Google LLC v. Dmitry Starovikov

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF NEW YORK

-------------------------------------- X

:

GOOGLE LLC, :

:

Plaintiff, :

: 2 1 c v 1 0 2 6 0 (DLC)

-v- :

: OPINION AND ORDER

DMITRY STAROVIKOV, ALEXANDER FILIPPOV, :

and DOES 1–15, :

:

Defendants. :

:

-------------------------------------- X

APPEARANCES:

For plaintiff:

Andrew Zenner Michaelson

Kathleen Elizabeth McCarthy

Laura Elizabeth Harris

King & Spaulding LLP (NYC)

1185 Avenue of the Americas

New York, NY 10036

Bethany Rupert

King & Spalding

1180 Peachtree Street NE

Atlanta, GA 30309

David Paul Mattern

Sumon Dantiki

King & Spalding LLP (DC)

1700 Pennsylvania Avenue, N.W.

Washington, DC 20006

For Defendants:

Igor B. Litvak

The Litvak Law Firm, PLLC

1733 Sheepshead Bay Road

Suite 22

Brooklyn, NY 11235

DENISE COTE, District Judge:

Google LLC (“Google”) has brought claims against the

defendants for operating a botnet to steal and exploit Google

users’ personal information. Dmitry Starovikov and Alexander

Filippov, the two named individual defendants (the “Defendants”)

failed to timely appear in this action, and after their default

was vacated, produced almost no discovery. The Defendants

assert that the discovery Google requests is held by their

former employer, Valtron LLC (“Valtron”), which Google alleges

operated many of the Defendants’ criminal schemes. Google

contends that the Defendants misrepresented their relationship

with Valtron to this Court and to Google, and that the

Defendants spoliated critical evidence. Google has filed a

motion for sanctions, in the form of monetary sanctions and

entry of a default judgment, against Dmitry Starovikov,

Alexander Filippov, and sanctions against their attorney, Igor

Litvak. The Defendants have cross-moved for sanctions. For the

following reasons, Google’s motion is granted, and the

Defendants’ motion is denied.

Background

This Court presumes familiarity with its prior Opinions in

this action. See Google LLC v. Starovikov, 21CV10260, 2022 WL

1239656 (S.D.N.Y. Apr. 27, 2022) (vacating the entry of

default); Google LLC v. Starovikov, 21CV10260, 2022 WL 4592899

(S.D.N.Y. Sept. 30, 2022) (issuing default judgment against

defendants Does 1–15). The complaint alleges that the

Defendants control the Glupteba botnet, a network of private

computers infected with malware. This malware hijacks the

infected computers, instructing them to execute commands issued

by a command-and-control server (also called a “C2 server”),

which controls the computers that are part of the botnet.

Conventional botnets receive instructions from C2 servers

whose domains or IP addresses are hardcoded in the botnet

malware. This means that a conventional botnet can be disabled

by taking the server at the hardcoded address offline. The

Glupteba malware, however, instructs infected computers to look

for the addresses of its C2 servers by referencing transactions

associated with specific accounts on the Bitcoin blockchain.

The blockchain is not controlled by any central authority, and

each transaction is disseminated to and viewable by any user on

the blockchain. These features make the Glupteba botnet

unusually resistant to disruption. If the botnet's C2 servers

are disabled, then its operators can simply set up new servers

and broadcast their addresses on the blockchain.

Google alleges that the Defendants use the Glupteba botnet

to further several unlawful schemes (collectively, the “Glupteba

Enterprise”). In particular, the Defendants use the botnet to

harvest personal and financial information from the infected

computers, which they then sell; the Defendants use the botnet

to place disruptive ads on the infected computers; the

Defendants use the infected computers to mine cryptocurrency;

and the Defendants use the infected computers as proxies,

directing third-party internet traffic through the infected

computers to disguise the origin of the traffic. The Defendants

operate these criminal schemes through various corporate

entities, including Valtron. Google also alleges that

Starovikov and Filippov used some of the botnet’s C2 servers

when signing up for their own Google accounts, that they operate

the botnet, and that they acted as administrators for Valtron’s

Google Workspace account.

Google filed the present lawsuit on December 2, 2021,

bringing claims for violation of the Racketeer Influenced and

Corrupt Organizations Act, the Computer Fraud and Abuse Act, the

Electronic Communications Privacy Act, trademark and unfair

competition law, and for tortious interference with a business

relationship and unjust enrichment. Along with the complaint,

Google requested a temporary restraining order enjoining the

defendants from their alleged unlawful activities, and

permitting Google to request that entities providing services to

domains and IP addresses associated with the Glupteba botnet

take reasonable best efforts to disrupt the botnet. The

temporary restraining order was issued on December 7, granting

the requested relief, and authorizing Google to use alternative

service “via mail, email, text, and/or service through ICANN.”

The temporary restraining order was converted into a preliminary

injunction on December 16 after no defendant made an appearance

to challenge it.

A. The Defendants’ Default

On February 7, 2022, Google requested an entry of default

from the Clerk of Court against Defendants Starovikov and

Filippov, describing their efforts on December 8 through 10 to

serve the Defendants by the methods authorized in the temporary

restraining order. Default was entered by the Clerk of Court

against them on February 8. An Order of February 1 required

Google to move for entry of a default 21 days thereafter.

On February 24, Litvak submitted a letter requesting that

the February 1 Order be suspended, and proposed a schedule for

filing a motion to vacate the default entered against the two

Defendants. The schedule for the motion was set at a conference

held on March 1. At the March 1 conference, Litvak represented

that the Defendants had never received notice of the action, and

that they only found out about it from their friends toward the

end of January. Google argued that the Defendants had received

notice, however, because they had actively set up new C2 servers

after Google had taken the previous ones offline. Google

explained that the Defendants would have known when the original

C2 servers were taken offline, because they had used the IP

addresses associated with those servers when signing up for

their Google accounts.

On March 14, the Defendants submitted a motion to vacate

the default, arguing that they had not been served, that the

Court lacked jurisdiction over them, and that they had

meritorious defenses, including that Google had failed to state

a claim against them. In support of their motion, the

Defendants submitted nearly identical signed declarations, each

of which stated: “I work for Valtron LLC as a software

engineer.” The declarations also asserted that the Defendants

had never received service of process, and did not receive

actual notice of the action until late January, when they heard

about it from “friends.” Google submitted a cross-motion for

default judgment against the Defendants on March 25, arguing

that the Defendants had agreed to waive personal jurisdiction in

their discussions with Google, and that they had no other

meritorious defenses. The motions became fully submitted on

April 19.

In an Opinion of April 27, this Court denied Google’s

motion for default judgment and vacated the entry of default

against the Defendants.1 See id. at *10. Although the Opinion

1 Google’s request for default judgment was also denied with

respect to Does 1–15, because the certificate of default did not

found it “improbable” that “all of Google’s attempts at service

. . . failed to provide the defendants with actual notice,” the

Opinion was unwilling to find that the Defendants’ default was

“willful” on the record before it. Id. at *3. The Opinion also

held that the Defendants had not waived personal jurisdiction,

but that the Court had jurisdiction over the Defendants

regardless. Id. at *4. And the Opinion found that the

Defendants should be provided the opportunity to mount a defense

by contesting their involvement in or knowledge of the botnet,

although they were unlikely to successfully seek dismissal of

the complaint for failure to state a claim. Id. at *7–10. With

these rulings, the Court allowed the Defendants to proceed so

that they could contest their participation in or knowledge of

the unlawful acts alleged in the complaint. Id. at *3.

Finally, the Opinion found that the Defendants’ delay did not

significantly prejudice Google, because the parties could still

“conduct expeditious and targeted discovery.” Id. at *10.

B. Case Management Plan

On May 11, the Defendants answered the complaint, bringing

a counterclaim for tortious interference with a prospective

business relationship. In support of this counterclaim, the

state that those defendants had been served. Id. Google then

served and obtained an entry of default against Does 1–15, and

default judgment was issued against them on September 30.

Google, LLC, 2022 WL 4592899, at *4.

Defendants alleged that Google “improperly interfered with

Defendants’ present and prospective relationships with their

employer, its clients and customers.” The Defendants

voluntarily dismissed their counterclaims on May 24, before

Google submitted a response.

At around the same time, the parties began to discuss a

discovery plan. On May 17, Google shared with Litvak a proposed

plan indicating that Google intended to request the electronic

devices that the Defendants used in connection with their

business. On May 20, Litvak responded, proposing discovery of

any computers or devices used in Google’s investigation of the

Defendants, and limiting discovery of the Defendants’ devices to

those devices “over which the Defendants have actual physical

control and possession.” Google rejected the Defendants’

modifications, instead proposing on May 31 to remove all

language specifically referencing a device exchange. Litvak

replied, however, that he liked the “initial version” much

better, asking to keep it. Ultimately, the parties submitted a

report pursuant to Rule 26(f), Fed. R. Civ. P., that did not

specifically mention a device exchange.

C. Rule 16 Conference

On June 1, the Court held a Rule 16 conference. At the

conference, the parties agreed that the case would proceed as a

nonjury action because Google had withdrawn its claim for

damages, seeking only injunctive relief. Google explained that

the Defendants had told them that they were interested in

settling, and that they could potentially help Google by taking

the botnet offline. But Google expressed frustration that the

Defendants were unwilling to consent to a permanent injunction,

and unable to articulate why an injunction forbidding them from

engaging in unlawful activities would pose a problem. The

Defendants insisted that they were not engaged in criminal

activity, and that any alleged activity in which they were

engaged was legitimate. Nevertheless, the Defendants resisted

entry of a permanent injunction, asserting that Google’s use of

the preliminary injunction had disrupted their normal business

operations.

The parties also expressed at the conference that they were

unable to agree on a location at which the Defendants could be

deposed. Nevertheless, the Defendants affirmed their commitment

to the discovery process, and stated their willingness to

produce documents and to be deposed, so long as their deposition

took place in a country to which they could realistically

travel. The Defendants also stated that they would be willing

to appear at trial, so long as they could travel to the United

States and secure the appropriate visas.

When the parties conferred after the conference to discuss

potential locations for the Defendants’ depositions, however,

the Defendants began to raise additional objections. Litvak

stated that the Defendants were opposed to depositions in a

country from which the Defendants might be extradited to the

United States.2 Additionally, Litvak also revealed the next day

that the Defendants did not have international passports, and

therefore could only be deposed in Russia, Belarus, or

Kazakhstan.

On June 3, the parties submitted letters to the Court

stating that they were unable to agree on a location for the

Defendants’ depositions. The same day, the Court vacated the

scheduling Order issued only two days before. The Court issued

an additional Order on June 9 staying discovery of the

plaintiff, and ordering the Defendants to comply with their

initial disclosure obligations pursuant to Rule 26(a)(1), Fed.

R. Civ. P., by June 17. The Order of June 9 also explained that

there was reason to believe that the Defendants sought discovery

only “to learn whether they could circumvent the steps that

Google has taken to block the malware described in its

complaint,” and expressed concern that the Defendants would “not

2 The parties disagree about whether the Defendants firmly

refused to appear in a country with an extradition treaty, or

whether they were merely “concerned” about doing so. As

discussed in more detail below, however, this disagreement is

not material to the parties’ motions.

participate in good faith in the discovery process and that

their counsel has not been candid with the Court.”

The June 9 Order required Google to propose three countries

in Europe at which it would be willing to depose the Defendants,

and ordered the parties to update the Court by June 14 as to

whether the Defendants were willing to be deposed there. On

June 14, the parties submitted letters explaining that they had

still not come to an agreement. On June 17, the Court ordered

the Defendants to diligently attempt to obtain a passport, and

to update the Court on their progress doing so by September 16.

D. Initial Disclosures

The Defendants served their initial disclosures on June 17,

and served amended initial disclosures on June 27. In their

disclosures, the Defendants identified seven individuals who

potentially had discoverable information at Valtron’s office

address, but did not provide their surnames. The Defendants

also listed themselves as potential witnesses, describing

Filippov as a “Valtron Software Engineer.” The Defendants

declined to provide any electronic devices to Google, however,

stating that any relevant electronic device was in Valtron’s

possession, not theirs. As Google continued to press the

Defendants to turn over any devices to which they had access,

the Defendants on July 19 represented for the first time that

they no longer worked at Valtron, and so did not have access to

any of the devices they used while working there.

The same day, Google filed a letter before this Court

requesting a discovery conference to address the deficiencies in

the Defendants’ initial disclosures. Google argued that the

Defendants were failing to comply with their discovery

obligations by refusing to provide their colleagues’ last names,

and by refusing to identify where discoverable documents could

be located.

The Court held a conference on July 29. During the

conference, the Court asked Litvak when the Defendants stopped

working at Valtron. Litvak at first declined to provide any

answer, stating only that they left in 2021. The Court asked

Litvak if he could identify a specific month, and he stated

that, to the best of his memory, the Defendants left Valtron

sometime in the latter half of 2021. The Court then asked

Litvak if he knew that the Defendants had no electronic devices

to produce in discovery at the time the parties discussed an

exchange of devices in May. The Court explained that “if the

correspondence or evidence shows that you discussed in May an

exchange of devices, at a time that you knew there were no

devices in your clients’ possession that could be exchanged,

that is troubling.” Litvak stated that he could not remember

exactly when he first learned that the Defendants no longer

worked at Valtron, but he denied representing that his clients

had ever had access to any electronic devices, and insisted that

he had preferred to take out any mention of a device exchange

entirely.

After the July 29 conference, this Court issued an Order

requiring the plaintiff to serve the Defendants and their

counsel with any questions regarding their knowledge of or

access to discoverable information. On August 8, the Defendants

submitted identical declarations to Google stating that they had

been fired by Valtron at the end of 2021 and had left their

laptops with Valtron in mid-January 2022. The Defendants did

not identify any devices that they used in 2021 or 2022 other

than their work laptops, nor did they identify the categories of

documents or methods of communication they used while at

Valtron. Litvak also sent a letter to Google on August 8

stating that he believed the Defendants would likely find more

discoverable electronic devices and electronically stored

information.

The parties submitted letters to the Court on August 12, in

which the Defendants stated that they were fired from Valtron in

December of 2021 due to a lack of work, that they each used a

laptop while working at Valtron, and that that laptop had been

returned to Valtron in the first half of January 2022.

Additionally, Litvak stated that he first learned that the

Defendants no longer worked for Valtron on May 20.

Each party’s letter requested sanctions against the other

party. In a conference on August 12, the Court set a briefing

schedule on the parties’ motions for sanctions. Google filed

its motion for sanctions on August 22. The Defendants filed

their motion for sanctions, and opposed Google’s motion, on

September 2. Google’s motion became fully submitted on

September 16. The Defendants’ motion became fully submitted on

September 23.

E. Further Discovery and Settlement Discussion

On September 6, Litvak emailed Google that his clients were

willing to discuss settlement. The parties held a call on

September 8, at which Litvak explained that the Defendants would

be willing to provide Google with the private keys for Bitcoin

addresses associated with the Glupteba botnet, and that they

would promise not to engage in their alleged criminal activity

in the future (without any admission of wrongdoing). In

exchange, the Defendants would receive Google’s agreement not to

report them to law enforcement, and a payment of $1 million per

defendant, plus $110,000 in attorney’s fees. The Defendants

stated that, although they do not currently have access to the

private keys, Valtron would be willing to provide them with the

private keys if the case were settled. The Defendants also

stated that they believe these keys would help Google shut down

the Glupteba botnet. Google rejected the Defendants’ offer as

extortionate, and reported it to law enforcement.

On September 15, while the parties’ cross-motions were

being briefed, the Defendants submitted responses to Google’s

discovery requests. The Defendants produced 15 documents,

consisting largely of contracts between the Defendants and

Valtron, license agreements, webpage printouts, and several code

files used to interface with a bank associated with the Glupteba

credit card scheme. The Defendants refused to respond to

Google’s request for inspection of each electronic device the

Defendants have used or owned since 2011. Additionally, the

Defendants responded to Google’s request for the private keys of

the Bitcoin accounts associated with the Glupteba botnet by

stating that they had no such information in their possession,

and that the Bitcoin accounts were owned by Valtron’s CEO.

Discussion

I. Google’s Motion for Sanctions

Google moves to sanction the Defendants and their attorney

for spoliating evidence, and for making various

misrepresentations to the Court in an effort to evade discovery.

The Defendants and Litvak dispute that they ever made any

intentional misrepresentation to either Google or to the Court,

and insist that they were willing to engage in good faith in

discovery. But, by Litvak’s own admission, he misrepresented

the Defendants’ employment status to Google and to the Court,

and attempted to induce an exchange of electronic devices at a

time when he knew that the Defendants had no devices to

exchange. The Court finds that the Defendants have

intentionally withheld information and misrepresented their

willingness and ability to engage in discovery in order to

disadvantage Google in this litigation, avoid liability, and

further profit off of the criminal scheme described in the

complaint.

Because of the Defendants’ shifting representations and

obstinacy during discovery, it is difficult to establish some

facts with certainty. The Court cannot be sure precisely when

or even if the Defendants left their employment at Valtron, and

when their attorney learned that this happened. Nevertheless,

the parties have not requested a hearing regarding their motions

for sanctions, nor would one be helpful. See In re 60 E. 80th

St. Equities, Inc., 218 F.3d 109, 117 (2d Cir. 2000) (holding

that, on a motion for sanctions, “a full evidentiary hearing is

not required; the opportunity to respond by brief or oral

argument may suffice.”). Both parties have submitted evidence,

revealing few, if any, disputes of material fact. Moreover, the

Defendants have had multiple opportunities to explain their

conduct at conferences, in briefs, in response to Google’s

motion for sanctions, and in their own motion for sanctions.

Rather than provide an explanation, however, the Defendants have

frequently used these opportunities to proffer even more

falsehoods.

No further factual inquiry is necessary. The record here

is sufficient to find a willful attempt to defraud the Court and

resist discovery. Despite evidence that the Defendants received

actual notice of this action in early December of 2021, in March

of this year, the Court granted the Defendants’ application to

vacate their default in order that this case could be

adjudicated on the merits. It is now clear that the Defendants

appeared in this Court not to proceed in good faith to defend

against Google’s claims but with the intent to abuse the court

system and discovery rules to reap a profit from Google.

Accordingly, for the reasons given below, Google’s motion is

granted.

A. Factual Findings

i. Misrepresentation Regarding the Defendants’

Employment

When they first appeared in this action, the Defendants

represented through their attorney that they continued to work

at Valtron. The Defendants submitted signed declarations in

connection with their motion to vacate the default that they

each “work for Valtron LLC as a software engineer.” They

asserted in their counterclaim that Google’s actions harmed

their “prospective relationship with their employer.” They

stated at the June 1 initial pretrial conference that the

preliminary injunction was preventing the Defendants “from

engaging in normal business activity.” And they identified

Filippov as a “Valtron Software Engineer” in their initial

disclosures. Each of these statements was false or misleading

if the Defendants had in fact left Valtron in December of 2021,

months before they appeared in this action.

Additionally, these misrepresentations severely prejudiced

Google. The Defendants now insist that they have no

discoverable information regarding Valtron because they returned

their work laptops to Valtron in January 2022, shortly after

they ended their employment, and weeks after Google made efforts

to serve them. But, in moving to vacate the default against

them, the Defendants stated that their delay in appearing “did

not . . . create increased difficulties of discovery.” The

Defendants stated during the March 1 conference that they were

ready to “get the discovery and litigate the case.” And in

vacating the default, the Court found that the Google was not

prejudiced by the Defendants’ delay, because the parties could

“conduct expeditious and targeted discovery.” Google LLC, 2022

WL 1239656, at *10. Accordingly, were it not for the

Defendants’ misrepresentation of their employment status and of

their willingness to participate in discovery, it is unlikely

that the default against them would have been vacated. Since

the Defendants’ appearance, any progress in the action has been

impeded by that falsehood.

Litvak argues that these misrepresentations were

unintentional, and that they accordingly do not provide a basis

for sanctions. Litvak concedes that he misrepresented that the

Defendants continued to work at Valtron. But he says that he

was simply mistaken, and that the Defendants simply failed to

notice the use of the present tense “work” when signing their

affidavits. Litvak states that, when he discovered on May 20

that the Defendants had left their jobs months earlier, he

ceased representing that they were currently employed by

Valtron. The Defendants also argue that their allegations in

their counterclaim, and comments regarding their prospective

business relations, did not affirmatively state that the

Defendants continued to work at Valtron, and so should not be

considered sanctionable misrepresentations.

Although Litvak disputes that he made any intentional

misrepresentation, he provides no explanation for his

“misunderstanding” for roughly five months of his clients’

employment status. Google’s complaint mentions Valtron, among

other organizations, several times in connection with the

Glupteba Enterprise’s criminal schemes, and it alleges that the

Defendants operated Google accounts associated with these

organizations. Litvak asserts that, from “the day [he] was

retained in mid-February until May 20th, 2022, [he] was under

the impression that the Defendants still worked at Valtron.”

But Litvak does not describe what conversations, if any, he had

with the Defendants about their relationships with the

organizations mentioned in Google’s complaint, nor does he

explain how he arrived at the conclusion that they had been

employed by Valtron and were still working there.

When an attorney makes a representation to the court, the

attorney “certifies to the best of [his] knowledge, information,

and belief, formed after an inquiry reasonable under the

circumstances” that the representation has “evidentiary support”

or “will likely have evidentiary support after a reasonable

opportunity for further investigation or discovery.” Fed. R.

Civ. P. 11(b), 11(b)(2). Additionally, an attorney has an

ethical obligation not to knowingly “make a false statement of

fact or law to a tribunal or fail to correct a false statement

of material fact or law previously made.” N.Y. Rules of Prof.

Conduct 3.3(a)(1). As Litvak and the Defendants now concede,

their representations regarding their employment status were

false, and the Defendants provide no explanation for this

falsehood except to label it a “misunderstanding.” But such

labels, without more, cannot excuse a false allegation about a

matter entirely within the Defendants’ knowledge and central to

the claims in this action and the Court’s decisionmaking.

Moreover, Litvak made no attempt to correct the

misrepresentation to this Court for months after he first made

it, until Google raised the issue itself.

The Defendants’ relationship with Valtron, and their access

to discoverable information relevant to Valtron, was essential

to the Defendants’ duty to preserve evidence, to discovery

obligations, and to their motion to vacate the default. Upon

becoming aware of this litigation, the Defendants and their

attorney had an obligation to preserve evidence that they knew

or should have known would be relevant to the litigation.

Fujitsu Ltd. v. Fed. Exp. Corp., 247 F.3d 423, 436 (2d Cir.

2001). Here, however, Litvak asserts that he did not even

ascertain whether the Defendants were still employed at Valtron,

much less determine what information related to their employment

they might be able to preserve, and advise them appropriately.

Litvak has provided no explanation for this failure, and has

declined to respond to Google’s discovery requests asking that

he detail his preservation efforts. Given Litvak’s refusal to

provide these explanations, the record shows that Litvak

misrepresented the Defendants’ employment status to the Court

and to Google, that he then failed to correct that

misrepresentation, that he failed to comply with his duty to

instruct his clients about document preservation rules, and that

the Defendants failed to comply with their preservation

obligations.

Although the Defendants concede that they misstated their

employment status when they said they “work” at Valtron in the

declarations, they dispute that they mischaracterized their

employment status in their counterclaims or in later statements

to Google and to the Court. But the Defendants alleged in their

counterclaim that Google’s actions harmed their “prospective

relationship with their employer.” This allegation -- made at a

time when Litvak asserts he still believed the Defendants worked

at Valtron -- can only be reasonably construed to represent that

the Defendants continued to work for Valtron. The allegation

refers to their “employer” rather than their “former employer,”

and refers to a “prospective relationship” that the Defendants

would have little reason to expect if their employment had been

terminated.

Moreover, the Defendants continued to exploit this

“misunderstanding” even after Litvak asserts that he became

aware that the Defendants no longer worked for Valtron and had

returned their work laptops to Valtron. On May 20, Litvak

proposed that the parties exchange electronic devices in

discovery, and proposed limiting the Defendants’ discovery

obligations to devices “over which the Defendants have actual

and physical control and possession.” When Google rejected this

language and removed the device exchange, Litvak on May 31

requested that it be added back.

Litvak contends that this exchange does not involve any

misrepresentation, as he never stated that the Defendants had

access to any devices, and proposed limiting language to qualify

the Defendants’ discovery obligations. But, until this point,

the Defendants had made uncorrected misrepresentations that they

continued to work at Valtron. Litvak did not inform Google by

May 31 that these representations were false, and he therefore

would have known that Google would rely on them when negotiating

the discovery plan. The limiting language proposed by Litvak

does nothing to ameliorate these misrepresentations. On the

contrary, it exacerbates them, by ensuring that the device

exchange would not be genuinely reciprocal, as Litvak knew by at

least that time that the Defendants would not be providing

critical devices in discovery. Litvak’s conduct is sharp

practice and will not be condoned. His negotiations over an

exchange of devices with Google support Google’s contention that

the Defendants and Litvak sought to weaponize the discovery

obligations contained in the Federal Rules of Civil Procedure to

undermine Google’s efforts to neutralize the Glupteba Entperise

and stop the frauds perpetrated by it.

The parties dispute precisely when Google became aware that

the Defendants no longer worked at Valtron, and therefore no

longer had access to discoverable devices. Litvak asserts that

he explained all of this on a June 27 call. Google, however,

contends that Litvak did not mention the Defendants’ employment

status on the June 27 call, and instead simply asserted that the

Defendants had no discoverable devices. According to Google, it

was not until a July 19 email exchange over the Defendants’

initial disclosures that the Defendants revealed they no longer

worked for Valtron.

The precise date at which Litvak revealed that the

Defendants no longer worked for Valtron, however, is not

material. Even crediting his assertion, the record shows that

the Defendants alleged more than once that they worked for

Valtron while they did not, and that their attorney did not

disclose this misrepresentation for weeks after he alleges he

became aware that it was false, even as he continued to

negotiate a discovery plan premised on that misrepresentation.

This conduct alone would justify sanctions against the

Defendants and Litvak. See Mitchell v. Lyons Prof. Servs.,

Inc., 708 F.3d 463, 467 (2d Cir. 2013) (terminating sanctions

appropriate “upon a finding of willfulness, bad faith, or

reasonably serious fault” (citation omitted)). As explained

below, however, the Defendants’ conduct likely constituted

deliberate spoliation of evidence.

ii. Intentional Spoliation

Although Litvak concedes that he misstated the Defendants’

relationship with Valtron, he argues that this was an innocent

error, and did not constitute an attempt to intentionally

obstruct discovery. The Defendants’ course of conduct

throughout the case, however, evinces a deliberate attempt to

deceive Google and the Court, and to avoid their discovery

obligations while attempting to obtain information from Google

that might weaken its efforts to protect Google’s users and the

security of its business.

The Defendants now assert that they stopped working for

Valtron in December of 2021, and that they turned over their

work laptops to Valtron in early January of 2022. And in their

motion to vacate the default against them, the Defendants stated

that they became aware of the case only in late January.

Although the April 27 Opinion found it “improbable” that the

Defendants had not received actual notice of this action until

late January, it nevertheless declined to find the Defendants’

default willful at the time and opted to let the case proceed on

the merits. Google LLC, 2022 WL 12396656, at *3.

In light of the Defendants’ subsequent dishonesty and the

shifting explanations for their conduct, however, their

representations as to when they received actual notice can no

longer be credited. As the April 27 Opinion explained, the

Defendants were served “at the address listed on [Valtron’s]

website, via email to their Google accounts, via notification

through ICANN, via SMS text message, and through WhatsApp.” Id.

at *3. Additionally, this action was widely reported in

Russian-language media. Id.

These facts alone made it “improbable” that the Defendants

had not received actual notice of this action before late

January. But their conduct since the default was vacated make

this even less likely. The Defendants now assert that they left

Valtron in December of 2021 -- just as this action was filed --

and that they turned their work laptops over to Valtron in early

2022 -- just before acquiring counsel to defend this action.

But the Defendants also now assert that they were aware of

Google’s attempts to disrupt the Glupteba botnet, claiming that

Google’s efforts have disrupted their normal business

operations. Those efforts, however, have been ongoing since

December 7, 2021, when Google obtained the TRO. Additionally,

although the Defendants originally asserted that they first

heard about this action from “friends,” they now assert that

they were instead informed by two other sources: Valtron’s CEO,

and Starovikov’s mother. Finally, the Defendants insist that

this action has made them a “pariah in the Russian IT industry,”

and that they can no longer seek employment or even find housing

as a result of their damaged reputation.

Each of these representations supports a finding that the

Defendants received actual notice before January, when they

allege that they turned over their work laptops to Valtron. The

Defendants cannot credibly assert both that they had no

knowledge of this action, and that it damaged their reputation

to such an extent that even Russian landlords were generally

aware of it. Additionally, Google’s efforts to disrupt the

Glupteba botnet would have at least put them on notice that

Google was shutting down some of their servers, and therefore

put them on inquiry notice of any legal action. Finally, the

Defendants’ shifting explanations for where they first heard

about the lawsuit reduce the credibility of their assertion that

they were first informed about it by third parties almost two

months after it was initiated.

The Court finds that the Defendants were aware of this

action before the dates on which they assert they left Valtron

and turned over their work laptops. As a result, they had an

obligation to preserve discoverable evidence upon becoming aware

of it. Rather than complying with that obligation, however, the

Defendants either got rid of (or more likely have refused to

produce)3 any incriminating devices, and have consistently

disclaimed any ability to recover them during discovery.

Tellingly, the Defendants have refused to identify or produce

any other electronic devices they still possess that might

contain discoverable information. There is little doubt that

their cellphones and personal computers contain a wealth of

information relevant to this litigation and to each of the

issues discussed in this Opinion. Beyond this failure to

cooperate in discovery and produce their currently possessed

devices, their September 8 settlement offer indicates that they

continue to have a working relationship with Valtron’s CEO. As

explained in more detail below, the Defendants’ resistance to

discovery and spoliation of electronically stored information

requires the entry of default judgment against them. See Fed.

R. Civ. P. 37(e)(2)(C).

iii. Other Misconduct

Finally, even if the Defendants in fact were not aware of

this action until January of 2022, and even if they left Valtron

and returned their work laptops without any reason to believe

that the devices would be discoverable, their behavior since

appearing in this action still constitutes intentional

misconduct. When the Defendants first appeared, they stated

3 After all, even in the Defendants’ initial disclosures,

Filippov identified himself as a “Valtron Software Engineer.”

that they were willing to participate in the discovery process.

Almost every time discovery has been requested of them, however,

they put forth a new reason to resist. When Google attempted to

arrange the Defendants’ deposition, they informed the Court that

they could not be deposed outside of Russia because they lacked

international passports. And once the Court indicated that the

Defendants would have to attempt to obtain those passports, the

Defendants came forth with a new reason for resisting

deposition: that they were concerned about extradition.

Additionally, when Google requested electronic devices and

electronically stored information from the Defendants, the

Defendants insisted they did not have any; and when pressed,

they stated that they no longer worked for Valtron, and had

turned over all relevant electronic devices. The Defendants

have refused to identify even so much as a cell phone with

communications relevant to their work at Valtron, despite the

fact that they assert that they have continued to maintain

contact with Valtron’s CEO. At the very least, this pattern of

behavior demonstrates an intentional attempt to mislead the

Court and the plaintiff regarding the Defendants’ ability and

willingness to participate in discovery.

Much of the Defendants’ conduct during the case, however,

evinces a more insidious motive. Since its motion for default

judgment, Google has sought only injunctive relief against the

Defendants to forbid them from engaging in criminal activity in

the future. The Defendants have refused to consent to any such

injunction,4 while at the same time telling Google that they have

the ability to shut down the Glupteba botnet. Google

represented at the June 1 conference -- without contradiction

from the Defendants -- that the Defendants had stated that they

had the ability to help disable the botnet. And in their

September 8 settlement demand, the Defendants told Google that

they could acquire the private keys for the Bitcoin accounts

associated with the botnet, thereby enabling Google to shut it

down. In that offer, however, the Defendants demanded $1

million each from Google and a payment to their counsel. The

Defendants’ offers of cooperation, but refusal to consent to a

preliminary injunction, indicates an intention to use the

litigation as a means of extorting Google, or at least seeking

discovery against Google that could help them evade its efforts

to shut down the botnet.

4 At the June 1 conference, Litvak stated that the Defendants

were unwilling to consent to a permanent injunction because

Google had used the preliminary injunction to disrupt their

lawful business operations. Litvak did not explain what those

lawful business operations were, or how they were distinct from

the criminal schemes alleged in Google’s complaint. Litvak also

failed to disclose that the Defendants no longer worked at

Valtron, and therefore did not address why Google’s operations

against the Glupteba Enterprise would inconvenience the

Defendants in any way now that they no longer worked at Valtron.

Additionally, even though the Defendants offered Google the

private keys to the Glupteba Enterprise’s Bitcoin accounts as

part of their offer, the Defendants refused to turn over those

private keys when they were requested in discovery. The

Defendants have attempted to explain this inconsistency by

asserting that, although they do not currently possess the

private keys, Valtron would be willing to provide them if the

case were settled.5 But this is inconsistent with the

Defendants’ representation -- made only one sentence later in

their brief -- that the Defendants’ request for money as part of

their settlement offer was not a condition for providing Google

with these private keys. If the Defendants can access these

private keys and produce them to Google, they must do so. See

Scherbakovskiy v. Da Capo Al Fine, Ltd., 490 F.3d 130, 138 (2d

Cir. 2007) (“[I]f a party has access and the practical ability

to possess documents not available to the party seeking them,

production may be required.”). If not, they cannot misrepresent

5 The Defendants also insist that they are not certain that the

private keys will help Google shut down the botnet, but merely

“believe” that they might. This assertion, however, is not

credible -- Google has provided a specific list of Bitcoin

addresses associated with the Glupteba botnet, and the

Defendants have not explained how they could be uncertain

whether the private keys they can provide are associated with

those accounts. Regardless, the Defendants’ certainty is not

relevant. If they believe that those private keys are relevant,

and if they can access them, they had an obligation to turn them

over in response to Google’s discovery requests.

their ability to do so in exchange for money. Either way, the

Defendants have intentionally misled Google and the Court and

failed to participate in this litigation in good faith.

B. Default Judgment Sanction

“If a party fails to obey an order to provide or permit

discovery, the district court may impose sanctions, including

rendering a default judgment against the disobedient party.”

Guggenheim Capital, LLC v. Birnbaum, 722 F.3d 444, 450 (2d Cir.

2013) (quoting Fed. R. Civ. P. 37(b)(2)(A)(vi)). In determining

what sanctions are warranted, a court should consider “(1) the

willfulness of the non-compliant party; (2) the efficacy of

lesser sanctions; (3) the duration of the noncompliance; and (4)

whether the non-compliant party had been warned that

noncompliance would be sanctioned.” Id. at 451; see also Funk

v. Belneftekhim, 861 F.3d 354, 366 (2d Cir. 2017). Entry of a

default is an extreme sanction, and may be appropriate “when a

court finds willfulness, bad faith, or any fault on the part of

the noncompliant party.” Guggenheim Capital, LLC, 722 F.3d at

451 (citation omitted).

Additionally, a court may award sanctions “[i]f

electronically stored information that should have been

preserved in the anticipation or conduct of litigation is lost

because a party failed to take reasonable steps to preserve it,

and it cannot be restored or replaced through additional

discovery.” Fed. R. Civ. P. 37(e). Upon a finding “that the

party acted with the intent to deprive another party of the

information’s use in litigation”, the court may issue an adverse

inference as to the lost information “or enter a default

judgment.” Fed. R. Civ. P. 37(e)(2)(C). Courts in this

district have found that a party acts with intent to deprive

another party of discoverable evidence when:

(1) evidence once existed that could fairly be

supposed to have been material to the proof or defense

of a claim at issue in the case; (2) the spoliating

party engaged in an affirmative act causing the

evidence to be lost; (3) the spoliating party did so

while it knew or should have known of its duty to

preserve the evidence; and (4) the affirmative act

causing the loss cannot be credibly explained as not

involving bad faith by the reason proffered by the

spoliator.

Charlestown Capital Advisors, LLC v. Acero Junction, Inc., 337

F.R.D. 47, 67 (S.D.N.Y. 2020) (citation omitted).

Each of these provisions justifies the entry of a default

judgment against the Defendants. On June 9, this Court ordered

the Defendants to serve their initial disclosures by June 17.

And on July 29, the Court ordered the Defendants to respond to

Google’s questions regarding their knowledge of or access to

discoverable information. As explained above, the Defendants’

incomplete and dishonest disclosures constituted a willful

violation of those orders. The Defendants’ misconduct began

almost as soon as they entered the case, when they

misrepresented their ability or willingness to engage in the

discovery process, and has continued since. At each stage, the

Defendants have proffered new reasons for resisting Google’s

discovery efforts, even when those reasons contradict previous

representations. Additionally, the Defendants were warned in

the June 9 Order and the July 29 conference that they appeared

to be engaging in misconduct. Finally, the Defendants have been

given ample opportunity to explain their behavior, and to

respond to Google’s request for sanctions.

For similar reasons, the record shows that the Defendants

acted with an intent to deprive Google of discoverable

information. The Defendants knew shortly after the lawsuit was

filed, when Google’s efforts to combat the Glupteba botnet

pursuant to the TRO took effect, that they would face

litigation. And they would also have known that their work

laptops would contain evidence relevant to the case, as the

Complaint alleges that the Defendants operated their criminal

schemes at least in part through Valtron. Nevertheless, the

Defendants assert that they turned the laptops over to Valtron,

and if they in fact did so, turned them over without taking any

effort to preserve discoverable information on those laptops, or

to obtain any such information since. Finally, because the

Defendants have known of this action nearly since its inception,

their conduct cannot be explained by any good faith

justification. Entry of a default judgment is therefore

appropriate under Rule 37(e), Fed. R. Civ. P.

Lesser sanctions would not be appropriate. The Defendants

have produced almost no discovery, and there is no indication

that they would be willing or able to produce any more. Lesser

sanctions requiring an adverse inference as to facts about which

the Defendants resisted discovery would effectively vitiate the

Defendants’ entire case, as the Defendants have resisted almost

all discovery. An adverse inference would therefore result in

the functional equivalent of a judgment.

Additionally, a sanction of a judgment is particularly

appropriate here because the Defendants’ misconduct began as a

means to vacate the default against them. In vacating the

default, the Court relied on the Defendants’ representations

that they continued to work at Valtron, and that their delay in

appearing would not inhibit discovery. Google LLC, 2022 WL

1239656, at *10. Those representations were false, and the

Defendants now claim that they have no discoverable information.

Accordingly, entry of a judgment against the Defendants is

necessary to adequately deter such misrepresentations, and to

“restore the prejudiced party to the same position [it] would

have been in” absent the Defendants’ wrongful conduct. West v.

Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999)

(citation omitted).

C. Monetary Sanctions

“Every district court has the inherent power to supervise

and control its own proceedings and to sanction counsel or a

litigant.” Mitchell, 708 F.3d at 467 (2d Cir. 2013) (citation

omitted). “Indeed . . . district judges have an obligation to

act to protect the public, adversaries, and judicial resources

from litigants and lawyers who show themselves to be serial

abusers of the judicial system.” Liebowitz v. Bandshell Artist

Mgmt., 6 F.4th 267, 280 (2d Cir. 2021). A district court's

inherent power to sanction includes the power to “sanction a

party . . . to deter abuse of the judicial process and prevent a

party from perpetrating a fraud on the court.” Yukos Cap.

S.A.R.L. v. Feldman, 977 F.3d 216, 235 (2d Cir. 2020).

Accordingly, federal courts have the “inherent power” to award

monetary sanctions against a party for that party’s “bad faith,

vexatious, or wanton” misconduct. Int’l Techs. Marketing, Inc.

v. Verint Sys. Ltd., 991 F.3d 361, 368 (2d Cir. 2021) (citation

omitted).

The power to sanction “must be exercised with restraint and

discretion.” Chambers v. NASCO, Inc., 501 U.S. 32, 44 (1991).

Nevertheless, even a single misrepresentation is enough to

justify sanctions: “A court need not wait until a party commits

multiple misrepresentations before it may put a stop to the

party’s chicanery.” Int’l Techs. Marketing, Inc., 991 F.3d at

368–69.

The Federal Rules of Civil Procedure also authorize

monetary sanctions for misconduct during discovery. See Fed. R.

Civ. P. 26(g) (allowing monetary sanctions, including the

“reasonable expenses” and “attorney’s fees” incurred as a result

of an incomplete or incorrect initial disclosure); Fed. R. Civ.

P. 37(b)(2)(C) (allowing monetary sanctions for refusal to obey

a discovery order); 37(c)(1)(A) (allowing monetary sanctions for

refusal to provide information in an initial disclosure); 37(f)

(allowing the court to require payment of “reasonable expenses,

including attorney’s fees” if a party “fails to participate in

good faith in developing and submitting a proposed discovery

plan.”). Monetary sanctions may also be awarded against a party

that participates in a Rule 16 conference in bad faith. See

Liebowitz, 6 F.4th at 290 & n.28 (quoting Fed. R. Civ. P.

16(f)((1)(B)).

Monetary sanctions are appropriate both under the Rules of

Civil Procedure, and as an exercise of the Court’s inherent

powers. As explained above, the Defendants attempted to

negotiate a discovery plan in bad faith, requesting an exchange

of electronic devices that they knew would not be reciprocal.

They attended the June 1 Rule 16 conference in bad faith,

misrepresenting their ability and willingness to engage in

discovery. And they disobeyed this Court’s Orders and the Rules

of Civil Procedure in declining to provide information about

their coworkers or discoverable evidence in their initial

disclosures.

The Defendants’ misconduct has caused Google to incur

significant expense since they moved to vacate the default.

Aside from the normal expense that would attach litigating any

case, Google has also had to engage in additional conferences

and motion practice regarding the Defendants’ misrepresentations

and resistance to discovery. Had the Defendants been honest

from the start, it is likely that the default against them would

not have been vacated, and that Google would have been able to

secure judgment against them immediately. Accordingly, Google

is entitled to recoup its reasonable expenses and attorney’s

fees since the entry of the default. See Int’l Techs.

Marketing, Inc., 991 F.3d at 367 (monetary sanctions are

appropriate to “make[] the wronged party whole for the expenses

caused by his opponent’s obstinacy” (citation omitted)).

The same monetary sanction is also imposed against Litvak.

A court may impose costs as sanctions against an attorney who

has “negligently or recklessly failed to perform his

responsibilities as an officer of the court.” Id. at 368 n.5

(citation omitted); Wilder v. GL Bus Lines, 258 F.3d 126, 130

(2d Cir. 2001). As an attorney, Litvak has a duty of candor to

the Court -- including a duty to promptly correct any

unintentional misrepresentations made to the court. N.Y. Rules

of Prof. Conduct 3.3(a)(3); see also In re Gordon, 780 F.3d 156,

160 (2d Cir. 2015) (disciplinary proceeding). Rather than

promptly alerting Google or the Court when he alleges he learned

that the Defendants no longer worked at Valtron, however, Litvak

continued to exploit that misrepresentation in his discovery

negotiations with Google, seeking to induce an exchange of

electronic devices that he knew would not be reciprocal.

Furthermore, Litvak has continued to insist that the Defendants

have no access to information at Valtron, even while he used

their access as leverage in settlement discussions.

Finally, Litvak has refused to respond to inquiries about

his compliance with his obligations as an officer of the court,

except in a conclusory statement in his affidavit asserting that

he instructed the Defendants during their initial consultation

on February 17 to preserve all discoverable information and ESI.

Google’s complaint alleged that the Defendants committed serious

misconduct in connection with Valtron, among other

organizations. Litvak does not explain how he could have

discussed entering the case and informed his clients about the

duty to preserve and produce relevant information without

learning about the Defendants’ relationship to Valtron and the

location of their work laptops. Accordingly, Litvak either

failed to explain his clients’ discovery obligations to them, or

knew as early as February that the Defendants were never going

to turn over any discoverable electronic devices.

Throughout this litigation, the Defendants have engaged

in a willful campaign to resist discovery and mislead the Court.

Their attorney has been complicit in this scheme, making

inconsistent representations to the plaintiff and to the Court,

and exploiting these representations in discovery and settlement

negotiations. Google is therefore entitled to recover from

Litvak and the Defendants, jointly and severally, the reasonable

fees and expenses that it has incurred litigating this action

against Defendants Starovikov and Filippov since their

appearance in the case.

II. Defendants’ Motion for Sanctions

The Defendants have moved for sanctions against Google. In

response to Google’s motion for sanctions, they argue that

Google repeatedly misled the Court about Defendants’ conduct

during the litigation in order to gain an advantage in the case

and tarnish their attorney’s reputation. In their reply brief,

the Defendants also request sanctions against Google for

threatening to make a criminal referral against them in order to

obtain an advantage in a civil matter. Google’s conduct,

however, is not sanctionable, and the Defendants’ motion is

denied.

A. Misrepresentations

The Defendants argue that Google falsely represented to the

Court that 1) the Defendants had agreed to waive personal

jurisdiction, 2) the Defendants refused to travel to any country

that might extradite them, 3) the Defendants worked “closely”

with the individuals identified in their initial disclosures, 4)

the Defendants were following advice given by Litvak that

hackers should leave their work laptops in Russia, and 5) Google

learned only on July 19, rather than on June 27, that the

Defendants had stopped working at Valtron. Each of these

statements by Google, however, is either true, or represents a

good faith dispute as to what Litvak stated on certain

occasions. And regardless, no statement was materially

misleading.

i. Waiver of Personal Jurisdiction

In its opposition to the Defendants’ motion to vacate the

default, Google argued that the Defendants had waived any

defense that the Court lacked personal jurisdiction over them.

In their motion for sanctions, the Defendants assert that Google

misled the Court, because they had only stated they would waive

personal jurisdiction if Google agreed to vacate the default

against them.

With its motion for default judgment, however, Google

provided a copy of the emails between its attorneys and Litvak,

as well as a copy of the transcript of the March 1 conference.

In the email exchange, Litvak requests that Google withdraw its

motion for default judgment, and represents that the Defendants

“will consent to personal jurisdiction in this matter.” The

email does not clearly state that the Defendants’ consent to

personal jurisdiction was conditional. Accordingly, Google did

not mislead the Court in arguing waiver. Regardless, the Court

found that the Defendants had not waived any personal

jurisdiction defense. Google LLC, 2022 WL 1239656, at *4. The

Defendants have therefore failed to show that Google’s

characterization of their stance was misleading in any material

respect.

ii. Concerns over Extradition

The Defendants also dispute Google’s assertion that, at a

June 1 discussion between Litvak and counsel for Google, Litvak

stated that the Defendants would refuse to appear in any country

that could extradite them to the United States. According to

Litvak, he stated only that the Defendants were “concerned”

about going to a country with an extradition treaty. Google’s

counsel, however, maintains that her recollection of the

conversation is correct.

Even if Litvak’s characterization is correct, it does not

suggest that Google’s characterization of the conversation was

intentionally, recklessly, or even negligently misleading. Nor

does it explain why any difference between the parties’ accounts

is material. In either case, the Defendants began to add

constraints on the locations at which they were willing to be

deposed, just after representing to the Court that they were

willing to be deposed in another country if they could travel

there. The Defendants, not the plaintiff, have misled the Court

in this respect.

iii. Names of Coworkers

The Defendants argue that Google mischaracterized Litvak’s

statements in a June 27 call, during which the parties discussed

the Defendants’ failure to provide information about their

coworkers (including surnames) in their initial disclosures. In

Google’s July 19 letter, Google’s counsel represented that

Litvak had stated on the call that the Defendants worked

“closely” with the individuals named in their initial

disclosures. This would be unsurprising given the breadth and

complexity of the activities described in the complaint.

According to Litvak, though, he only stated that the Defendants

worked “with the individuals in question in the same location at

some point in the past.” Google’s counsel has submitted an

affidavit stating that Litvak described the Defendants as

working “very closely” with the coworkers named in their initial

disclosures. The Defendants have provided no reason to think

that Google misrepresented Litvak’s statements in bad faith, or

that Google’s account of the conversation was materially

misleading in any way.

iv. Timing of Defendants’ Disclosure that They No

Longer Worked at Valtron

The Defendants insist that they first informed Google on

June 27 that they no longer worked at Valtron, rather than on

July 19, as Google claims. In support of this argument, the

Defendants note that they stated without objection at the July

29 conference that they first disclosed the end of the

employment with Valtron on June 27. The Defendants have also

provided excerpts from emails after a June 27 call with

plaintiff’s counsel, showing that the Defendants expressed on

the June 27 call that they did not have any discoverable

electronic devices because those devices were in Valtron’s

possession.

These emails, however, only show that the Defendants told

Google they no longer had access to any electronic devices.

They do not show that the Defendants disclosed on June 27 that

their employment with Valtron had ended. On the contrary,

Google’s email suggests that it continued to believe that the

Defendants would have access to their work devices as part of

their employment.

Regardless, whether the Defendants first disclosed the end

of their employment with Valtron on June 27 or July 19 is not

material to these proceedings. When they appeared in this

action, the Defendants asserted that they continued to work at

Valtron. And even by his own admission, the Defendants’ counsel

did not correct this misrepresentation until at least a month

after he learned it was incorrect, and continued to exploit it

in the meantime. Whether the Defendants’ employment status was

first disclosed on June 27 or July 19 is not material.

v. Litvak’s Interview

Finally, the Defendants move for sanctions based on

Google’s submission of transcripts of Litvak’s Russian-language

interview, conducted for a documentary in 2016, in which Litvak

is asked: “What mistakes do hackers usually make that turn them

into your clients?” Litvak responds by saying that their

biggest mistake is failing to separate their work laptop and

personal laptops, and that they should leave their work laptop

at home when they leave the country.

The Defendants argue that Google has misled the Court by

characterizing Litvak’s interview response as an instruction to

the Defendants, even though the interview took place years

before the events giving rise to this action took place. But

the Defendants do not dispute the accuracy of Google’s

translation of the interview, nor do they point to any specific

misleading statement Google made. When Google submitted the

interview, it described it as an interview that took place years

before this lawsuit was filed. Nothing in Google’s

characterization of Litvak’s statements was misleading. Nor can

the Defendants argue that the interview was irrelevant to this

litigation. The Defendants have refused to produce not only

their work laptops, but also any other electronic devices.

B. Threat of Criminal Prosecution

Finally, the Defendants request sanctions against Google

for characterizing its September 8 settlement demand as

extortionate, and for telling them and the Court that the demand

would be reported to law enforcement. The Defendants do not

deny that they made the demand described by Google. Instead,

they argue that Google’s conduct violates New York Rule of

Professional Conduct 3.4(e), which states that an attorney may

not “present, participate in presenting, or threaten to present

criminal charges solely to obtain an advantage in a civil

matter.” Courts interpreting this rule have generally found a

violation only when the threat of criminal prosecution is used

as leverage to demand civil relief, and only when the threat is

made solely for that purpose. See United States v. Huntress,

13CV00199, 2015 WL 631976, at *22 (W.D.N.Y. Feb. 13, 2015).

Google’s response to the Defendants’ settlement demand did

not violate Rule 3.4(e), and regardless was not sanctionable.

The Defendants do not explain how Google’s report to law

enforcement was used to advance its position in this action.

Google had already moved for sanctions before the Defendants’

settlement demand, and Google has not made its criminal report

contingent on any demands of the Defendants. Additionally,

Google has a good-faith basis to believe that the Defendants

have committed the crime of extortion by demanding payment in

exchange for halting criminal activity. See United States v.

Jackson, 196 F.3d 383, 387 (2d Cir. 1999) (a demand for money is

extortionate when “the defendant has no plausible claim of right

to the money demanded or if there is no nexus between the threat

and the defendant’s claim”). The Defendants have therefore

failed to show that Google has reported their activity to gain

advantage in this litigation, rather than to report a crime.

Accordingly, the Defendants have not shown that Google has

violated the Rules of Professional Conduct, or that it has

otherwise engaged in sanctionable conduct.

Conclusion

The plaintiff’s August 22, 2022 motion for sanctions is

granted. The Defendants’ September 2, 2022 motion for sanctions

is denied. Default judgment is issued against the Defendants

pursuant to Fed. R. Civ. P. 37. A monetary sanction in the

amount of the plaintiff’s reasonable attorneys’ fees, costs, and

expenses associated with litigating the case against the

Defendants since March 14, 2022 is assessed jointly and

severally against Dmitry Starovikov, Alexander Filippov, and

Igor Litvak as an exercise of this Court’s inherent power and

pursuant to Fed. R. Civ. P. 37. A scheduling order addressing

the calculation of the monetary sanction accompanies this

Opinion.

Dated: New York, New York

November 15, 2022

DENTSE COTE

United States District Judge

48