov and Filippov (the “Named

Defendants.”). Default was entered against the Named Defendants

on February 8. On March 1, the Named Defendants appeared at a

conference, expressing their intention to move to vacate the

entry of default against them. On April 27, this Court denied

Google’s motion for default judgment and vacated the entry of

default against the Named Defendants. See id. at *10.

Google’s motion for default judgment against the Doe Defendants

was also denied, because the Doe Defendants had not yet been

served, and because no certificate of default had issued against

them. Id.

Google requested a certificate of default against the Doe

Defendants on June 9. Accompanying its request, Google

submitted a certificate of service stating that the Doe

Defendants were served by email, text message, internet

publication, and WhatsApp message, as authorized by the

temporary restraining order. Default was entered against the

Doe Defendants on June 10.

On July 19, Google moved for default judgment against the

Doe Defendants, requesting an injunction preventing the Doe

Defendants from carrying on their alleged unlawful activities.

The Named Defendants opposed the motion on August 5. The motion

became fully submitted on August 12.

Discussion

Issuing default judgment against a defendant is a two-step

process: “first, the entry of a default, and second, the entry

of a default judgment.” City of New York v. Mickalis Pawn Shop,

LLC, 645 F.3d 114, 128 (2d Cir. 2011); Fed. R. Civ. P. 55(a)–

(b). The clerk must, upon request, enter a default against a

party who has “failed to plead or otherwise defend.” Fed. R.

Civ. P. 55(a); Bricklayers & Allied Craftworkers Local 2,

Albany, N.Y. Pension Fund v. Moulton Masonry & Const., LLC, 779

F.3d 182, 186 (2d Cir. 2015). The entry of default establishes

the liability of the defaulting party. Mickalis Pawn Shop, LLC,

645 F.3d at 128.

I. Prejudice to the Named Defendants

The Named Defendants argue that default judgment cannot be

entered against the Doe Defendants until the liability of all

defendants has been adjudicated. In support of their argument,

the Named Defendants cite the Supreme Court’s decision in Frow

v. De La Vega, 82 U.S. 552, 554 (1872), which held that a

default judgment could not be entered against defaulting

defendants in a fraud conspiracy when the liability of the

remaining defendants had yet to be determined.

The Second Circuit, however, has held that Frow is likely

inapplicable since the adoption of Rule 54(b), which permits the

entry of a final judgment against only some defendants when

there is “no just reason for delay.” Fed. R. Civ. P. 54(b);

Int’l Controls Corp. v. Vesco, 535 F.2d 742, 746 n.4 (2d Cir.

1976). “[A]t most, Frow controls in situations where the

liability of one defendant necessarily depends upon the

liability of the others.” Int’l Controls Corp., 535 F.2d at 746

n.4; see also Charles Alan Wright, Arthur R. Miller & Mary Kay

Kane, 10A Federal Practice and Procedure § 2690 (4th ed. 2022)

(the Frow rule applies “when the liability is joint and

several,” or when “it is necessary that the relief against the

defendants be consistent.”).

The Named Defendants argue that relief must be consistent

among the defendants, because Google requests the same relief

against them as they request against the Doe Defendants, and

because Google alleges that all defendants, without distinction,

operate the Glupteba botnet and associated criminal scheme. But

the Named Defendants do not explain what inconsistency or

prejudice would arise if Google were to obtain a default

judgment against the Doe Defendants and not them. Google does

not seek, on this motion, to hold the defendants jointly and

severally liable for any damages. It requests only an

injunction prohibiting the Doe Defendants from engaging in the

kind of unlawful activity alleged in the Complaint. The Named

Defendants will not be prejudiced if such an injunction issues

against only the Doe Defendants. Indeed, the Named Defendants

have repeatedly disclaimed any participation in this activity.

Accordingly, the rule announced in Frow does not preclude

default judgment against the Doe Defendants.

II. Service

Even if the Named Defendants had an interest in opposing a

default judgment against the Doe Defendants, however, the Named

Defendants have not shown that default judgment against the Doe

Defendants is unwarranted. The Named Defendants argue that

default judgment cannot be awarded against the Doe Defendants

because the Doe Defendants were not properly served. For the

same reasons as expressed in the April 27 Opinion, however, the

Doe Defendants have been adequately served. Google LLC, 2022 WL

1239656, at *5. An individual in a foreign country may be

served by any “means not prohibited by international agreement,

as the court orders.” Fed. R. Civ. P. 4(f)(3). Additionally,

under the Due Process Clause, service must be “reasonably

calculated, under all the circumstances, to apprise interested

parties of the pendency of the action and afford them an

opportunity to present their objections.” Oneida Indian Nation

of N.Y. v. Madison County, 665 F.3d 408, 428 (2d Cir. 2011)

(quoting Jones v. Flowers, 547 U.S. 220, 226 (2006)).

Google served the Doe Defendants by publishing information

about the lawsuit at https://www.serviceofprocess.xyz/glupteba,

by text message, by email, and by WhatsApp message. The email

addresses and phone numbers were associated with accounts used

to register domain names associated with the Glupteba botnet.

Twenty-two of the twenty-six messages sent were successfully

delivered, and three of the four recipients of WhatsApp messages

read the message that was sent to them.

The Named Defendants object that these phone numbers and

email addresses were not reasonably calculated to reach the Doe

Defendants because there was no showing that the Doe Defendants

used that contact information. But Google gathered this contact

information from accounts used to register domains associated

with the Glupteba botnet. The Doe Defendants therefore used the

contact information for at least that purpose.

The Named Defendants speculate that some of the Doe

Defendants may not have received notice because their email

addresses may have been deactivated, and because four of the

twenty-six text messages sent failed to deliver. But this

argument regarding whether the Doe Defendants received actual

notice does not speak to the relevant inquiry, which is whether

the methods for service of process were “reasonably calculated”

to provide notice. Id.; see also Mennonite Bd. Of Missions v.

Adams, 462 U.S. 791, 798 (1983) (“constructive notice” is

sufficient when the defendant is not “reasonably

identifiable.”). Google’s attempts at service of process

satisfy this standard. It posted information about the action

on a publicly accessible website, and served the Doe Defendants

electronically via all the contact information it had available

to it. Other District Courts have found such service against

unidentified defendants alleged to have disseminated malware

sufficient to support default judgment. See, e.g., Microsoft

Corp. v. Does 1–2, 20CV01217, 2021 WL 4260665, at *2 (E.D.N.Y.

Sept. 20, 2021); Microsoft Corp. v. Does 1–51, 17CV04566, 2018

WL 3471083, at *1 (N.D. Ga. June 18, 2018).

Finally, the Named Defendants argue that Google could

identify the Doe Defendants through discovery, suggesting that

Google request information about the Doe Defendants from other

entities, including Valtron, the company at which the Named

Defendants worked. But Google is not required to take every

possible measure to identify the Doe Defendants, so long as it

has pursued methods of service “reasonably calculated” to

provide them notice. See Mennonite Bd. of Missions, 462 U.S. at

798 n.4 (declining to require “extraordinary efforts to discover

the identity and whereabouts of a [party] whose identity is not

in the public record.”). Nor have the Named Defendants provided

any reason to think that additional discovery would help

identify the Doe Defendants. Indeed, when Google sought

information about other employees of Valtron from the Named

Defendants in discovery, the Named Defendants provided little

more than the first names of several other individuals.

Accordingly, Google’s efforts at service are sufficient to

satisfy Fed. R. Civ. P. 4(f)(3) and the Due Process Clause.

III. Liability

Finally, the Named Defendants argue that Google is not

entitled to default judgment against the Doe Defendants because

it has not established the Doe Defendants’ liability. A court

must accept all factual allegations against a defaulting

defendant as true. Finkel v. Romanowicz, 577 F.3d 79, 84 (2d

Cir. 2009). Before issuing a default judgment, however, the

court “is also required to determine whether the . . .

allegations establish . . . liability as a matter of law.” Id.

The April 27 Opinion found that Google’s complaint stated

valid causes of action. Google LLC, 2022 WL 1239656, at *7–10.

The Named Defendants nevertheless argue that Google has not

established liability against the Doe Defendants, because the

April 27 Opinion applies only to the Named Defendants, not the

Doe Defendants. The complaint states valid causes of action

against the Doe Defendants as well as the Named Defendants, and

the Named Defendants have not provided any argument to explain

why Google’s allegations against the Doe Defendants are

insufficient. Accordingly, Google has sufficiently established

the Doe Defendants’ liability.

IV. Final Judgment

When an action involves multiple parties, a court may enter

final judgment against a subset of the parties, but “only if the

court expressly determines that there is no just reason for

delay.” Fed. R. Civ. PB. 54(b). The court’s Rule 54(b)

certification “must be accompanied by a reasoned, even if brief,

explanation of its conclusion.” O’Bert ex rel. Estate of O' Bert

v. Vargo, 331 F.3d 29, 41 (2d Cir. 2003).

Final judgment against the Doe Defendants is appropriate

because, for many of the reasons stated above, there is no just

reason for delay. The Doe Defendants’ default establishes that

they participated in a continuing criminal enterprise to harm

Google and its users. Additionally, the claims against the Doe

Defendants are factually separable from the claims against the

Named Defendants, who would not be prejudiced by a default

judgment against the Doe Defendants. Accordingly, final

Judgment may be entered against the Doe Defendants pursuant to

Rule 54({b).

Conclusion

Google’s July 19, 2022 motion for default judgment against

the Doe Defendants is granted. A separate Order issuing the

judgment wiil accompany this Opinion.

Dated: New York, New York

September 30, 2022

Menus Ly i

DENTSE COTE

United States District Judge

11