United States District Court, E.D. New York
MEMORANDUM & ORDER
NICHOLAS G. GARAUFIS, United States District Judge.
Fabio Gasperini is charged with two counts of computer
intrusion, one count of conspiracy to commit wire fraud, one
count of wire fraud, and one count of conspiracy to commit
money laundering. (See Indictment ("Ind.")
(Dkt. 3) ¶¶ 11-21.) The charges stem from
Defendant's alleged creation of a "botnet" to
further a "click fraud" perpetrated against
advertising companies. (Id. ¶¶ 1-10.)
Stated briefly, the Government alleges that Defendant and
others obtained unauthorized access to computers in the U.S.
and around the world and remotely directed those computers to
fraudulently inflate the number of times that online
advertisements were "viewed." The court assumes
familiarity with the allegations against Defendant, which are
discussed in previous opinions. (See, e.g.. May 31,
2017, Mem. & Order (Dkt. 45) at 2-3.)
has filed numerous motions in limine seeking
exclusion of certain proposed trial evidence. (1st Mot. in
Lim. ("1st MIL") (Dkt. 65); 2d Mot. in Lim.
("2d MIL") (Dkt. 105); 3d Mot. in Lim. ("3d
MIL") (Dkt. 111).) For the reasons set forth below,
Defendant's motions m limine are GRANTED IN PART
and DENIED IN PART, with ruling on certain questions RESERVED
Motions in Limine
purpose of a motion in limine is to allow the trial
court to rule in advance of trial on the admissibility and
relevance of certain forecasted evidence." Gorbea v.
Verizon N.Y., Inc., No. 1 l-CV-3758 (KAM), 2014 WL
2916964, at * 1 (E.D.N.Y. June 25, 2014) (citing Luce v.
United States, 469 U.S. 38, 40 n.2 (1984); Palmieri
v. Defaria. 88 F.3d 136, 141 (2d Cir. 1996);
Nat'l Union Fire Ins. Co. of Pittsburgh v. L.E. Myers
Co.. 937 F.Supp. 276, 283 (S.D.N.Y. 1996)).
"Evidence should be excluded on a motion in
limine only when the evidence is clearly inadmissible on
all potential grounds." United States v.
Paredes, 176 F.Supp.2d 179, 181 (S.D.N.Y. 2001).
"[C]ourts considering a motion in limine may
reserve decision until trial, so that the motion is placed in
the appropriate factual context." Jean-Laurent v.
Hennessy, 840 F.Supp.2d 529, 536 (E.D.N.Y. 2011) (citing
Nat'l Union Fire Ins. Co., 937 F.Supp. at 287).
Further, a district court's ruling on a motion in
limine is preliminary and "subject to change when
the case unfolds." Luce, 469 U.S. at 41. The
moving party bears the burden of establishing that evidence
is inadmissible for any purpose and so properly excluded on a
motion in limine. See United States v.
Push, 162 F.Supp.3d 97, 101 (E.D.N.Y. 2016).
Relevance and Prejudice
admissibility of evidence at trial is determined by the
Federal Rules of Evidence, and only relevant evidence may be
admitted. Fed.R.Evid. 402. Evidence is relevant if it
"has any tendency to make a fact more or less
probable" and "the fact is of consequence in
determining the action." Fed.R.Evid. 401. This standard
imposes a "very low" bar. United States v.
White. 692 F.3d 235, 246. (2d Cir. 2012) (quoting
United States v. Al-Moayad, 545 F.3d 139, 176 (2d
Cir. 2008)). Even where it is determined to be relevant,
evidence may be excluded if the court determines that
"its probative value is substantially outweighed by a
danger of one or more of the following: unfair prejudice,
confusing the issues, misleading the jury, undue delay,
wasting time, or needlessly presenting cumulative
evidence." Fed.R.Evid. 403.
Objections to Expert Testimony and Other Testimony
Testimony Regarding Cybercrime. Botnets, and Malware
initial notice of proposed expert witnesses, the Government
stated that it expected to call an expert to testify
general terminology related to cybercrime, including botnets,
click fraud scripts, malware, servers, the Shellshock
vulnerability and other terms material to the charges against
the defendant. In addition, the government anticipates that
[the expert witness] will testify about the operation and
capabilities of botnets and malware generally as well as the
operation and capability of the malware and botnet employed
by the defendant in this case.
(See May 23, 2017, Gov't Ltr. ("Expert
Disclosure Ltr.") (Dkt. 38) at 2.) Defendant raises
three general objections to this proposed testimony, which
are discussed separately below.
Background Testimony Regarding Cybercrime, Botnets, and
first contends that general testimony providing background
regarding cybercrime, botnets, and malware is irrelevant and
may prejudice or confuse the jury. (1st MIL at 1-2.) The
court disagrees. Despite its sometimes tenuous relationship
to "disputed matter, " background evidence and
testimony is "universally offered and admitted as an aid
to understanding" and treated as relevant. See
Fed.R.Evid. 401 advisory committee notes. While the proffered
expert testimony here does not directly implicate the
allegations against Defendant, it provides background
regarding the sometimes obscure technology and concepts at
issue in the case, including malware, botnets, and server
operations, and other terms that are likely to be unfamiliar
to the average juror. The court views this proposed testimony
as relevant and helpful, and sees no overriding potential for
prejudice or confusion evident at this juncture.
Defendant's motion to exclude background testimony
regarding cybercrime, malware, botnets, and related terms and
concepts is therefore DENIED.
Testimony Regarding the Capabilities of the Botnet and
Malware Allegedly Employed by Defendant
next argues that testimony regarding the capabilities of the
specific malware and botnet that he allegedly employed is
both irrelevant and more prejudicial than probative. (1st MIL
at 2.) Defendant contends that testimony regarding those
capabilities without further context does not touch on the
actual employment of malware and botnet alleged to have
occurred in this case and so is not consequential to the
action. (Id.) The Government responds that it will
limit the expert testimony to the actual capabilities of the
botnet at issue, which it argues are relevant to the
"value" obtained as a result of the alleged
computer intrusions. (Gov't Opp'n to 1st MIL
("MIL Opp'n") (Dkt. 93) at 8-9.) The
Government's proposed basis for introducing testimony
establishes that the proffered evidence is clearly relevant,
as it goes directly to the elements the Government must prove
to secure a conviction on the charged counts. See,
e.g., (stating that computer intrusion must lead to
obtaining "anything of value"). To the extent that
Defendant argues that testimony regarding general botnet
capabilities risks prejudicing or confusing jurors by
presenting them with far-flung harms, the Government appears
to address this concern by limiting the testimony to
"the capabilities of the specific botnet that defendant
built, and not  capabilities that are merely
speculative." (MIL Opp'n at 8.) Defendant's
motion to exclude testimony the capabilities of his alleged
botnet and malware is therefore DENIED.
Defendant contends that the proposed testimony is hearsay
because the Government does not state that the expert has
personally reviewed the malware, botnet, or servers at issue
here. (1st MIL at 2.) In response, the Government clarifies
that the expert has, in fact, viewed the malware at issue.
(MIL Opp'n at 9.) Based on this representation,
Defendant's motion to exclude testimony regarding the
malware and botnets is DENIED. 2. Testimony of Dr.
Johannes Ulrich Defendant moves to limit the testimony
of Dr. Johannes Ulrich, which the Government states will
[Ulrich's] review of findings from one of SANS'
"honeypots, " Le., a computer security mechanism
used to research online and computer- based threats and
identify means to better protect against such threats. ...
[as well as] his observations that certain Network Attached
Storage devices were being targeted through the Shellshock
(Expert Disclosure Ltr. at 1-2.)
to the previous motion, Defendant moves to exclude testimony
regarding "computer-based threats and the means to
protect against such threats, " claiming that this
general testimony is irrelevant to the allegations against
him. (1st MIL at 4.) The Government has clarified that
Ulrich's testimony will be specific to "how he
detected the defendant's malicious software (using a
detection mechanism called a 'honeypot') and his
analysis of that malicious software." (MIL Opp'n at
10.) Presented in this way, the proposed testimony analyzing
the malware at issue is clearly relevant to the charges
against Defendant. Accordingly, Defendant's motion to
exclude that testimony is DENIED.
separately moves to limit Ulrich's testimony to exclude
references to servers from which the Government does not
allege information was obtained. (1 st MIL at 4.) Defendant
argues that testimony is irrelevant because he "has not
been charged with attempt, and therefore an attempted
intrusion is not an element of any of the charges."
(Id.) However, as the Government points out, several
of the counts include charges of attempt. (MIL Opp'n at
10-11 (citing Ind. ¶¶ 12, 14, 19).) Testimony
regarding observations of alleged attempts are thus directly
relevant to the charges against Defendant. Defendant's
motion to exclude testimony regarding servers from which no
information or other objects of value were obtained is
Testimony of Stuart Gorton
seeks to exclude the testimony of Stuart Gorton on the basis
that "he is not an expert." (1st MIL at 3.) The
Government's initial list of potential expert witnesses
included Gorton. (See Expert Disclosure Ltr. at 2.)
In response to Defendant's motion, however, the
Government states that it "presently intends to call Mr.
Gorton as a fact witness." (MIL Opp'n at 9.)
Defendant's motion to exclude Gorton's testimony is
DENIED as moot.
expert disclosure, the Government informed Defendant that it
would seek to introduce testimony from Italian linguists
regarding their own translations or the accuracy of
others' translations of Italian language documents.
(Expert Disclosure Ltr. at 3.) Defendant argues that the
court should exclude the testimony of the linguists, as their
identities have not been disclosed to Defendant, preventing
him from assessing their qualifications. (1st MIL at 7.)
After Defendant filed his motion, the Government disclosed
the names of its proposed linguist witnesses (Gov't
Witness List (Dkt. 109) at 4), and indicated that it will
"elicit their qualifications during direct
testimony" (MIL Opp'n at 13). In light of this
disclosure, the court DENIES Defendant's motion to
exclude the linguists' testimony as moot.
Testimony Regarding the New Jersey Server
seeks exclusion of proposed testimony analyzing a server
allegedly operated by Defendant in connection with the
charged computer intrusions. (1st MIL at 3-4.) He contends
that the Government "constructively denied" him
access to that server by failing to provide access to
"forensic tools" that Defendant claims are needed
to view the contents of the server. (Id. at 4.) The
court already considered and rejected the same argument in
the context of Defendant's motion to compel. (See July 6,
2017, Hr'g Tr. (Dkt. 96) 21:6-25.) Defendant has received
access to the "virtual image file" containing the
contents of that server, as well as reports by Government
witnesses analyzing the file. (Id. 19:6-22.) There
has therefore been no constructive denial of access, and the
motion to exclude testimony regarding the contents of the
server on that basis is DENIED.
Objections to Documentary and Electronic Evidence
Italian Language Documents
seeks exclusion of "all  documents in a foreign
language for which a certified translation has not been
provided." (1st MIL at 7.) The Government's response
does not indicate whether it has provided Defendant with
copies of certificated translations of all proposed foreign
language trial exhibits. To the extent that it has not
already done so, the Government is ORDERED to provide
Defendant with any certified translations that it seeks to
introduce at trial by no later than July 22, 2017. Any
foreign language documents for which certified translations
are not provided by this deadline will be held inadmissible
moves to exclude the entire contents of email accounts
attributed to Defendant. (1st MIL at 4-6.) He argues that
those documents have not been properly authenticated and,
separately, that they constitute inadmissible
hearsay. The court addresses these points
first argues that the emails should be held inadmissible, as
they have not been and cannot be properly authenticated.
(Id. at 5.) Defendant contends that email
communications can only be authenticated by testimony of the
author or another party who observed the drafting and sending
of the message. (Id.) The Government counters that