United States v. Zarokian

United States of America, Plaintiff, v. Pierre Zarokian, Defendant.

No. CR-18-01626-001-PHX-MTL

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA

July 22, 2020

ORDER

This Order addresses the United States' request for restitution on behalf of the victim, Xcentric Ventures, LLC d/b/a Ripoff Report ("Xcentric"). The United States seeks restitution in the amount of $87,367.25. At Defendant Pierre Zarokian's request, the Court postponed its decision on restitution until after sentencing to give him and his attorneys an opportunity to review the restitution claim. On June 11 and 18, 2020, the Court held an evidentiary hearing on restitution and heard argument. (Docs. 59, 67.) The parties have submitted extensive briefing. (Docs. 46, 53, 54, 64, 69, 70.) The Court has considered the parties' arguments and the factors set forth under 18 U.S.C. § 3664(f)(2). The Court determines that Mr. Zarokian must pay $87,367.25 in restitution to Xcentric.

I. BACKGROUND

Xcentric operates the RipoffReport.com website that allows customers to anonymously post complaints about people and businesses. (Doc. 41 ¶ 9.a.) Mr. Zarokian operated a company that offered "reputation management services," which included services that removed negative customer complaints from websites such as Ripoff Report. (Id.) To provide results for his clients, Mr. Zarokian worked with another individual, a co-defendant, who Mr. Zarokian knew had gained unauthorized access to Xcentric's computer systems. (Id.) Mr. Zarokian paid this person $1,000 per job while charging his clients a fee that ranged between $1,000 and $5,000. (Id.)

The intrusion method employed by the co-defendant involved a "brute force attack," through which software automatically generates many consecutive guesses to learn the computer system's login and password information. (Doc. 35 ¶ 3.) Once the co-defendant obtained the system's credentials, he overrode the login and password protection through an existing account for an Xcentric employee. (Id.)

While Mr. Zarokian and his co-defendant were working together on this conspiracy, the co-defendant demanded a $90,000 payment from Xcentric. (Doc. 35 ¶ 4.) The co-defendant threatened to publicly distribute stolen data, including the personal identifiable information of Ripoff Report's users, if Xcentric did not pay the extortion demand. (Id.)

Mr. Zarokian pleaded guilty to one count of conspiracy in violation of 18. U.S.C. § 371, a Class D felony offense. Mr. Zarokian conspired with the co-defendant to intentionally damage a protected computer in violation of 18 U.S.C. § 1030(a)(5)(A). The Court adopted the plea agreement and sentenced Mr. Zarokian. (Docs. 40, 41.) As part of his plea agreement, Mr. Zarokian agreed to pay full restitution to Xcentric in an amount not to exceed $200,000. (Doc. 41 ¶ 3.c.)

II. DISCUSSION

A. Request for Restitution

The Government asserts that this prosecution involves a crime against property under Title 18 of the United States Code and thus the Mandatory Victims Restitution Act ("MVRA") applies. Mr. Zarokian does not dispute the applicability of the MVRA. The Court finds that the MVRA applies because this case involves a crime against Xcentric's personal property by harming its computer systems. See United States v. Gammell, 932 F.3d 1175, 1180 (8th Cir. 2019).

The MVRA requires the payment of restitution to the victim of the offense.18 U.S.C. § 3663A(a)(1), (b)(1), (c)(1)(A)(ii). "The MVRA requires the district court to order restitution in the amount of the victim's actual loss." United States v. Anieze-Smith, 923 F.3d 565, 571 (9th Cir. 2019). Mr. Zarokian does not dispute that Xcentric is a victim of his offense. Xcentric bore the financial loss caused by his unlawful conduct. The Court therefore finds that Xcentric is a victim of the offense and it is entitled to restitution.

The United States argues that Xcentric's expenditures are subject to a restitution order because each expense was necessary to mitigate and remediate the damage caused by Mr. Zarokian's criminal act. (See Doc. 46 at 3.) This consists of these expenses paid by Xcentric: (1) $66,557.55 paid to Delirious Visions, LLC for services relating to investigating and remediating the breach into Xcentric's computer systems; (2) $1,625.00 paid to Gingras Law Office for legal services; (3) $1,755.00 paid to Jaburg & Wilk, P.C. for legal services; (4) $11,062.50 paid to Out of Box Innovations, a subcontractor of Delirious Visions; and (5) $5,367.20 paid to Teris, a computer forensics company. Additionally, the United States seeks restitution in the amount of $1,000 representing the extortion fee that Xcentric paid to Mr. Zarokian's co-defendant. The total restitution sought for Xcentric is $87,367.25.

Mr. Zarokian objects to the Government's request for restitution to the extent that it seeks restitution (1) relating to the extortion committed by his co-defendant and (2) for expenses that exceed restoring Xcentric's computer systems to their pre-breached state. (See Doc. 53 at 4.) He also asks that the Court allow him to pay any restitution with a down payment and a monthly payment plan. When the parties dispute "the proper amount or type of restitution," the Court will decide the amount of restitution payable and the Government has the burden to establish amounts payable by a preponderance of the evidence. 18 U.S.C. § 3664(e).

B. Extortion-Related Expenditures

Mr. Zarokian points out that he was not directly involved with or charged with the co-defendant's extortion offense. For that reason, he argues, he is not responsible to pay restitution for the $ 1,000 extorted amount or any remedial expenses related to the extortion.Mr. Zarokian generally objects to many of Delirious Visions' time entry narratives that use the terms "hack" and "extortion" interchangeably. He also argues that he is not responsible for some expenditures, such as legal fees paid to Jaburg & Wilk, P.C., because they relate to reputation management services relating to the extortion.

Under the MVRA, a "victim" is defined as "a person directly and proximately harmed as a result of the commission of an offense for which restitution may be ordered . . . ." 18 U.S.C. § 3663A(a)(2). With the phrase "proximately harmed," the statute establishes that restitution applies to losses that are directly related to the defendant's conduct. United States v. Hackett, 311 F.3d 989, 992-93 (9th Cir. 2002); United States v. Booth, 309 F.3d 566, 576 (9th Cir. 2002). The Court finds that the co-defendant's extortion is directly related to Mr. Zarokian's participation in the conspiracy. On behalf of his clients, Mr. Zarokian enlisted the co-defendant's involvement in hacking into Xcentric's computer systems to cause damage. As the United States argues in its Supplemental Memorandum (Doc. 64 at 3), "the extortion and the 'reputation management' scheme both flowed from the underlying computer intrusion" that Mr. Zarokian instigated. The Court agrees with the United States and finds that it has established, by a preponderance of the evidence, that extortion-related expenditures are appropriately included in the restitution calculation. This includes the $1,000 extortion payment and any other expenses relating to it, including legal fees and reputation management service fees.

C. Computer Security Investigation and Remediation Expenses

Mr. Zarokian next objects to amounts billed by vendors, particularly Delirious Visions, that provided security and software investigation and remediation for Xcentric's computer systems. He argues that Xcentric has incurred expenses beyond those necessary to restore its computer systems to the pre-breached state. The evidence submitted by the United States, however, undermines the basis of this objection. None of the expenses relate to upgrading Xcentric's computer systems. Instead, they are related to investigating the hack; determining whether the systems remained compromised to unauthorized intrusion; and investigating and repairing damages from the security breach. The United States calledJustin Crossman as a witness at the evidentiary hearing on restitution. Mr. Crossman is an owner of Delirious Visions, LLC, the vendor mainly responsible for investigating and remediating the hack. Mr. Crossman submitted a declaration in support of the restitution request. (Doc. 46-1.) Mr. Crossman testified that none of his company's expenses related to hardware or software improvements. (Doc. 64-1 at 3.) During his work, Mr. Crossman managed the involvement of two other vendors, Teris and Out of Box Innovations. (Id. at 4.) Mr. Crossman testified that their work focused exclusively on investigating and repairing the damage caused by the breach. (Id. at 4-5.) He added that "I can further elaborate on that by saying that there were no hardware or software updates, and so that particular point is moot." (Id. at 5.) Mr. Zarokian did not introduce any evidence showing that these expenditures were made for hardware or software updates. Nor did Mr. Zarokian introduce any controverting evidence showing that the methods undertaken by Delirious Visions or the other vendors was unreasonable or unnecessary.

The Eighth Circuit recently addressed this issue in Gammell. There, the defendant argued that the restitution order "improperly included expenses that victims incurred for mitigation services and infrastructure modifications, which effectively provided victims with a windfall because it allowed the victims to recover costs against future and speculative property loss due to already-existing security vulnerabilities." 932 F.3d at 1181 (the defendant was convicted of engaging in distributed denial of service ("DDoS") attacks against computers and websites). The court affirmed the restitution order, holding that the victims incurred the expenses "to restore the affected website and applications to proper functionality." Id. The court quoted the restitution order, which found that "[t]hese...