Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Gasperini

United States District Court, E.D. New York

July 21, 2017



          NICHOLAS G. GARAUFIS, United States District Judge.

         Defendant Fabio Gasperini is charged with two counts of computer intrusion, one count of conspiracy to commit wire fraud, one count of wire fraud, and one count of conspiracy to commit money laundering. (See Indictment ("Ind.") (Dkt. 3) ¶¶ 11-21.) The charges stem from Defendant's alleged creation of a "botnet" to further a "click fraud" perpetrated against advertising companies. (Id. ¶¶ 1-10.) Stated briefly, the Government alleges that Defendant and others obtained unauthorized access to computers in the U.S. and around the world and remotely directed those computers to fraudulently inflate the number of times that online advertisements were "viewed." The court assumes familiarity with the allegations against Defendant, which are discussed in previous opinions. (See, e.g.. May 31, 2017, Mem. & Order (Dkt. 45) at 2-3.)

         Defendant has filed numerous motions in limine seeking exclusion of certain proposed trial evidence. (1st Mot. in Lim. ("1st MIL") (Dkt. 65); 2d Mot. in Lim. ("2d MIL") (Dkt. 105); 3d Mot. in Lim. ("3d MIL") (Dkt. 111).) For the reasons set forth below, Defendant's motions m limine are GRANTED IN PART and DENIED IN PART, with ruling on certain questions RESERVED until trial.


         A. Motions in Limine

         "The purpose of a motion in limine is to allow the trial court to rule in advance of trial on the admissibility and relevance of certain forecasted evidence." Gorbea v. Verizon N.Y., Inc., No. 1 l-CV-3758 (KAM), 2014 WL 2916964, at * 1 (E.D.N.Y. June 25, 2014) (citing Luce v. United States, 469 U.S. 38, 40 n.2 (1984); Palmieri v. Defaria. 88 F.3d 136, 141 (2d Cir. 1996); Nat'l Union Fire Ins. Co. of Pittsburgh v. L.E. Myers Co.. 937 F.Supp. 276, 283 (S.D.N.Y. 1996)). "Evidence should be excluded on a motion in limine only when the evidence is clearly inadmissible on all potential grounds." United States v. Paredes, 176 F.Supp.2d 179, 181 (S.D.N.Y. 2001). "[C]ourts considering a motion in limine may reserve decision until trial, so that the motion is placed in the appropriate factual context." Jean-Laurent v. Hennessy, 840 F.Supp.2d 529, 536 (E.D.N.Y. 2011) (citing Nat'l Union Fire Ins. Co., 937 F.Supp. at 287). Further, a district court's ruling on a motion in limine is preliminary and "subject to change when the case unfolds." Luce, 469 U.S. at 41. The moving party bears the burden of establishing that evidence is inadmissible for any purpose and so properly excluded on a motion in limine. See United States v. Push, 162 F.Supp.3d 97, 101 (E.D.N.Y. 2016).

         B. Relevance and Prejudice

         The admissibility of evidence at trial is determined by the Federal Rules of Evidence, and only relevant evidence may be admitted. Fed.R.Evid. 402. Evidence is relevant if it "has any tendency to make a fact more or less probable" and "the fact is of consequence in determining the action." Fed.R.Evid. 401. This standard imposes a "very low" bar. United States v. White. 692 F.3d 235, 246. (2d Cir. 2012) (quoting United States v. Al-Moayad, 545 F.3d 139, 176 (2d Cir. 2008)). Even where it is determined to be relevant, evidence may be excluded if the court determines that "its probative value is substantially outweighed by a danger of one or more of the following: unfair prejudice, confusing the issues, misleading the jury, undue delay, wasting time, or needlessly presenting cumulative evidence." Fed.R.Evid. 403.


         A. Objections to Expert Testimony and Other Testimony

         1. Testimony Regarding Cybercrime. Botnets, and Malware

         In its initial notice of proposed expert witnesses, the Government stated that it expected to call an expert[1] to testify regarding:

general terminology related to cybercrime, including botnets, click fraud scripts, malware, servers, the Shellshock vulnerability and other terms material to the charges against the defendant. In addition, the government anticipates that [the expert witness] will testify about the operation and capabilities of botnets and malware generally as well as the operation and capability of the malware and botnet employed by the defendant in this case.

(See May 23, 2017, Gov't Ltr. ("Expert Disclosure Ltr.") (Dkt. 38) at 2.) Defendant raises three general objections to this proposed testimony, which are discussed separately below.

         a. Background Testimony Regarding Cybercrime, Botnets, and Malware

         Defendant first contends that general testimony providing background regarding cybercrime, botnets, and malware is irrelevant and may prejudice or confuse the jury. (1st MIL at 1-2.) The court disagrees. Despite its sometimes tenuous relationship to "disputed matter, " background evidence and testimony is "universally offered and admitted as an aid to understanding" and treated as relevant. See Fed.R.Evid. 401 advisory committee notes. While the proffered expert testimony here does not directly implicate the allegations against Defendant, it provides background regarding the sometimes obscure technology and concepts at issue in the case, including malware, botnets, and server operations, and other terms that are likely to be unfamiliar to the average juror. The court views this proposed testimony as relevant and helpful, and sees no overriding potential for prejudice or confusion evident at this juncture. Defendant's motion to exclude background testimony regarding cybercrime, malware, botnets, and related terms and concepts is therefore DENIED.

         b. Testimony Regarding the Capabilities of the Botnet and Malware Allegedly Employed by Defendant

         Defendant next argues that testimony regarding the capabilities of the specific malware and botnet that he allegedly employed is both irrelevant and more prejudicial than probative. (1st MIL at 2.) Defendant contends that testimony regarding those capabilities without further context does not touch on the actual employment of malware and botnet alleged to have occurred in this case and so is not consequential to the action. (Id.) The Government responds that it will limit the expert testimony to the actual capabilities of the botnet at issue, which it argues are relevant to the "value" obtained as a result of the alleged computer intrusions. (Gov't Opp'n to 1st MIL ("MIL Opp'n") (Dkt. 93) at 8-9.) The Government's proposed basis for introducing testimony establishes that the proffered evidence is clearly relevant, as it goes directly to the elements the Government must prove to secure a conviction on the charged counts. See, e.g., (stating that computer intrusion must lead to obtaining "anything of value"). To the extent that Defendant argues that testimony regarding general botnet capabilities risks prejudicing or confusing jurors by presenting them with far-flung harms, the Government appears to address this concern by limiting the testimony to "the capabilities of the specific botnet that defendant built, and not [] capabilities that are merely speculative." (MIL Opp'n at 8.) Defendant's motion to exclude testimony the capabilities of his alleged botnet and malware is therefore DENIED.

         c. Hearsay

         Lastly, Defendant contends that the proposed testimony is hearsay because the Government does not state that the expert has personally reviewed the malware, botnet, or servers at issue here. (1st MIL at 2.) In response, the Government clarifies that the expert has, in fact, viewed the malware at issue. (MIL Opp'n at 9.) Based on this representation, Defendant's motion to exclude testimony regarding the malware and botnets is DENIED. 2. Testimony of Dr. Johannes Ulrich Defendant moves to limit the testimony of Dr. Johannes Ulrich, which the Government states will cover:

[Ulrich's] review of findings from one of SANS' "honeypots, " Le., a computer security mechanism used to research online and computer- based threats and identify means to better protect against such threats. ... [as well as] his observations that certain Network Attached Storage devices were being targeted through the Shellshock vulnerability.

(Expert Disclosure Ltr. at 1-2.)

         Similar to the previous motion, Defendant moves to exclude testimony regarding "computer-based threats and the means to protect against such threats, " claiming that this general testimony is irrelevant to the allegations against him. (1st MIL at 4.) The Government has clarified that Ulrich's testimony will be specific to "how he detected the defendant's malicious software (using a detection mechanism called a 'honeypot') and his analysis of that malicious software." (MIL Opp'n at 10.) Presented in this way, the proposed testimony analyzing the malware at issue is clearly relevant to the charges against Defendant. Accordingly, Defendant's motion to exclude that testimony is DENIED.

         Defendant separately moves to limit Ulrich's testimony to exclude references to servers from which the Government does not allege information was obtained. (1 st MIL at 4.) Defendant argues that testimony is irrelevant because he "has not been charged with attempt, and therefore an attempted intrusion is not an element of any of the charges." (Id.) However, as the Government points out, several of the counts include charges of attempt. (MIL Opp'n at 10-11 (citing Ind. ¶¶ 12, 14, 19).) Testimony regarding observations of alleged attempts are thus directly relevant to the charges against Defendant. Defendant's motion to exclude testimony regarding servers from which no information or other objects of value were obtained is therefore DENIED.

         3. Testimony of Stuart Gorton

         Defendant seeks to exclude the testimony of Stuart Gorton on the basis that "he is not an expert." (1st MIL at 3.) The Government's initial list of potential expert witnesses included Gorton. (See Expert Disclosure Ltr. at 2.) In response to Defendant's motion, however, the Government states that it "presently intends to call Mr. Gorton as a fact witness."[2] (MIL Opp'n at 9.) Defendant's motion to exclude Gorton's testimony is DENIED as moot.

         4. Italian Linguists

         In its expert disclosure, the Government informed Defendant that it would seek to introduce testimony from Italian linguists regarding their own translations or the accuracy of others' translations of Italian language documents. (Expert Disclosure Ltr. at 3.) Defendant argues that the court should exclude the testimony of the linguists, as their identities have not been disclosed to Defendant, preventing him from assessing their qualifications. (1st MIL at 7.) After Defendant filed his motion, the Government disclosed the names of its proposed linguist witnesses (Gov't Witness List (Dkt. 109) at 4), and indicated that it will "elicit their qualifications during direct testimony" (MIL Opp'n at 13). In light of this disclosure, the court DENIES Defendant's motion to exclude the linguists' testimony as moot.

         5. Testimony Regarding the New Jersey Server

         Defendant seeks exclusion of proposed testimony analyzing a server allegedly operated by Defendant in connection with the charged computer intrusions. (1st MIL at 3-4.) He contends that the Government "constructively denied" him access to that server by failing to provide access to "forensic tools" that Defendant claims are needed to view the contents of the server. (Id. at 4.) The court already considered and rejected the same argument in the context of Defendant's motion to compel. (See July 6, 2017, Hr'g Tr. (Dkt. 96) 21:6-25.) Defendant has received access to the "virtual image file" containing the contents of that server, as well as reports by Government witnesses analyzing the file. (Id. 19:6-22.) There has therefore been no constructive denial of access, and the motion to exclude testimony regarding the contents of the server on that basis is DENIED.

         B. Objections to Documentary and Electronic Evidence

         1. Italian Language Documents

         Defendant seeks exclusion of "all [] documents in a foreign language for which a certified translation has not been provided." (1st MIL at 7.) The Government's response does not indicate whether it has provided Defendant with copies of certificated translations of all proposed foreign language trial exhibits. To the extent that it has not already done so, the Government is ORDERED to provide Defendant with any certified translations that it seeks to introduce at trial by no later than July 22, 2017. Any foreign language documents for which certified translations are not provided by this deadline will be held inadmissible at trial.

         2. Defendant's Emails

         Defendant moves to exclude the entire contents of email accounts attributed to Defendant. (1st MIL at 4-6.) He argues that those documents have not been properly authenticated and, separately, that they constitute inadmissible hearsay.[3] The court addresses these points separately.

         a. Authentication

         Defendant first argues that the emails should be held inadmissible, as they have not been and cannot be properly authenticated. (Id. at 5.) Defendant contends that email communications can only be authenticated by testimony of the author or another party who observed the drafting and sending of the message. (Id.) The Government counters that ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.