United States v. Klyushin

• Jurisdiction: United States,Federal
• Citation: United States v. Klyushin, 643 F.Supp.3d 261 (D. Mass. 2022)
• Decision Date: 02 December 2022
• Parties: UNITED STATES of America v. Vladislav KLYUSHIN, Defendant.
• Court: U.S. District Court — District of Massachusetts
• Docket Number: Criminal Action No. 21-10104-PBS

643 F.Supp.3d 261

UNITED STATES of America v. Vladislav KLYUSHIN, Defendant.

Criminal Action No. 21-10104-PBS

United States District Court, D. Massachusetts

Signed December 2, 2022

Seth B. Kosto, Stephen E. Frank, Assistant U.S. Attorneys, United States Attorney's Office, Boston, MA, for United States of America.

Maksim Nemtsev, Boston, MA, Marc Fernich, Law Office of Marc Fernich, New York, NY, for Defendant.

MEMORANDUM AND ORDER

Saris, District Judge

INTRODUCTION

A grand jury indicted Russian national Vladislav Klyushin for allegedly hacking into American computer systems and using the confidential information he obtained to make profitable trades in the shares of public companies.The Indictment states four counts against Klyushin and his alleged co-conspirators Ivan Ermakov and Nikolai Rumiantcev: (I) Conspiracy, (II) Wire Fraud, (III) Unauthorized Access to Computers, and (IV) Securities Fraud.Klyushin now moves to dismiss Count IV of the Indictment and to partially dismiss Count I as to the allegations of conspiracy to commit securities fraud.Klyushin further asks the Court to suppress evidence the government seized pursuant to search warrants.After hearing, the CourtDENIES the motion to dismiss and DENIES the motion to suppress.

FACTUAL BACKGROUND

A.The Indictment

The Indictment alleges the following facts.

Klyushin was the owner and first deputy general director of M-13, a purported information technology company in Moscow.Ermakov and Rumiantcev were deputy general directors of M-13. M-13 offered technological and media monitoring services to enterprises and government entities in Russia, including testing and analyzing organizations' cybersecurity preparedness.M-13 also offered investment management services to at least three individuals in exchange for up to 60 percent of the profits.

From approximately January 2018 through September 2020, Klyushin, Ermakov, and Rumiantcev schemed to gain access to information stored on the computer networks of two American filing agents ("Filing Agent 1" and "Filing Agent 2"), then traded on the information for profit.Filing agents assist public companies with their SEC filings.Consequently, they frequently possess the quarterly and annual financial data of public companies before they become public.Klyushin, Ermakov, Rumiantcev, and their co-conspirators operated malicious software to steal the usernames and passwords of employees of Filing Agents 1 and 2, and then used the credentials to log into the Filing Agents' computer networks.Once inside the Filing Agents' networks, the defendants and their co-conspirators viewed or downloaded the financial disclosures of publicly traded companies and used the data to make profitable trades on securities exchanges.

On January 21, 2020, Ermakov used the login credentials of an employee of Filing Agent 1 to access the quarterly earnings information of Avnet, Inc., whose securities trade on the NASDAQ.Two days later, Ermakov used Klyushin's account at a Denmark-based bank to take a short position in Avnet securities, betting that their value would fall.Another co-conspirator also shorted Avnet shares.Hours after these trades, Avnet reported disappointing quarterly financial results.

The Indictment recites additional specific examples of the co-conspirators using employee login credentials to access the Filing Agents' computer networks and trading on public company financial information they found.

B.The Search Warrants

The government seized evidence pursuant to a search warrant directed to Apple, Inc. on September 29, 2020(the "September 29 Search Warrant") and search warrants directed to Apple, Inc. and Google, LLC on October 13, 2020(the "October 13 Search Warrants").The government based its search warrant applications on two affidavits of FBI Special Agent BJ Kang(the "September 29 Affidavit" and the "October 13 Affidavit").In the September 29 Affidavit, the government sought to search the email address MIKKA777@yahoo.com, belonging to another target of the investigation, Mikhail Irzak, and Klyushin's Apple iCloud account associated with the email address 9227748@gmail.com.The October 13 Affidavit was in support of applications to search the Apple iCloud account associated with the Apple ID 1093366326 and the Google account 9227748@gmail.com, both linked to Klyushin.The two affidavits are substantially similar, and the Court will recite the facts they aver while noting any material differences.

The affidavits discuss the allegedly unlawful trading activities of various of the targets, focusing on Irzak and Klyushin.In September 2019, the SEC informed the FBI that it had identified a group of traders, including Irzak, who had made suspicious trades in the shares of several publicly traded companies before their earnings announcements.Approximately 95% of the companies whose shares the traders purchased or sold used Filing Agent 1 or Filing Agent 2 to assist with their quarterly filings.On January 16, 2020, the Financial Industry Regulatory Authority notified the SEC that in October and November, 2019, a client account at Otkritie Broker, Ltd., a Cyprus-based brokerage firm headquartered in Russia, had made profitable trades in the immediate leadup to 21 quarterly earnings announcements.Irzak traded in parallel with many of this account's trades.In early 2020, the FBI learned that Filing Agent 1 and 2's computer networks and employee login credentials were compromised.Through the Filing Agent 1 hack, Avnet's earnings data was exposed on January 21, 2020.

The affidavits tie Klyushin to the scheme through Ermakov's Avnet trades.Ermakov had been indicted in the District of Columbia for interference in the 2016 United States elections and in the Western District of Pennsylvania for hacking into the servers of various sporting and antidoping agencies.Special Agent Kang's review of Ermakov's Apple account showed that Ermakov had access to an account belonging to Klyushin on the SaxoTrader-GO app¹ and that the account had images of Avnet "contracts for difference" dated January 23, 2020.²Irzak and other overseas traders sold Avnet shares short on the same day.The September 29 Affidavit (but not the October 13 Affidavit) also states that Klyushin's Saxo trading account "is believed to have traded in parallel with IRZAK in multiple publicly traded companies generally within hours of earning's announcements."Dkt. 98 ¶ 38.At the hearing, the government could not explain why the statement was struck from the October 13 Affidavit.

Special Agent Kang found that Ermakov listed Klyushin's phone as a contact.He also learned that Klyushin was associated with the 9227748@gmail.com address and that Ermakov and Klyushin had corresponded over WhatsApp on many occasions between May 29, 2020 and July 9, 2020.Ermakov had an entry on his Apple calendar that indicated he had a meeting with "Vlad" about the stock exchange.Dkt. 98 ¶ 40;Dkt. 98-2 ¶ 25.Special Agent Kang believed the "Vlad" may have been a reference to Klyushin.

The Magistrate Judge issued the September 29 Search Warrant authorizing the FBI to search Klyushin's Apple iCloud account associated with the email address 9227748@gmail.com.Review of the Apple-produced records showed that this account was locked but that Klyushin's phone was associated with the Apple ID 1093366326.Accordingly, the FBI submitted the October 13 Affidavit.The Magistrate Judge issued the October 13 Search Warrants, which authorized the FBI to search both the iCloud account with the Apple ID 1093366326 and the 9227748@gmail.com Google account.The warrant to Apple listed 19 categories of evidence as examples of the types of information the FBI could search and seize pursuant to the warrant.

DISCUSSION

A.Motion to Dismiss³

Klyushin seeks dismissal of Count IV of the Indictment, alleging securities fraud, and so much of Count I as alleges a conspiracy to commit securities fraud.An indictment "must be a plain, concise, and definite written statement of the essential facts constituting the offense charged."Fed. R. Crim. P. 7(c)(1).The Court presumes that the allegations of the indictment are true in assessing a motion to dismiss.SeeUnited States v. Dunbar, 367 F. Supp. 2d 59, 60(D. Mass.2005).

Count IV of the Indictment alleges that Klyushin violated Section 10(b) of the Securities Exchange Act of 1934 and the SEC's Rule 10b-5.These two provisions prohibit fraud in the purchase or sale of securities.Section 10(b) makes it unlawful

for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce or of the mails, or of any facility of any national securities exchange . . . [t]o use or employ, in connection with the purchase or sale of any security registered on a national securities exchange or any security not so registered . . . any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the Commission may prescribe as necessary or appropriate in the public interest or for the protection of investors.

15 U.S.C. § 78j(b).

Rule 10b-5 is the primary implementing regulation of Section 10(b), and makes it unlawful, in connection with the purchase or sale of any security,

for any person, directly or indirectly, by the use of any means or instrumentality of interstate commerce, or of the mails or of any facility of any national securities exchange, (a) To employ any device, scheme, or artifice to defraud, (b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading, or (c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person.

17 C.F.R. § 240.10b-5.

The question before the Court is whether a hack-and-trade scheme like that alleged in the Indictment amounts to securities fraud.The...