1 2

MELINDA HAAG (CABN 132612) United States Attorney

F=/I_E::.D
201/ JUL I 3 p 2: 3
t~n~v eLE,·,.I: '...... ,",::,!;'i..rJNG '7T /fI' .. :r'T('/)!
~~i,V' ;/~: ;.'~

3
4 5

('),!('I.IJ,f;,)

II'

;.j

j

.'

• "';

,. .'.LJj

6
7

8
9

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

10
11

CRll 00471
No. CR~

SAN JOSE DIVISION

JF
J

PS

VIOLATIONS: 18 U.S.C.§§1030(b), (c)(4)(A)(i)(I) - Conspiracy, ; 18 U.S.C. §§ I030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i)Intentional Damage toa Protected Computer; 18 U.S.C. § 2 - Aiding and Abetting.

(SAN JOSE VENUE)
Filed Under Seal

No.

d.OIO

R OJ. 3 13

C
COURT
DISTRICT OF CALIFORNIA San Jose Division

JF
PSG
FILED
NORTH~ DJ

UNITED STATES D
NORTHERN

===================:::!:!:!::!::!::::::!::::y2011

THE UNITED STATES OF AMERICA

cIJIP~IJ.IJ.n .J. 'MORT,
JOSE
~bAURJRNIA

VS. CHRISTOPHER WAYNE COOPER, aka "Anthropbobic, COVELLI, aka "Absolem, and, "Toxic," KEITH WILSON DOWNEY, MERCEDES RENEE HAEFER,aka &eNo,"and "mmmm," DONALD HUSBAND, aka "Ananon," VINCENT CHARLES KERSHAW, aka "Trivette," "Triv," and "Reaper,"ETHAN MILES, JAMES C. MURPHY, DREW ALAN PHILLIPS, aka "Drew010," JEFFREY PUGLISI,aka "Jeffer," "Jefferp," and "Ji," DANIEL SULLIVAN, TRACY ANN VALENZUELA, CHRISTOPHER QUANG VO,

INDICTMENT
COUNT 1: COUNTS 2 -H:

."

18 U.S.C. §§ l030(b), (c)(4)(A)(i)(I) - Conspiracy; 18 U.S.C. §§ 1030(a)(S)(A),(c)(4)(A)(i)(I),(c)(4)(B)(I) - Intentional Damage to a Protected Computer.

A true bilL

v'
Filed in open court this
A.D. 2011

0 Foreperson'
July

13th

day of

1

The Gnnd Jury charges: Introductoa Allegations:

INDICTMENT

2 3 4 5 6 7

At all times relevant to this Indictment: 1. PayPal, Inc. ("PayPalj was an e-commerce business, wholly-owned byeBay,

Inc., with headquarters and computer servers located in San Jose, California, that enabled payments and money transfers to be made over the Internet These online money transfers served as electronic alternatives to traditional paper payment methods, such as checks and money orders. PayPai required its customers to abide by its terms of service, and conducted business in
interstate and foreign commerce. PayPaI's computers were used in and affecting interstate and

a
9 10
11

foreign commerce and communication. 2. WikiLeaks was an international non-profit organization that published submissioDSof otherwise unavailable documents from anonymous sources. The WikiLeaks website stated that WikiLeaks provided an innovative, secure, and anonymous way for independent sources to l~ information. WikiLeaks' only revenue stream was through donatioDS,and it conducted its collection of donations through PayPal, among others. Julian Assange was the founder, main spokesperson, and editor-in-chieffor WikiLeaks. 3. Anonymous, also known as AnonOps ("Anonymous"), was an online collective of

12 13 14 15

16
17 18 19 20 21 22 23

individuals that was associated with collaborative hacking attacks motivated by political and social goals, often referred to as "hactivism."
4. A

Distributed Denial of Service ("DDoSj was a hacking attack that attempted to

render a computer resource unavailable to its intended users. One common DDoS attack attempted to saturate the target computer or network with external communications requests,
such that the target could not respond to legitimate traffic, or responded so slowly as to render the

2' target effectively unavailable.
25 26

S.

A Low

Orbit Ion Cannon ("LOICj was an open source computer program that
stress

was originally designed as a network

testing application, but which was also used as a tool

27 28

by DDoS attackers. Attackers used LOIC to send extremely large amounts of packets or

requests over a network in an attempt to overwhelm a target. Attackers configured LOIC in two
INDICTMENT
2

1 2 3
4

ways: Manual mode or HIVE mode. In Manual mode, an individual attacker had to enter a specific target, such as the IP address or the http address of the targel The HIVE mode enabled an attacker to connect their LOIC to an Internet Relay Chat Server, which allowed a third party to control at which specific target all HIVE-mode LOIC attackers would be aimed. Anonymous DDoS Attacks on PayPal:

5 6 7 8 9 10 11

6.

In late November 2010, WikiLeaks released a large amount of classified United

States State Department cables on its website. Citing violations of the PayPal terms of service, and in response to WikiLeaks' release of the classified cables, PayPal suspended WikiLeaks' accounts such that Wikileaks could no longer receive donations via PayPal. WikiLeaks' website declared that PayPal's action "tried to economically strangle WikiLeaks."

7.

In retribution for PayPal's tennination ofWikiLeaks' donation account,

12 Anonymous co-ordinated and executed DDoS attacks against PayPal's computer servers using 13 LOIC. Anonymous referred to these co-ordinated attacks on PayPal as "Operation Avenge 14
15

Assange."
COUNT ONE.i (18 U.S.C. § 1030(b)-Conspiracy to Commit Intentional Damage Protected Computer)
to

a

16 17 18 19
20

8. 9.

The factual allegations contained in Paragraphs 1 through 7 are rea11eged

and incoIpOrated herein by reference as if ~t forth in full.

On or about a date unknown but at least by December 6, 2010, and continuing to

on or about December 10, 2010, in the Northem District of California and elsewhere, the

21 defendants, 22 23 24
25

26 27 28

KEITH waSON DOWNEY, MERCEDES RENEE HAEFER, aka "No," and "MMMM," VINCENT CHARLES KERSHAW, "Trivette," "Triv," and "Reaper,"

aka "Absolem, and,

JOSHUA JOHN COvELLI, "Toxic," DONALD HUSBAND, aka "Ananon,"

aka "Anthrophobic "

WA

aka

INDICTMENT

3

1 2
3 4

5
6

ETHAN MILES, DREW ALAN PHILLIPS, aka "DrewOl 0," JEFFREY PUGLISI, aka "Jeffer," "Jefferp," and "Ji," DANIEL SULLIVAN, TRACY ANN VALENZUELA, CHRISTOPHER QUANG vo. did knowingly conspire and agree with each other and other persons known and unknown to the Grand Jury to commit Intentional Damage to a Protected Computer, in violation of 18 U.S.C. §§ 1030(a)(5)(A), (c)(4)(A)(i)(I), & (c)(4)(B)(I), that is to commit a DDoS attack on PayPal's protected computers. All in violation of Title 18, United States Code, Sections 1030(b) & (c)(4)(A)(i)(I). (18 U.S.C. §§ 1030(a)(5)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) & (2)Intentional Damage to a Protected Computer, Aiding and Abetting)

7
8

9
10

11 COUNT TWO: 12 13

10.

The factual allegations contained in Paragraphs 1 through 7 are realleged

14
15 16 17 18
19 20

and incorporated herein by reference as if set forth in full. On or about between December 6, 2010 and December 10,2010, District of California and elsewhere, the defendant, in the Northern

knowingly caused the transmission of a program, information, code, and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPal, and caused loss to 1 or more persons during a l-year period from the defendant's course of conduct affecting protected computers aggregating at least $5,000 in value. All in violation of Title 18, United States Code, Sections 1030(a)(5)(A), (c)(4)(A)(i)(I),
(c)(4)(B)(i), & 2.

21 22 23 24
25

26 27 28

COUNT THREE:

(18 U.S.C. §§ I030(a)(5)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) & (2)Intentional Damage to a Protected Computer, Aidmg and Abetting)

11. INDICTMENT

The factual allegations contained in Paragraphs 1 through 7 are realleged
4

1
2

and incorporated herein by reference as if set forth in full. On or about between December 6,2010 and December 10,2010, in the Northern District of California and elsewhere, the defendant, CHRISTOPHER WAYNE COOPER, aka "Anthrophobic," knowingly caused the transmission of a program, infonnation, code, and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPaI, and caused loss to 1 or more persons during a I-year period from the defendant's course of conduct affecting protected computers aggregating at least SS,Ooo in value. All in violation of Title 18, United States Code, Sections 1030(a)(S)(A), (c)(4)(A)(i)(l), (c)(4)(BXi). & 2.

,
3 S 6 7 8 9 10

11
12 13

COUNT FOUR:
12.

14
lS 16

(18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(AXi)(I), (c)~4)(B)(i) cl (2)fntentional Oamage to a Protected Computer, Aldmg and Abetting)

The factual allegations contained in Paragraphs I through 7 are realleged

and incorporated herein by reference as if set forth in full. On or about between December 6, 2010 and December 10, 2010 , in the Northern District of California and elsewhere, the defendant, JOSHUA JOHN COVELLI, aka "Absolem, and, "Toxic," knowingly caused the transmission of a program, information, code, and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPal, and caused loss to I or more persons during a I-year period from the defendant's course of conduct affecting protected computers aggregating at least SS,ooo in
value.

17
18

19 20
21 22 23 24
2S

26

All in violation of Title 18, United States Code, Sections 1030(a)(S)(A), (c)(4)(AXi)(l),
(c)(4)(B)(i),& 2.

27
28

III INDICTMENT
5

1 2

COUNT FIVE:

(18 U.S.C. §§ 1030(a)(5XA), (c)(4)(A)(i)(I), (c)(4)(B)(i) & (2)Intentional Damage to a Protected Computer, Aiding and Abetting)

3
4 5 6 7 8
9

13.

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorporated herein by reference as if set forth in full.

On or about between December 6,2010 and December 10.2010, in the Northern District of California and elsewhere, the defendant, KEIrn WILSON DOWNEY. knowingly caused the transmission of a program, information, code, and command, that is• LOIC, and, as a result of such conduct, intentionally caused damage without authorization to

.

10 . protected computers at PayPal, and caused loss to I or more persons during a I-year period &om 11 the defendant's course of conduct affecting protected computers aggregating at least $5,000 in 12 value. 13

All in violation of Tide 18, United States Code. Sections 1030(a)(5)(A). (c)(4)(A)(i)(I),

14 (c)(4)(B)(i). &: 2.
15

COUNT SIX:

16
17 18 19

(18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i}ffi. (c)(4)(lJ)(i) &(2)Intentional Damage to a Protected Computer, Aiding and Abetting) . The factual allegations contained in Paragraphs 1 through 7 are rea1leged On or about between December 6, 2010 and December 10,2010. in the Northern

14.

and incorporated herein by reference as if set forth in full.

20 21 22
23 24

District of California and elsewhere, the defendant, MERCEDES RENEE HAEFER, aka ''No,'' and "MMMM," knowingly caused the transmission of a program. infonnation. code, and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to
protected computers at PayPal, and caused loss to 1 or more persons during
8

25

l-year period from

26 . the 27

defendant's course of conduct affecting protected computers aggregating at least 55,000 in
All in violation of Title 18. United States Code, Sections 1030(a)(S)(A). (c)(4)(A)(i)(l),

value.

28

INDICTMENT

6

1 2
3

(c)(4)(B)(i), &. 2. COUNT SEVEN: (18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i)(l), (c)(4)(B)(i) &. (2)intentional Damage to a Protected Computer, Aiding and Abetting)

4
5 6

IS.

The factual allegations contained in Paragraphs I through 7 are realleged

and incorporated herein by reference as if set forth in full. On or about between December 6, 2010 and December 10, 20 I0 , in the Northern District of California and elsewhere, the defendant, DONALD HUSBAND, aka C& Ananon," lmowjngly caused the transmission of a program, infonnation, code, and command, that is,

7
8 9 10

11 LOIC, and, as a result of such conduct, intentionally caused damage without authorization to 12 protected computers at PayPai. and caused loss to 1 or more persons during a I-year period fiom
13 14 15

the defendant's course of conduct affecting protected computers aggregating at least SS,OOO in value. All in violation of Title 18, United States Code, Sections 1030(a)(5)(A). (c)(4)(A)(i)(I),
(c)(4)(B)(i). . 2. &

16
17

COUNT

EIGHT;

18
19 20

(I8 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) &. (2)Intentional fiamage to a Protected Computer, Aiding and Abetting)

16.

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorponted herein by reference as if set forth in full.
On or about between December 6, 2010 and December 10, 2010 , in the Northern

21 22
23

District ofCalifomia and elsewhere, the defendant,
aka "Trivette," "Triv," and "Reaper."

VINCENT CHARLES KERSHAW,

24
25

knowingly caused the transmission of a program. infonnation, code. and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPaI, and caused loss to 1 or more persons during a I-year period fiom the defendant's course of conduct affecting protected computers aggregating at least $5,000 in INDICTMENT

26 27 28

.

,

1
2 3 4

value. All in violation of Tide IS, United States Code, Sections 1030(a)(S)(A), (c)(4)(B)(i), &; 2. ' (c)(4)(A)(i)(l),

COUNT NINE;
17. and incorporated

5 6 1
8 9 10

(18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) &; (2)-lntentional Damage to a Protected C:omputer, Aiding and Abetting)

The factual allegations

contained in Paragraphs

1 through 7 are reaIleged.

herein by reference as if set forth in full.
On or about between December 6, 2010

and December 10, 2010, in the Northern

District of California and elsewhere, the defendant,
ETHAN MILES, of a program, infonnation, code, and command, that is,

11 knowingly caused the transmission
12 13

LOIC, and, as a result of such conduct, intentionally caused damage without authorization

to

protected computers at PayPaI, and caused loss to 1 or more persons during a I-year period from course of conduct affecting protected computers aggregating at least S5,000 in

14 the defendant's 15 value. 16 11
18 19 20 21 22 23 24
25

All in violation of Tide 18, United States Code, Sections 1030(a)(SXA), (c)(4)(B)(i), 2. &

(c)(4)(A)(i)(l),

COUNT TENi
18. and incorporated

(18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) & (2)Intentional Damage to a Protected Computer, Aiding and Abetting) The factual allegations contained in Paragraphs 1 through 7 are reaIleged

herein by reference as if set forth in full. On or about between December 6, 2010 and December 10, 2010 , in the Northern

Disbict of Califomia and elsewhere, the defendant,
JAMES C. MURPHY, knowingly caused the transmission of a program, infonnation,
code, and command, that is,

26
27

LOIC, and, as a result of such conduct, intentionally caused damage without authorization

to

protected computers at PayPaJ, and caused loss to 1 or more persons during a I-year period from
the defendant's

28

course of conduct affecting protected computers aggregating
B

at least S5,ooO in

INDICTMENT

1
2 3
4

value. All in violation of Tide 18, United States Code, Sections 1030(aXS)(A), (c)(4)(A)(i)(l), (c)(4)(B)(i), &; 2.

COUNT ELEVEN:
19.

5 6 7 8
9

(18 U.S.C. §§ 1030(a)(S){A),(c)(4)(A)(i)(I), (c)(4)(B)(t) &. (2)futentional Damage to a Protected Computer, Aiding and Abetting)

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorporated herein by reference as if set forth in full.
On or about between December 6,2010 and December 10,2010, in the Northem .

District of California and elsewhere, the defendant, DREW ALAN PHILLIPS, aka "DrewO 10,"

10

11

12 knowingly caused the transmission of a program, information, code, and command, that is, 13 LOIC, and, as a result of such conduct, intentionally caused damage without authorization to

14
15 16 17 18 19 20 21 22

protected computers at PayPal, and caused loss to 1 or more persons during a I-year period &om the defendant's course of conduct affecting protected computers aggregating value. AU in violation of Tide 18, United States Code, Sections 1030(aXSXA), (c)(4)(A)(i)(l), (c)(4)(B)(i), &; 2.
at

least S5,000 in

COUNT TWELVE:
20.

(18 U.S.C. §§ 1030(a)(S){A),(c)(4XA)(i)(I), (cX4)(B)(i) &. (2)lntentional Damage to a Protected Computer, Aiding and Abetting)

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorporated herein by reference as if set forth in full.
On or about between December 6, 2010 and December 10, 2010 , in the Northern

23
24 25 26 27 28

District of California and elsewhere, the defendant,
JEFFREY PUGUSI, aka "Jeffer," "Jeft'erp," and "Ji," knowingly caused the transmission of a program, infonnation, code, and command, that is,

LOIC, and, as a result of such conduct, intentionally caused damage without authorization to INDICTMENT
9

1 2
3 4

protected computers at PayPal, and caused loss to 1 or more persons during a I-year period from the defendant's course of conduct affecting protected computers aggregating at least SS,ooOin value. All in violation of TItle 18, United States Code, Sections 1030(a)(S)(A), (c)(4)(A)(i)(I),
(c)(4)(B)(i), &. 2.

5 6 7 8 9 10 11 12

COUNITHIRTEEN: 21.

(18 U.S.C. §§ 1030(a)(S)(A), (c)(4)(A)(i)(l), (c)(4)(B)(i) & (2)lntentional Damage to a Protected t!omputer, Alcfuig and Abetting)

The factual allegations contained in Paragraphs 1 through 7 are rea11eged

and incorporated herein by reference as if set forth in full. On or about between December 6, 2010 and December 10, 2010 • in the Northern District of California and elsewhere, the defendant, DANIEL SULLIVAN, knowingly caused the transmission of a program, information, code, and command, that is, LOIC, and, as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPal, and caused loss to 1 or more persons during a I-year period from the defendant's course of conduct affecting protected computers aggregating at least S5,OOO in value. All in violation of TItle 18, United States Code, Sections 1030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i), & 2. COUNT FOURTEEN: 22. (18 U.S.C. §§ 1030(a)(5XA), (c)(4)(A)(i)(l). (c).(4)(B)(i) &. (2)lntentionall)amage to a Protected Computer, Aiding and Abetting}

13
14 15 16 17 18

19
20 21 22
23

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorporated herein by reference as if set forth in full.
On or

about between December 6,2010 and December 10,2010, in the Northern

24 25
26 27 28

District of Califomia and elsewhere, the defendant
TRACY ANN VALENZUELA.

knowingly caused the transmission of a program. information, code, and command, that is, LOIC, and. as a result of such conduct, intentionally caused damage without authorization to protected computers at PayPal. and caused loss to I or more persons during a I-year period from INDICTMENT
10

1
2

the defendant's course of conduct affecting protected computers aggregating at least $5,000 in value.
All in violation of Title 18, United States Code, Sections 1030(aX5)(A), (c)(4)(A)(i)(l),

3
4 5 6

(c)(4)(B)(i), & 2. COUNT FlFIEEN: (18 U.S.C. §§ 1030(a)(5)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i) & (2)lntentioual Damage to a Protected Computer, Aidmg and Abetting)

7
8

23.

The factual allegations contained in Paragraphs 1 through 7 are realleged

and incorporated herein by reference as if set forth in full. On or about between December 6,2010 and December 10,2010, in the Northern District of California and elsewhere, the defendant CHRISTOPHER QUANG VO,

9 10

11

12 knowingly caused the transmission of a program, infonnation, code, and command, that is,
13 '

LOIC, and, as a result of such conduct, intentionally caused damage without authorization to

14 protected computers at PayPal, and caused loss to 1 or more persons during a I-year period from
15 16 17 18

the defendant's course of conduct affecting protected computers aggregating at least S5,OOO in value.
All in violation of Title 18, United States Code, Sections 1030(a)(S)(A), (c)(4)(A)(i)(I), (c)(4)(B)(i), & 2.

19 20 21 22 23

DATED:

f

Trn Ie Dn T

..

26
27

(Approved as to form: ,"",~~~~T-r-;;-;~:owr'

28

INDICTMENT

11