Northern District of California

A Daly City, California, resident and former rideshare driver was arrested today for an Oct. 26, 2023, assault on a rider because he perceived the rider to be Jewish or Israeli.

“The defendant, a rideshare driver, is charged with assaulting a rider because he thought the rider was Jewish or Israeli,” said Attorney General Merrick B. Garland. “No one in this country should live in fear because of how they worship or where they come from. The Justice Department will aggressively prosecute those who perpetrate hate-fueled violence motivated by antisemitism or by bias of any kind.”

“No one should ever fear being attacked because of their nationality or religion,” said FBI Director Christopher Wray. “In this case, a rideshare driver assaulted the victim because he perceived them as Jewish or Israeli. The FBI is firmly committed to investigating such bias-motivated acts of violence and holding the perpetrators accountable to keep Americans safe.”

“When taking public transportation – whether a taxi, bus, or rideshare – customers should be able to ride without being profiled, or worse yet attacked, because of their nationality or religion by drivers,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We will prosecute any ride-share driver who assaults a passenger in such hate-fueled violence.”

According to the indictment unsealed this morning, on Oct. 26, 2023, Csaba John Csukás, 39, struck the victim in the face while at San Francisco International Airport (SFO) because the defendant perceived the victim to be Jewish or Israeli. The indictment alleges Csukás worked as a driver for an app-based rideshare company and was hired to drive the victim from SFO to the victim’s home. The indictment further alleges that when Csukás approached the victim at a predetermined pickup location, Csukás asked the victim if the victim was Jewish or Israeli, stated that he would not transport a Jewish or Israeli person, and attacked the victim by striking the victim in the face with his fist.

Csukás made his initial appearance today and is charged with committing a federal hate crime which prohibits, among other things, causing bodily injury because of the actual or perceived religion or national origin of a person in circumstances affecting interstate commerce.

Csukás faces a maximum penalty of 10 years in prison and a fine of $250,000 for the hate crime charge. If convicted, a federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Assistant Attorney General Kristen Clarke of the Justice Department’s Civil Rights Division and Special Agent in Charge Robert K. Tripp of the FBI San Francisco Field Office joined the announcement.

The FBI San Francisco Field Office investigated the case.

The U.S. Attorney’s Office for the Northern District of California’s Special Prosecutions Section is prosecuting the case.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

SAN FRANCISCO—A Daly City, California, resident and former rideshare driver was arrested on March 13, 2024, for an Oct. 26, 2023, assault on a rider because he perceived the rider to be Jewish or Israeli.

“The defendant, a rideshare driver, is charged with assaulting a rider because he thought the rider was Jewish or Israeli,” said Attorney General Merrick B. Garland. “No one in this country should live in fear because of how they worship or where they come from. The Justice Department will aggressively prosecute those who perpetrate hate-fueled violence motivated by antisemitism or by bias of any kind.”

“When taking public transportation – whether a taxi, bus, or rideshare – customers should be able to ride without being profiled, or worse yet attacked, because of their nationality or religion by drivers,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We will prosecute any ride-share driver who assaults a passenger in such hate-fueled violence.”

“This unprovoked attack was senseless and brutal,” said Robert Tripp, SAC of the San Francisco FBI Field Office. “Hate crime is among the FBI’s highest priorities and we will work to bring justice for victims of bias-motivated crime.”

According to the indictment unsealed this morning, on Oct. 26, 2023, Csaba John Csukás, 39, struck the victim in the face while at San Francisco International Airport (SFO) because the defendant perceived the victim to be Jewish or Israeli. The indictment alleges Csukás worked as a driver for an app-based rideshare company and was hired to drive the victim from SFO to the victim’s home. The indictment further alleges that when Csukás approached the victim at a predetermined pickup location, Csukás asked the victim the if the victim was Jewish or Israeli, stated that he would not transport a Jewish or Israeli person, and attacked the victim by striking the victim in the face with his fist.

Csukás made his initial appearance today and is charged with committing a federal hate crime which prohibits, among other things, causing bodily injury because of the actual or perceived religion or national origin of a person in circumstances affecting interstate commerce.

Csukás faces a maximum penalty of 10 years in prison and a fine of $250,000 for the hate crime charge. If convicted, a federal district court judge will determine any sentence after consulting the U.S. Sentencing Guidelines and other statutory factors. 

Assistant Attorney General Kristen Clarke of the Justice Department’s Civil Rights Division, U.S. Attorney Ismail J. Ramsey for the Northern District of California and Special Agent in Charge Robert K. Tripp of the FBI San Francisco Field Office made the announcement.

The FBI San Francisco Field Office investigated the case.

The U.S. Attorney’s Office for the Northern District of California’s Special Prosecutions Section is prosecuting the case. 
 

​​​​​​​View the indictment here.

Watch U.S. Attorney Ramsey's video statement here.

A federal grand jury indicted Linwei Ding, aka Leon Ding, charging him with four counts of theft of trade secrets in connection with an alleged plan to steal from Google LLC (Google) proprietary information related to artificial intelligence (AI) technology. The announcement was made by Attorney General Merrick B. Garland this afternoon while participating in a “Fireside Chat” at the American Bar Association’s 39th National Institute on White Collar Crime in San Francisco.

According to the indictment, returned on March 5 and unsealed earlier today, Ding, 38, a national of the People’s Republic of China and resident of Newark, California, transferred sensitive Google trade secrets and other confidential information from Google’s network to his personal account while secretly affiliating himself with PRC-based companies in the AI industry. Ding was arrested earlier this morning in Newark.

“The Justice Department will not tolerate the theft of artificial intelligence and other advanced technologies that could put our national security at risk,” said Attorney General Garland. “In this case, we allege the defendant stole artificial intelligence-related trade secrets from Google while secretly working for two companies based in China. We will fiercely protect sensitive technologies developed in America from falling into the hands of those who should not have them.”  

“While we work to responsibly harness the benefits of AI, the Justice Department is on high alert to its risks, including global threats to our national security,” said Deputy Attorney General Lisa Monaco. “As alleged in today’s charges, the defendant stole from Google over 500 confidential files containing AI trade secrets, while covertly working for China-based companies seeking an edge in the AI technology race. The Justice Department will relentlessly pursue and hold accountable those who would siphon disruptive technologies – especially AI – for unlawful export.”

“Today’s charges are the latest illustration of the lengths affiliates of companies based in the People’s Republic of China are willing to go to steal American innovation,” said FBI Director Christopher Wray. “The theft of innovative technology and trade secrets from American companies can cost jobs and have devastating economic and national security consequences. The FBI will continue its efforts to vigorously pursue those responsible for stealing U.S. companies’ intellectual property and most closely guarded secrets.”  

“Mr. Ding allegedly schemed to siphon off cutting-edge AI technology from Google while secretly trying to go into business with Chinese competitors,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “Through the Disruptive Technology Strike Force, we will work relentlessly to find and hold accountable those who would steal advanced American technology and jeopardize our national security and economic prosperity.”

“While Linwei Ding was employed as a software engineer at Google, he was secretly working to enrich himself and two companies based in the People’s Republic of China,” said U.S. Attorney Ismail Ramsey. “By stealing Google’s trade secrets about its artificial intelligence supercomputing systems, Ding gave himself and the companies that he affiliated with in the PRC an unfair competitive advantage.  This office is committed to protecting the innovation of our Silicon Valley companies. To that end, we will aggressively investigate and prosecute the theft of sensitive trade secrets by insiders like Ding, including criminal efforts to jump start illegitimate competition.”

“In the one year since its inception, the Disruptive Technology Strike Force has been relentless in protecting advanced U.S. technologies, like artificial intelligence, from malign actors,” said Assistant Secretary Matthew S. Axelrod of the Commerce Department’s Office for Export Enforcement. “Let today’s announcement serve as further warning – those who would steal sensitive U.S. technology risk finding themselves on the wrong end of a criminal indictment.”

According to court documents, the technology Ding allegedly stole involves the building blocks of Google’s advanced supercomputing data centers, which are designed to support machine learning workloads used to train and host large AI models. According to the indictment, large AI models are AI applications capable of understanding nuanced language and generating intelligent responses to prompts, tasks, or queries. The indictment describes how Google developed both proprietary hardware and software to facilitate the machine learning process powered by its supercomputing data centers. With respect to hardware, Google uses advanced computer chips with the extraordinary processing power required to facilitate machine learning and run AI applications. With respect to software, Google deploys several layers of software, referred to in the indictment as the “software platform,” to orchestrate machine learning workloads efficiently. For example, one component of the software platform is the Cluster Management System (CMS), which functions as the “brain” of Google’s supercomputing data centers. The CMS organizes, prioritizes, and assigns tasks to the hardware infrastructure, allowing the advanced chips to function efficiently when executing machine learning workloads or hosting AI applications.

According to the indictment, Google hired Ding as a software engineer in 2019. Ding’s responsibilities included developing the software deployed in Google’s supercomputing data centers. In connection with his employment, Ding was granted access to Goggle’s confidential information related to the hardware infrastructure, the software platform, and the AI models and applications they supported. The indictment alleges that on May 21, 2022, Ding began secretly uploading trade secrets that were stored in Google’s network by copying the information into a personal Google Cloud account. According to the indictment, Ding continued periodic uploads until May 2, 2023, by which time Ding allegedly uploaded more than 500 unique files containing confidential information.

In addition, the indictment alleges that Ding secretly affiliated himself with two PRC-based technology companies. According to the indictment, on or about June 13, 2022, Ding received several emails from the CEO of an early-stage technology company based in the PRC indicating Ding had been offered the position of Chief Technology Officer for the company. Ding allegedly traveled to the PRC on Oct. 29, 2022, and remained there until March 25, 2023, during which time he participated in investor meetings to raise capital for the new company. The indictment alleges potential investors were told Ding was the new company’s Chief Technology Officer and that Ding owned 20% of the company’s stock.

According to the indictment, unbeknownst to Google, by no later than May 30, 2023, Ding had founded his own technology company in the AI and machine learning industry and was acting as the company’s CEO. Ding’s company touted the development of a software platform designed to accelerate machine learning workloads, including training large AI models. As alleged in the indictment, Ding applied to a PRC-based startup incubation program and traveled to Beijing, to present his company at an investor conference on Nov. 24, 2023. As set forth in the indictment, a document related to Ding’s startup company stated, “we have experience with Google's ten-thousand-card computational power platform; we just need to replicate and upgrade it - and then further develop a computational power platform suited to China's national conditions.” 

The indictment alleges Ding’s conduct violated his employment agreement as well as a separate code of conduct that Ding signed when he became a Google employee. Further, the indictment describes measures that Ding allegedly took to conceal his theft of the trade secrets. For example, he allegedly copied data from Google source files into the Apple Notes application on his Google-issued MacBook laptop. By then converting the Apple Notes into PDF files and uploading them from the Google network into as separate account, Ding allegedly evaded detection by Google’s data loss prevention systems. Likewise, the indictment describes how in December 2023 Ding allegedly permitted another Google employee to use his Google-issued access badge to scan into the entrance of a Google building – making it appear he was working from his U.S. Google office when, in fact, he was in the PRC.

Ding is charged with four counts of theft of trade secrets. If convicted, Ding faces a maximum penalty of 10 years in prison and up to a $250,000 fine for each count. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI and Commerce Department are investigating the case.

The U.S. Attorney’s Office for the Northern District of California and Justice Department National Security Division’s Counterintelligence and Export Control Section are prosecuting the case.

Today’s action was coordinated through the Justice and Commerce Departments’ Disruptive Technology Strike Force. The Disruptive Technology Strike Force is an interagency law enforcement strike force co-led by the Departments of Justice and Commerce designed to target illicit actors, protect supply chains, and prevent critical technology from being acquired by authoritarian regimes and hostile nation-states.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

SAN FRANCISCO – A federal grand jury indicted Linwei Ding, aka Leon Ding, charging him with four counts of theft of trade secrets in connection with an alleged plan to steal from Google LLC (Google) proprietary information related to artificial intelligence (AI) technology. The announcement was made by Attorney General Merrick B. Garland this afternoon while participating in a “Fireside Chat” at the American Bar Association’s 39th National Institute on White Collar Crime in San Francisco. U.S. Attorney Ismail Ramsey posted a statement about the case here: https://youtu.be/l64VlrA-GUA.

According to the indictment, returned on March 5 and unsealed earlier today, Ding, 38, a national of the People’s Republic of China and resident of Newark, California, stole sensitive Google trade secrets and other confidential information from Google’s network to his personal account while secretly affiliating himself with PRC-based companies in the AI industry. Ding was arrested earlier this morning in Newark.

“The Justice Department will not tolerate the theft of artificial intelligence and other advanced technologies that could put our national security at risk,” said Attorney General Garland. “In this case, we allege the defendant stole artificial intelligence-related trade secrets from Google while secretly working for two companies based in China. We will fiercely protect sensitive technologies developed in America from falling into the hands of those who should not have them.”

“While we work to responsibly harness the benefits of AI, the Justice Department is on high alert to its risks, including global threats to our national security,” said Deputy Attorney General Lisa Monaco. “As alleged in today’s charges, the defendant stole from Google over 500 confidential files containing AI trade secrets, while covertly working for China-based companies seeking an edge in the AI technology race. The Justice Department will relentlessly pursue and hold accountable those who would siphon disruptive technologies – especially AI – for unlawful export.”

“While Linwei Ding was employed as a software engineer at Google, he was secretly working to enrich himself and two companies based in the People’s Republic of China,” said U.S. Attorney Ismail Ramsey. “By stealing Google’s trade secrets about its artificial intelligence supercomputing systems, Ding gave himself and the companies that he affiliated with in the PRC an unfair competitive advantage. This office is committed to protecting the innovation of our Silicon Valley companies. To that end, we will aggressively investigate and prosecute the theft of sensitive trade secrets by insiders like Ding, particularly when the theft endeavors to jump start illegitimate competition.”

“Today’s charges are the latest illustration of the lengths affiliates of companies based in the People’s Republic of China are willing to go to steal American innovation,” said FBI Director Christopher Wray. “The theft of innovative technology and trade secrets from American companies can cost jobs and have devastating economic and national security consequences. The FBI will continue its efforts to vigorously pursue those responsible for stealing U.S. companies’ intellectual property and most closely guarded secrets.”

“The FBI’s area of responsibility is home to internationally renowned innovation and cutting-edge technology. Unfortunately, this makes many businesses a target for criminals looking to steal crucial proprietary information, " said FBI Special Agent in Charge Robert Tripp. "This case exemplifies our commitment to protecting U.S. technologies and our ability to accelerate priority investigations when we have a pre-established relationship with private sector companies.”

“Mr. Ding allegedly schemed to siphon off cutting-edge AI technology from Google while secretly trying to go into business with Chinese competitors,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “Through the Disruptive Technology Strike Force, we will work relentlessly to find and hold accountable those who would steal advanced American technology and jeopardize our national security and economic prosperity.”

“In the one year since its inception, the Disruptive Technology Strike Force has been relentless in protecting advanced U.S. technologies, like artificial intelligence, from malign actors,” said Assistant Secretary Matthew S. Axelrod of the Commerce Department’s Office for Export Enforcement. “Let today’s announcement serve as further warning – those who would steal sensitive U.S. technology risk finding themselves on the wrong end of a criminal indictment.”

According to court documents, the technology Ding allegedly stole involves the building blocks of Google’s advanced supercomputing data centers, which are designed to support machine learning workloads used to train and host large AI models. According to the indictment, large AI models are AI applications capable of understanding nuanced language and generating intelligent responses to prompts, tasks, or queries. The indictment describes how Google developed both proprietary hardware and software to facilitate the machine learning process powered by its supercomputing data centers. With respect to hardware, Google uses advanced computer chips with the extraordinary processing power required to facilitate machine learning and run AI applications. With respect to software, Google deploys several layers of software, referred to in the indictment as the “software platform,” to orchestrate machine learning workloads efficiently. For example, one component of the software platform is the Cluster Management System (CMS), which functions as the “brain” of Google’s supercomputing data centers. The CMS organizes, prioritizes, and assigns tasks to the hardware infrastructure, allowing the advanced chips to function efficiently when executing machine learning workloads or hosting AI applications.

According to the indictment, Google hired Ding as a software engineer in 2019. Ding’s responsibilities included developing the software deployed in Google’s supercomputing data centers. In connection with his employment, Ding was granted access to Google’s confidential information related to the hardware infrastructure, the software platform, and the AI models and applications they supported. The indictment alleges that on May 21, 2022, Ding began secretly uploading trade secrets that were stored in Google’s network by copying the information into a personal Google Cloud account. According to the indictment, Ding continued periodic uploads until May 2, 2023, by which time Ding allegedly uploaded more than 500 unique files containing confidential information.

In addition, the indictment alleges that Ding secretly affiliated himself with two PRC-based technology companies. According to the indictment, on or about June 13, 2022, Ding received several emails from the CEO of an early-stage technology company based in the PRC indicating Ding had been offered the position of Chief Technology Officer for the company. Ding allegedly traveled to the PRC on Oct. 29, 2022, and remained there until March 25, 2023, during which time he participated in investor meetings to raise capital for the new company. The indictment alleges potential investors were told Ding was the new company’s Chief Technology Officer and that Ding owned 20% of the company’s stock.

According to the indictment, unbeknownst to Google, by no later than May 30, 2023, Ding had founded his own technology company in the AI and machine learning industry and was acting as the company’s CEO. Ding’s company touted the development of a software platform designed to accelerate machine learning workloads, including training large AI models. As alleged in the indictment, Ding applied to a PRC-based startup incubation program and traveled to Beijing, to present his company at an investor conference on Nov. 24, 2023. As set forth in the indictment, a document related to Ding’s startup company stated, “we have experience with Google's ten-thousand-card computational power platform; we just need to replicate and upgrade it - and then further develop a computational power platform suited to China's national conditions.”

The indictment alleges Ding’s conduct violated his employment agreement as well as a separate code of conduct that Ding signed when he became a Google employee. Further, the indictment describes measures that Ding allegedly took to conceal his theft of the trade secrets. For example, he allegedly copied data from Google source files into the Apple Notes application on his Google-issued MacBook laptop. By then converting the Apple Notes into PDF files and uploading them from the Google network into as separate account, Ding allegedly evaded detection by Google’s data loss prevention systems. Likewise, the indictment describes how in December 2023 Ding allegedly permitted another Google employee to use his Google-issued access badge to scan into the entrance of a Google building – making it appear he was working from his U.S. Google office when, in fact, he was in the PRC.

Ding is charged with four counts of theft of trade secrets. If convicted, Ding faces a maximum penalty of 10 years in prison and up to a $250,000 fine for each count. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI and Commerce Department are investigating the case.

The U.S. Attorney’s Office for the Northern District of California and Justice Department National Security Division’s Counterintelligence and Export Control Section are prosecuting the case.

Today’s action was coordinated through the Justice and Commerce Departments’ Disruptive Technology Strike Force. The Disruptive Technology Strike Force is an interagency law enforcement strike force co-led by the Departments of Justice and Commerce designed to target illicit actors, protect supply chains, and prevent critical technology from being acquired by authoritarian regimes and hostile nation-states.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

ding_indictment_filed.pdf

SAN FRANCISCO – Joon Woo Kim pleaded guilty in federal court to charges related to his role in two related multi-million-dollar fraud schemes—the first, a scheme to mislead investors to contribute to a fund he formed in San Francisco, and the second, a scheme to obtain a multi-million dollar business loans and line of credit by lying to a bank—announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp.

In his plea agreement, Kim, 57, of Montebello, Calif., admitted that he engaged in the first fraud scheme from June 2015 through at least March 19, 2022. Kim created an investment fund called the M5 Doctors Fund and induced investors to contribute to the fund by making false statements and omissions about the kinds of investments Kim would make while managing the fund’s assets. For example, Kim admitted that he advertised that he would invest assets of the M5 Doctors Fund in securities of Tesla, Inc. and electric vehicle companies. Nevertheless, rather than invest the funds as he promised, Kim admitted that he transferred nearly all M5 Doctors Fund assets, including funds from the liquidation of investments and the return on those investments, to CKR Enterprise, Inc., a wholesale food distribution company owned by, among others, Kim and his wife and operated by Kim and his wife.

Kim further admitted in his plea agreement that he acted with the intent to deceive and cheat investors and that in furtherance of the scheme he caused the creation of the M5 Doctors Fund and a separate management entity called M5 Management and he induced investors to invest in the M5 Doctors Fund and maintain their investment funds in the M5 Doctors Fund based on false statements and omissions regarding the kinds of investments he would make.

Kim admitted that without telling his investors he transferred nearly all M5 Doctors Fund assets to his business, CKR, and thereby defrauded investors out of $4,690,000. Further, Kim misled investors into believing that the M5 Doctors fund was solvent and engaged in investment activities. For example, Kim sent investors misleading quarterly reports suggesting that their money was invested in securities such as Tesla when in fact Kim had transferred nearly all investor money to CKR.

Kim further admitted that he engaged in a second fraud scheme in which he defrauded Hanmi Bank by applying for two loans for CKR, a $1,300,000 line of credit and a $3,200,000 business loan, that contained materially false and fraudulent representations and promises. As a result of these fraudulent representations and promises, Kim obtained the proceeds of these loans.

A federal grand jury charged Kim on June 27, 2023, with eight counts of wire fraud, in violation of 18 U.S.C. § 1343; two counts of bank fraud, in violation of 18 U.S.C. § 1344; and one count of making a false statement to a bank, in violation of 18 U.S.C. § 1014. Under the plea agreement, Kim pleaded guilty to one count of wire fraud and one count of making a false statement to a bank. If Kim complies with his plea agreement, the remaining counts will be dismissed at sentencing.

Kim was arrested on July 17, 2023, and subsequently released on a bond. His sentencing hearing is scheduled for June 24, 2024. The maximum statutory penalty for each of the wire fraud charges is 20 years in prison, and a fine of $250,000, plus restitution, if appropriate. The maximum statutory penalty for each of the bank fraud and making a false statement to a bank is 30 years in prison, and a fine of $1,000,000, plus restitution, if appropriate. The court also may order an additional term of supervised release to begin after a prison term as part of any sentence. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Christiaan Highsmith is prosecuting the case with the assistance of Aarian Beti. The prosecution is the result of an investigation by the FBI.

SAN JOSE – Paul Garcia was sentenced today to 235 months’ imprisonment after pleading guilty to methamphetamine trafficking, announced United States Attorney Ismail J. Ramsey and Bureau of Alcohol, Tobacco, Firearms & Explosives (ATF) Special Agent in Charge Jennifer L. Cicolani. The sentence was handed down by the Hon. Edward J. Davila, United States District Judge.

Garcia, 34, formerly of Santa Cruz County, was arrested in July 2019 after Santa Cruz County Sheriff’s Deputies seized a stash of drugs in a Santa Cruz motel room Garcia was using. The stash included more than two pounds of heroin, 440 grams of methamphetamine, cocaine, fentanyl, and pills. Deputies also found a loaded, semi-automatic pistol in the motel room. Garcia was indicted by a federal grand jury on February 6, 2020, on one count of possession with intent to distribute 50 grams or more of a mixture or substance containing methamphetamine, in violation of 21 U.S.C. §§ 841(a)(1) and 841(b)(1)(A).

In February 2020, Garcia made his initial appearance in federal court and was released on a $100,000 bond. Garcia eventually violated the terms of his release, his bail was revoked, and Garcia was ordered to report to the Santa Rita Jail facility in June 2020. Garcia failed to report as ordered, and became a fugitive. Garcia’s bond was subsequently forfeited, and the Court entered forfeiture judgments against his sureties.

Garcia remained a fugitive until he was arrested on April 18, 2021. At that time, Sunnyvale police officers approached Garcia in the parking lot of a motel, and Garcia fled through the motel with officers in pursuit. During the chase, Garcia retrieved a pistol from his waistband and fired two shots at the officers before being taken into custody.

On December 18, 2023, Garcia pleaded guilty to the federal charge against him. In the plea agreement, Garcia admitted, among other things, that he possessed the methamphetamine, cocaine, and heroin found in his Santa Cruz motel room in July 2019, with the intent to distribute them, and also that he possessed the semi-automatic pistol found in the motel room in connection with his drug dealing. Garcia also admitted he failed to report to the Santa Rita Jail facility as ordered, and that he willfully remained a fugitive until he was arrested in Sunnyvale.

“Disrupting drug trafficking in Santa Cruz County is a priority for our office,” said United States Attorney Ismail J. Ramsey. “Anyone who traffics drugs in Santa Cruz County, or anywhere else in the Northern District, particularly while armed, should know that federal criminal convictions come with serious prison time.”

“Removing violent offenders from our communities is a priority for ATF,” said ATF Special Agent in Charge Jennifer Cicolani. “Anyone who participates in trafficking will be held accountable. Throughout this case, ATF has worked side by side with our prosecutorial partners to fulfill one of our core duties to the public. That duty being to ensure the safety of our communities. Today’s sentencing ensured that our commitment to the public is being upheld.”

Judge Davila ordered that Garcia’s federal prison term be served concurrently with a 29-year prison term Garcia is currently serving. In addition to the prison term, Judge Davila also ordered Garcia to serve a five-year term of supervised release upon his release from prison.

Assistant United States Attorneys Michael G. Pitman and Daniel N. Kassabian are prosecuting the case, with the assistance of Sahib Kaur. The prosecution is the result of an investigation by ATF and the Santa Cruz County Sheriff’s Office.

OAKLAND - A federal grand jury indicted Edijalma De Souza Ferreira, charging him with smuggling ammunition from the United States to Brazil without an export license, announced United States Attorney Ismail J. Ramsey and Homeland Security Investigations (HSI) Special Agent in Charge Tatum King.

According to the indictment, filed February 27, Ferreira, 46, of Richmond, Calif., smuggled thousands of rounds of ammunition in two container shipments that were exported from the Port of Oakland in 2021. Export of the ammunition was contrary to the Export Control Reform Act and associated regulations. The indictment charges Ferreira with a felony violation of 18 U.S.C. § 554.

Ferreira was arrested on February 29, 2024, and made his initial appearance in federal court in Oakland the same day. He was released on bond and his next appearance is scheduled for March 6, 2024, before U.S. Magistrate Judge Donna M. Ryu for identification of counsel.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, Ferreira faces a maximum sentence of ten years of imprisonment, and a fine of $250,000 for the 18 U.S.C. § 554 violation. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Michelle J. Kane is prosecuting the case with the assistance of Kathy Tat. The prosecution is the result of an investigation by HSI with assistance from the U.S. Department of Commerce, the U.S. Customs and Border Protection Container Security Initiative, the HSI Brasilia Attaché Office, and the Customs and Revenue Service of Brazil.

SAN JOSE – Cuong Chi Quan, also known as “Roger Quan,” was sentenced last week to 10 months in prison for crimes related to a scheme to underreport his income by nearly $4.5 million, announced United States Attorney Ismail J. Ramsey and Kareem Carter, Special Agent in Charge of IRS–Criminal Investigation (IRS-CI)’s Washington D.C. Field Office. The sentence was handed down by the Honorable Edward J. Davila, United States District Judge.

On March 27, 2023, Quan was charged by felony information with one count each of willfully aiding and assisting in the preparation of a false tax return, in violation of 26 U.S.C. § 7206(2), and willfully violating foreign bank account reporting requirements, in violation of 31 U.S.C. §§ 5314 and 5322(a). On April 24, 2023, Quan pleaded guilty to both counts.

Quan, 56, of Milpitas, Calif., owned and managed QXQ, Inc. (“QXQ”), a manufacturer of circuit board test fixtures based in Fremont, Calif. QXQ shipped its products to customers in the United States and abroad. According to his plea agreement, Quan admitted that, since before 2014, QXQ maintained two sets of QuickBooks bookkeeping files. One set of books recorded sales to customers in the United States and all of QXQ’s expenses. The second set of books recorded sales to customers in Asia. Quan directed QXQ’s customers in Asia to wire their payments to QXQ’s bank accounts in New Zealand. The income and expenses of QXQ were reported on Quan’s individual Form 1040 tax returns. Quan admitted that he provided his income tax preparer only with the QuickBooks bookkeeping file that recorded QXQ’s sales to customers in the United States and all of its expenses. Further, Quan acknowledged he knowingly did not provide his income tax return preparer with, or disclose to the tax preparer the existence of, the bookkeeping file that recorded QXQ’s sales to customers in Asia or the statements from his and QXQ’s foreign bank accounts, which included significant interest. Quan agreed his actions omitted over $4 million in 2017 income, causing his 2017 federal income taxes to be underreported by $1,783,339.

The plea agreement contains further details of the scheme. For example, Quan admitted that he had signature authority over at least eleven foreign bank accounts in 2017. One of these accounts held a balance of at least $12,137,288.50 on April 15, 2018. Quan admitted that he knowingly did not report the existence of these accounts as required. Quan also did not report the interest earned in foreign bank accounts to his tax return preparer.

Judge Davila imposed restitution to the Internal Revenue Service of $8,167,733 for underreported federal income tax for the years 2014 through 2018. Judge Davila further imposed a fine of $35,000, and a 3-year term of supervised release.

Assistant U.S. Attorney Colin Sampson is prosecuting the case. The prosecution is the result of an investigation by the IRS-CI International Tax and Financial Crimes (ITFC) group, a team of Special Agents dedicated to investigating international tax crimes. 

SAN FRANCISCO – Long Nguyen, who pleaded guilty last year to charges relating to a scheme to defraud at least 20 individuals out of millions of dollars, has been sentenced to 30 months in prison and ordered to pay nearly $1.5 million in restitution and to forfeit $1 million, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation (FBI) Special Agent in Charge Robert K. Tripp. The sentence was imposed by the Hon. Trina L. Thompson, United States District Judge.

Nguyen, 35, a resident of Alameda, California, pleaded guilty in October 2023 to four counts of wire fraud, in violation of 18 U.S.C. § 1343. In his plea agreement, Nguyen admitted that, between September 2015 and July 2021, he operated a scheme to defraud his victims by making false statements about himself, his investment opportunities, how he would invest his victims’ money, and what he in fact did with their money.

Specifically, Nguyen admitted making the following false statements, among others, to induce victims to give him money: that (i) he was a billionaire; (ii) other people who invested with him had received large payouts at a high rate of return; (iii) he was starting his own hedge fund; (iv) he had access to pre-IPO investment opportunities that he would and did invest victims’ money into; and (v) he managed a real estate investment trust that he would and did invest victims’ money into and that would provide victims with monthly income. Nguyen also admitted creating fake screenshots that purported to show victims’ growing investment account balances, and falsely telling victims not only that they were making money, but also that he would buy—and, in some cases, had bought—them Teslas and homes.

According to the plea agreement, Nguyen also admitted that he did not, in fact, invest the majority of the money he received from his victims. Rather, Nguyen admitted spending victims’ money for his own personal use and operating a Ponzi scheme by using money he had received from some victims to pay other victims back. And Nguyen admitted he devised and executed his fraudulent scheme with the intent to defraud his victims.

According to the government’s sentencing memorandum, Nguyen perpetuated his fraud by lying to his victims when they asked for their money back, including by falsely telling them that he was being audited, that his accounts had been frozen, and that others, including his lawyer and the bank, were the source of the delay. He also sent fraudulent checks that his victims were unable to cash.

Nguyen was indicted by a federal grand jury in October 2022 on four counts of wire fraud, all of which he pleaded guilty to. In addition to sentencing Nguyen to prison, Judge Thompson ordered the defendant to pay $1,494,496.89 in restitution to his victims and to forfeit $1 million. Judge Thompson also ordered Nguyen to serve three years of supervised release to begin after his prison term is completed.

Assistant United States Attorney Kelsey Davidson is prosecuting the case with the assistance of Lance Libatique and Marina Ponomarchuk. The prosecution is the result of an investigation by the FBI.

SAN FRANCISCO – Augusto Alizo, pleaded guilty in federal court today to charges related to his role in a multi-million-dollar fraudulent kickback scheme, announced United States Attorney Ismail J. Ramsey and IRS Criminal Investigation (CI) Acting Special Agent in Charge Michael Mosley. The plea was accepted by the Hon. Richard Seeborg, U.S. District Judge.

In his plea agreement, Alizo, of Weston, Florida, admitted he conspired with two co-defendants—a Vice President at Williams Sonoma, Inc. (WSI), and Kourosh Mirmehdi, Alizo’s direct report at the global logistics company where they both worked—to divert and steal more than $4 million in commercial real estate broker commission rebates that should have gone to WSI.

WSI is a home-goods retailer headquartered in San Francisco that operates brands such as Williams Sonoma, Pottery Barn, and West Elm. The global logistics company where Alizo worked helped clients secure commercial real estate, including large commercial warehouses. In his plea agreement, Alizo admitted that he concealed from the global logistics company that co-defendant Mirmehdi was helping WSI obtain commercial warehouse space. Alizo also admitted that he and his co-defendants concealed from WSI and the global logistics company that he, Mirmehdi, and the conspiring Vice President at WSI pocketed real estate broker commissions rebates that should have gone to WSI.

As part of his plea agreement, Alizo admitted that from 2020 through 2022, co-defendant Mirmehdi was working to secure commercial warehouse space for WSI in Georgia, New Jersey, Arizona, and California. Alizo hid this from their employer. Alizo also hid from their employer the fact that his co-defendants were negotiating with real estate brokers to obtain broker commission rebates that should have gone to WSI. These broker commissions rebates were paid to REM Group, a shell company owned by the conspiring WSI Vice President, and then distributed to private bank accounts controlled by Alizo, Mirmehdi, and the conspiring WSI Vice President. REM Group was not affiliated with WSI. Alizo also admitted in his plea agreement that he knew co-defendant Mirmehdi was holding himself out to real estate brokers as an employee of the global logistics company and that in negotiating with real estate brokers Mirmehdi was benefitting from status and bargaining power due to his position and title at the global logistics company. Alizo further admitted that he knew Mirmehdi was falsely and deceptively representing that WSI was the global logistics company’s client when in fact it was not. Alizo concealed this deception from his and Mirmehdi’s employer.

As part of his plea agreement, Alizo admitted that he acted with the intent to deceive and cheat both his employer and WSI to further the scheme and conspiracy to defraud so that he and his co-defendants could obtain broker commissions rebates that should have gone to WSI. Alizo admitted that he received approximately 25% of the broker commissions and rebates obtained as part of the conspiracy. Alizo admitted that the conspirators obtained a total of $4,110,323.81 and that he personally obtained $965,526.51.

Alizo was indicted by a federal grand jury on April 11, 2023. He was charged with one count of wire fraud conspiracy, in violation of 18 U.S.C. § 1349; four counts of wire fraud, in violation of 18 U.S.C. § 1343; and one count of money laundering conspiracy, in violation of 18 U.S.C § 1956(h). Under the plea agreement, Alizo pleaded guilty to the wire fraud conspiracy. If Alizo complies with his plea agreement, the remaining counts will be dismissed at sentencing.

Alizo is currently released on bond. His sentencing hearing is scheduled for August 27, 2024. The maximum statutory penalty is 20 years in prison for each of the wire fraud and money laundering conspiracy counts, as well as a $250,000 fine for the wire fraud conspiracy count and a $500,000 fine for the money laundering conspiracy count. As part of any sentence the court also may order Alizo to serve an additional term of supervised release and to pay restitution, if appropriate. However, any sentence will be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Alizo and three co-defendants were charged via grand jury indictment on April 11, 2023. Co-defendant Khourosh Mirmehdi pleaded guilty on May 30, 2023. Co-defendant Michael Podhurst pleaded guilty on June 9, 2023. The charges against the conspiring WSI Vice President are pending.

Assistant U.S. Attorney Christiaan Highsmith is prosecuting the case with the assistance of Aarian Beti. The prosecution is the result of an investigation by the CI.

SAN FRANCISCO – U.S. Attorney Ismail J. Ramsey convened a press conference today with Brian Clark, Special Agent in Charge of the Drug Enforcement Administration and Robert K. Tripp, Special Agent in Charge of the Federal Bureau of Investigation, to announce that the government of Honduras extradited three of its nationals to the United States. The three Honduran nationals now will face federal felony charges that they were involved in separate conspiracies to sell drugs in the Tenderloin District of San Francisco. U.S. Attorney Ramsey used the occasion to provide an update the progress being made after his November 2023 announcement that federal, state, and local law enforcement authorities would be implementing “All Hands on Deck,” a joint law enforcement initiative to address drug dealing in San Francisco.

The three extradited Honduran nationals are Jorge Alberto Viera-Chirinos, 34; Mayer Benegas-Medina, 30; and Elmer Bonilla Matute, 34.

Viera-Chirinos was originally charged by criminal complaint on July 29, 2019, with charges that he participated in a conspiracy to distribute drugs on the Tenderloin. Viera-Chirinos was arrested the same day. On May 6, 2020, he was released on bond. A federal grand jury indicted Viera-Chirinos on August 8, 2019; the indictment alleges he is one of 14 defendants trafficking large quantities of heroin, methamphetamine, cocaine base, and cocaine in San Francisco. The indictment alleged Viera-Chirinos was a high-level manager of the organization responsible for having overseen the organization’s drug trafficking activities. On September 2, 2020, he fled from the home where he was required to stay while on release, thereby violating the terms of his bond. The court issued an arrest warrant but Viera-Chirinos fled to Honduras where he was later found. He will now face the charges set out in the August 2019 indictment. He made his initial appearance before U.S. Magistrate Judge Peter H Kang on Feb. 23, 2024. His next appearance is scheduled to take place February 28, 2023, before Magistrate Judge Kang.

A federal grand jury indicted Mayer Benegas-Medina on December 16, 2020. The indictment alleges Benegas participated in a conspiracy to distribute and possess with intent to distribute fentanyl. Benegas was arrested on December 10, 2020, and on December 21, 2020, he was ordered released on bond. The terms of his release included electronic monitoring and a curfew. In March 2021, he absconded. He was found in Honduras and made his initial appearance before Magistrate Judge Kang on Feb. 23, 2024. His next court appearance is scheduled for March 26, 2024, before the Hon. William Alsup, U.S. District Judge.

A federal grand jury indicted Matute on Dec. 19, 2019, charging him with possession with intent to distribute heroin, methamphetamine, cocaine, and cocaine base. The indictment alleges Matute is part of a drug trafficking organization based in San Francisco and that, between approximately 2017 and 2019, was responsible for distributing large quantities of heroin, methamphetamine, cocaine base, and cocaine as well as trafficking the drugs through the State of Oregon and into the State of Washington. Matute appeared before Magistrate Judge Kang this morning. His next appearance in district court is scheduled for April 3, 2024, before Hon. Vince Chhabria, U.S. District Judge.

At today’s press conference, U.S. Attorney Ramsey stated that as the elements of “All Hands on Deck” are implemented, the pressure on drug dealers in the Tenderloin will continue to increase. “In addition to the risk that your money will be taken and that you may face criminal penalties far in excess than you anticipated, you can now add that you should look over your shoulder for years after committing your crime—even if you leave the country.” In addition, U.S. Attorney Ramsey stated that various elements of the “All Hands on Deck” initiative continue to be implemented. U.S. Attorney Ramsey recited several cases in which defendant received lengthy sentences and reviewed additional elements of “All Hands on Deck” including the following:

•    The Office of the United States Attorney is pursuing criminal actions related to money services businesses that facilitate the movement of drug profits.

•    The Office of the United States Attorney has convicted 51 defendants under a Fast Track program. The program supplements traditional federal drug distribution cases and brings consequences to low-level dealers in the Tenderloin.

•    Federal prosecutors join with local prosecutors at state court on two random days per week to review cases that can be pursued in federal, rather than state, courts.

“In sum,” said U.S. Attorney Ramsey, “drug dealing in the Tenderloin is simply a different proposition than it’s been in the past.”

“These extraditions should send a clear message to those who peddle poison in San Francisco: if you traffic deadly drugs that threaten the safety and health of our community, if you flee from justice, if you think you can hide, you are wrong. DEA will be relentless in our pursuit to hold you accountable,” said DEA Special Agent in Charge Brian M. Clark.

U.S. Attorney Ramsey thanked the Justice Department’s Office of International Affairs for their substantial assistance in securing the arrests and extraditions of Viera-Chirinos, Benegas-Medina and Matute.

SAN FRANCISCO – Melvin Alexis Diaz Arteaga (Diaz), a resident of Oakland, was sentenced today to 78 months in federal prison following his conviction last year on six drug charges relating to his sale of—and intent to sell—fentanyl, methamphetamine, heroin, and cocaine in the Tenderloin district of San Francisco, announced United States Attorney Ismail J. Ramsey. The sentence was imposed by the Hon. Charles R. Breyer, Senior United States District Judge.

Diaz, 30, a citizen of Honduras, pleaded guilty in October 2023 to charges including conspiracy to distribute fentanyl, in violation of 21 U.S.C. §§ 846 and 841(a)(1) and (b)(1)(A)(vi); possession with intent to distribute fentanyl, heroin and cocaine, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(A)(vi), (b)(1)(B)(i)–(ii); and distribution of methamphetamine, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B)(viii), (b)(1)(C).

In his plea agreement, Diaz admitted he possessed 6.6 kilograms—that is, nearly 15 pounds—of fentanyl, along with lesser quantities of methamphetamine, heroin, cocaine, and other controlled substances, all of which he intended to sell, when he was arrested outside an apartment in Berkeley, California, on November 16, 2022. He also admitted that he (i) used that Berkeley apartment to manufacture and store significant quantities of drugs for sale in the Tenderloin, among other locations; and (ii) sold, or arranged the sale of, fentanyl and methamphetamine to an undercover officer of the San Francisco Police Department (SFPD) on four separate occasions between September 16, 2022, and October 5, 2022.

According to the government’s sentencing memorandum, officers found two firearms, cash, and drug manufacturing and processing equipment inside the stash house, in addition to the drugs themselves. In addition, the government’s sentencing memorandum says, officers determined that Diaz traveled from his residence in Oakland to the Tenderloin every night between October 13, 2022, and November 11, 2022. As part of his regular commute, Diaz typically picked up his co-defendant at another location in the East Bay and the two men then stopped by their Berkeley stash house to pick up drugs before heading into San Francisco to sell those drugs on the streets of the Tenderloin.

“By his own admission, this defendant had access to a staggering quantity of fentanyl, which he repeatedly sold in the Tenderloin,” said United States Attorney Ismail J. Ramsey. “Today’s sentencing should serve as a warning to those who regularly sell dangerous drugs on our streets: you will not escape justice. I am proud of the work being done by this Office and by our federal and local law enforcement partners to ensure that fentanyl dealers operating throughout this District, and particularly in the Tenderloin, are held to account.”

Pursuant to the plea agreement, Diaz agreed to forfeit, among other things, more than $50,000 in cash that officers seized on the night of his arrest, including nearly $42,000 found in Diaz’s bedroom. Diaz acknowledged these funds either were, or were derived from, drug proceeds, or that they were used, or were intended to be used, to commit or facilitate his drug trafficking crimes.

Diaz and two co-defendants were indicted by a federal grand jury on January 5, 2023. Diaz was charged in six of the eight counts alleged in the indictment.

In addition to sentencing Diaz to prison, Judge Breyer ordered the defendant to serve four years of supervised release to begin after his prison term is completed. Diaz has been in custody since he was arrested on November 16, 2022, and he was remanded into custody following his sentencing today.

Assistant United States Attorney Nicholas M. Parker is prosecuting the case with the assistance of Jessie Chelsea. The prosecution is the result of an investigation by the Drug Enforcement Administration, with assistance from SFPD.

The Department of Justice joined the United Kingdom and international law enforcement partners in London today to announce the disruption of the LockBit ransomware group, one of the most active ransomware groups in the world that has targeted over 2,000 victims, received more than $120 million in ransom payments, and made ransom demands totaling hundreds of millions of dollars.

The U.K. National Crime Agency’s (NCA) Cyber Division, working in cooperation with the Justice Department, Federal Bureau of Investigation (FBI), and other international law enforcement partners disrupted LockBit’s operations by seizing numerous public-facing websites used by LockBit to connect to the organization’s infrastructure and seizing control of servers used by LockBit administrators, thereby disrupting the ability of LockBit actors to attack and encrypt networks and extort victims by threatening to publish stolen data.

“For years, LockBit associates have deployed these kinds of attacks again and again across the United States and around the world. Today, U.S. and U.K. law enforcement are taking away the keys to their criminal operation,” said Attorney General Merrick B. Garland. “And we are going a step further — we have also obtained keys from the seized LockBit infrastructure to help victims decrypt their captured systems and regain access to their data. LockBit is not the first ransomware variant the Justice Department and its international partners have dismantled. It will not be the last.”

Additionally, the NCA, in cooperation with the FBI and international law enforcement partners, has developed decryption capabilities that may enable hundreds of victims around the world to restore systems encrypted using the LockBit ransomware variant. Beginning today, victims targeted by this malware are encouraged to contact the FBI at https://lockbitvictims.ic3.gov/ to enable law enforcement to determine whether affected systems can be successfully decrypted. 

“Today’s actions are another down payment on our pledge to continue dismantling the ecosystem fueling cybercrime by prioritizing disruptions and placing victims first,” said Deputy Attorney General Lisa Monaco. “Using all our authorities and working alongside partners in the United Kingdom and around the world, we have now destroyed the online backbone of the LockBit group, one of the world’s most prolific ransomware gangs. But our work does not stop here: together with our partners, we are turning the tables on LockBit — providing decryption keys, unlocking victim data, and pursuing LockBit’s criminal affiliates around the globe.”

The Justice Department also unsealed an indictment obtained in the District of New Jersey charging Russian nationals Artur Sungatov and Ivan Kondratyev, also known as Bassterlord, with deploying LockBit against numerous victims throughout the United States, including businesses nationwide in the manufacturing and other industries, as well as victims around the world in the semiconductor and other industries. Today, additional criminal charges against Kondratyev were unsealed in the Northern District of California related to his deployment in 2020 of ransomware against a victim located in California. 

Finally, the Department also unsealed two search warrants issued in the District of New Jersey that authorized the FBI to disrupt multiple U.S.-based servers used by LockBit members in connection with the LockBit disruption. As disclosed by those search warrants, those servers were used by LockBit administrators to host the so-called “StealBit” platform, a criminal tool used by LockBit members to organize and transfer victim data.

“Today, the FBI and our partners have successfully disrupted the LockBit criminal ecosystem, which represents one of the most prolific ransomware variants across the globe,” said FBI Director Christopher A. Wray. “Through years of innovative investigative work, the FBI and our partners have significantly degraded the capabilities of those hackers responsible for launching crippling ransomware attacks against critical infrastructure and other public and private organizations around the world. This operation demonstrates both our capability and commitment to defend our nation's cybersecurity and national security from any malicious actor who seeks to impact our way of life. We will continue to work with our domestic and international allies to identify, disrupt, and deter cyber threats, and to hold the perpetrators accountable.”

“I am proud to stand with our U.K. partners to announce the coordinated law enforcement actions announced today — including the disruption of the LockBit ransomware variant and charges against two Russian nationals for using LockBit to attack victims throughout the United States,” said Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department's Criminal Division. “Through our attorneys in the Criminal Division’s Computer Crime and Intellectual Property Section and our U.S. Attorney’s office partners, we have seized U.S.-based infrastructure used by LockBit actors, and the FBI, along with international partners, have developed tools to help victims whose systems have been encrypted. These actions send a clear message: the Justice Department and its law enforcement partners are united in the fight against cybercrime and are committed to using all available tools to disrupt ransomware activity and bring cybercriminals to justice.”

According to the indictment obtained in the District of New Jersey, from at least as early as January 2021, Sungatov allegedly deployed LockBit ransomware against victim corporations and took steps to fund additional LockBit attacks against other victims. Sungatov allegedly deployed LockBit ransomware against manufacturing, logistics, insurance, and other companies located in Minnesota, Indiana, Puerto Rico, Wisconsin, Florida, and New Mexico. Additionally, as early as August 2021, Kondratyev similarly began to allegedly deploy LockBit against multiple victims. Kondratyev, operating under the online alias “Bassterlord,” allegedly deployed LockBit against municipal and private targets in Oregon, Puerto Rico, and New York, as well as additional targets located in Singapore, Taiwan, and Lebanon. Both Sungatov and Kondratyev are alleged to have joined in the global LockBit conspiracy, also alleged to have included Russian nationals Mikhail Pavlovich Matveev and Mikhail Vasiliev, as well as other LockBit members, to develop and deploy LockBit ransomware and to extort payments from victim corporations.

“Today’s indictment, unsealed as part of a global coordinated action against the most active ransomware group in the world, brings to five the total number of LockBit members charged by my office and our FBI and Computer Crime and Intellectual Property Section partners for their crimes,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. “And, even with today’s disruption of LockBit, we will not stop there. Our investigation will continue, and we remain as determined as ever to identify and charge all of LockBit’s membership — from its developers and administrators to its affiliates. We will put a spotlight on them as wanted criminals. They will no longer hide in the shadows.”

With the indictment unsealed today, a total of five LockBit members have now been charged for their participation in the LockBit conspiracy. In May 2023, two indictments were unsealed in Washington, D.C., and the District of New Jersey charging Matveev with using different ransomware variants, including LockBit, to attack numerous victims throughout the United States, including the Washington, D.C., Metropolitan Police Department. Matveev is currently the subject of a reward of up to $10 million through the U.S. Department of State’s Transnational Organized Crime Rewards Program, with information accepted through the FBI tip website at https://tips.fbi.gov. In November 2022, a criminal complaint was filed in the District of New Jersey charging Vasiliev in connection with his participation in the LockBit global ransomware campaign. Vasiliev, a dual Russian-Canadian national, is currently in custody in Canada awaiting extradition to the United States. In June 2023, Russian national Ruslan Magomedovich Astamirov was charged by criminal complaint in the District of New Jersey for his participation in the LockBit conspiracy, including his deployment of LockBit against victims in Florida, Japan, France, and Kenya. Astamirov is currently in custody in the United States awaiting trial.

Kondratyev, according to the indictment obtained in the Northern District of California and unsealed today, is also charged with three criminal counts arising from his use of the Sodinokibi, also known as REvil, ransomware variant to encrypt data, exfiltrate victim information, and extort a ransom payment from a corporate victim based in Alameda County, California. 

The LockBit ransomware variant first appeared around January 2020 and, leading into today’s operation, had grown into one of the most active and destructive variants in the world. LockBit members have executed attacks against more than 2,000 victims in the United States and around the world, making at least hundreds of millions of U.S. dollars in ransom demands and receiving over $120 million in ransom payments. The LockBit ransomware variant, like other major ransomware variants, operates in the “ransomware-as-a-service” (RaaS) model, in which administrators, also called developers, design the ransomware, recruit other members — called affiliates — to deploy it, and maintain an online software dashboard called a “control panel” to provide the affiliates with the tools necessary to deploy LockBit. Affiliates, in turn, identify and unlawfully access vulnerable computer systems, sometimes through their own hacking or at other times by purchasing stolen access credentials from others. Using the control panel operated by the developers, affiliates then deploy LockBit within the victim computer system, allowing them to encrypt and steal data for which a ransom is demanded to decrypt or avoid publication on a public website maintained by the LockBit developers, often called a data leak site. 

The FBI Newark Field Office is investigating the LockBit ransomware variant.

Assistant U.S. Attorneys Andrew M. Trombly, David E. Malagold, and Vinay Limbachia for the District of New Jersey and Trial Attorneys Jessica C. Peck, Debra Ireland, and Jorge Gonzalez of the Criminal Division’s Computer Crime and Intellectual Property Section are prosecuting the charges against Sungatov and Kondratyev unsealed today in the District of New Jersey. The Justice Department’s Cybercrime Liaison Prosecutor to Eurojust and Office of International Affairs also provided significant assistance.

The disruption announced today was the result of a joint operation between the FBI; NCA South West Regional Organised Crime Unit; France’s  Gendarmerie Nationale Cyberspace Command; Germany’s Landeskriminalamt Schleswig-Holstein and the Bundeskriminalamt; Switzerland’s Federal Office of Police, Public Prosecutor’s Office of the Canton of Zurich, and Zurich Cantonal Police; Japan’s National Policy Agency; Australian Federal Police; Sweden’s Polismyndighetens; Royal Canadian Mounted Police; Politie Dienst Regionale Recherche Oost-Brabant of the Netherlands; Finland’s Poliisi; Europol; and Eurojust.

The FBI Phoenix Field Office and Assistant U.S. Attorney Helen L. Gilbert are investigating and prosecuting the case against Kondratyev in the Northern District of California.

Additionally, the Department of the Treasury’s Office of Foreign Assets Control announced today that it is designating Sungatov and Kondratyev for their roles in launching cyberattacks.

As mentioned above, victims of LockBit should contact the FBI at https://lockbitvictims.ic3.gov for further information. Additional details on protecting networks against LockBit ransomware are available at StopRansomware.gov. These include Cybersecurity and Infrastructure Security Agency Advisories AA23-325A, AA23-165A, and AA23-075A.       

Watch the Attorney General’s remarks:

Remote video URL

An indictment is merely an allegation. Under U.S. law, all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Indictment

SAN FRANCISCO – The Department of Justice joined the United Kingdom and international law enforcement partners in London today to announce the disruption of the LockBit ransomware group, one of the most active ransomware groups in the world that has targeted over 2,000 victims, received more than $120 million in ransom payments, and made ransom demands totaling hundreds of millions of dollars.

The U.K. National Crime Agency’s (NCA) Cyber Division, working in cooperation with the Justice Department, Federal Bureau of Investigation (FBI), and other international law enforcement partners disrupted LockBit’s operations by seizing numerous public-facing websites used by LockBit to connect to the organization’s infrastructure and seizing control of servers used by LockBit administrators, thereby disrupting the ability of LockBit actors to attack and encrypt networks and extort victims by threatening to publish stolen data.

“For years, LockBit associates have deployed these kinds of attacks again and again across the United States and around the world. Today, U.S. and U.K. law enforcement are taking away the keys to their criminal operation,” said Attorney General Merrick B. Garland. “And we are going a step further — we have also obtained keys from the seized LockBit infrastructure to help victims decrypt their captured systems and regain access to their data. LockBit is not the first ransomware variant the Justice Department and its international partners have dismantled. It will not be the last.”

Additionally, the NCA, in cooperation with the FBI and international law enforcement partners, has developed decryption capabilities that may enable hundreds of victims around the world to restore systems encrypted using the LockBit ransomware variant. Beginning today, victims targeted by this malware are encouraged to contact the FBI at https://lockbitvictims.ic3.gov/ to enable law enforcement to determine whether affected systems can be successfully decrypted.

“Today’s actions are another down payment on our pledge to continue dismantling the ecosystem fueling cybercrime by prioritizing disruptions and placing victims first,” said Deputy Attorney General Lisa Monaco. “Using all our authorities and working alongside partners in the United Kingdom and around the world, we have now destroyed the online backbone of the LockBit group, one of the world’s most prolific ransomware gangs. But our work does not stop here: together with our partners, we are turning the tables on LockBit — providing decryption keys, unlocking victim data, and pursuing LockBit’s criminal affiliates around the globe.”

The Justice Department also unsealed an indictment obtained in the District of New Jersey charging Russian nationals Artur Sungatov and Ivan Kondratyev, also known as Bassterlord, with deploying LockBit against numerous victims throughout the United States, including businesses nationwide in the manufacturing and other industries, as well as victims around the world in the semiconductor and other industries. Additional criminal charges against Kondratyev were unsealed in the Northern District of California related to his deployment in 2020 of ransomware against a victim located in California.

Finally, the Department also unsealed two search warrants issued in the District of New Jersey that authorized the FBI to disrupt multiple U.S.-based servers used by LockBit members in connection with the LockBit disruption. As disclosed by those search warrants, those servers were used by LockBit administrators to host the so-called “StealBit” platform, a criminal tool used by LockBit members to organize and transfer victim data.

“Today, the FBI and our partners have successfully disrupted the LockBit criminal ecosystem, which represents one of the most prolific ransomware variants across the globe,” said FBI Director Christopher A. Wray. “Through years of innovative investigative work, the FBI and our partners have significantly degraded the capabilities of those hackers responsible for launching crippling ransomware attacks against critical infrastructure and other public and private organizations around the world. This operation demonstrates both our capability and commitment to defend our nation's cybersecurity and national security from any malicious actor who seeks to impact our way of life. We will continue to work with our domestic and international allies to identify, disrupt, and deter cyber threats, and to hold the perpetrators accountable.”

According to the indictment obtained in the District of New Jersey, from at least as early as January 2021, Sungatov allegedly deployed LockBit ransomware against victim corporations and took steps to fund additional LockBit attacks against other victims. Sungatov allegedly deployed LockBit ransomware against manufacturing, logistics, insurance, and other companies located in Minnesota, Indiana, Puerto Rico, Wisconsin, Florida, and New Mexico. Additionally, as early as August 2021, Kondratyev similarly began to allegedly deploy LockBit against multiple victims. Kondratyev, operating under the online alias “Bassterlord,” allegedly deployed LockBit against municipal and private targets in Oregon, Puerto Rico, and New York, as well as additional targets located in Singapore, Taiwan, and Lebanon. Both Sungatov and Kondratyev are alleged to have joined in the global LockBit conspiracy, also alleged to have included Russian nationals Mikhail Pavlovich Matveev and Mikhail Vasiliev, as well as other LockBit members, to develop and deploy LockBit ransomware and to extort payments from victim corporations.

“Today’s indictment, unsealed as part of a global coordinated action against the most active ransomware group in the world, brings to five the total number of LockBit members charged by my office and our FBI and Computer Crime and Intellectual Property Section partners for their crimes,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. “And, even with today’s disruption of LockBit, we will not stop there. Our investigation will continue, and we remain as determined as ever to identify and charge all of LockBit’s membership — from its developers and administrators to its affiliates. We will put a spotlight on them as wanted criminals. They will no longer hide in the shadows.”

With the indictment unsealed today, a total of five LockBit members have now been charged for their participation in the LockBit conspiracy. In May 2023, two indictments were unsealed in Washington, D.C., and the District of New Jersey charging Matveev with using different ransomware variants, including LockBit, to attack numerous victims throughout the United States, including the Washington, D.C., Metropolitan Police Department. Matveev is currently the subject of a reward of up to $10 million through the U.S. Department of State’s Transnational Organized Crime Rewards Program, with information accepted through the FBI tip website at https://tips.fbi.gov. In November 2022, a criminal complaint was filed in the District of New Jersey charging Vasiliev in connection with his participation in the LockBit global ransomware campaign. Vasiliev, a dual Russian-Canadian national, is currently in custody in Canada awaiting extradition to the United States. In June 2023, Russian national Ruslan Magomedovich Astamirov was charged by criminal complaint in the District of New Jersey for his participation in the LockBit conspiracy, including his deployment of LockBit against victims in Florida, Japan, France, and Kenya. Astamirov is currently in custody in the United States awaiting trial.

Kondratyev, according to the indictment obtained in the Northern District of California and unsealed today, is also charged with three criminal counts arising from his use of a ransomware variant to encrypt data, exfiltrate victim information, and extort a ransom payment from a corporate victim based in Alameda County, California.

The LockBit ransomware variant first appeared around January 2020 and, leading into today’s operation, had grown into one of the most active and destructive variants in the world. LockBit members have executed attacks against more than 2,000 victims in the United States and around the world, making at least hundreds of millions of U.S. dollars in ransom demands and receiving over $120 million in ransom payments. The LockBit ransomware variant, like other major ransomware variants, operates in the “ransomware-as-a-service” (RaaS) model, in which administrators, also called developers, design the ransomware, recruit other members — called affiliates — to deploy it, and maintain an online software dashboard called a “control panel” to provide the affiliates with the tools necessary to deploy LockBit. Affiliates, in turn, identify and unlawfully access vulnerable computer systems, sometimes through their own hacking or at other times by purchasing stolen access credentials from others. Using the control panel operated by the developers, affiliates then deploy LockBit within the victim computer system, allowing them to encrypt and steal data for which a ransom is demanded to decrypt or avoid publication on a public website maintained by the LockBit developers, often called a data leak site.

The FBI Newark Field Office is investigating the LockBit ransomware variant.

Assistant U.S. Attorneys Andrew M. Trombly, David E. Malagold, and Vinay Limbachia for the District of New Jersey and Trial Attorneys Jessica C. Peck, Debra Ireland, and Jorge Gonzalez of the Criminal Division’s Computer Crime and Intellectual Property Section are prosecuting the charges against Sungatov and Kondratyev unsealed today in the District of New Jersey. The Justice Department’s Cybercrime Liaison Prosecutor to Eurojust and Office of International Affairs also provided significant assistance.

The disruption announced today was the result of a joint operation between the FBI; NCA South West Regional Organised Crime Unit; France’s Gendarmerie Nationale Cyberspace Command; Germany’s Landeskriminalamt Schleswig-Holstein and the Bundeskriminalamt; Switzerland’s Federal Office of Police, Public Prosecutor’s Office of the Canton of Zurich, and Zurich Cantonal Police; Japan’s National Policy Agency; Australian Federal Police; Sweden’s Polismyndighetens; Royal Canadian Mounted Police; Politie Dienst Regionale Recherche Oost-Brabant of the Netherlands; Finland’s Poliisi; Europol; and Eurojust.

Assistant U.S. Attorney Helen L. Gilbert and the FBI Phoenix Field Office are investigating and prosecuting the case against Kondratyev in the Northern District of California.

Additionally, the Department of the Treasury’s Office of Foreign Assets Control announced today that it is designating Sungatov and Kondratyev for their roles in launching cyberattacks.

As mentioned above, victims of LockBit should contact the FBI at https://lockbitvictims.ic3.gov for further information. Additional details on protecting networks against LockBit ransomware are available at StopRansomware.gov. These include Cybersecurity and Infrastructure Security Agency Advisories AA23-325A, AA23-165A, and AA23-075A.

Watch the Attorney General’s remarks at www.youtube.com/watch?v=-jKykhKKMZw.

An indictment is merely an allegation. Under U.S. law, all defendants are presumed innocent unless and until proven guilty in a court of law.

1_indictment.pdf

OAKLAND – Dileep Kumar Reddy Kamujula was sentenced today to six months in prison, and ordered to forfeit $130,369.28, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp. The sentence was handed down by the Honorable Jon S. Tigar, U.S. District Judge.

Kamujula, 37, of Fremont, pleaded guilty to the charge on November 3, 2023. According to his plea agreement, Kamujula admitted that between April 9 and April 30, 2020, he used confidential Twilio customer usage data when purchasing approximately 167 Twilio call options that he sold on May 7 and May 8, 2020. Kamujula obtained the confidential information from a relative who worked at Twilio and made a profit of more than $550,000 on the transactions.

A federal grand jury indicted Kamujula on March 24, 2022, charging him with securities fraud, in violation of 18 U.S.C. §§ 1348 and 2 (Count One), and 15 U.S.C. §§78j(b) and 78ff, 17 C.F.R. §§ 240.10b-5, 240.10b5-1 (Count Two). Kamujula pleaded guilty to Count Two and Judge Tigar dismissed Count One on the government’s motion at the sentencing hearing.

In addition to the prison term, Judge Tigar also sentenced the defendant to serve a three-year period of supervised release, to begin after the prison term, and ordered the defendant to forfeit $130,369.28. Judge Tigar ordered the defendant to surrender to begin serving his prison term on April 15, 2024.

Assistant U.S. Attorney Garth Hire is prosecuting the case with the assistance of Aarian Beiti. The prosecution is the result of an investigation by the Federal Bureau of Investigation. The U.S. Attorney’s Office appreciates the assistance of the San Francisco Regional Office of the Securities and Exchange Commission and Financial Industry Regulatory Authority (FINRA).

OAKLAND – Naikano Tuipulotu made his initial appearance on February 15, 2024, to face charges presented in a criminal complaint alleging he committed, and attempted to commit, a series of bank robberies in the East Bay, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation, Special Agent in Charge Robert K. Tripp.

According to the complaint affidavit, from October 23, 2023, through January 13, 2024, Tuipulotu, 30, of Oakland, robbed three banks and attempted to rob two others, each in Alameda County. During the robberies and attempted robberies, Tuipulotu passed handwritten notes stating that he had a gun and demanded money from bank tellers. The criminal complaint charges Tuipulotu with bank robbery, in violation of 18 U.S.C. § 2113(a).

Tuipulotu was arrested on February 14, 2024, and made his initial appearance in federal court in Oakland the following day. Tuipulotu remains in custody pending further proceedings in the case. Tuipulotu’s next scheduled appearance is at 10:30 a.m. on February 21, 2024, for status regarding detention before U.S. Magistrate Judge Kandis A. Westmore.

A criminal complaint merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, the defendant faces a maximum sentence of twenty years in prison and a fine of $250,000, plus restitution if appropriate, for a single violation of 18 U.S.C. § 2113(a). However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Jonah Ross is prosecuting the case. The prosecution is the result of an investigation by the FBI and the San Leandro, Fremont, and Hayward Police Departments.

SAN FRANCISCO – Sandra (Sandi) Eileen Le was sentenced today to 20 months in prison, and ordered to pay at least $1,536,089.64 in restitution for wire fraud, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation (FBI) Special Agent in Charge Robert K. Tripp. The sentence was handed down by the Hon. William H. Orrick, Senior U.S. District Judge.

Le, 55 of San Francisco, was indicted on August 26, 2021, and pleaded guilty on November 9, 2023, to three counts of wire fraud, in violation of 18 U.S.C. § 1343. According to the plea agreement, Le admitted she was the Academic Program Officer for the University of California, San Francisco (UCSF) School of Nursing’s Post-Master’s and Special Studies Certificate Programs. She abused her position by directing students in those programs to have their tuition checks made out to her, or to a merchandiser she purchased from, or to leave the checks’ payee line blank so she could then make out the checks to herself or her associates. She then deposited the checks into her personal bank accounts, including joint bank accounts that she shared with associates, and used the funds to pay for luxury items from that merchandiser. She also used the funds for gambling, home improvement, and other personal expenses. Le disguised and concealed her misconduct by generating false records of payments and student enrollment for her supervisors at the university. The investigation into her conduct revealed that Le diverted almost 300 such checks from November 2013 through March 2019, totaling $1,536,089.64.

According documents filed by the government in connection with sentencing, the investigation began in May 2019, when Le took a leave of absence while facing increased scrutiny from UCSF’s Audit and Advisory Services Unit, given the school’s inability to reconcile tuition revenues with enrollment in the programs Le administered. The government’s filings describe how, while Le was on leave, a program student provided Le’s replacement a tuition check written out to Le-- the student explained that the payment was per Le’s instructions. Thereafter, investigators conducted interviews of dozens of program students and completed a forensic examination of Le’s bank accounts. This and additional other investigation revealed the extent of Le’s fraud, and corresponding harm to the UCSF School of Nursing community.

Judge Orrick ordered Le to surrender on or before May 10, 2024, to begin serving her 20 month prison term, and found that restitution was at least $1,536,089.64, with the exact amount to be ordered after a further hearing. In addition to the prison term, Judge Orrick also ordered Le to serve a three-year period of supervised release.

Assistant U.S. Attorney Daniel N. Kassabian is prosecuting the case with the assistance of Veronica Hernandez. The prosecution is the result of an investigation by the FBI and the UCSF Police Department.

SAN FRANCISCO – A federal jury has convicted three defendants—Luis Torres Garcia, Evan Martinez Diaz, and Timothy Peoples—of multiple drug trafficking offenses following an eight-day trial, announced United States Attorney Ismail J. Ramsey and Drug Enforcement Administration (DEA), San Francisco Field Division, Special Agent in Charge Brian M. Clark. The jury convicted the defendants on all counts, rendering its verdict on February 14, 2024, after deliberating for two hours. The verdict followed a trial before the Hon. Richard Seeborg, Chief U.S. District Judge for the Northern District of California.

The evidence at trial included calls intercepted between April 2018 and February 2019 as part of a federal wiretap investigation into two drug suppliers in the East Bay. The intercepted calls established, among other things, that both suppliers received drugs from sources in Mexico. At trial, the government also presented evidence of several significant drug seizures including: 8.8 pounds of fentanyl and heroin in May 2018, valued at as much as $1.1 million, according to uncontested evidence at trial; 18 pounds of methamphetamine in August 2018; and 20 pounds of methamphetamine and one kilogram of cocaine in February 2019. The evidence at trial also established that law enforcement seized more than $300,000 in drug-related cash over the course of the investigation.

Torres Garcia, 38, of Rio Dell, California, was charged with conspiracy to distribute methamphetamine, in violation of 21 U.S.C. §§ 846 and 841(a)(1) and (b)(1)(A). The evidence at trial showed that Torres Garcia was a Humboldt County drug trafficker, who used the nickname “Guero.” Torres Garcia received methamphetamine shipments on credit from a Fairfield, California-based drug supplier. On August 8, 2018, the Fairfield supplier attempted to send about 18 pounds of methamphetamine—valued at $158,000—to Torres Garcia in Humboldt County. DEA agents and the Sonoma County Sheriff’s Office intercepted the drug courier and seized the drugs during a vehicle stop on Highway 101 near Healdsburg, California. In February 2019, the DEA tracked Torres Garcia to a meeting in Windsor, California, where Torres Garcia delivered about $13,800 in cash to a courier for his drug supplier. Although he was present throughout the trial and listened to closing arguments, Torres Garcia absconded before the jury handed down its verdict; he is now a fugitive.

Martinez Diaz, 31, of Bay Point, California, was charged with three counts—conspiracy to distribute methamphetamine and cocaine, in violation of 21 U.S.C. §§ 846 and 841(a)(1) and (b)(1)(B); possession with intent to distribute methamphetamine, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B); and possession with intent to distribute cocaine, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B). The evidence at trial established, among other things, that on February 9, 2019, Martinez Diaz was transporting about 20 pounds of methamphetamine and one kilogram of cocaine through a residential neighborhood in Antioch, California, when he realized he was being followed by law enforcement—which knew about the drugs through intercepted calls. Martinez Diaz began driving erratically, briefly evading law enforcement and directing a co-conspirator to discard the drugs he was carrying in the bushes on a residential street. A short time later law enforcement located the drugs, which evidence at trial established had street retail values of $177,860 (methamphetamine) and $40,000 (cocaine). After Martinez Diaz was stopped by police and released with a traffic citation, he was intercepted on a call telling his supplier that he had seen law enforcement and discarded the drugs to avoid arrest.

Peoples, 44, of Antioch, California, was arrested after law enforcement officers found cocaine in his home, and charged with two counts of possession with intent to distribute cocaine, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B)–(C). Evidence presented at trial showed that Peoples was a regular customer of an Antioch-based cocaine wholesaler from whom he bought some 10.5 pounds of cocaine for more than $120,000 in a 90-day period. Peoples used the codeword “babies” to refer to ounce quantities of cocaine. The evidence at trial established that Peoples then sold cocaine to his own customers in smaller quantities and used his proceeds to buy expensive cars.

Judge Seeborg scheduled a sentencing hearing for June 11, 2024. Torres Garcia faces a maximum sentence of life imprisonment and a minimum sentence of 10 years in prison. Martinez Diaz and Peoples each face a maximum sentence of 20 years in prison for every count on which they were convicted. However, the defendants’ sentences will be imposed only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

This prosecution is part of an Organized Crime Drug Enforcement Task Force (OCDETF) investigation. OCDETF identifies, disrupts, and dismantles the highest-level drug traffickers, money launderers, gangs, and transnational criminal organizations that threaten the United States by using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state, and local law enforcement agencies against criminal networks.

Assistant U.S. Attorneys Daniel Pastor and Joseph Tartakovsky prosecuted the case with the assistance of Erick Machado. This prosecution is the result of an investigation led by the DEA Oakland Resident Office, with assistance from the Bureau of Alcohol, Tobacco, Firearms, and Explosives; Homeland Security Investigations; U.S. Customs and Border Protection; U.S. Postal Inspection Service; the police departments in Fairfield, Antioch, Concord, and Oakland; the Sonoma County Sheriff’s Office; and the California Highway Patrol.

SAN FRANCISCO – Esmun Moyses Moral-Raudales was sentenced yesterday to 80 months in prison for crimes including distribution of, and possession with intent to distribute, fentanyl and methamphetamine, announced United States Attorney Ismail J. Ramsey and Drug Enforcement Administration (DEA), San Francisco Field Division, Special Agent in Charge Brian M. Clark. The sentence was handed down by the Hon. James Donato, United States District Judge.

Moral-Raudales, 28, a citizen of Honduras, pleaded guilty in October 2023 to two counts of distributing methamphetamine and one count of distributing fentanyl, all in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(C). He also pleaded guilty to one count of possessing 40 grams or more of fentanyl with intent to distribute it, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B)(vi).

According to his plea agreement, Moral-Raudales admitted that, during two drug deals in the Tenderloin in January and February 2023, he sold a total of 103.8 grams (gross weight) of fentanyl and 95 grams (gross weight) of methamphetamine. He also admitted that, at the time of his arrest in Oakland in March 2023, he had 317.7 grams (gross weight) of fentanyl on his person and in his car, and that he had a loaded, privately manufactured, semi-automatic handgun (a “ghost gun”) in his backpack.

At the time he committed the offenses for which he was sentenced yesterday, Moral-Raudales was on federal supervised release following a 2020 drug trafficking conviction that also resulted from his sale of drugs in the Tenderloin.

“Recidivist drug dealers who prey on the Tenderloin are a clear and present danger to our community, especially those who arm themselves with guns,” said United States Attorney Ismail J. Ramsey. “This Office will marshal all resources needed to ensure that repeat players in the Tenderloin drug market face justice.”

“Moral-Raudales was given the opportunity to change his life after his first federal drug trafficking conviction. Instead, he recklessly chose to endanger our community by selling poison in the Tenderloin while arming himself with a weapon,” said DEA Special Agent in Charge Brian M. Clark. “DEA will be relentless in our pursuit of those who repeatedly and brazenly violate the law.”

In addition to sentencing Moral-Raudales to prison, Judge Donato ordered the defendant to serve four years of supervised release to begin after his prison term is completed. The defendant was immediately remanded into custody.

Assistant U.S. Attorney George Hageman is prosecuting the case with the assistance of Erick Machado. The prosecution is the result of a months-long investigation by the DEA and the San Francisco Police Department.

One Pill Can Kill: Beware of pills bought on the street. Fentanyl, a Schedule II controlled substance, is a highly potent opiate that can be diluted with cutting agents to create counterfeit pills that purport to mimic the effects of Oxycodone, Percocet, and other drugs, but can be obtained at a lower cost. However, very small variations in the amount or quality of fentanyl create huge effects on the potency of the counterfeit pills and can easily cause death. Fentanyl has now become the leading cause of drug overdose deaths in the United States. Counterfeit, fentanyl-laced pills are usually shaped and colored to resemble pills that are sold legitimately at pharmacies.

SAN JOSE – A federal grand jury has indicted Victoriano Romero, charging him with conspiracy and related charges in connection with an alleged scheme to steal high-end performance bicycles from residents in the Bay Area and transport the bicycles to Mexico for resale.

According to the indictment, filed January 23, 2024, and unsealed earlier today, Romero, 53, from San Jose, participated in a complex international fencing operation that involved stealing bicycles from homes in San Francisco and Redwood City, Calif., during nighttime burglaries, and then transporting the stolen bicycles to Jalisco, Mexico, for resale. The indictment alleges Romero owns an automotive shop in San Jose where he received the stolen bicycles, took pictures of them, disassembled them, packaged them for delivery, and then had them transported to a co-conspirator in Mexico. Romero allegedly sent the pictures to his co-conspirator who used the pictures for online advertisements to sell the bicycles. Further, the indictment alleges Romero received a share of the profits from the international bicycle fencing scheme.

The indictment contains a description of nine of the bicycles that were stolen between April 2020 and April 2021. The bicycles, ranging in value from $3,000 to $9,000, included notable manufacturers such as a Serotta Titanium bicycle, a Bulls Grinder Evo bicycle, and a Cervelo C3 Carbon bicycle.

The indictment also describes additional details about the participation of Romero’s alleged co-conspirator in the scheme. For example, the indictment alleges the unindicted co-conspirator posted pictures of the stolen bicycles on a Facebook sales page using a virtual private network (or similar method) so that only persons in Mexico could see that the bicycles were for sale. In addition, the indictment describes how the co-conspirator reassembled the bicycles in Mexico before selling them and maintained a ledger listing the profits from the sales of the bicycles.

In sum, Romero is charged with one count of conspiracy to transport stolen goods in foreign commerce, in violation of 18 U.S.C. §§ 371 and 2314, and two counts of transportation of stolen goods in foreign commerce, in violation of 18 U.S.C. §§ 2314 and 2.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. The maximum statutory penalty for the conspiracy charge is five years in prison. The maximum statutory penalty for the substantive transportation charges is 10 years, per count. In addition, as part of any sentence, the court could order defendant to serve an additional term of supervised release to begin after a prison term, additional fines, and restitution, if appropriate. However, any sentence following conviction would be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Romero made his initial federal court appearance to face the charges this morning before U.S. Magistrate Judge Peter H. Kang. He was released on bond. His next scheduled court appearance is scheduled for April 10, 2024, before P. Casey Pitts, United States District Judge, for status.

The announcement was made by U.S. Attorney Ismail J. Ramsey and Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp.

Assistant U.S. Attorney Michael Lagrama is prosecuting the case. The prosecution of this case is the result of an investigation by the FBI and the San Francisco Police Department.

SAN JOSE – Attorney General Merrick B. Garland announced the recipients of the 70th and 71st Attorney General’s Awards, honoring Justice Department employees and others for extraordinary contributions to the enforcement of our nation’s laws. Recipients from both 2022 and 2023 were selected from a group of more than 800 nominees. Four Assistant United States Attorneys serving in the Northern District of California were among the persons who received awards during the ceremony in Washington, D.C.

“Each of today’s recipients has served with distinction, and in so doing, they have enabled the Justice Department to advance its work on behalf of the American people,” said Attorney General Garland. “Their exceptional leadership, heroism, and dedication have benefited people and communities across the country.”

“I am extremely proud to see the hard work of this team recognized by Attorney General Garland,” said U.S. Attorney Ismail Ramsey. “The guilty verdicts and sentencings in the Theranos case could not have been achieved without the dedicated efforts of team members who spent many hours reviewing millions of pages of documents, organizing many skillful presentations, and delivering careful arguments in furtherance of justice for the people of the United States. The recognition is well-deserved.”

The awards presented include the John Marshall Award, named for the fourth Chief Justice of the United States. The award recognizes outstanding professional achievement by attorneys of the Justice Department. Recipients of the 2023 John Marshall Award for Trial of Litigation include Northern District of California Assistant U.S. Attorneys Robert S. Leach, Kelly I. Volkar, John C. Bostic, and Jeffrey D. Nedrow for their work in United States v. Holmes and United States v. Balwani. These prosecutions were also the product of outstanding work by former Assistant U.S. Attorney Jeff Schenk, the Federal Bureau of Investigation (in particular, Special Agent Mario Scussel and Special Agent Adelaida Hernandez), the U.S. Postal Inspections Service (in particular, Special Agent Christopher McCollow), and the U.S. Food and Drug Administration’s Office of Criminal Investigations (in particular, Special Agent in Charge George Scavdis), as well as the assistance of Madeline Wachs, Lakisha Holliman, Sara Slattery, Elise Etter, Susan Kreider, Lynette Dixon, Sahib Kaur, and Leeya Kekona. These criminal cases arose from fraud committed by defendants Elizabeth A. Holmes and Ramesh “Sunny” Balwani in connection with Theranos, Inc., a now-defunct blood testing company based in Palo Alto and Newark, Calif. Each defendant was convicted in a separate trial, after which Holmes was sentenced to 135 months (11 years, 3 months) in federal prison for defrauding investors in Theranos of hundreds of millions of dollars and Balwani was sentenced to 155 months (12 years, 11 months) in federal prison for fraud that risked patient health by misrepresenting the accuracy of Theranos blood analysis technology and that defrauded Theranos investors.

A list of all the recipients of the 70th and 71st Attorney General’s Awards can be found here.

An indictment was unsealed on Tuesday charging a Belarusian and Cypriot national with money laundering conspiracy and operation of an unlicensed money services business.

According to the indictment, between 2011 and July 2017, Aliaksandr Klimenka, 42, allegedly controlled BTC-e, a digital currency exchange, with Alexander Vinnik and others. Klimenka also allegedly controlled Soft-FX, a technology services company, and FX Open, a financial company. 

The indictment alleges BTC-e was a significant cybercrime and online money laundering entity that allowed its users to trade in bitcoin with high levels of anonymity and developed a customer base heavily reliant on criminal activity. BTC-e allegedly facilitated transactions for cybercriminals worldwide and received criminal proceeds from numerous computer intrusions and hacking incidents, ransomware scams, identity theft schemes, corrupt public officials, and narcotics distribution rings, and allegedly was used to facilitate crimes ranging from computer hacking to fraud, identity theft, tax refund fraud schemes, public corruption, and drug trafficking. BTC-e’s servers, maintained in the United States, were allegedly one of the primary ways in which BTC-e and its operators effectuated their scheme. Those servers were allegedly leased to and maintained by Klimenka and Soft-FX.

Despite doing substantial business in the United States, BTC-e allegedly was not registered as a money services business with the U.S. Department of Treasury, had no anti-money laundering process, no system for appropriate “know your customer” or “KYC” verification, and no anti-money laundering program as required by federal law.  

Klimenka was arrested in Latvia on Dec. 21, 2023, at the request of the United States and made his initial appearance in San Francisco yesterday. He is currently being held in custody. 

If convicted, Klimenka faces a maximum penalty of 25 years in prison. 

Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division, U.S. Attorney Ismail J. Ramsey for the Northern District of California, Special Agent in Charge William Mancino of the U.S. Secret Service (USSS) Criminal Investigative Division, Assistant Director Michael D. Nordwall of the FBI’s Criminal Investigative Division, Chief Jim Lee of IRS Criminal Investigation (IRS:CI), and Special Agent in Charge Tatum King of Homeland Security Investigations (HSI) San Francisco made the announcement.

The USSS; FBI; IRS:CI Oakland Field Office and Cyber Crime Unit in Washington, D.C.; and HSI are investigating the case. 

Trial Attorney C. Alden Pelker of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Claudia Quiroz for the Northern District of California, both members of the National Cryptocurrency Enforcement Team (NCET), and Assistant U.S. Attorney Katherine Lloyd-Lovett for the Northern District of California are prosecuting the case. 

The Justice Department’s Office of International Affairs worked with the Latvian government to secure the arrest of Klimenka.

The NCET was established to combat the growing illicit use of cryptocurrencies and digital assets. Within the Criminal Division’s Computer Crime and Intellectual Property Section, the NCET conducts and supports investigations into individuals and entities that are enabling the use of digital assets to commit and facilitate a variety of crimes, with a particular focus on virtual currency exchanges, mixing and tumbling services, and infrastructure providers. The NCET also works to set strategic priorities regarding digital asset technologies, identify areas for increased investigative and prosecutorial focus, and lead the department’s efforts to collaborate with domestic and foreign government agencies as well as the private sector to aggressively investigate and prosecute crimes involving cryptocurrency and digital assets.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

SAN FRANCISCO — An indictment was unsealed on Tuesday charging a Belarusian and Cypriot national with money laundering conspiracy and operation of an unlicensed money services business.

According to the indictment, between 2011 and July 2017, Aliaksandr Klimenka, 42, allegedly controlled BTC-e, a digital currency exchange, with Alexander Vinnik and others. Klimenka also allegedly controlled Soft-FX, a technology services company, and FX Open, a financial company.

The indictment alleges BTC-e was a significant cybercrime and online money laundering entity that allowed its users to trade in bitcoin with high levels of anonymity and developed a customer base heavily reliant on criminal activity. BTC-e allegedly facilitated transactions for cybercriminals worldwide and received criminal proceeds from numerous computer intrusions and hacking incidents, ransomware scams, identity theft schemes, corrupt public officials, and narcotics distribution rings, and allegedly was used to facilitate crimes ranging from computer hacking to fraud, identity theft, tax refund fraud schemes, public corruption, and drug trafficking. BTC-e’s servers, maintained in the United States, were allegedly one of the primary ways in which BTC-e and its operators effectuated their scheme. Those servers were allegedly leased to and maintained by Klimenka and Soft-FX.

Despite doing substantial business in the United States, BTC-e allegedly was not registered as a money services business with the U.S. Department of Treasury, had no anti-money laundering process, no system for appropriate “know your customer” or “KYC” verification, and no anti-money laundering program as required by federal law.

Klimenka was arrested in Latvia on Dec. 21, 2023, at the request of the United States and made his initial appearance in San Francisco yesterday. He is currently being held in custody.

If convicted, Klimenka faces a maximum penalty of 25 years in prison.

U.S. Attorney Ismail J. Ramsey for the Northern District of California, Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division, Special Agent in Charge William Mancino of the U.S. Secret Service (USSS) Criminal Investigative Division, Assistant Director Michael D. Nordwall of the FBI’s Criminal Investigative Division, Chief Jim Lee of IRS Criminal Investigation (IRS:CI), and Special Agent in Charge Tatum King of Homeland Security Investigations (HSI) San Francisco made the announcement.

The USSS; FBI; IRS:CI Oakland Field Office and Cyber Crime Unit in Washington, D.C.; and HSI are investigating the case.

Trial Attorney C. Alden Pelker of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Claudia Quiroz for the Northern District of California, both members of the National Cryptocurrency Enforcement Team (NCET), and Assistant U.S. Attorney Katherine Lloyd-Lovett for the Northern District of California are prosecuting the case.

The Justice Department’s Office of International Affairs worked with the Latvian government to secure the arrest of Klimenka.

The NCET was established to combat the growing illicit use of cryptocurrencies and digital assets. Within the Criminal Division’s Computer Crime and Intellectual Property Section, the NCET conducts and supports investigations into individuals and entities that are enabling the use of digital assets to commit and facilitate a variety of crimes, with a particular focus on virtual currency exchanges, mixing and tumbling services, and infrastructure providers. The NCET also works to set strategic priorities regarding digital asset technologies, identify areas for increased investigative and prosecutorial focus, and lead the department’s efforts to collaborate with domestic and foreign government agencies as well as the private sector to aggressively investigate and prosecute crimes involving cryptocurrency and digital assets.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

SAN JOSE – A federal grand jury returned an indictment yesterday charging Dory Lindsay Ford with charges related to COVID fraud, including bank fraud, wire fraud, and money laundering, announced United States Attorney Ismail J. Ramsey; IRS Criminal Investigation (CI) Acting Special Agent in Charge Michael Mosley of the Oakland Field Office; and Small Business Administration, Office of Inspector General (SBA-OIG) Special Agent in Charge Weston King.

According to the indictment, Ford, 57, of Monterey, California, operated a catering company called Aqua Terra Culinary, Inc. (Aqua Terra). During the pandemic, Ford applied for and received approximately $4 million in loans and grants from the Paycheck Protection Program (PPP), the Restaurant Revitalization Fund (RRF), and the Economic Injury Disaster Loan Program (EIDL).

The Coronavirus Aid, Relief, and Economic Security (“CARES”) Act was a federal law enacted in or around March 2020 and designed to provide emergency financial assistance to the millions of Americans suffering the economic effects of the COVID-19 pandemic. One source of relief provided by the CARES Act was the authorization of up to $349 billion in forgivable loans to small businesses for job retention and certain other expenses, through the PPP.

Section 5003 of American Rescue Plan Act of 2021 (ARPA) established the RRF and appropriated $28.6 billion to the SBA for the purpose of making grants under the RRF. The SBA awarded funding through the RRF to restaurants, bars, and similar businesses serving food and drink. The purpose of this funding was to provide support to eligible entities that suffered revenue losses as a result of the COVID-19 pandemic and related mitigation measures.

The Economic Injury Disaster Loan (“EIDL”) program is an SBA program that provided low-interest financing to small businesses, renters, and homeowners in regions affected by declared disasters.

According to the indictment, Ford obtained approximately $4 million in PPP, RRF, and EIDL funds by using false and fraudulent, representations, promises, and omissions and concealed material facts. The indictment alleges that Ford used the COVID-19 loan and grant money to purchase real estate properties in the country of Belize, to invest in the stock market, and to fund a different business venture instead of using the loan money for proper expenses, such as payroll costs, rent or mortgage payments, and supplies.

The indictment charges Ford with bank fraud, in violation of 18 U.S.C. § 1344, as well as three counts of wire fraud in violation of 18 U.S.C. § 1343, and two counts of money laundering in violation of 18 U.S.C. § 1957.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, Ford faces a maximum statutory sentence of 30 years in prison and a maximum statutory fine of $1 million for bank fraud; a maximum statutory sentence of 20 years in prison and a maximum statutory fine of $250,000 for each count of wire fraud; and a maximum statutory sentence of 10 years in prison and a maximum statutory fine of $250,000 for both counts of money laundering. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Ford’s next court appearance is scheduled for January 31, 2024, before the Honorable Virginia K. DeMarchi, United States Magistrate Judge for the Northern District of California.

Assistant United State Attorney Neal C. Hong is prosecuting the case. The prosecution is a result of an investigation by CI and SBA-OIG.

SAN JOSE – Brian Risso was sentenced today to 60 months in prison for possession of child pornography, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp. The sentence was handed down by the Honorable Beth L. Freeman, U.S. District Judge.

Risso, 63, of San Jose, pleaded guilty to the charge on June 8, 2023. According to his plea agreement, Risso admitted that in February 2022, he knowingly possessed visual depictions of minors engaged in sexually explicit conduct, in violation of 18 U.S.C. § 2252(a)(4)(B). At sentencing, the Court found that these depictions included prepubescent minors and minors engaged in sadistic or masochistic conduct. According to a court filing, Risso possessed 542 files containing child pornography, including 513 images and 29 videos. 

In addition to the prison term, Judge Freeman ordered Risso to serve 60 months of supervised release, to begin after his prison term and to pay a fine of $25,000; and to pay a $5,100 special assessment. Judge Freeman scheduled a hearing to decide issues regarding restitution for April 9, 2024. 

Assistant United States Attorney Neal C. Hong is prosecuting the case. This case is a result of an investigation by the Federal Bureau of Investigation. 

SAN FRANCISCO – Tony Tan was sentenced to serve 18 months in prison for possession with intent to distribute methamphetamine in connection with his sale of counterfeit Adderall pills pressed with methamphetamine on the dark web, announced United States Attorney Ismail J. Ramsey; Drug Enforcement Administration (DEA), San Francisco Field Division, Special Agent in Charge Brian M. Clark; San Francisco Division Postal Inspector in Charge Rafael Nuñez; and IRS Criminal Investigation (IRS-CI) Oakland Field Office Acting Special Agent in Charge Michael Mosley. The sentence was handed down by the Hon. Richard Seeborg, Chief United States District Judge.

Tan, 28, of San Francisco, pleaded guilty to the charge in May 2023. According to his plea agreement, Tan admitted that he operated a dark web vendor site, Adderall123, through which he sold counterfeit Adderall pills that were laced with methamphetamine. Tan admitted the counterfeit Adderall pills were created and stamped in such a way as to mirror legitimate Adderall pills; specifically, they were orange, circular, and pressed with the letters “dp” and the number “30.” Tan sold the drugs to buyers located throughout the United States. Over the years, Tan operated Adderall123 on numerous dark web marketplaces, including Empire, ASAP, White House Market and Torrez. During this time, Tan executed thousands of sales of the counterfeit Adderall pills in various quantities.

Tan’s plea agreement contains additional details of his drug distribution operation. For example, the plea agreement describes how Tan distributed the counterfeit Adderall pills using the United States Postal Service by mailing the drugs in smell-proof bags contained within Priority Mail Flat Rate Envelopes. In addition, the plea agreement describes how Tan recruited others to assist with packaging and mailing the drugs. Further, Tan wrote fake sender names and addresses on the packages and paid postage in cash, all in hopes of thwarting law enforcement efforts to find the sender of the illicit packages. Also, Tan accepted payment for the counterfeit pills in cryptocurrency, which has privacy features that help users anonymize their transaction activity.

On November 12, 2021, federal agents seized two packages mailed by Tan that contained over 640 methamphetamine-pressed Adderall pills—approximately 11.35 grams of actual methamphetamine. On March 29, 2023, Tan was charged by Information with one count of possession with intent to distribute 5 grams and more of methamphetamine, in violation of 21 U.S.C. §§ 841(a)(1) and (b)(1)(B)(viii). He pleaded guilty to the charge.

In addition to the prison term, Judge Seeborg ordered Tan to forfeit $17,744 in U.S. currency as well as the cryptocurrency (Ethereum, Bitcoin, and Litecoin) seized from his accounts. Judge Seeborg also ordered Tan to serve three years of supervised release, to begin after his prison term. Judge Seeborg ordered Tan to self-surrender on April 2, 2024, to begin serving his prison term.

Assistant U.S. Attorney Kristina Green is prosecuting the case, with assistance from Pat Mahoney. The prosecution is the result of an investigation by the DEA, CI, and USPIS.

SAN FRANCISCO – David Scott Cacchione was arrested and has been charged by criminal complaint with conspiring to commit wire fraud in connection with an investment fraud scheme, announced United States Attorney Ismail J. Ramsey, Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp, and IRS Criminal Investigation (CI) Oakland Field Office Acting Special Agent in Charge Michael Mosley.

According to the complaint, Cacchione, 59, of San Carlos, worked with another person to solicit investors in what they called an “Accounts Receivable Factoring Program.” The complaint alleges Cacchione and an unnamed co-conspirator told victims that investment funds would be used to purchase investment grade accounts receivable, and that investors would be repaid once the receivables were paid. According to the complaint, investors were promised as much as 2 percent per month in interest on the investment and were told that Cacchione himself was a large investor in the program.

The complaint alleges these representations were false and the investment funds were not used to purchase accounts receivables. From at least November 2021 through September 2022, at least four victims were cheated out of a total of about $1.1 million, according to the allegations. The complaint also states that, instead of investing the money as promised, Cacchione and his co-conspirator spent the money on personal and living expenses. The criminal complaint charges Cacchione with conspiracy to commit wire fraud, in violation of 18 U.S.C. § 1349 and 18 U.S.C. § 1343.

Cacchione was arrested on January 16, 2024, and made his initial appearance in federal court in San Francisco on January 17, 2024. Cacchione remains in custody pending further proceedings in the case. Cacchione’s next scheduled appearance is at 9:30 a.m. on January 19, 2024, for a detention hearing before U.S. Magistrate Court Judge Lisa J. Cisneros.

A criminal complaint merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, the defendant faces a maximum sentence of twenty years in prison and a fine of $250,000, plus restitution if appropriate, for a violation of 18 U.S.C. § 1349. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Garth Hire is prosecuting the case with the assistance of Aarian Beiti. The prosecution is the result of an investigation by CI and the FBI.

complaint_filed-signed-copycacchione.pdf

SAN FRANCISCO — A federal magistrate judge has ordered that Defendant Milton Joel Varela Arteaga—a Honduran national who resides in Oakland, California, and was recently indicted by a federal grand jury for possessing large quantities of fentanyl on three separate occasions in 2023—be detained pending trial on fentanyl trafficking charges, announced United States Attorney Ismail J. Ramsey; Homeland Security Investigations (HSI) Special Agent in Charge Tatum King; and Drug Enforcement Administration (DEA), San Francisco Field Division, Special Agent in Charge Brian M. Clark.

Arteaga, 27, was originally charged via a criminal complaint in November 2023. Among other things, the complaint alleges that:

•    On May 11, 2023, law enforcement officers searched Arteaga’s Oakland residence and seized more than 1.3 kilograms of fentanyl and more than $70,000 in cash. In a post-arrest interview, Arteaga told officers that he regularly sold drugs in the Tenderloin neighborhood of San Francisco;

•    On June 28, 2023, law enforcement officers stopped Arteaga in a car as it left the Oakland Airport and seized more than two kilograms of fentanyl and more than $12,000 in cash; and

•    On November 29, 2023, federal and state law enforcement officers searched Arteaga’s Oakland residence and found more than half a kilogram of fentanyl in a black Mercedes that belonged to Arteaga and his partner and over $13,000 in cash in their bedroom.

All of the fentanyl seizures described in the complaint occurred while Arteaga was on pretrial release for state narcotics charges filed against him in 2022. Arteaga has been in federal custody since his arrest in late November 2023, and he was ultimately indicted by a federal grand jury on December 13, 2023, on three counts of possession with intent to distribute fentanyl, in violation of 21 U.S.C. § 841(a)(1) and (b)(1)(B)(vi). A second defendant was indicted at the same time on similar charges.

“Tackling the scourge of fentanyl is a top priority for my Office,” said U.S. Attorney Ramsey. “Our efforts to disrupt the fentanyl trade take many forms, from prosecuting the dealers who peddle this poison on the streets of the Tenderloin to identifying, arresting, and charging their suppliers. We and our law enforcement partners will hold accountable those who sell or facilitate the sale of this deadly drug at every level.”

“The indictment and subsequent detainment of Mr. Arteaga underscore HSI’s commitment to work with law enforcement agencies to stop the scourge of fentanyl trafficking from further ravaging the Bay Area,” said HSI Special Agent in Charge King. “HSI appreciates the joint investigative work with the DEA, Alameda County Narcotics Task Force, the U.S. Attorney’s Office, and the DOJ OCDETF Program, which resulted in this action. As Mr. Arteaga’s case demonstrates, we will not rest while fentanyl poisons our communities and will pursue its purveyors at every turn to disrupt and ultimately dismantle their operations.”

“Fentanyl is now the leading cause of death for Americans between the ages of 18 to 45 and is the greatest drug threat facing our nation,” said DEA Special Agent in Charge Clark. “DEA’s relentless enforcement efforts in the Tenderloin will continue in pursuit of those who distribute this deadly drug in our community.”

Arteaga was ordered detained by United States Magistrate Judge Peter H. Kang on January 12, 2024. His next scheduled appearance is a status conference before Senior United States District Judge Charles R. Breyer on January 31, 2024.

An indictment and a complaint merely allege that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, Arteaga faces a minimum prison sentence of five years and a maximum prison sentence of 40 years on each of the three counts on which he is indicted. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

This prosecution is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) investigation. OCDETF identifies, disrupts, and dismantles the highest-level drug traffickers, money launderers, gangs, and transnational criminal organizations that threaten the United States by using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state, and local law enforcement agencies against criminal networks.

Assistant U.S. Attorneys Daniel Pastor and Kevin Yeh are prosecuting this case with assistance from Paralegal Specialist Tina Rosenbaum. The prosecution is the result of a federal and state partnership between HSI, DEA, and the Alameda County Narcotics Task Force (ACNTF) to target the distribution of the deadly opioid fentanyl.

SAN FRANCISCO – William Koo Ichioka was sentenced to serve four years in prison and ordered to pay a $5 million fine for committing multiple felonies in connection with an investment fraud scheme involving cryptocurrencies and other investment vehicles. The sentence was handed down by the Hon. Vince Chhabria, United States District Judge.

Ichioka, 30, formerly of San Francisco and New York, pleaded guilty to five charges—wire fraud, two counts of aiding and assisting in the preparation of a false or fraudulent tax return, committing fraud in connection with the purchase and sale of securities, and engaging in commodities fraud—on July 12, 2023. According to his plea agreement, beginning in 2018, Ichioka operated a scheme in which he fraudulently raised tens of millions of dollars from over 100 persons and entities. Court documents describe how Ichioka held himself out as “self-made investor” with a “multimillion fortune” as he solicited investors by promising that their funds would be invested in various securities and/or commodities, including cryptocurrency, and cryptocurrency arbitrage, futures, and derivatives, and foreign exchange currency transactions. Ichioka began doing business under the name “Ichioka Ventures” in 2019 and represented to prospective investors that they would earn 10% returns every 30 business days, and that his investment and trading activities actually had been generating or had the ability to generate returns in excess of these amounts. Further, Ichioka created a website for Ichioka Ventures that allowed investors to create and login to accounts to invest, view balances and investments, and view transaction history.

Ichioka admitted that, rather than invest his victims’ money as he promised, he instead commingled investor money with his own funds and used investor money to make purchases of luxury items (including luxury vehicles, watches, and other jewelry) and to fund his own personal expenses. Such personal expenses included his personal residence, restaurants and bars, grocery stores, taxi and car share rides, retail stores, gym membership fees, and online purchases. Moreover, Ichioka admitted that he and Ichioka Ventures did not actually earn 10% returns every 30 business days for his investors throughout the time that he represented that it did. Rather, he and Ichioka Ventures sustained losses from portions of funds that he did invest. Court documents describe that by the end of 2019—unbeknownst to investors—Ichioka had privately acknowledged that the “[c]ompany hasn’t made any money since we started.”

“Ichioka lured his victims by falsely promising they would receive huge returns quickly on their investments,” said First Assistant United States Attorney Patrick Robbins. “During the years that he ran his cryptocurrency-based Ponzi scheme, Ichioka managed to defraud more than 100 investors of tens of millions of dollars. Today’s sentence illustrates that lengthy prison terms await all those who seek to swindle investors in this district.”

“Ichioka convinced unsuspecting investors to pour money into his bogus venture with false promises of legitimate profits. His deceitful financial scheme victimized more than 100 people, including his friends and family. I hope that today's sentence brings them some measure of justice,” said FBI Special Agent in Charge Robert Tripp. “The FBI and our law enforcement partners will continue to pursue criminals who choose to commit financial fraud and hold them accountable for their crimes.”

“Predatory financial schemes like Ichioka’s are not victimless, nor do they escape justice as evidenced by today’s sentencing,” said IRS Criminal Investigation Acting Special Agent in Charge Michael Mosley of the Oakland Field Office. “IRS CI Oakland Field Office Special Agents and investigative staff in conjunction with our federal law enforcement partners follow the money, and as a result, deliver cases that lead to just outcomes.”

Ichioka admitted that he repaid existing investors with new investor funds to further perpetuate the fraud. Further, Ichioka agreed that he owes non-family investors in “Ichioka Ventures” at least $21 million as a result of the scheme, and additionally owes his family members over $40 million.

Ichioka also admitted that he concealed and hid the scheme by doctoring financial documents to falsely overstate the value of assets (including bank, brokerage, and cryptocurrency exchange materials) and providing doctored documents to prospective investors, according to court filings describing Ichioka’s agreement to plead guilty. Ichioka also presented false statements of account to investors via the Ichioka Ventures website, failed to provide tax documentation to investors, and willfully failed to report income to the Internal Revenue Service in this scheme.

On June 22, 2023, Ichioka was charged in an Information with one count of wire fraud, in violation of 18 U.S.C. § 1343; two counts of aiding or assisting in the preparation of a false or fraudulent tax return, in violation of 26 U.S.C. § 7206(2); one count of securities fraud, in violation of 15 U.S.C. §§ 78j(b), 78ff; 17 C.F.R. § 240.10b-5; and one count of commodities fraud, in violation of 18 U.S.C. § 1348. Ichioka pleaded guilty to all five counts.

In addition to the prison term and fine, Judge Chhabria also ordered Ichioka to serve five years of supervised release to begin after his prison term. A hearing is scheduled for February 20, 2024, before Judge Chhabria to determine issues related to restitution.

The case is being prosecuted by Assistant United States Attorneys Eric Cheng and Benjamin Kingsley with assistance from Megan Pagaduan. The prosecution is the result of an investigation by the FBI and IRS-Criminal Investigation. The U.S. Attorney’s Office and the federal law enforcement agencies also thank the San Francisco Regional Office of the Securities and Exchange Commission and the Commodity Futures Trading Commission, both of whom conducted separate parallel investigations into the defendant’s conduct.

SAN FRANCISCO -- The leader of the San Francisco 20th Street clique of the MS-13 street gang was sentenced to life in prison after being convicted of racketeering conspiracy, two counts of murder in aid of racketeering, one count of attempted murder in aid of racketeering, and one count of brandishing a firearm in furtherance of a crime of violence, announced First Assistant United States Attorney Patrick Robbins and Homeland Security Investigations (HSI) Special Agent in Charge Tatum King. There is no parole in the federal system.

Elmer Rodriguez, a/k/a “Gordo,” of San Francisco, California, was convicted on June 1, 2023, following a three-week jury trial. The Honorable Richard Seeborg, Chief U.S. District Judge, handed down today’s sentence.

“For years, the defendant led a violent street gang that committed several murders and attempted murders in the Bay Area, particularly in the Mission District of San Francisco,” said First Assistant United States Attorney Patrick Robbins. “San Francisco residents deserve to feel safe in their own communities. Today’s sentence sends a clear message that anyone who commits acts of violence and endangers public safety in the Northern District of California will face federal prosecution and a severe federal prison sentence as a consequence of their conduct.”

“This sentence today sends a loud and clear message that HSI, with law enforcement agencies in the region, will continue to work around the clock, always prioritizing the safety of our communities. It represents another important stride in our ongoing effort to combat crime in the Bay Area,” said San Francisco HSI Special Agent in Charge Tatum King. “Working with the San Francisco Police Department (SFPD) and the U.S. Attorney’s Office, Northern District of California, we’ve successfully brought to justice this dangerous gang leader who played a key role in ruthlessly murdering multiple victims. Of note, collective efforts in this overarching case began in July 2017, which underlies the complexities of investigations into transnational criminal organizations like MS-13, as well as the commitment of the agencies involved. HSI is deeply appreciative of the work of its agents and analysts, as well as SFPD and the U.S. Attorney’s Office.”

At trial, the government presented evidence that Rodriguez ordered the murder of Jorge Martinez near 19th and Mission Streets on March 17, 2017. Martinez had been celebrating his birthday after attending a Golden State Warriors game with his son. After the game, they went to a bar in the Mission District. Rodriguez and other MS-13 clique members were also present at the bar that night and identified Martinez as a possible rival Norteño gang member. Rodriguez ordered another clique associate to murder Martinez. The associate followed Martinez out of the bar and shot him to death.

Evidence at trial also showed that Rodriguez ordered the murder of Giovanni Alvarez, a/k/a “P Wee,” on May 25, 2017. Alvarez was a 20th Street clique member whom Rodriguez and others in the clique believed to be cooperating with law enforcement. Rodriguez sanctioned Alvarez’s murder because of these suspicions. Rodriguez and his associates, including Edwin Alvarado Amaya, a/k/a “Muerte,” and Kenneth Campos, a/k/a “Nesio,” lured Alvarez into a car. Campos drove the group to Bernal Heights Park. At the park, Rodriguez gave a signal to Alvarado Amaya, who then hacked Alvarez to death by inflicting dozens of deep wounds to his face and torso with a machete. Alvarado Amaya and Campos have pled guilty and been sentenced for their roles in this murder.

Rodriguez was also sentenced for his role in an attempted murder and use of a firearm in furtherance of a crime of violence stemming from a shotgun shooting that followed an extortion attempt by Rodriguez and other MS-13 associates on Eddy Street in the Tenderloin District on November 26, 2017.

Rodriguez’s trial also featured evidence of Rodriguez’s involvement in additional acts of violence including:

•    Ordering that other members of the clique go on a “hunt” to shoot suspected Norteños, which culminated with the September 16, 2016 shooting of a suspected Norteño at 21st Street and Hampshire Street; •    Attending an October 27, 2016 gang assault in the Mission District; •    Instigating a May 17, 2017 gang assault outside of a taqueria in the Mission District; •    Serving as the driver in a November 30, 2017 attempted murder at 24th Street and Potrero Avenue in the Mission District during which members of the 20th Street clique repeatedly stabbed a victim whom they incorrectly identified as a Norteño.

In total, 17 defendants have been convicted as a part of this investigation, which has resulted in convictions relating to four murders, four attempted murders, and multiple assaults with dangerous weapons.

This case is being prosecuted by the Organized Crime Strike Force of the Office of the United States Attorney. The prosecution is the result of investigations by HSI, SFPD Homicide Unit and Community Violence Reduction Team, San Mateo County Sheriff’s Office Gang Intelligence Unit and Investigations Bureau, Daly City Police Department, Pinole Police Department, Redwood City Police Department Street Crimes Reduction Team, and San Pablo Police Department.

OAKLAND – A federal grand jury indictment was unsealed charging Jasbir S. Thandi, Sandeep Sahota, and Jaspreet Padda with insurance fraud crimes related to the collapse of Global Hawk Risk Retention Group, an insurance company headquartered in Livermore, California, announced United States Attorney Ismail J. Ramsey, FBI Special Agent in Charge Robert K. Tripp, and San Francisco Division Postal Inspector in Charge Rafael Nuñez.

According to the indictment, Thandi 67, of El Sobrante, was the president and treasurer of Global Hawk, The indictment alleges that between 2017 and 2019, Thandi, misappropriated over $19 million in Global Hawk funds, including sending over $1 million to an entity domiciled in the British Virgin Islands, and over $7 million to other outside entities controlled by Thandi.

The indictment further alleges that Thandi, Sahota, 47, resident of Concord, and Padda, 40, of Elk Grove, submitted false and fraudulent financial statements to insurance regulators that overstated Global Hawk’s assets by tens of millions of dollars and concealed the misappropriations. Sahota was Global hawk’s vice president and secretary and Padda was the company’s outside investment advisor. Global Hawk’s primary business was providing automobile liability insurance coverage for truck drivers and small trucking companies. In May 2020, after regulators discovered the misappropriation and Global Hawk’s insolvency, Global Hawk was declared insolvent and was liquidated pursuant to a court order.

The indictment charges Thandi, Sahota, and Padda with conspiracy to commit insurance fraud, in violation of 18 U.S.C. § 371 as well as two counts of insurance fraud (false statements to regulators), in violation of 18 U.S.C. §§ 1033(a) and 2. The indictment also charges Thandi with two counts of insurance fraud (misappropriation) in violation of 18 U.S.C. § 1033(b).

The indictment also charges Thandi with two counts of bank fraud, in violation of 18 U.S.C. § 1344. The indictment alleges that in 2016, Thandi obtained a $6.4 million bank loan based on false representations, and in 2017, obtained another $14.75 million bank loan, also based on false representations.

The conspiracy count has a maximum statutory sentence of five years in prison and a fine of $250,000. Each insurance fraud count has a maximum statutory sentence of 10 years in prison (or 15 years if the fraud jeopardized the safety and soundness of an insurer and was a significant cause of such insurer being placed in conservation, rehabilitation, or liquidation by an appropriate court) and a maximum fine of $250,000. Each bank fraud count has a maximum statutory sentence of 30 years in prison and a maximum fine of $1,000,000.

For all counts, the court also may order a term of supervised release, fines or other assessments, restitution, and forfeiture, if appropriate. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Sahota was arrested yesterday morning and made an initial appearance before the Hon. Alex G. Tse, U.S. Magistrate Judge for the Northern District of California. Padda was arrested in the Eastern District of California.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Assistant United States Attorneys David Ward and Abraham Fine are prosecuting the case with assistance from Kay Konopaske, Kathleen Turner, and Kevin Costello. The prosecution is a result of an investigation by the FBI and the United States Postal Inspection Service.

Individuals who believe that they may be a victim in this case should contact the United States Attorney’s Office for the Northern District of California’s victim specialists by email at: [email protected].

SAN JOSE – A federal grand jury has indicted James Luna, charging him with the robbery of a mail carrier in the Sunnyvale, Calif., area, announced U.S. Attorney Ismail J. Ramsey and U.S. Postal Inspector in Charge Rafael Nuñez. The indictment follows the announcement by U.S. Attorney Ramsey and Postal Inspector in Charge Nuñez regarding multiple arrests made throughout the Bay Area in cases involving the interference with delivery of the U.S. mail.

According to papers filed in connection with the Luna case, on December 30, 2022, a person fitting Luna’s description approached a United States Postal Service mail carrier just before 4:00 p.m. and demanded that the mail carrier hand over her postal keys. The mail carrier reported that she could see the handle of a firearm sticking out of the robber’s pocket. The mail carrier handed over the keys and the robber absconded with them. The robber was later identified as James Luna, 32, of San Jose. The keys are used to open United States Postal Service mailboxes in a designated area.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. Luna is charged with robbery of a mail carrier, in violation of 18 U.S.C. § 2114. The maximum statutory penalty for robbery of a mail carrier is 10 years in prison. Further, in addition to the prison term, the court may order defendant to serve an additional term of supervised release to begin after a prison term, additional fines, and restitution, if appropriate. However, any sentence following conviction would be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

On October 10, 2023, U.S. Attorney Ramsey and Postal Inspector in Charge Nuñez held a press conference at which they discussed a recent increase in the theft of postal keys, break-ins of postal vehicles, assaults on letter carriers, and various other criminal acts involving interference with delivery of the mail. According to U.S. Attorney Ramsey, a surge in arrests throughout the Bay Area has resulted in several defendants now facing severe federal penalties. A press release discussing the press conference can be found here.

Assistant U.S. Attorney Neal Hong is prosecuting the Luna case. The prosecution of this case is the result of an investigation by the United States Postal Inspection Service and Sunnyvale Police Department.

SAN FRANCISCO – Kent Laird pleaded guilty in federal court today to two counts of conspiracy to commit mail fraud, announced United States Attorney Ismail J. Ramsey and FBI Special Agent in Charge Robert K. Tripp. The plea was accepted by the Honorable Jaqueline S. Corley, U.S. District Judge.

In pleading guilty, Laird, 50, of Bothell, Washington, admitted that as the Head of Content, Video & Studios for LinkedIn Media Productions (otherwise known as LMP) he became involved in two separate conspiracies and mail fraud schemes involving two independent contractors. Specifically, in June and then in October of 2018, Laird recommended that two independent contractors be hired by LinkedIn to assist him with producing various podcast projects despite knowing that neither person had any professional experience as a podcast producer. Over the course of the next eighteen months, Laird approved a total of 129 false invoices that the independent contractors submitted to LinkedIn. Laird submitted these invoices knowing that the two independent contractors had performed little to no podcast writing and producing work on behalf of LinkedIn. As a result of receiving these false invoices, LinkedIn paid a combined total of $689,210 to the two independent contractors. During the course of the conspiracy, Laird received kickbacks in the amount of $184,050 from the falsely obtained proceeds.

A federal grand jury indicted Laird on February 21, 2023, charging him with two counts of conspiracy to commit mail fraud, in violation of 18 U.S.C. § 1349, and eighteen counts of mail fraud, in violation of 18 U.S.C. § 1341. Under the plea agreement, Laird pleaded guilty to the two conspiracy counts. If he complies with the plea agreement, the remaining counts will be dismissed at sentencing.

Laird faces a maximum sentence of 20 years in prison, a fine of $250,000, plus restitution, if appropriate, for each violation of 18 U.S.C. § 1349. Any sentence will be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Judge Corley scheduled Laird’s sentencing hearing for March 27, 2024.

Assistant U.S. Attorney Barbara J. Valliere is prosecuting the case with the assistance of Kathy Tat. The prosecution is the result of an investigation by the Federal Bureau of Investigation.

SAN FRANCISCO – Oakland resident Fares Abdo Al Eyani, 40, pleaded guilty in federal court in San Francisco to one count of conspiring to export defense articles and seven counts of attempting to export defense articles, announced United States Attorney Ismail J. Ramsey, Assistant Attorney General for the Department of Justice National Security Division Matthew G. Olsen, Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp, and Homeland Security Investigations Special Agent in Charge Tatum King. The plea was accepted by the Hon. Charles R. Breyer, U.S. District Judge.

According to the plea agreement, Al Eyani admitted he acquired no less than four firearms, with magazines and ammunition, and at least 44 rifle scopes, monoculars, and goggles with night vision capabilities in 2019. In November 2019, Al Eyani attempted to send the firearms to the Sultanate of Oman in shipping containers departing from the Port of Oakland. He concealed the firearms by disassembling them, wrapping them in aluminum foil, and then secreting them within automobiles inside the shipping container. Then, in December 2019, Al Eyani attempted to export the 44 rifle scopes, monoculars, and goggles to the Sultanate of Oman in two shipping containers departing from the Port of Oakland. Law enforcement searched the containers and seized the firearms, the magazines, and the ammunition, as well as the 44 rifle scopes, monoculars, and goggles with night vision capabilities. These actions thwarted Al Eyani’s unlawful scheme.

The commercial export of arms, ammunitions, implements of war and defense articles and services from the United States is governed by the Arms Export Control Act (“AECA”), 22 U.S.C. § 2778, and its attendant regulations, the International Trafficking in Arms Regulations (“ITAR”), 22 C.F.R. §§ 120-130. The AECA authorizes the President, among other things, to control the export of “defense articles” deemed critical to the national security and foreign policy interests of the United States. The AECA also authorizes the President to designate goods as “defense articles,” require licenses for the export of such articles, and promulgate regulations for the export of such articles. By executive order, the President has delegated this authority to the United States Department of State, Bureau of Political-Military Affairs, Directorate of Defense Trade Controls (“DDTC”). Accordingly, the DDTC has promulgated regulations under the AECA, known as the ITAR. The ITAR defines a “defense article” as any item on the United States Munitions List (“USML”). Persons desiring to export items on the USML from the United States to a place overseas must first register with the DDTC and obtain individual export licenses prior to any shipment abroad.

The plea agreement lays out that the four firearms, the magazines, and the ammunition, as well as at least seven of the night-vision rifle scopes, were defense articles prohibited from export without a license by the AECA and the ITAR. Al Eyani did not have a license to export the defense articles.

In a separate plea agreement, Al Eyani’s wife, Saba Mohsen Dhaifallah, 41, also pleaded guilty to making false statements to Federal Bureau of Investigation special agents during the investigation of this matter, in violation of 18 U.S.C. § 1001. Her plea also was accepted by Judge Breyer.

Judge Breyer scheduled Al Eyani’s and Dhailfallah’s sentencing hearings for March 22, 2024, at 9:30 am. Al Eyani faces a maximum sentence of twenty years’ imprisonment and a fine of $1,000,000. Dhaifallah faces a maximum sentence of five years’ imprisonment and a fine of $250,000. In addition, the court may order each defendant to serve an additional period of supervised release, if appropriate. However, any sentence would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

The National Security and Cybercrime Section of the United States Attorney’s Office for the Northern District of California is prosecuting the case in consultation with the Counterintelligence and Export Control Section of the National Security Division of the Department of Justice. The prosecution is the result of an investigation by the Federal Bureau of Investigation, Homeland Security Investigations, and United States Customs and Border Protection.

OAKLAND – A South Lake Tahoe man pleaded guilty to willfully failing to pay employment tax withholdings due to the IRS, announced U.S. Attorney Ismail J. Ramsey, Acting Deputy Assistant Attorney General Stuart M. Goldberg of the Justice Department’s Tax Division, and Internal Revenue Service Criminal Investigation (IRS-CI), Oakland Field Office, Acting Special Agent in Charge Mark Silva.

According to court documents and statements made in court, in 2016 and 2017, Robert Hienekamp, 58, was the Chief Executive Officer of Endowance Solutions, Inc., a software consulting and development company. During each of those years, Endowance Solutions withheld income, Social Security, and Medicare taxes from its employees’ wages. Hienekamp, however, did not file the legally required quarterly employment tax returns or pay the withholdings due to the IRS, despite knowing of his obligation to do so. In total, Hienekamp caused a tax loss of over $800,000.

Hienekamp is scheduled to be sentenced on June 27, 2024, and faces a maximum penalty of five years in prison. He also faces a period of supervised release, restitution, and monetary penalties. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

IRS-CI, Oakland Field Office, is investigating the case.

Trial Attorney Mahana Weidler of the Tax Division and Assistant U.S. Attorney Michael Lagrama of the Northern District of California are prosecuting the case.

SAN FRANCISCO – Nemr Hallak, a citizen of Canada and Lebanon charged with operating a telemarketing fraud and money laundering conspiracy, was extradited from Greece to the United States to face charges in the Northern District of California, announced United States Attorney Ismail J. Ramsey, U.S. Postal Inspector in Charge Rafael Nunez, and Internal Revenue Service – Criminal Investigation (IRS-CI) Acting Special Agent in Charge Mark Silva of the Oakland Field Office.

Hallak was charged in a seven-count superseding indictment on April 21, 2016. The superseding indictment alleges that, between January 2010 and August 2014, Hallak and others operated a “business directory” telemarketing scam. Using a variety of means, including false and misleading cold calls and bogus invoices, Hallak and his co-defendants deceived churches, doctors’ offices, non-profits, mom-and-pop stores, and small businesses into paying for business directory services they neither ordered nor received.

As part of the scheme, Hallak and his co-defendants caused shell companies to be formed in Florida and Delaware in the names of nominees, who were paid in cash to be listed as officers and directors of the shell companies. Many of the shell companies used the term “Yellow Pages” to suggest their operations were legitimate. The superseding indictment further alleges that Hallak and the co-defendants caused others to cold call victims and tell them that they had a pre-existing business relationship with a “Yellow Pages” or other entity formed by the defendants; that they had previously purchased business directory services from the defendants; and that they owed the defendants for those services. Victims were told that they owed the defendants anywhere between $400 and $1800 for a previously purchased business directory listing. When such initial misrepresentations were not sufficient to induce payment, victims were harassed and threatened with legal action and sent additional bogus invoices with additional charges. The superseding indictment alleges that, as a result of the conspiracy, Hallak and others collected at least approximately $10.8 million.

The superseding indictment also charges Hallak with conspiracy to launder the proceeds of a separate telemarketing fraud, from March 2011 through in or about May 2013.

Hallak was arrested in Greece pursuant to an Interpol Red Notice and made his initial appearance in federal court in San Francisco on December 11, 2023. On the government’s motion, Defendant was detained. The Court set a detention hearing for December 21, 2023, at 10:30 a.m. before U.S. Magistrate Judge Sallie Kim.

The superseding indictment charges Hallak with one count of conspiracy to commit money laundering, in violation of 18 U.S.C. § 1956(h), one count of conspiracy to commit mail and wire fraud, in violation of 18 U.S.C. § 1349, four counts of mail fraud, in violation of 18 U.S.C. § 1341, and one count of wire fraud, in violation of 18 U.S.C. § 1343.

An indictment merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. If convicted, Defendant faces a maximum sentence of 20 years in prison, a fine of $250,00 or twice the gross gain or loss, plus restitution if appropriate for each violation of 18 U.S.C. §§ 1341, 1343, and 1349. The maximum sentence for violation of 18 U.S.C. §1956(h) is 20 years in prison, plus a fine of $500,000, or twice the value of the monetary instrument or funds involved. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Robert S. Leach is prosecuting the case with the assistance of Megan Pagaduan. The prosecution is the result of an investigation by the U.S. Postal Inspection Service and IRS-CI. The Justice Department’s Office of International Affairs provided critical assistance in securing the extradition of Hallak. The Justice Department thanks the Ministry of Justice of the Hellenic Republic and the Hellenic Police which provided excellent cooperation in the arrest and re-arrest of Hallak and his subsequent extradition.

SAN FRANCISCO – Miklos Daniel Brody was sentenced to 24 months in prison today for a network intrusion and for making false statements to a government agency, announced United States Attorney Ismail J. Ramsey and United States Secret Service (USSS) Special Agent in Charge Shawn M. Bradstreet. The sentence was handed down by the Hon. William. H. Orrick, Senior United States District Judge.

Brody, 38, of San Francisco, pleaded guilty in April 2023 to two charges that he violated the Computer Fraud and Abuse Act—by obtaining information from a protected computer, in violation of 18 U.S.C. § 1030(a)(2)(C) and (c)(2)(B), and by intentionally damaging a protected computer, in violation of 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i)—and one charge of making false statements to a government agency, in violation of 18 U.S.C. § 1001(a)(2).

According to a superseding indictment returned by a federal grand jury in December 2022, Brody worked as a cloud engineer for a bank headquartered in San Francisco until March 11, 2020, when he was fired for violating company policy.

The superseding indictment alleges that, later that evening, and continuing into the following morning, Brody used his company-issued laptop—which he failed to return upon being fired—to access the bank’s computer network without authorization and to cause substantial damage. Among other things, Brody deleted the bank’s code repositories, ran a malicious script to delete logs, left taunts within the bank’s code for former colleagues, and impersonated other bank employees by opening sessions in their names. He also emailed himself proprietary bank code that he had worked on as an employee, which was valued at over $5,000. At the sentencing hearing, Judge Orrick determined the total cost of the damage to the bank’s systems to be at least $220,621.22.

The superseding indictment also alleges that, in the days and weeks that followed his firing, Brody engaged in a series of evasive and deceptive actions, including filing a police report in which he falsely told the San Francisco Police Department that his company-issued laptop had been stolen from his car while he was working out at the gym. Brody doubled down on that false allegation in statements he made to USSS agents during an interview following his arrest in March 2021. In his guilty plea application, Brody admitted he made a false statement about the company-issued laptop and that he knew his statement was false at the time.

In addition to sentencing Brody to prison, Judge Orrick ordered him to pay restitution totaling $529,266.37 and to serve three years of supervised release to begin after his prison term is completed.

Assistant U.S. Attorneys Lauren M. Harding and George O. Hageman are prosecuting the case, with assistance from Paralegal Specialist Mark DiCenzo. The prosecution is the result of an investigation by the U.S. Secret Service.

SAN FRANCISCO – Three San Francisco Mission District (SFMD) Norteño gang members who murdered and attempted to murder four victims in San Francisco between January 2018 and July 2019 were sentenced today to prison terms ranging from 21 to 33 years following their convictions on racketeering conspiracy charges, announced First Assistant United States Attorney Patrick D. Robbins and Federal Bureau of Investigation (FBI) Special Agent in Charge Robert K. Tripp. The sentences were handed down by the Hon. William H. Orrick, Senior United States District Judge.

Fernando Madrigal, AKA “Nando,” 25; Alvaro Reina Cordero, AKA “G-Boy,” 26; and Oscar Guadron Diaz, AKA “Cutty,” 24, all of San Francisco, each pleaded guilty in February 2023 to one count of racketeering conspiracy, in violation of 18 U.S.C. § 1962(d), in connection with their roles in the murders and attempted murder of four victims, including a 15-year-old innocent bystander who was mistaken for a rival gang member.

In his plea agreement, Madrigal—who was sentenced today to 33 years in prison—admitted that, on July 12, 2018, he lured a victim to a parking lot near Candlestick Park in San Francisco on the pretense of purchasing marijuana from the victim. In fact, however, Madrigal admitted that he planned to rob the victim and that he and an accomplice were both armed when they arrived at the parking lot near Candlestick Park, where they met the victim around 6:20 p.m. Madrigal admitted he shot and killed the victim, disposed of the victim’s cell phone on or near the San Mateo Bridge, and dumped the victim’s body in the Oakland Hills, where it was found more than a year later.

Madrigal also admitted that, on July 8, 2019, he was in the Mission District in San Francisco when he used an AR-style firearm to shoot and kill a 15-year-old boy whom Madrigal mistakenly believed was a member of a rival gang. Madrigal admitted he committed these two murders in part to earn respect from other SFMD Norteños and to enhance his status in the gang. Finally, Madrigal admitted that he regularly traveled between California and Iowa to engage in drug trafficking; that he possessed two firearms, dozens of bullets, and nearly $7,000 in cash when he was arrested on August 14, 2020; and that he was on probation following a prior carjacking conviction when he committed the murders in July 2018 and July 2019.

In their plea agreements, Cordero and Guadron Diaz—who were sentenced today to 26 and 21 years in prison, respectively—admitted that, on January 23, 2018, they were driving around the Holly Park neighborhood of San Francisco when they saw a suspected rival Sureño gang member standing with a female companion at a bus stop near the intersection of Leese Street and Richland Avenue. They also admitted that, upon confirming the man’s identity in another drive-by, Guadron Diaz (who was driving) parked about two blocks away from the bus stop, where he idled while Cordero—who was, and who Guadron Diaz knew to be, armed with a loaded gun—put on a black and white skeleton mask and got out of the car.

Cordero admitted he then ran to the bus stop, approached the man and his female companion, and fired approximately nine shots, hitting the man (who died) in the body and the woman (who survived) in the face. Cordero then ran back to the parked car and he and Guadron Diaz—who admitted in his plea agreement that he knew Cordero planned to shoot the man and that he knowingly assisted Cordero commit the shooting—drove away from the scene. Guadron Diaz also admitted that law enforcement officers found ammunition consistent with the type used in the murder and attempted murder, as well as a fully automatic machine gun, in a search of his home in San Francisco two days after the shooting. Finally, both Cordero and Guadron Diaz admitted they committed and participated in the murder and attempted murder to earn respect and prestige among other SFMD Norteño gang members.

“Norteño criminal street gangs have terrorized San Francisco’s Mission District for years through a relentless campaign of shootings, robberies, gun trafficking, drug dealing, and extortion,” said First Assistant United States Attorney Patrick D. Robbins. “Today’s sentences send a clear message that gang members who inflict wanton violence and harm our community will be arrested, prosecuted federally, and sentenced to lengthy prison terms.”

“The brazen acts of violence committed by these men deprived local residents of their sense of security,” said FBI San Francisco Special Agent in Charge Robert K. Tripp. “The sentences handed down today cannot undo the harm inflicted on the victims or their families, but the defendants have been held accountable. The FBI and its partners will continue to work to eradicate violent gangs from our streets.”

In addition to the custodial sentences, Judge Orrick ordered all three defendants to spend five years on supervised release, beginning after their prison terms are completed.

Assistant U.S. Attorney Leif Dautch is prosecuting the case with the assistance of Paralegal Specialist Kevin Costello. The prosecution is the result of a multi-year investigation by the FBI, with assistance from the San Francisco Police Department’s Community Violence Reduction Team and Homicide Detail.

SAN FRANCISCO - Rodolfo “Rudy” Pada pleaded guilty in federal court in San Francisco today to participating in an honest services fraud conspiracy, announced Criminal Division Deputy Chief Matthew Yelovich and FBI Special Agent in Charge Robert K. Tripp. The plea was accepted by the Hon. Susan Illston, U.S. District Judge.

In pleading guilty, Pada, 68 of Millbrae, CA, admitted that he accepted bribes from individuals seeking building and construction permits from the San Francisco Department of Building Inspection. Pada worked as a plan checker at DBI from 1984 to September 2017, reviewing and approving construction plans and providing builders with the permits necessary for residential and commercial construction projects in San Francisco.

According to the plea agreement, the bribes to Pada, which began in 2003 and continued until September 2017, consisted of cash, free meals, drinks, and other benefits, paid by executives at a construction planning and design firm. Pada accepted the bribes in return for expediting and approving permits for their building and construction plans. In addition, Pada solicited and accepted an interest-free $85,000 loan facilitated by one of the executives.

DBI is a regulatory city agency in San Francisco responsible for overseeing enforcement of building, electrical, plumbing, and housing codes for the City of San Francisco’s more than 200,000 commercial and residential buildings. Contractors and builders submit construction plans to DBI for approval and permitting; the plans are required to be reviewed and approved by DBI to insure that the proposed construction and building meets city codes and regulations.

Pada, was initially charged by a criminal complaint in May 2022. On Nov. 3, 2023, Pada was charged by Information with one count of conspiracy to commit honest services wire fraud, in violation of 18 U.S.C. § 1349. Under the plea agreement, Pada pleaded guilty to the single count in the Information.

Judge Illston scheduled Pada’s sentencing hearing for March 29, 2024. The maximum statutory penalty is 20 years imprisonment and a $250,000 fine. However, any sentence will be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney David Ward is prosecuting the case with the assistance of Aarian Beiti. The prosecution is the result of an investigation by the Federal Bureau of Investigation.

A federal grand jury in San Francisco returned an indictment on Tuesday charging two individuals with a campaign to hack into computer networks in the United States, the United Kingdom, other North Atlantic Treaty Organization member countries and Ukraine, all on behalf of the Russian government. 

According to court documents, Ruslan Aleksandrovich Peretyatko (Перетятько Руслан Александрович), an officer in Russia’s Federal Security Service (FSB) Center 18, Andrey Stanislavovich Korinets (Коринец Андрей Станиславович) and other unindicted conspirators employed a sophisticated spear phishing campaign to gain unauthorized, persistent access (i.e., “hack”) into victims’ computers and email accounts.

“The Russian government continues to target the critical networks of the United States and our partners, as highlighted by the indictment unsealed today,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “Through this malign influence activity directed at the democratic processes of the United Kingdom, Russia again demonstrates its commitment to using weaponized campaigns of cyber espionage against such networks in unacceptable ways. The Department of Justice will respond to such behavior with an even more determined commitment to disrupt those activities and to hold accountable the individuals responsible.”

“Today’s indictment is part of a coordinated international response to send a message to the conspirators that the whole of the United States government stands together and with our partners internationally to identify and disrupt cyber espionage actors, particularly those seeking to obtain government information and attempting to create chaos in democratic processes,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We are grateful to all of our partners for their assistance in addressing these threats posed by the FSB’s action in the Northern District of California, across the United States and around the world.”   

“The FBI will not stand idly by as Russia continues to perpetuate this type of targeted malicious activity,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “Russian interference through malign foreign influence campaigns is deplorable, and we will not tolerate it in the United States or directed against our foreign partners. The FBI is dedicated to combating this pervasive threat and will tirelessly seek to prevent and disrupt these criminal acts carried out by Russia.”

The indictment, which was unsealed today, alleges the conspiracy targeted current and former employees of the U.S. Intelligence Community, Department of Defense, Department of State, defense contractors, and Department of Energy facilities between at least October 2016 and October 2022. In addition, the indictment alleges the conspirators – known publicly by the name “Callisto Group” – targeted military and government officials, think tank researchers and staff, and journalists in the United Kingdom and elsewhere, and that information from certain of these targeted accounts was leaked to the press in Russia and the United Kingdom in advance of U.K. elections in 2019. 

As a common example, the conspirators used “spoofed” email accounts designed to look like personal and work-related email accounts of the group’s targets. The conspirators allegedly also sent sophisticated looking emails that appeared to be from email providers suggesting users had violated terms of service. These messages were designed to trick victims into providing their email account credentials to false login prompts. Once the conspirators fraudulently obtained the victim’s credentials, they were able to use those credentials to access the victims’ email accounts at will.

In addition to the indictment, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced that it has sanctioned both Peretyatko and Korinets for their roles in malicious cyber-enabled activity. Moreover, the United Kingdom has issued sanctions of its own, and the U.S. Department of State announced rewards of up to $10 million for information leading to the identification or location of Peretyatko and Korinets, as well as their conspirators.

In addition to the name “Callisto Group,” FSB Center 18 is known by cybersecurity investigators as “Dancing Salome” by Kaspersky Labs, “STAR BLIZZARD” by Microsoft Threat Intelligence Center and “COLDRIVER” by Google’s Threat Analysis Group.

The defendants are each charged with one count of conspiracy to commit an offense against the United States, namely, computer fraud, which carries a maximum sentence of five years in prison for PERETYATKO, and up to 10 years for KORINETS. The maximum potential sentences in this case are prescribed by Congress and are provided here for informational purposes only, as any sentencings of the defendants will be determined by the assigned judge.

The investigation was conducted jointly by the U.S. Attorney’s Office for the Northern District of California, the National Security Cyber Section of the Justice Department’s National Security Division and the FBI San Francisco Field Office. The FBI’s Cyber Division, Cyber Assistant Legal Attachés, and Legal Attachés in countries around the world provided essential support. Numerous victims cooperated and provided valuable assistance in the investigation.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Note: This release has been updated to reflect the correct criminal offense and statutory penalties.

Peretyatko Korinets indictment

SAN FRANCISCO – A federal grand jury in San Francisco returned an indictment on Tuesday charging two individuals with a campaign to hack into computer networks in the United States, the United Kingdom, other North Atlantic Treaty Organization member countries and Ukraine, all on behalf of the Russian government.

According to court documents, Ruslan Aleksandrovich Peretyatko (Перетятько Руслан Александрович), an officer in Russia’s Federal Security Service (FSB) Center 18, Andrey Stanislavovich Korinets (Коринец Андрей Станиславович) and other unindicted conspirators employed a sophisticated spear phishing campaign to gain unauthorized, persistent access (i.e., “hack”) into victims’ computers and email accounts.

“The Russian government continues to target the critical networks of the United States and our partners, as highlighted by the indictment unsealed today,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “Through this malign influence activity directed at the democratic processes of the United Kingdom, Russia again demonstrates its commitment to using weaponized campaigns of cyber espionage against such networks in unacceptable ways. The Department of Justice will respond to such behavior with an even more determined commitment to disrupt those activities and to hold accountable the individuals responsible.”

“Today’s indictment is part of a coordinated international response to send a message to the conspirators that the whole of the United States government stands together and with our partners internationally to identify and disrupt cyber espionage actors, particularly those seeking to obtain government information and attempting to create chaos in democratic processes,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We are grateful to all of our partners for their assistance in addressing these threats posed by the FSB’s action in the Northern District of California, across the United States and around the world.”

“The FBI will not stand idly by as Russia continues to perpetuate this type of targeted malicious activity,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “Russian interference through malign foreign influence campaigns is deplorable, and we will not tolerate it in the United States or directed against our foreign partners. The FBI is dedicated to combating this pervasive threat and will tirelessly seek to prevent and disrupt these criminal acts carried out by Russia.”

“Countering the persistent threat to critical infrastructure posed by state-sponsored Russian cybercriminals remains a top priority for the FBI,” said FBI San Francisco Division Special Agent in Charge Robert Tripp. “Today’s charging announcement underscores the FBI’s commitment to collaborate with our U.S. and international partners to disrupt these activities. We will identify those responsible and hold them accountable.”

The indictment, which was unsealed today, alleges the conspiracy targeted current and former employees of the U.S. Intelligence Community, Department of Defense, Department of State, defense contractors, and Department of Energy facilities between at least October 2016 and October 2022. In addition, the indictment alleges the conspirators – known publicly by the name “Callisto Group” – targeted military and government officials, think tank researchers and staff, and journalists in the United Kingdom and elsewhere, and that information from certain of these targeted accounts was leaked to the press in Russia and the United Kingdom in advance of U.K. elections in 2019.

As a common example, the conspirators used “spoofed” email accounts designed to look like personal and work-related email accounts of the group’s targets. The conspirators allegedly also sent sophisticated looking emails that appeared to be from email providers suggesting users had violated terms of service. These messages were designed to trick victims into providing their email account credentials to false login prompts. Once the conspirators fraudulently obtained the victim’s credentials, they were able to use those credentials to access the victims’ email accounts at will.

In addition to the indictment, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced that it has sanctioned both Peretyatko and Korinets for their roles in malicious cyber-enabled activity. Moreover, the United Kingdom has issued sanctions of its own, and the U.S. Department of State announced rewards of up to $10 million for information leading to the identification or location of Peretyatko and Korinets, as well as their conspirators.

In addition to the name “Callisto Group,” FSB Center 18 is known by cybersecurity investigators as “Dancing Salome” by Kaspersky Labs, “STAR BLIZZARD” by Microsoft Threat Intelligence Center and “COLDRIVER” by Google’s Threat Analysis Group.

The defendants are each charged with one count of conspiracy to commit an offense against the United States, namely, computer fraud, which carries a maximum sentence of five years in prison for PERETYATKO, and up to 10 years for KORINETS. The maximum potential sentences in this case are prescribed by Congress and are provided here for informational purposes only, as any sentencings of the defendants will be determined by the assigned judge.

The investigation was conducted jointly by the U.S. Attorney’s Office for the Northern District of California, the National Security Cyber Section of the Justice Department’s National Security Division and the FBI San Francisco Field Office. The FBI’s Cyber Division, Cyber Assistant Legal Attachés, and Legal Attachés in countries around the world provided essential support. Numerous victims cooperated and provided valuable assistance in the investigation.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

indictment.pdf

SAN FRANCISCO – Craig Bolland was sentenced today to 72 months (six years) in prison after pleading guilty to manufacturing and dealing firearms without a license and several other firearms-related offenses, announced United States Attorney Ismail J. Ramsey and Bureau of Alcohol, Tobacco, Firearms & Explosives (ATF) Special Agent in Charge Jennifer L. Cicolani. The sentence was handed down by the Hon. Vince Chhabria, United States District Judge.

Bolland, 40, of San Francisco, was indicted by a federal grand jury on August 2, 2023, on four charges: (i) manufacturing and dealing firearms without a license, in violation of 18 U.S.C. § 922(a)(1)(A); (ii) being a felon in possession of a firearm, in violation of 18 U.S.C. § 922(g)(1); (iii) possession of a firearm with an obliterated serial number, in violation of 18 U.S.C. § 922(k); and (iv) possession of a machinegun, in violation of 18 U.S.C. § 922(o). He pleaded guilty to all four charges on September 13, 2023.

In the plea agreement, Bolland admitted, among other things, that, despite not having a license to do so, he was in the business of manufacturing and selling firearms—including hard-to-trace “ghost guns” he manufactured himself using a 3-D printer and parts he had shipped to him—from at least June 2021 through May 30, 2023, the date of his arrest. Bolland admitted he sold at least five of these privately manufactured “ghost guns” (both pistols and rifles), as well as dozens of commercially manufactured firearms—some of which Bolland admitted he modified by installing “switches” that turned semi-automatic weapons into fully automatic weapons—to buyers he knew or had reason to know were criminals who were not legally allowed to possess firearms and who paid Bolland for the guns in cash, cryptocurrency, and/or narcotics.

According to the plea agreement, Bolland, who had previously been convicted of a felony, possessed five firearms on the date of his arrest, including four handguns and a fully automatic AR-15 style rifle with no serial number. He also possessed hundreds of rounds of ammunition of varying calibers. Finally, Bolland admitted in the plea agreement that, in addition to his own firearms dealing, he brokered multiple sales of firearms and ammunition between other sellers and buyers and that he received a commission for brokering such deals.

In addition to the prison term, Judge Chhabria ordered Bolland to serve three years of supervised release to begin after his prison term is completed.

Assistant U.S. Attorney George O. Hageman is prosecuting the case with assistance from Amala James. The prosecution is the result of an investigation by ATF and the San Francisco Police Department.

OAKLAND - Former federal correctional officer John Bellhouse was sentenced today to 63 months in prison, followed by five years of supervised release and ordered to pay $25,500 for his sexually abusive conduct against two female victims who were serving prison sentences at Federal Correctional Institution (FCI) Dublin. The sentence was handed down by U.S. District Judge Yvonne Gonzalez Rogers.

Bellhouse, 40, formerly of Pleasanton, Calif., was initially charged with sexual abuse of an inmate on Feb. 17, 2022. A federal grand jury issued a superseding indictment on Sept. 29, 2022, charging Bellhouse with two counts of sexual abuse of a ward and three counts of abusive sexual contact that occurred between December 2019 and December 2020. A jury convicted Bellhouse of all counts.

“John Bellhouse exploited his position of trust at the Federal Bureau of Prisons by sexually abusing multiple women in his custody – and today he has been held to account,” said Deputy Attorney General Lisa O. Monaco. “The sentence of imprisonment imposed today is the latest example of the Justice Department’s continuing work to address the egregious misconduct that took place at FCI Dublin and prioritize the eradication of sexual assault from our prison system.”

“This defendant’s conduct was a disturbing deviation from the expectations and requirements of all federal correctional officers,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “Bellhouse violated his oath and abused the power given to him, all to victimize the people he was supposed to protect. This sentence makes clear that the sexual abuse of inmates by guards will not be tolerated.”

“While today’s sentencing cannot undo the horrific abuse that Bellhouse’s victims endured, it sends a clear message that BOP employees who abuse inmates in their custody and care will be brought to justice. Our investigation of sexual abuse at FCI Dublin remains ongoing, and we will continue to aggressively pursue justice for victims of sexual abuse at the hands of BOP employees,” said Department of Justice Inspector General Michael E. Horowitz.

“The horrendous sexual abuse committed by convicted offender John Bellhouse is cruel and despicable,” said FBI Deputy Director Paul Abbate. “As a federal corrections officer, Bellhouse sexually abused inmates under his care and attempted to cover-up his crimes. These violations are inexcusable breaches of the trust and authority granted to government officials. This sentencing is a reminder that the FBI and our partners will relentlessly pursue those who physically harm others and hold them accountable.”

“John Bellhouse has been held accountable for his abhorrent actions, preying upon vulnerable individuals in his custody,” said FBI Special Agent in Charge Robert K. Tripp of the San Francisco Division. “Our investigation continues. We will find justice for victims of these heinous crimes.”

Bellhouse was employed as a correctional officer at the FCI Dublin, California, an all-female low security federal correctional institution. Trial evidence showed that beginning December 2019 through October 2020 Bellhouse sexually abused and committed abusive sexual contact against a victim incarcerated and serving a prison sentence at FCI Dublin under Bellhouse’s custodial, supervisory, and disciplinary authority. Bellhouse engaged in oral sex with the victim in the prison Safety Warehouse and Safety Office and touched the victim’s vagina and breasts in the prison Safety Office, according to the trial evidence.

Evidence presented at trial also demonstrated Bellhouse committed abusive sexual contact against a second victim between October and December of 2020. Trial evidence showed that the acts occurred in the Safety Office at the FCI Dublin Camp.

The trial evidence further showed that Bellhouse sexually abused another inmate in 2020 and 2021 when he reached through a window in her cell and grabbed her breast, and on another occasion put his finger in her vagina without her consent while she was in her cell after showering.

In a memorandum filed in connection with Bellhouse’s sentencing, the government provided additional information regarding Bellhouse’s criminal conduct while he was a correctional officer. In the memorandum, the government argued that in addition to the three women who testified at trial about Bellhouse’s sexual abuse of them, Bellhouse also abused other women. Further, the government’s memorandum describes how Bellhouse used his ability to access everyday items such as Starbucks coffee, yarn, jewelry, and cleaning supplies, to get his victims both to acquiesce in the abuse and to keep them quiet about his conduct. For example, according to the memorandum, Bellhouse would provide items to coax compliance with his demands. Because these items were considered contraband at FCI Dublin, mere possession of them exposed inmates to potential punishments such as solitary confinement and loss of good time credits.

Bellhouse was convicted of two counts of sexual abuse of a ward, and three counts of abusive sexual conduct.

Judge Gonzalez Rogers ordered Bellhouse to surrender on or before Feb. 2, 2024, to begin serving his sentence. In addition, Judge Gonzalez Rogers scheduled a hearing for Feb. 1, 2024, to determine issues regarding restitution.

The Department of Justice’s Office of Inspector General and the FBI investigated the case.

Assistant U.S. Attorneys Molly Priedeman and Andrew Paulson prosecuted the case with the assistance of Madeline Wachs, Sara Slattery, Leeya Kekona, and Kay Konopaske.

SAN FRANCISCO - A federal grand jury in San Francisco indicted Arnold Kinman Low today with involuntary manslaughter and operating a motor vehicle under the influence of alcohol, announced United States Attorney Ismail J. Ramsey and United States Park Police Chief Jessica M.E. Taylor.

According to the indictment, Low, 81, of San Francisco, was the driver of a motor vehicle that struck a bicyclist in the Presidio on April 4, 2023. The victim-bicyclist died of his injuries shortly after the crash. Low is alleged to have been under the influence of alcohol at the time of the crash, to a degree that rendered him incapable of safe operation.

Driving while under the influence of any amount of alcohol can have serious and sometimes fatal consequences. The United States Attorney for the Northern District of California takes seriously all allegations of driving under the influence in places of federal jurisdiction like the Presidio Trust. Area drivers are reminded to consider alternative forms of transportation like ride-sharing or carpooling if necessary.

Low currently is scheduled to make his initial appearance in federal court in San Francisco at 10:30 AM on December 6, 2023, before U.S. Magistrate Judge Alex Tse.

An indictment merely alleges that crimes have been committed, and the defendant is presumed innocent until proven guilty beyond a reasonable doubt. If convicted, the defendant faces a maximum sentence of 8 years in prison, and a fine of $250,000, plus restitution if appropriate. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney George Hageman is prosecuting the case with the assistance of Erick Machado. The prosecution is the result of an investigation by the United States Park Police.

SAN FRANCISCO - Joseph Nubla and Henry Ku were sentenced today to 36 months and 30 months in prison, respectively, following their convictions by a jury at trial in April 2023 on charges of conspiracy to defraud the United States and tax evasion, announced United States Attorney Ismail J. Ramsey and Internal Revenue Service – Criminal Investigation (IRS-CI) Acting Special Agent in Charge Mark Silva of the Oakland Field Office. The sentences were handed down by the Hon. Richard Seeborg, Chief U.S. District Court Judge for the Northern District of California.

Nubla, 45, of Danville, California, is—and at all relevant times was—President of Brisbane Recycling Company, Inc. (“Brisbane”), a rock-crushing business located in Brisbane, California. Ku, 56, of Pleasanton, California, was formerly counsel for Brisbane and Nubla. Both defendants were convicted by a jury on April 7, 2023, following a two-week trial on charges that they conspired to defraud the United States from 2008 through 2016, in violation of 18 U.S.C. § 371. Nubla was also convicted of one count of tax evasion, in violation of 26 U.S.C. § 7201, for failing to report more than $5.8 million in income on his 2014 federal tax return.

The evidence at trial showed that Nubla ran daily operations at Brisbane and that Ku owned and controlled several businesses, including Pegasus Aggregate, Inc., Jupiter Prime Monarch, and JPM Energy, Inc. (collectively, “Ku’s entities”). Between February 20, 2009, and March 30, 2015, Ku and his entities deposited checks written by Nubla from Brisbane and totaling more than $18 million. To avoid paying corporate income taxes for Brisbane, Nubla expensed Brisbane’s payments to Ku’s entities as royalties for the use of heavy equipment purportedly owned by Ku’s entities. In fact, however, Ku had used the funds from Brisbane to purchase that equipment. Ku also returned the funds he received from Brisbane to Nubla in a variety of ways: (i) by regular money transfers from 2009 through 2016; (ii) by purchasing three homes for Nubla; and (iii) by writing cashier’s checks totaling $7 million pursuant to a fake loan. Nubla did not declare the funds given to him by Ku as personal income, even though they originated from Brisbane and thus were taxable, constructive dividends.

“These defendants skirted paying their taxes out of pure greed,” said U.S. Attorney Ramsey. “Today’s sentences send a clear message to those who try to avoid paying their fair share that our office will always marshal its resources to protect the public treasury.”

“The schemes orchestrated by Mr. Nubla and Mr. Ku seeking to defraud the United States and evade our tax system were rooted in blatant greed,” said IRS-CI Acting Special Agent in Charge Silva. “Today’s sentencing reaffirms that IRS-CI special agents are superbly motivated and equipped to disrupt, foil, and eliminate future nefarious attempts to defraud and evade our government. Just outcomes like today’s sentencing help protect responsible law-abiding business owners and taxpayers.”

In addition to the custodial sentences, Chief Judge Seeborg ordered Nubla and Ku to pay fines of $15,000 and $10,000, respectively, and $9,322,549.20 in restitution—a sum for which the defendants are jointly and severally liable.

Assistant U.S. Attorney Daniel N. Kassabian and Trial Attorney Christopher J. Carlberg of the Department of Justice’s Antitrust Division are prosecuting the case, with assistance from Helen Yee, Veronica Hernandez, and Amala James. The prosecution is the result of an investigation by IRS-CI.

SAN FRANCISCO – Trajordon Svarda was sentenced to 52 months in prison for crimes related to his firearms sales—including the sale of a machinegun—to a confidential informant (CI), announced United States Attorney Ismail J. Ramsey and Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) Special Agent in Charge Jennifer Cicolani. The sentence was handed down by the Hon. William H. Alsup, Senior United States District Judge.

Svarda, 36, of San Francisco, pleaded guilty to one count of Felon in Possession of a Firearm, in violation of 18 U.S.C. § 922(g)(1), and one count of Illegal Possession of a Machinegun, in violation of 18 U.S.C. § 922(o), on July 12, 2023. He was charged by Information on January 11, 2023.

According to his plea agreement, Svarda sold drugs and firearms to a CI throughout early 2021. The sales began in February 2021, when Svarda sold the CI ecstasy on two occasions. In March, Svarda added firearms to his list of goods for sale, selling the CI ecstasy and a pistol, which ATF later determined was stolen. Later in March, Svarda sold the CI ecstasy, a Smith and Wesson revolver, and a privately made, AR style, .223 caliber pistol. The AR style pistol was a “ghost gun,” meaning it was privately made and did not bear a serial number.

As court documents show, the sales continued throughout April and July. On July 22, 2023, Svarda sold the CI methamphetamine and another privately manufactured AR-style pistol. The privately manufactured AR-style pistol was capable of automatically shooting more than one shot without manual reloading, via a single function of the trigger. At the time of the sale, Svarda showed the CI how to turn the AR-style pistol into a fully automatic weapon using this function.

In total, Svarda admitted to selling to the CI over 150 grams of ecstasy, 157 grams of methamphetamine, and six firearms. In addition, Svarda admitted that he knew at the time that previously he had been convicted of at least one felony.

In addition to the prison term, Judge Alsup ordered Svarda to serve three years of supervised release to begin after his prison term is completed.

Assistant U.S. Attorney Sophia Cooper prosecuted the case, with the assistance of Paralegal Specialist Tina Rosenbaum. The prosecution is the result of an investigation by ATF.

SAN FRANCISCO – The Office of the United States Attorney has filed a federal criminal complaint charging Leion Butler with aiding and abetting murder after surveillance videos led investigators to conclude Butler was involved in the murder of a victim whose lifeless body was found on November 12, 2023, in the Presidio, in San Francisco, Calif. The complaint was filed November 20, 2023, and was unsealed earlier today.

According to the complaint, Butler, 20, of San Francisco, is responsible for the murder of the victim found in the Presidio on November 12, 2023. Early that morning, witnesses discovered a deceased body in the parking lot of Crissy Field East Beach in the Presidio. The complaint describes how the victim was found to have suffered from a single gunshot wound to his head.

The criminal complaint describes how investigators reviewed video from surveillance cameras near where the body was found, including those capturing cars leaving the area near the time of the murder. One of the cars observed leaving the area was linked to the deceased victim. Three days later, the victim’s vehicle was located, unoccupied, with its license plates still attached. The car reportedly was double parked for days in a street in the Hunters Point neighborhood of San Francisco. The criminal complaint describes how investigators obtained additional surveillance footage from cameras near where the victim’s car was found. The additional surveillance video captured the arrival of the victim’s car and showed someone—later identified as the defendant—parking the car, exiting, and speaking into a cellphone. Further, the video captured the eventual arrival of a second car. The criminal complaint further describes how the surveillance camera captured images of the defendant speaking with the driver of the second car, the defendant making several trips between the victim’s car and the second car, and the defendant wiping down the driver’s side door and interior of the victim’s car with “a clothing item or towel.” In addition, the video showed additional images of the defendant retrieving items from the victim’s car and eventually getting into the second vehicle and leaving the scene.

The complaint describes how further investigation led investigators to discover the name of the person who owned the second vehicle and, eventually, to the defendant. According to investigators, the defendant both fit the description of the person who parked the victim’s car in Hunter’s Point and was related to the owner of the second vehicle. Further, investigators developed evidence establishing that on the day of the murder, the defendant’s cell phone was both in the general area where the victim was found and where the victim’s car was wiped down.

In sum, Butler is charged with murder, in violation of 18 U.S.C. §§ 1111 and 2.

A criminal complaint merely alleges that crimes have been committed, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt. The maximum statutory penalty for murder is death or life imprisonment. However, any sentence following conviction would be imposed by the court after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Butler was arrested on November 20, 2023, and remains in federal custody. Butler appeared this morning before U.S. Magistrate Judge Sallie Kim to face the charges. Butler pleaded not guilty. Butler’s next appearance is scheduled for November 22, 2023, before Magistrate Judge Kim, for further status on detention.

Assistant U.S. Attorney Kelsey Davidson is prosecuting the case. The prosecution is the result of an investigation by the Federal Bureau of Investigation.

The Justice Department announced today the seizure of nearly $9 million worth of Tether, a cryptocurrency pegged to the U.S. dollar. These seized funds were traced to cryptocurrency addresses allegedly associated with an organization that exploited over 70 victims through romance scams and cryptocurrency confidence scams, which are widely known as “pig butchering.”

“Through this significant seizure, we disrupted the financial infrastructure of an organized network of scammers who stole millions from victims across the United States. These scammers prey on ordinary investors by creating websites that tell victims their investments are working to make them money. The truth is that these international criminal actors are simply stealing cryptocurrency and leaving victims with nothing,” said Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division. “The department hopes this recovery of assets will bring some closure and a sense of justice to the over 70 victims affected by this series of scams. This seizure should also serve as a reminder to cybercriminals that, although the current landscape of the cryptocurrency ecosystem may seem like an ideal way to launder ill-gotten gains, law enforcement will continue to develop the expertise needed to follow the money and seize it back for victims.”

According to court documents, criminal actors worked together to target victims and convince them to make cryptocurrency deposits by fraudulently representing that the victims were making investments with trusted firms and cryptocurrency exchanges. In reality, the purported firms and cryptocurrency exchanges were non-existent trading platforms. Agents and analysts from the U.S. Secret Service (USSS) were able to trace those victim deposits and observed that the funds were quickly laundered through dozens of cryptocurrency addresses and exchanged for several different cryptocurrencies, a money laundering technique often referred to as “chain hopping.” These techniques are used to “layer” the proceeds of criminal activity into new cryptocurrency ecosystems, all to obfuscate the nature, source, control, and ownership of those proceeds. The seized funds were linked to numerous victim reports made via the FBI’s Internet Crime Complaint Center (IC3) and Federal Trade Commission’s (FTC) Consumer Sentinel Network.

“This seizure is the culmination of the exceptional hard work and collaborative partnership between the Justice Department and the United States Secret Service,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “Silicon Valley remains one of the world’s preeminent locations for cryptocurrency firms. As such, we remain dedicated to using all tools at our disposal to bring justice to the victims of frauds and scams. Even when money and criminals are abroad, we will work with our partners to seize cyber criminals’ illegal proceeds.”

“This seizure exemplifies the Secret Service’s mission to protect the financial infrastructure of the United States. We remain determined and vigilant to combat cyber-enabled financial fraud,” said Special Agent in Charge Shawn Bradstreet of the USSS San Franscisco Field Office. “It is a priority for the Secret Service to protect the financial security that citizens work so hard to obtain. We want to thank the Justice Department for their partnership, dedication, and outstanding work on this case.”

The USSS San Francisco Field Office investigated this case.

Trial Attorney Georgiana MacDonald of the Criminal Division’s Computer Crime and Intellectual Property Section, National Cryptocurrency Enforcement Team, and Assistant U.S. Attorneys Chris Kaltsas and Galen Phillips for the Northern District of California are handling the case, as well as the seizure and forfeiture actions.

The department would like to acknowledge Tether for its assistance in effectuating the transfer of these assets.

If you are a victim of a cryptocurrency scam, or other scam involving the use of the Internet, please file a report with the IC3 at ic3.gov and with the FTC at www.reportfraud.ftc.gov.

SAN FRANCISCO – The Justice Department announced today the seizure of nearly $9 million worth of Tether, a cryptocurrency pegged to the U.S. dollar. These seized funds were traced to cryptocurrency addresses allegedly associated with an organization that exploited over 70 victims through romance scams and cryptocurrency confidence scams, which are widely known as “pig butchering.”

“Through this significant seizure, we disrupted the financial infrastructure of an organized network of scammers who stole millions from victims across the United States. These scammers prey on ordinary investors by creating websites that tell victims their investments are working to make them money. The truth is that these international criminal actors are simply stealing cryptocurrency and leaving victims with nothing,” said Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division. “The department hopes this recovery of assets will bring some closure and a sense of justice to the over 70 victims affected by this series of scams. This seizure should also serve as a reminder to cybercriminals that, although the current landscape of the cryptocurrency ecosystem may seem like an ideal way to launder ill-gotten gains, law enforcement will continue to develop the expertise needed to follow the money and seize it back for victims.”

“This seizure is the culmination of the exceptional hard work and collaborative partnership between the Justice Department and the United States Secret Service,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “Silicon Valley remains one of the world’s preeminent locations for cryptocurrency firms. As such, we remain dedicated to using all tools at our disposal to bring justice to the victims of frauds and scams. Even when money and criminals are abroad, we will work with our partners to seize cyber criminals’ illegal proceeds.”

“This seizure exemplifies the Secret Service’s mission to protect the financial infrastructure of the United States. We remain determined and vigilant to combat cyber-enabled financial fraud,” said Special Agent in Charge Shawn Bradstreet of the USSS San Francisco Field Office. “It is a priority for the Secret Service to protect the financial security that citizens work so hard to obtain. We want to thank the Justice Department for their partnership, dedication, and outstanding work on this case.”

According to court documents, criminal actors worked together to target victims and convince them to make cryptocurrency deposits by fraudulently representing that the victims were making investments with trusted firms and cryptocurrency exchanges. In reality, the purported firms and cryptocurrency exchanges were non-existent trading platforms. Agents and analysts from the U.S. Secret Service (USSS) were able to trace those victim deposits and observed that the funds were quickly laundered through dozens of cryptocurrency addresses and exchanged for several different cryptocurrencies, a money laundering technique often referred to as “chain hopping.” These techniques are used to “layer” the proceeds of criminal activity into new cryptocurrency ecosystems, all to obfuscate the nature, source, control, and ownership of those proceeds. The seized funds were linked to numerous victim reports made via the FBI’s Internet Crime Complaint Center (IC3) and Federal Trade Commission’s (FTC) Consumer Sentinel Network.

The USSS San Francisco Field Office investigated this case.

Trial Attorney Georgiana MacDonald of the Criminal Division’s Computer Crime and Intellectual Property Section, National Cryptocurrency Enforcement Team, and Assistant U.S. Attorneys Chris Kaltsas and Galen Phillips for the Northern District of California are handling the case, as well as the seizure and forfeiture actions.

The department would like to acknowledge Tether for its assistance in effectuating the transfer of these assets.

If you are a victim of a cryptocurrency scam, or other scam involving the use of the Internet, please file a report with the IC3 at ic3.gov and with the FTC at www.reportfraud.ftc.gov.

SAN FRANCISCO – Jairo Tomas Santos pleaded guilty in San Francisco federal court today to bank fraud, announced United States Attorney Ismail J. Ramsey and Federal Bureau of Investigation Special Agent in Charge Robert K. Tripp. The plea was accepted by the Honorable William Alsup, U.S. District Judge.

In pleading guilty, Santos, 42, formerly of San Mateo, Calif., admitted to embezzling more than $1.1 million from his employer, a San Francisco-based law firm, where Santos worked as the office manager. According to his plea agreement, Santos began embezzling from his employer in March of 2016 and continued with his scheme through February 2023. As part of the scheme, Santos obtained checks from the victim law firm, filled out the payee line of those checks, addressing them to “Jairo Santos,” and signed each check with the signature of the law firm’s senior partner even though Santos was not authorized to do so. Santos then deposited these checks into his personal checking accounts at Wells Fargo Bank. Santos admitted to depositing approximately 806 fraudulent and unauthorized checks from the victim law firm made payable to Santos into his personal checking accounts. The total value of these unauthorized deposits was approximately $1,191,683. Santos deposited these checks from the victim law firm knowing that the payments were not authorized by the firm or its senior partner.

A federal grand jury indicted Santos on July 25, 2023, charging him with three counts of bank fraud, in violation of 18 U.S.C. § 1344. Under the plea agreement, Santos pleaded guilty to one count. If Santos complies with the plea agreement, the remaining counts of bank fraud will be dismissed at sentencing.

Santos is currently free on bond. Judge Alsup scheduled Santos’s sentencing hearing for March 12, 2024, at 11:00 a.m. The maximum statutory penalty for the 18 U.S.C. § 1344 violation is 30 years in prison and a fine of $1,000,000. The court may also ordered Santos to serve an additional term of supervised release and may order restitution, if appropriate. However, any sentence will be imposed by the court only after consideration of the U.S. Sentencing Guidelines and the federal statute governing the imposition of a sentence, 18 U.S.C. § 3553.

Assistant U.S. Attorney Christiaan Highsmith is prosecuting the case with the assistance of Aarian Beiti. The prosecution is the result of an investigation by the FBI.