The Computer Crimes of Vasiliy Gorshkov and Alexey Ivanov

In this section, the facts of Gorshkov’s and Ivanov’s crimes are outlined. Gorshkov’s case is discussed in some detail. Finally, the Ivanov’s case is outlined, describing the charges and the results of the court proceedings.

The mainstream media is alive these days with tales of Russian hacking of American companies, political parties, and the federal government⁵. These hackers have been involved in some extremely large cybercrimes. For example, in 2014, Russian Federal Security Service (FSB) officers Dmitry Dokuchaev and Igor Sushchin were convicted of hacking over one billion Yahoo! Accounts⁶. Another example of Russian hacking occurred when Sasha Panin hacked over one million computer systems and stole credit card and bank account information⁷.

In 1999 and 2000, Vasiliy Gorshkov and Alexey Ivanov were two young Russians actively engaged in cybercrime⁸. Gorshkov and Ivanov grew up in Chelyabinsk, one of the most polluted places on the planet due to a mysterious explosion in a nuclear-bomb-making factory in the 1950s⁹. Gorshkov was a troubled youth even though he was a computer whiz because played with the computers in his mother’s office¹⁰ . After failing the exams at Southern Ural State University, Gorshkov affiliated himself with a group of hackers that called themselves the Expert Group of Protection Against Hackers¹¹. The group consisted of cells of two or three hackers and paid a 30 percent protection fee to an unknown entity¹². Gorshkov coordinated one of these cells, where Ivanov and another programmer called Michael were members¹³.

In 2000, life was good for these two hackers. Gorshkov and Ivanov would hack into a supposedly secure network in the United States, explain to the network administrators when they had just done, and then offer to fix the problem for a price¹⁴. The companies paid the programmers in cash ranging from $80 to $4,000¹⁵. Cognizant Technology Solutions (CTS), headquartered in Seattle, Washington, even gave the hackers storage space on its servers¹⁶.

In June 2000, Gorshkov received an email from Seattle company called Invita Security, asking him whether he would like to work for a cybersecurity company in America¹⁷. Gorshkov jumped at the opportunity, traveling with Ivanov for 48 hours to interview with the company¹⁸. At the interview, the two hackers demonstrated their hacking skills, and the two programmers logged into their computers in Chelyabinsk¹⁹. When the meeting was over, they were driven back to their hotel²⁰. The car then stopped suddenly, the doors were opened, and several FBI officers arrested them.²¹

When Speakeasy, a Seattle-based Internet service provider, had been victimized, the FBI created Operation Flyhook, a surveillance operation to arrest and then prosecute cyber criminals^{23, 24}. The idea was to lure hackers to the United States by offering hackers employment at a fake cybersecurity company. Because many Russian hackers were young technologists with little income, the opportunity to work in America was irresistible²⁵. Even though Gorshkov and Ivanov were making a good living in Russia scamming and extorting money from American companies, the temptation to work for a company like Amazon or Google was bait too good to pass up²⁶. Gorshkov and Ivanov took the bait, hook, line, and sinker.

Gorshkov was tried and convicted of 20 counts of conspiracy, and a variety of computer crimes against the Speakeasy Network of Seattle, Washington²⁷. Gorshkov’s attorney, Kenneth Kanev, attempted to block the use of data from the hacker’s servers in Russia²⁸. After Gorshkov and Ivanov were arrested, the FBI proceeded to download 1.3 to 2.7 gigabytes of data from the hacker’s servers that were located in Russia^{29, 30}. A warrant was issued to the FBI ten days after the download occurred³¹. While the two Russian hackers were demonstrating their talents to the FBI agents posing in Invita hiring managers, a keyboard sniffer was installed on their machines unbeknownst to Gorshkov and Ivanov, recording every keystroke³². Because the Russian servers were located in Chelyabinsk, Kanev argued that the FBI violated Gorshkov’s Fourth Amendment rights³³. Four years later, the Supreme Court opined that no search warrant was necessary when American law enforcement a non-U.S. citizen’s residence in a foreign country³⁴. Gorshkov was sentenced to three years in prison and ordered to pay $692,000 in restitution³⁵.

Ivanov was indicted in Connecticut for charges of conspiracy, computer fraud, extortion, and possession of illegal access devices under the Computer Fraud and Abuse Act (CFAA)^{36, 37}. Had Ivanov been convicted on all counts, he could have spent up to 90 years in prison³⁸. After the indictment was handed down by the court, Ivanov filed a motion to dismiss all charges because he was physically located in Russia, not the United States when the offenses occurred, and thus he could not be charged with violating United States law. The federal district court denied Ivanov’s motion because the harm resulting from Ivanov’s action occurred in the United States and because the statutes under which he was charged were intended by Congress to apply extraterritorially. The court cited Muench which opined that when the intent is to cause harm inside the United States by individuals outside this country, the United States Law can be successfully applied against these individuals³⁹. The court also cited Steinberg, where it concluded that there is ample precedent that a person could be charged where the harm occurs even if the individual was not physically present in the jurisdiction where the harm took place⁴⁰. The court noted that the computers were located in Vernon, Connecticut where the illegal access occurred, and that there is legislative evidence indicating that the statues under which Ivanov was indicted were meant to apply .extraterritorially. At trial, Ivanov was sentenced to three years and eight months in prison and required to pay $800,000 in restitution⁴¹.

At a later date, Ivanov pleaded guilty to several of the charges and was sentenced to four years in prison followed by three months of supervised release. Ivanov was prosecuted and convicted in California⁴², New Jersey⁴³, and Washington⁴⁴ for similar crimes. In total, Ivanov was tried in five federal district courts for computer crime.

One event that deserves to be mentioned is that the FBI agent who was responsible for Operation Flyhook, Michael Schuler, was charged unauthorized access to computer information by Russia’s FSB⁴⁵. The purpose of the Russian complaint was to assert Russian sovereignty⁴⁶. If the long-arm of American law can reach into another country, entice foreign nationals to come to the United States, and then arrest and prosecute them, it is apparent that the Russian Federation felt no restraint in doing the same to an American citizen⁴⁷. In Gorshkov’s trial, the federal district court ruled that Russian law does not apply to American agents⁴⁸.

The issue with the outcome of these two cases is that in the future other countries will feel no compunction to searching servers located in America⁴⁹. The United States courts have opined that America law has personal jurisdiction extraterritorially⁵⁰. In contrast, the federal district has opined that Russian law, and probably the laws of any other nation, does not apply to American agents⁵¹. This result is the most likely an outgrowth of American exceptionalism, where the United States can do what it wants, where it wants, when it wants, to whomever it wants, and however it wants⁵². The issue with the ideology is that the United States is unique among nations in that it presumes that America has a right to exist and that no other nation can question its actions⁵³.

The alleged Russian hack of the servers of the Democratic National Committee (DNC) can be viewed as a negative response to American exceptionalism, where the United States holds other countries to standards that it rejects for itself⁵⁴. It should be remembered that in Special Prosecutor Robert Mueller’s indictment of 12 Russians, each one of the Russians was specifically named, the address of where the hack occurred in St. Petersburg was specified, and a declaration of their rank in the Russian military was stated⁵⁵. The question that begs to be asked is: How did Muller’s team find out this information? It is more than probable that the Russian military computers were hacked in violation of Russian law⁵⁶. It serves as a striking example of American exceptionalism, where the rule is: Do as I say, not as I do.

According to Lemos, the cases against Gorshkov and Ivanov were extremely dangerous because they open Pandora’s box where in the future, individuals as well as corporations could be criminally charged for conducting corporate espionage, particularly if the entities are headquartered in different countries⁵⁷. In many cases, the CFAA exempts law enforcementofficers from being prosecuted if they engage in an unauthorized entry into a computer⁵⁸. Unauthorized entry can be compared to an FBI officer driving a car beyond the speed limit to in pursuit of a criminal. Any evidence obtained when law enforcement breaks the law in performance of their duties is admissible in court⁵⁹.

When evidence is obtained from a foreign country, diplomatic channels are used with all of its niceties⁶⁰. The issue with employing formal communications with other nations is the length of time it takes to receive the desired evidence, sometimes as long as six months⁶¹. In the Gorshkov and Ivanov cases, a six month wait would have been too long. According to the court papers, the password to one Ivanov’s accounts was changed six days after the two Russians were arrested⁶². The issue with asking a foreign country to help the United States in convicting a cyber criminal located in another country is that it takes weeks and more likely months for the other nation to collect the requisite evidence⁶³. Simply stated, such efforts take too much time because the United States is waiting for the evidence, it can be permanently deleted, thereby thwarting the prosecution of cybercriminals.

The author has read and agreed to the published version of the manuscript.

CFAA-Computer Fraud and Abuse Act

DNC-Democratic National Committee

FBI-Federal Bureau of Investigation

FSB-Russian Federal Security Service