Russian convicted of hacking seeks new trial or acquittal

The trial of a Russian convicted of hacking major Silicon Valley technology companies was plagued by prejudicial testimony from the prosecutors' primary witness and evidence from an unreliable source intended to frame the defendant, defense lawyers argued in a motion seeking acquittal or a new trial.

"The jury could only have found [Yevgeniy] Nikulin guilty of these crimes by use of conjecture and speculation, not facts," attorney Adam Gasner wrote.

Nikulin was convicted in July on nine counts of computer intrusion, causing damage to a protected computer, aggravated identity theft, trafficking and conspiracy. He was accused of hacking LinkedIn, Dropbox and Formspring in 2012 to steal and sell the login credentials of more than 100 million user accounts.

The jury in the first criminal trial to resume in federal court in California since the start of the COVID-19 pandemic returned the verdict after roughly five hours of deliberation. USA v. Nikulin, 18-cr-00440 (N.D. Cal., filed Oct. 20, 2020).

According to the Tuesday motion, prosecutors failed to produce any direct evidence to connect Nikulin to the alleged hacks. Defense attorneys attacked the credibility and alleged biased investigative strategies of the government's primary witness, FBI special agent Jeffrey Miller.

Gasner pointed to an exchange during cross-examination in which Miller admitted he was not familiar with Yevgeniy Bogachev, among the most wanted cyber criminals in the world who shares the same first name, birth month and nationality as his client. He argued the agent's "tunnel vision" prevented him from investigating whether Nikulin was framed or a victim of identity theft.

"The fact that Agent Miller was not familiar with one of the most serious cybercrime cases in United States history, or the alleged perpetrators of those crimes, makes his testimony unreliable," he wrote.

Prosecutors also improperly relied on evidence obtained from the Russian government that the defense claimed is unreliable and might have been provided to deceive the U.S. Attorney's Office.

The evidence connected one of the IP addresses associated with the LinkedIn hack to Nikulin's residence in Russia.

Gasner said the certificate of authenticity for the information provided by Russia through a Mutual Legal Assistance Treaty was not filled out correctly or completely, and "did not have any degree of reliability as to the information provided."

It was revealed during trial that Russia's initial response to the information request only included information that was publicly available and was unresponsive to the inquiry. The second attempt at obtaining the evidence was similarly unsuccessful since the documents were blurry and indiscernible.

When Miller followed up for a third attempt to obtain the information, he was sent a document with multiple pages of names and addresses, including Nikulin's. Gasner emphasized in the acquittal motion that Miller failed to investigate others on the list and made no efforts to verify the information.

"On cross-examination on this issue, Agent Miller testified he had no reason to distrust the information being provided by the Russian intelligence, yet he also admits the Russian government is a state sponsor of cyber-crime and cyber-terrorism," Gasner wrote. "This contradiction cannot be reconciled and undermines the credibility of Agent Miller's testimony."

U.S. District Judge William Alsup, who oversaw the case, was skeptical of some of the evidence prosecutors presented at trial, saying at one point, "There's no evidence in this case that this defendant did this."

But prosecutors in closing arguments laid out an intricate web of connections that they said pointed to Nikulin as the hacker.

Several experts from the hacked companies testified that they traced the origins of the intrusions to a Russian IP address belonging to the email chinabig01@gmail.com. Prosecutors said they tied that account to another that contained personal information about Nikulin, including messages from his brother and girlfriend.

The Justice Department, Assistant U.S. Attorney Katherine Wawrzyniak and plaintiffs' attorneys did not immediately respond to requests for comment.

Nikulin is scheduled to be sentenced Sept. 29 before Alsup.