In this section, the facts of Gorshkov’s and Ivanov’s crimes are outlined. Gorshkov’s case is discussed in some detail. Finally, the Ivanov’s case is outlined, describing the charges and the results of the court proceedings.

The mainstream media is alive these days with tales of Russian hacking of American companies, political parties, and the federal government5. These hackers have been involved in some extremely large cybercrimes. For example, in 2014, Russian Federal Security Service (FSB) officers Dmitry Dokuchaev and Igor Sushchin were convicted of hacking over one billion Yahoo! Accounts6. Another example of Russian hacking occurred when Sasha Panin hacked over one million computer systems and stole credit card and bank account information7.

In 1999 and 2000, Vasiliy Gorshkov and Alexey Ivanov were two young Russians actively engaged in cybercrime8. Gorshkov and Ivanov grew up in Chelyabinsk, one of the most polluted places on the planet due to a mysterious explosion in a nuclear-bomb-making factory in the 1950s9. Gorshkov was a troubled youth even though he was a computer whiz because played with the computers in his mother’s office10 . After failing the exams at Southern Ural State University, Gorshkov affiliated himself with a group of hackers that called themselves the Expert Group of Protection Against Hackers11. The group consisted of cells of two or three hackers and paid a 30 percent protection fee to an unknown entity12. Gorshkov coordinated one of these cells, where Ivanov and another programmer called Michael were members13.

In 2000, life was good for these two hackers. Gorshkov and Ivanov would hack into a supposedly secure network in the United States, explain to the network administrators when they had just done, and then offer to fix the problem for a price14. The companies paid the programmers in cash ranging from $80 to $4,00015. Cognizant Technology Solutions (CTS), headquartered in Seattle, Washington, even gave the hackers storage space on its servers16.

In June 2000, Gorshkov received an email from Seattle company called Invita Security, asking him whether he would like to work for a cybersecurity company in America17. Gorshkov jumped at the opportunity, traveling with Ivanov for 48 hours to interview with the company18. At the interview, the two hackers demonstrated their hacking skills, and the two programmers logged into their computers in Chelyabinsk19. When the meeting was over, they were driven back to their hotel20. The car then stopped suddenly, the doors were opened, and several FBI officers arrested them.21

When Speakeasy, a Seattle-based Internet service provider, had been victimized, the FBI created Operation Flyhook, a surveillance operation to arrest and then prosecute cyber criminals2324. The idea was to lure hackers to the United States by offering hackers employment at a fake cybersecurity company. Because many Russian hackers were young technologists with little income, the opportunity to work in America was irresistible25. Even though Gorshkov and Ivanov were making a good living in Russia scamming and extorting money from American companies, the temptation to work for a company like Amazon or Google was bait too good to pass up26. Gorshkov and Ivanov took the bait, hook, line, and sinker.

Gorshkov was tried and convicted of 20 counts of conspiracy, and a variety of computer crimes against the Speakeasy Network of Seattle, Washington27. Gorshkov’s attorney, Kenneth Kanev, attempted to block the use of data from the hacker’s servers in Russia28. After Gorshkov and Ivanov were arrested, the FBI proceeded to download 1.3 to 2.7 gigabytes of data from the hacker’s servers that were located in Russia2930. A warrant was issued to the FBI ten days after the download occurred31. While the two Russian hackers were demonstrating their talents to the FBI agents posing in Invita hiring managers, a keyboard sniffer was installed on their machines unbeknownst to Gorshkov and Ivanov, recording every keystroke32. Because the Russian servers were located in Chelyabinsk, Kanev argued that the FBI violated Gorshkov’s Fourth Amendment rights33. Four years later, the Supreme Court opined that no search warrant was necessary when American law enforcement a non-U.S. citizen’s residence in a foreign country34. Gorshkov was sentenced to three years in prison and ordered to pay $692,000 in restitution35.

Ivanov was indicted in Connecticut for charges of conspiracy, computer fraud, extortion, and possession of illegal access devices under the Computer Fraud and Abuse Act (CFAA)3637. Had Ivanov been convicted on all counts, he could have spent up to 90 years in prison38. After the indictment was handed down by the court, Ivanov filed a motion to dismiss all charges because he was physically located in Russia, not the United States when the offenses occurred, and thus he could not be charged with violating United States law. The federal district court denied Ivanov’s motion because the harm resulting from Ivanov’s action occurred in the United States and because the statutes under which he was charged were intended by Congress to apply extraterritorially. The court cited Muench which opined that when the intent is to cause harm inside the United States by individuals outside this country, the United States Law can be successfully applied against these individuals39. The court also cited Steinberg, where it concluded that there is ample precedent that a person could be charged where the harm occurs even if the individual was not physically present in the jurisdiction where the harm took place40. The court noted that the computers were located in Vernon, Connecticut where the illegal access occurred, and that there is legislative evidence indicating that the statues under which Ivanov was indicted were meant to apply .extraterritorially. At trial, Ivanov was sentenced to three years and eight months in prison and required to pay $800,000 in restitution41.

At a later date, Ivanov pleaded guilty to several of the charges and was sentenced to four years in prison followed by three months of supervised release. Ivanov was prosecuted and convicted in California42, New Jersey43, and Washington44 for similar crimes. In total, Ivanov was tried in five federal district courts for computer crime.

One event that deserves to be mentioned is that the FBI agent who was responsible for Operation Flyhook, Michael Schuler, was charged unauthorized access to computer information by Russia’s FSB45. The purpose of the Russian complaint was to assert Russian sovereignty46. If the long-arm of American law can reach into another country, entice foreign nationals to come to the United States, and then arrest and prosecute them, it is apparent that the Russian Federation felt no restraint in doing the same to an American citizen47. In Gorshkov’s trial, the federal district court ruled that Russian law does not apply to American agents48.

The issue with the outcome of these two cases is that in the future other countries will feel no compunction to searching servers located in America49. The United States courts have opined that America law has personal jurisdiction extraterritorially50. In contrast, the federal district has opined that Russian law, and probably the laws of any other nation, does not apply to American agents51. This result is the most likely an outgrowth of American exceptionalism, where the United States can do what it wants, where it wants, when it wants, to whomever it wants, and however it wants52. The issue with the ideology is that the United States is unique among nations in that it presumes that America has a right to exist and that no other nation can question its actions53.

The alleged Russian hack of the servers of the Democratic National Committee (DNC) can be viewed as a negative response to American exceptionalism, where the United States holds other countries to standards that it rejects for itself54. It should be remembered that in Special Prosecutor Robert Mueller’s indictment of 12 Russians, each one of the Russians was specifically named, the address of where the hack occurred in St. Petersburg was specified, and a declaration of their rank in the Russian military was stated55. The question that begs to be asked is: How did Muller’s team find out this information? It is more than probable that the Russian military computers were hacked in violation of Russian law56. It serves as a striking example of American exceptionalism, where the rule is: Do as I say, not as I do.

According to Lemos, the cases against Gorshkov and Ivanov were extremely dangerous because they open Pandora’s box where in the future, individuals as well as corporations could be criminally charged for conducting corporate espionage, particularly if the entities are headquartered in different countries57. In many cases, the CFAA exempts law enforcementofficers from being prosecuted if they engage in an unauthorized entry into a computer58. Unauthorized entry can be compared to an FBI officer driving a car beyond the speed limit to in pursuit of a criminal. Any evidence obtained when law enforcement breaks the law in performance of their duties is admissible in court59.

When evidence is obtained from a foreign country, diplomatic channels are used with all of its niceties60. The issue with employing formal communications with other nations is the length of time it takes to receive the desired evidence, sometimes as long as six months61. In the Gorshkov and Ivanov cases, a six month wait would have been too long. According to the court papers, the password to one Ivanov’s accounts was changed six days after the two Russians were arrested62. The issue with asking a foreign country to help the United States in convicting a cyber criminal located in another country is that it takes weeks and more likely months for the other nation to collect the requisite evidence63. Simply stated, such efforts take too much time because the United States is waiting for the evidence, it can be permanently deleted, thereby thwarting the prosecution of cybercriminals.

The author has read and agreed to the published version of the manuscript.

CFAA-Computer Fraud and Abuse Act

DNC-Democratic National Committee

FBI-Federal Bureau of Investigation

FSB-Russian Federal Security Service