Count One (Conspiracy To Commit Securities Fraud) : Indictment
Count One (Conspiracy To Commit Securities Fraud) : Indictment
Count One (Conspiracy To Commit Securities Fraud) : Indictment
INDICTMENT
The Grand Jury in and for the District of New Jersey, sitting at Newark,
charges:
Count One
(Conspiracy to Commit Securities Fraud)
Overview
sophisticated securities fraud scheme that involved h acking into the computer
companies before the reports were disseminated to the investing public. Many
among other things, the earnings of the companies. The defendants and
others sought to profit illegally from their scheme by selling access to the
Ukraine.
and disseminate press releases for publicly traded companies (the "Newswire
employed some of the same techniques and m ethods that he had used in the
d. The New York Stock Exchange ("NYSE") was the largest stock
trade processing and data services were performed at its data center in or
The NASDAQ did not have a central trading floor. Instead, it relied on
2
f. Companies whose shares were registered with the SEC and
filed annual a nd quarterly reports with the SEC on Forms 10-K and 10-Q,
things, the financial condition and operations of the companies, including their
generally.
whose duties included mainta ining fair, orderly, and efficient markets. The
SEC operated the Electronic Data Ga thering, Analysis and Retrieval system,
Required Filings. EDGAR also allowed companies to make test filings h ours or
days in advance of the public release of the Required Filings ("Test Filings").
3
similar to the material information that was eventually released to the public in
the Required Filings, and, as a result, at the time the Test Filings were made,
Relevant Terms
accessed by a web browser which identified the version of the web browser
sent from and directed to th at computer could be directed properly from its
that person.
4
f. "Bitcoin" was a type of virtual curren cy, circulated over the
Internet as a form of value. Bitcoin was not issued by any government, bank,
which Bitcoin were sent and received. A Bitcoin address was analogou s to a
sensitive string of letters and number s . Each Bitcoin address was controlled
a ddress's private key could authorize a trans fer of Bitcoin from that address to
The Conspiracy
defendants,
did willfully and knowingly conspire and agree with each other , CC-1, and
interstate commer ce, and of the m ails, and of facilities of national securities
exchanges, use and employ, in connection with the purchase and sale of
Title 17, Code of Federal Regulation s, Section 240. lOb-5, by: (i) employing
5
devices, schemes and artifices to defraud; (ii) making untrue statements of
material fact and omitting to state material facts necessary in order to make
the statements made, in the light of the circumstances under which they were
made, not misleading; and (iii) engaging in acts, practices and courses of
business which operated and would operate as a fraud and deceit upon
persons, contrary to Title 15, United States Code, Sections 78j(b) and 78ff, and
CC- 1, and others, to unlawfully enrich themselves by: (a) hacking into the
profiting by selling the material non-public information and trading ah ead of its
public disclosure .
6. It was part of the conspiracy that the defenda nts and others gain ed
a ttacks. The co-conspirators took steps to con ceal and misrepresent their
6
7. It was further part of the conspiracy that the defendants and
that were made to falsely appear as though they originated from actual SEC
infected, the co-conspirators used them to probe the SEC's network and to
Test Filings.
others employed some of the same methods that IEREMENKO had used in the
that IEREMENKO controlled (the "Romanian IP Address") and that had been
networks of the SEC frequently employed the same uncommon user agent
traversal attacks, the defendants stole and ex.filtrated Test Filings containing
Lithuania (the "Lit huanian Server''). From in or about May 2 016 through in or
7
about October 2016, the defendants exploited the unauthorized access they
had gained to the SEC and the EDGAR system by extracting thousands of Test
deceptive methods to steal Test Filings and extract them from the United States
11. It was further part of the conspiracy that the defendants provided
access to the stolen Test Filings to other co-conspirators for the purpose of
conspirators. The conspiracy was designed for the traders to use the stolen
traders to join the conspiracy and maintained notes for himself describing the
SEC's role in financial reporting and the co-conspirators' access to the SEC's
8
Every company is required to report important issues,
such as bankruptcies or CEO replacements to the
SEC.
or about May 19, 2016, at approximately 3:32 p.m., a Test Filing containing
p.m., RADCHENKO, IEREMENKO, and others used and caused to be used the
and steal the Public Company 1 Test Filing that had just been uploaded to
EDGAR. Between approximately 3:42 p.m. and 3:59 p.m., a trading account
121,000 shares of the stock of Public Company 1 for more than approximately
in the Test Filing was made available to the investing public when Public
Company 1 released its second quarter earnings report and announced that it
expected to deliver record earnings in the 20 16 fiscal year. By the end of the
next day, the CC-1 Trading Account had sold the position it acquired the day
9
Overt Acts
to be committed the following overt acts, among others, in the District of New
others, accessed and caused to be accessed the SEC's EDGAR servers, without
others, used and caused to be used the Lithuanian Server to access the SEC's
EDGAR servers, without authorization, in order to steal a Test Filing for Public
Company 1 that had been uploaded to EDGAR minutes earlier which, at the
others, u sed and caused to be used the Lithuanian Server to access the SEC's
EDGAR servers, without authorization, in order to steal a Test Filing for Public
Company 2 that had been uploaded to EDGAR hours earlier which, a t the time,
others, used and caused to b e used the Lithuanian Server to access the SEC's
10
EDGAR servers, without authoriza tion, in order to steal a Test Filing for Public
Company 3 that had been uploaded to EDGAR minutes earlier which, at the
and others, used and caused to be used the Lithuanian Server to access the
SEC's EDGAR servers, without authorization, in order to steal a Test Filing for
Public Company 4 that had b een uploaded to EDGAR minutes earlier which, at
and others, used and caused to be used the Lithuanian Server to access the
SEC's EDGAR servers, without authorization, in order to steal a Test Filing for
Public Company 5 that had been uploaded to EDGAR hours earlier which, at
and others, used and caused to be used the Lithuanian S erver to access the
SEC's EDGAR servers, without authorization, in order to steal a Test Filing for
Public Company 1 that had been uploaded to EDGAR minutes earlier which, at
All in viola tion of Title 18, United States Code, Section 371.
11
Count Two
(Conspiracy to Commit Fraud and
Related Activity i n Connection with Computers)
in Middlesex County, in the District of New Jersey and elsewh ere, the
d efendants,
did knowingly and intentionally conspire and agree with each other, and
obtain information from a department and agency of the United States, namely
the Securities and Exchange Commission, and from a protected computer for
such information being in excess of $5,000, contrary to Title 18, United States
and oth ers, to gain unlawful access to the computer networks of the SEC for
among others.
Overt Acts
13
Count Three
(Conspiracy to Commit Wire Fraud)
through 14 of Count One of this Indictment are re-alleged and incorpor ated as
d id knowingly and intentionally conspire and agree with each other, CC-1, and
others to devise a schem e and artifice to d efra ud the SEC and the publicly
traded companies whose Test Filings they stole (the "Public Companies"), and
to obtain money and property, including confidential and econ omically valua ble
re presenta tions, and promises, and, for the purpose of executing such sch e m e
wire communications in inte rstate and foreign commer ce, certain writings,
signs, signals, pictures, and sounds, contrary to Title 18, United States Code,
Section 1343.
CC-1, and oth ers, to unlawfully e nrich themselves by: (a) hacking into the
14
stealing Test Filings containing confidential and economically valuable
profiting by selling the material non-public information and trading ahead of its
public disclosure .
4. To carry out the con spiracy and to effect its unlawful objects,
deprived the SEC and the Public Companies of their right to control the use of
the Test Filings, including the decision of when and how the information
15
Counts Four through Nine
(Wire Fraud)
namely, the scheme described in Count Three, and to obtain money and
interstate and foreign commerce, certain writings, signs, signals, and sounds,
16
Count Approximate Description
Date
Five July 22, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 2.
Six July 29, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization , in order to access a Test Filing
associated with Public Company 3.
Seven August 4, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 4.
Eight August 8, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 5 .
Nine August 17, 20 16 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 1.
17
Counts Ten through Sixteen
(Fraud and Related Activity in Connection with Computers)
through 14 of Count One of this Indictment are re-alleged and incorpora ted as
2. On or about the dates set forth below, in the District of New Jersey
did knowingly and inten tionally access and cause to be accessed computers
agency of the United States, namely the Securities and Exchange Commission,
and from a protected computer for the purpose of commercial advantage and
private financial gain, the valu e of such information being in excess of $5,000,
Indictment:
18
Count Approximate Description
Date
Twelve July 22, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 2.
Thirteen July 29, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 3.
Fourteen August 4, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 4.
Fifteen August 8, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 5.
Sixteen August 17, 2016 Used and caused to be used the Lithuanian
Server to access the SEC's EDGAR servers in
Middlesex County, New Jersey, without
authorization, in order to access a Test Filing
associated with Public Company 1.
19
FORFEITURE ALLEGATION AS TO COUNTS
ONE AND THREE THROUGH NINE
Counts Three through Nine of this Indictment, the defendants charged in each
respective count shall forfeit to the United States, pursuant to Title 18, United
States Code, Section 98l(a)(l)(C) and Title 28, United States Code, Section
2461, all property, real and personal, that constitutes or is derived from
proceeds traceable to the commission of the offense, and all property traceable
thereto.
Counts Ten through Sixteen of this Indictment, the defendants charged in each
20
SUBSTITUTE ASSETS PROVISION
(Applicable to All Forfeiture Allegations)
without difficulty;
forfeiture of any other property of the d efendants up to the value of the a bove-
A True Bill,
Foreperson
cb ~
United States Attorney
21
CASE NUMBER: - - - - -- - -
v.
INDICTMENT FOR
18 u.s.c. §§ 371, 1030, 1343, 1349, 2
A True Bill,
Foreperson
CRAIG CARPENITO
UNITED S TATES ATTORNEY
FOR THE DISTRICT OF N EW JERSEY