Google LLC v. Dmitry Starovikov

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF NEW YORK

-------------------------------------- X

:

GOOGLE LLC, :

:

Plaintiff, :

: 2 1 c v 1 0 2 6 0 (DLC)

-v- :

: OPINION AND ORDER

DMITRY STAROVIKOV, ALEXANDER FILIPPOV, :

and DOES 1–15, :

:

Defendants. :

:

-------------------------------------- X

APPEARANCES:

For plaintiff:

Andrew Zenner Michaelson

Kathleen Elizabeth McCarthy

Laura Elizabeth Harris

King & Spaulding LLP (NYC)

1185 Avenue of the Americas

New York, NY 10036

Bethany Rupert

King & Spalding

1180 Peachtree Street NE

Atlanta, GA 30309

David Paul Mattern

Sumon Dantiki

King & Spalding LLP (DC)

1700 Pennsylvania Avenue, N.W.

Washington, DC 20006

For Defendants:

Igor B. Litvak

The Litvak Law Firm, PLLC

1733 Sheepshead Bay Road

Suite 22

Brooklyn, NY 11235

DENISE COTE, District Judge:

Defendants Dmitry Starovikov and Alexander Filippov (the

“Defendants”) have moved to reconsider monetary and default

judgment sanctions imposed upon them and their attorney, Igor

Litvak, in an Opinion of November 15. Although the Defendants

and Litvak attempt to explain their conduct during the

litigation, none of their explanations undermines the basis for

sanctions: that the Defendants mispresented their employment

status; that their attorney failed to correct and continued to

exploit this misrepresentation in order to seek discovery

against Google while avoiding discovery against the Defendants;

and that the Defendants leveraged their ability to shut down the

Glupteba botnet in order to extort money from Google.

Accordingly, the motion for reconsideration is denied.

Background

This Court presumes familiarity with its prior Opinion

issuing sanctions against the Defendants and Litvak. See Google

LLC v. Starovikov, 21CV10260 (DLC), 2022 WL 16948296 (S.D.N.Y.

Nov. 15, 2022). Google filed this lawsuit on December 2, 2021,

alleging that the defendants operate the Glupteba botnet, a

network of infected computers programmed to execute commands

issued by a remote server (a “C2 Server”). Google alleged that

the defendants used this botnet to harvest personal data from

infected computers and hijack them for criminal ends (a scheme

referred to as the “Glupteba Enterpise”). The Complaint

identifies several organizations alleged to form the Glupteba

Enterprise, including Valtron LLC (“Valtron”). Unlike

conventional botnets, which hardcode the address of the C2

servers into the code of their malware, the Glupteba botnet

broadcasts the addresses of its C2 servers on the blockchain.

This makes the botnet harder to disrupt –- even if existing C2

servers are taken down, the Glupteba Enterprise can always set

up more, and post their addresses on the blockchain.

On December 7, 2021, this Court issued a temporary

restraining order allowing Google to disrupt the Glupteba

botnet, and to use alternative methods to effect service on the

defendants. Google attempted service, but no defendant

responded. Google then requested an entry of default, and moved

for default judgment against the defendants. The temporary

restraining order was converted into a preliminary injunction on

December 16, 2021.

On February 24, 2022, Litvak submitted a letter on behalf

of the Defendants requesting that the default against them be

vacated. Accompanying their brief to vacate the default, the

Defendants each submitted identical declarations stating: “I

work for Valtron as a software engineer.” In an Opinion of

April 27, the Court vacated the default entered against the

Defendants, finding that Google had not been prejudiced by the

delay because the parties could still “conduct expeditious and

targeted discovery to ensure they can quickly obtain the

evidence they need, without inhibiting Google’s efforts to

disrupt the Glupteba botnet.” Google LLC v. Starovikov,

21CV10260 (DLC), 2022 WL 1239656, at *10 (S.D.N.Y. Apr. 27,

2022).

After the default was vacated, the parties began to discuss

a discovery plan. On May 17, Google shared with Litvak a

proposed plan indicating that Google intended to request

electronic devices that the Defendants used in connection with

their business. On May 20, Litvak responded by proposing

discovery of Google’s electronic devices, and limiting discovery

of the Defendants’ devices to those “over which the Defendants

have actual physical control and possession.” Google rejected

these modifications on May 31, taking out any reference to a

device exchange. But Litvak replied that he liked the initial

version better, and asked to keep it.

The Court held a Rule 16 conference on June 1. During that

conference, Google expressed frustration that the Defendants

were unwilling to agree on a location at which they could be

deposed, and that they refused to consent to a permanent

injunction prohibiting them from engaging in unlawful activity

without explaining the reasons for that refusal. By that time,

Google had withdrawn its claim for damages, and only the claim

for injunctive relief remained to be litigated. Litvak

explained that the Defendants did not believe they were engaged

in any unlawful activity, but that they were unwilling to

consent to a permanent injunction because Google’s use of the

preliminary injunction had disrupted their legitimate business

activities. Litvak also expressed that the Defendants were

willing to be deposed in any country to which they could travel

and obtain a visa. Shortly after the conference, however,

Litvak revealed that the Defendants lacked passports, and that

they had concerns about being deposed in a country from which

they might be extradited.

The Defendants served their initial disclosures on June 17.

The disclosures identified seven individuals with potentially

discoverable information at Valtron’s office address, but did

not provide their surnames. Additionally, the Defendants

refused to provide any electronic devices, stating that any such

devices were in Valtron’s possession, not theirs. As Google

continued to press the Defendants to turn over any devices to

which they had access, the Defendants clarified on July 19 that

they no longer worked at Valtron, and therefore no longer had

access to any discoverable devices.

The Court held a conference on July 29 to address the

deficiencies in the Defendants’ initial disclosures. At the

conference, the Defendants were ordered to submit a letter

responding to Google’s questions about their knowledge of or

access to discoverable information. In a letter of August 8,

Litvak stated that the Defendants had left their jobs at Valtron

in December of 2021, that they returned their work laptops to

Valtron in mid-January of 2022, and that he had learned of this

on May 20. In letters of August 12, the parties also requested

sanctions against each other. The motions for sanctions became

fully briefed on September 23.

On September 6, while the parties’ cross-motions for

sanctions were being briefed, Litvak emailed Google that his

clients were willing to discuss settlement. The parties held a

call on September 8, during which Litvak explained that the

Defendants would be willing to provide Google with the private

keys for the Bitcoin accounts associated with the Glupteba

botnet, and that the Defendants would promise not to engage in

the alleged criminal activity in the future. In exchange, the

Defendants demanded Google’s agreement not to report them to law

enforcement, a payment of $1 million per defendant, and $110,000

in attorney’s fees. Google rejected the demand and reported it

to law enforcement.

The Court granted Google’s motion for sanctions and denied

the Defendants’ motion for sanctions in an Opinion of November

15. Google LLC, 2022 WL 16948296, at *16. The Opinion found

that Litvak failed to disclose that the Defendants had left

Valtron after he purportedly learned that they had on May 20,

and that the Defendants instead continued to exploit this

misunderstanding by attempting to negotiate an exchange of

devices that they knew would not be reciprocal. Id. at *7–8.

The Opinion also found that the Defendants likely knew about the

litigation before they claimed to have learnt about it in mid-

January, and that their refusal to turn over any electronic

devices showed that they had no intention to participate in

discovery in good faith. Id. at *8–10. Finally, the

Defendants’ unwillingness to consent to a permanent injunction,

combined with their willingness to shut down the Glupteba botnet

in exchange for money, evinced an intention to use the

litigation to profit off of their criminal scheme. Id. at *10.

The Court therefore issued default judgments against the

two Defendants, explaining that the default would likely never

have been vacated had the Defendants’ been honest about their

willingness or ability to engage in discovery from the start.

Id. at *11–12. And it imposed monetary sanctions against the

Defendants and against Litvak for their “willful campaign to

resist discovery and mislead the Court.” Id. at *13. The

Defendants and Litvak moved to reconsider the Opinion on

November 28.

Discussion

The standard for granting a motion for reconsideration is

“strict.” Cho v. Blackberry Ltd., 991 F.3d 155, 170 (2d Cir.

2021) (citation omitted). A motion for reconsideration is “not

a vehicle for relitigating old issues, presenting the case under

new theories, securing a rehearing on the merits, or otherwise

taking a second bite at the apple.” Analytical Surv., Inc. v.

Tonga Partners, L.P., 684 F.3d 36, 52 (2d Cir. 2012) (citation

omitted). “A party may . . . obtain relief only when the party

identifies an intervening change of controlling law, the

availability of new evidence, or the need to correct a clear

error or prevent manifest injustice.” Cho, 991 F.3d at 170.

The decision to grant or deny the motion for reconsideration

rests within “the sound discretion of the district court.”

Aczel v. Labonia, 584 F.3d 52, 61 (2d Cir. 2009) (citation

omitted).

In their motion for reconsideration, the Defendants attempt

to provide various explanations of their behavior and the

conduct of their counsel throughout this litigation. Many of

their arguments were raised in the briefing on the motion for

sanctions, and therefore need not be reconsidered here.

Regardless, nothing in the Defendants’ motion challenges the

facts underlying the November 15 Opinion’s findings, or the

basis for its imposition of sanctions.

I. Misconduct

The Defendants first argue that they only misrepresented

once, in the declarations submitted in connection with their

motion to vacate the default, that they were current employees

of Valtron. This argument was raised in the parties’ briefs on

their cross-motions for sanctions, and was addressed in the

November 15 Opinion. Google LLC, 2022 WL 16948296, at *7–8. It

therefore need not be reconsidered here. As the November 15

Opinion explained, the Defendants’ statements after May 20, such

as those labeling Filippov a “Valtron Software Engineer” or

referring to their “prospective relationship with their

employer,” must be understood in the context of the Defendants’

earlier statements that they “work at Valtron as a software

engineer.” The Defendants knew when they made each of these

statements that Google would have believed that they were

currently employed at Valtron, and that these statements would

be taken to refer to a present employment.

Similarly, the Defendants did not vitiate their

misrepresentation when they said they “worked” at Valtron in

their brief on their motion to vacate the default. Though

phrased in the past tense, the statement in the brief was made

in reference to the period described in the Complaint, and was

made at a time when Litvak purportedly still believed that the

Defendants continued to work at Valtron. The Defendants cannot

argue that the statement makes clear that they had left Valtron

when, by his own admission, Litvak believed that they still

worked at Valtron when he wrote it.

The Defendants also attempt to justify their settlement

demand to Google. Each of the Defendants’ arguments was already

addressed in the November 15 Opinion, and therefore need not be

reconsidered. Id. at *10. The Defendants argue that they have

no access to the private keys of the Glupteba botnet’s Bitcoin

accounts until Valtron provides them, and that Valtron will not

provide them unless a settlement is reached. But the Defendants

also insist that their offer to turn over the private keys is

not contingent on any payment. The Defendants cannot insist

that they did not make the offer of private keys contingent on a

money payment, while at the same time arguing that the private

keys could only be obtained as a result of a settlement, and

demanding money as a condition of settlement. Moreover, the

Defendants refused to consent to the permanent injunction

prohibiting criminal activity but could not provide a coherent

explanation for that refusal, as the November 15 Opinion

explained. Id. at *10. Then, in their settlement discussions

with Google, they offered their consent to such an injunction,

again contingent on a payment.

Litvak also argues that he never misrepresented the

Defendants’ willingness or ability to engage in discovery. The

November 15 Opinion, however, recounts multiple instances in

which the Defendants suggested to Google that they would have

discovery to produce, and then refused to provide any discovery

when asked, raising myriad objections that they had not

previously voiced. Id. at *3–4. Litvak stated at the June 1

conference that the Defendants would be willing to attend a

deposition in a country to which they could get a visa and

travel. But after that conference, they expressed concerns

about extradition, and revealed that they had no passports. The

Defendants have offered to produce the private keys associated

with the Glupteba botnet’s Bitcoin accounts as part of a

settlement, while refusing to turn over the private keys in

discovery. And the Defendants repeatedly suggested to Google

that they have discoverable electronic devices to produce, while

refusing to produce any such devices when pressed. All of this

misconduct was discussed in the November 15 Opinion, id. at *6–

10, and the Defendants have raised no new arguments to excuse

it.

The Defendants’ inconsistency on the availability of

discoverable electronic devices or electronically stored

information is particularly suggestive of bad faith. In their

initial disclosures, the Defendants refused to identify any

discoverable electronic devices. And in response to Google’s

questions after the July 29 conference, the Defendants refused

to identify any device except their work laptops and claimed

that those laptops had been turned over to Valtron.1 The

Defendants also refused to explain what efforts they took to

preserve discovery, despite the Court’s Order that they answer

Google’s questions regarding their “knowledge of or access to

discoverable information.” After the Court observed in the

Opinion of November 15 that the Defendants’ cellphones likely

“contain a wealth of information relevant to this litigation,”

id. at *9, in their briefing on the present motion for

reconsideration, the Defendants now state that they have

smartphones which they would have been willing to turn over had

the Court ordered it.

Litvak asserts that he never intentionally exploited the

misrepresentation regarding the Defendants’ employment status,

because he explained to Google that the Defendants had no

electronic information to produce as soon as the issue became

relevant during their discussions of electronic discovery on

June 27. But, by Litvak’s own admission, he knew at least by

May 20 that the Defendants were taking the position that they no

longer had access to their work laptops, and he did not disclose

1 Despite being required to identify “each device that you used

in 2021 or 2022,” including those owned by Valtron, a third

party, or owned personally, on August 8, 2022, each of the

Defendants identified only one device, a MacBook Pro, that they

asserted had been returned to Valtron.

this to Google by May 31, when the parties negotiated a

discovery plan that could involve an exchange of electronic

devices. Litvak even proposed language limiting any device

exchange to devices over which the Defendants had “actual

physical control and possession.” This conduct evinces an

attempt to entice Google into agreeing to ostensibly reciprocal

discovery, while ensuring that the Defendants would not have to

turn over discoverable information themselves.

Finally, the Defendants insist that they did not

participate in, and did not know about, the operation of servers

associated with the Glupteba botnet. But the Defendants have

also repeatedly attempted to leverage their access to the botnet

and to these servers as part of their litigation strategy. At

the June 1 Conference, Litvak explained that the Defendants were

unwilling to consent to a permanent injunction, because Google’s

disruption of the servers harmed the Defendants’ business

activities.2 And in their September 8 settlement demand, the

2 Although the June 1 conference took place after the date at

which Litvak purportedly learned that the Defendants no longer

worked at Valtron, Litvak did not disclose this at the

conference. Nevertheless, Litvak stated at the conference that

the Defendants refused to consent to a permanent injunction in

part because Google’s takedown of domain names disrupted their

business activities. This representation suggests that the

Defendants continued to have access to servers that Google

believed were associated with the botnet. But the Defendants

never identified any such information in their initial

disclosures, or in response to Google’s discovery requests.

Defendants offered to provide the private keys to the botnet’s

Bitcoin accounts in exchange for $2 million plus attorneys’

fees. If the Defendants had access to or knowledge of these

servers or accounts, then they were required to provide that

information in discovery. If not, then they could not rely on

that access or knowledge in their representations to Google and

to the Court. In either case, the Defendants committed

sanctionable misconduct.

II. Sanctions

The Defendants argue that, even if they or Litvak committed

misconduct, the Court erred in sanctioning them. “If a party

fails to obey an order to provide or permit discovery, the

district court may impose sanctions, including rendering a

default judgment against the disobedient party.” Guggenheim

Capital, LLC v. Birnbaum, 722 F.3d 444, 450 (2d Cir. 2013)

(quoting Fed. R. Civ. P. 37(b)(2)(A)(vi)). In determining what

sanctions are warranted, a court should consider “(1) the

willfulness of the non-compliant party; (2) the efficacy of

lesser sanctions; (3) the duration of the noncompliance; and (4)

whether the non-compliant party had been warned that

noncompliance would be sanctioned.” Id. at 451; see also Funk

v. Belneftekhim, 861 F.3d 354, 366 (2d Cir. 2017). Entry of a

default is an extreme sanction, and may be appropriate “when a

court finds willfulness, bad faith, or any fault on the part of

the noncompliant party.” Guggenheim Capital, LLC, 722 F.3d at

451 (citation omitted).

Additionally, courts have the inherent power to “sanction a

party . . . to deter abuse of the judicial process and prevent a

party from perpetrating a fraud on the court.” Yukos Capital

S.A.R.L. v. Feldman, 977 F.3d 216, 235 (2d Cir. 2020). Federal

courts may therefore issue monetary sanctions against a party

for that party’s “bad faith, vexatious, or wanton” misconduct.

Int’l Techs. Marketing, Inc. v. Verint Sys. Ltd., 991 F.3d 361,

368 (2d Cir. 2021) (citation omitted). The imposition of

monetary sanctions on an attorney acting on behalf of litigants

generally requires a finding of bad faith. See United States v.

Seltzer, 227 F.3d 36, 41–42 (2d Cir. 2000).

The Federal Rules of Civil Procedure also authorize

monetary sanctions for misconduct during discovery. See Fed. R.

Civ. P. 26(g) (allowing monetary sanctions, including the

“reasonable expenses” and “attorney's fees” incurred as a result

of an incomplete or incorrect initial disclosure); Fed. R. Civ.

P. 37(b)(2)(C) (allowing monetary sanctions for refusal to obey

a discovery order); 37(c)(1)(A) (allowing monetary sanctions for

refusal to provide information in an initial disclosure); 37(f)

(allowing the court to require payment of “reasonable expenses,

including attorney's fees” if a party “fails to participate in

good faith in developing and submitting a proposed discovery

plan.”). Monetary sanctions may also be awarded against a party

that participates in a Rule 16 conference in bad faith. See

Liebowitz v. Bandshell Artist Mgmt., 6 F.4th 267, 290 & n.28 (2d

Cir. 2021) (quoting Fed. R. Civ. P. 16(f)).

A. Sanctions against the Defendants

Litvak argues that sanctions should not have been imposed

on him or on the Defendants, because the Court should have first

considered lesser sanctions, such as admonishment. But the

November 15 Opinion considered lesser sanctions, and determined

that they would not suffice. As the Opinion explained, the

Defendants likely would not have made it past default judgment

but for their misconduct. Google LLC, 2022 WL 16948296, at *12.

A sanction of default judgment and reasonable attorneys’ fees

was therefore necessary to “restore the prejudiced party to the

same position [it] would have been in” but for the Defendants’

and Litvak’s misconduct. West v. Goodyear Tire & Rubber Co.,

167 F.3d 776, 779 (2d Cir. 1999).

Litvak also cites Bobal v. Rensselaer Polytechnic

Institute, 916 F.2d 759, 764 (2d Cir. 1990), for the proposition

that sanctions terminating a case may not be issued without a

warning that terminating sanctions will be imposed. But Bobal

involved a pro se litigant who was sanctioned because she

refused to attend certain depositions and conferences. Id. at

762. The Defendants, by contrast, are represented by an

attorney, who is required to be aware of his discovery

obligations and his ethical obligations as an officer of the

court. Moreover, their misconduct consists not just of a

passive failure to satisfy court-imposed deadlines, but an

active campaign of misrepresentations and evidence spoliation.

Finally, the Court issued an Order on June 3 expressing

concern that Litvak was not being candid with the Court and that

Defendants were not participating in the litigation in good

faith. And the Court further expressed concern in a July 29

conference that Litvak had attempted to negotiate a device

exchange at a time he knew there were no devices within his

clients’ possession. Nevertheless, the Defendants persisted in

resisting discovery and in attempting to profit off the Glupteba

Enterprise. These warnings, in light of the extensive bad faith

misconduct on the part of the Defendants and their attorney, are

more than adequate to justify the sanctions imposed. See

Guggenheim Capital, LLC, 722 F.3d at 451.

B. Sanctions against Litvak

Litvak argues that Court should not have imposed monetary

sanctions on him, because he never acted in bad faith. Litvak

insists that he genuinely believed that the Defendants worked at

Valtron at the time he submitted declarations stating that they

did, and that he corrected this misrepresentation as soon as it

became relevant. He also asserts that he informed the

Defendants about their discovery obligations when he was hired,

and argues that he therefore should not be held responsible for

any spoliation of discoverable evidence.

Each of these arguments was addressed repeatedly in the

November 15 Opinion, and therefore need not be reconsidered

here. Id. at *6–13. The Opinion identified numerous instances

in which Litvak made misrepresentations or resisted discovery in

bad faith. Litvak claims to have learned on May 20 that the

Defendants left Valtron in 2021 and had returned their work

laptops. Yet after that date, Litvak stated in a brief that

Google’s complaint threatened their business relationship with

Valtron, represented at a conference that Google’s shutdown of

the Glupteba botnet’s servers was disrupting the Defendants’

business activities, attempted to negotiate a device exchange

that would leave the Defendants without any electronic devices

to turn over, and described Filippov as a Valtron software

engineer in the Defendants’ initial disclosures. Litvak has

also participated in the Defendants’ extortionate settlement

demands, requesting payment of attorney’s fees to reimburse the

Defendants in exchange for helping to shut down the Glupteba

botnet. This bad-faith conduct is more than sufficient to

justify the imposition of monetary sanctions.

Litvak also argues that the November 15 Opinion should not

have found his discovery preservation efforts insufficient

without a hearing or some further inquiry through which he could

explain his preservation efforts. Litvak did not request a

hearing in his briefing on the parties’ cross-motions for

sanctions. And regardless, Litvak has had multiple

opportunities to explain his conduct, at conferences, in

briefing and in his declaration submitted in connection with the

cross-motions for sanctions, and in connection with the motion

for reconsideration. Indeed, Litvak declined to respond to

Google’s request for information about his discovery

preservation efforts, even though the Court had ordered Litvak

to respond to Google’s questions about the Defendants’

“knowledge of or access to discoverable information.” Nor did

Litvak take these opportunities to identify an issue of material

fact that would necessitate a hearing. Litvak has therefore

been provided with a sufficient opportunity to be heard on this

issue. See In re 60 E. 80th St. Equities, Inc., 218 F.3d 109,

117 (2d Cir. 2000). Moreover, even if Litvak had carefully

explained to his clients their obligation to preserve

discoverable evidence -- an unlikely occurrence, as he claims

his clients did not reveal until months into the case that they

had essentially no evidence to produce -- this would not excuse

the multiple other instances of Litvak’s bad faith misconduct

throughout the course of this litigation.

Litvak argues that the amount of monetary sanctions imposed

is excessive, because he is a sole practitioner with limited

financial means, and because his personal and family

circumstances would make sanctions especially burdensome. But

the November 15 Opinion awarded monetary sanctions only in the

amount of attorneys’ fees and expenses that Google had incurred

since the Defendants’ appearance in the case. Id. at *16.

Awards of reasonable expenses are not only permissible under the

Court’s inherent powers, but required by the rules of Civil

Procedure for certain bad faith violations. See Liebowitz, 6

F.4th at 291 (citing Fed. R. Civ. P. 16(f)); see also Fed. R.

Civ. P. 37(a)(5)(A). As the November 15 Opinion explained, the

Defendants’ misconduct has been ongoing since their entry into

the litigation, and the default against them would likely not

have been vacated but for that misconduct. Google LLC, 2022 WL

16948296, at *13. An award of attorneys’ fees is therefore

necessary to compensate Google for the harm caused by the

Defendants’ and Litvak’s misconduct.

Litvak has cited no authority to suggest that monetary

sanctions must be reduced according to an attorney’s financial

means, and the attorney’s means and personal circumstances are

not among the factors generally considered when imposing

sanctions or bad faith misconduct. See Int’l Techs. Marketing,

Inc., 991 F.3d at 368. These sanctions are designed to

compensate Google for the harm it suffered as the result of

misconduct, not to punish Litvak or the Defendants. See

Liebowitz, 6 F.4th at 289-90 (distinguishing between

“compensatory” and “punitive” sanctions). The sanctions are

payable to the opposing party, rather than to the Court.

Nonetheless Litvak and the Defendants will be given an

opportunity to resolve the amount of sanctions to be imposed

before briefing on that amount is due. A separate order will

refer the parties for settlement discussions. This will also

give the Defendants the opportunity to demonstrate that their

offer to provide the private keys to the Glupteba botnet’s

Bitcoin accounts is not contingent on a payment of $2 million,

and otherwise to amelicrate the sanctions. Finaliy, to the

extent that Litvak believes his financial means or personal

circumstances are relevant, he may submit evidence on those

issues in connection with the briefing on the amount of

sanctions to be imposed.

Conclusion

The Defendants’ and Litvak’s November 28, 2022 motion for

reconsideration is denied.

Dated: New York, New York

December 5, 2022

NISE COTE

United Ae District Judge

21