Broidy Amended Complaint
Broidy Amended Complaint
12
13 UNITED STATES DISTRICT COURT
14 CENTRAL DISTRICT OF CALIFORNIA, WESTERN DIVISION
15 BROIDY CAPITAL MANAGEMENT
B O I E S
9 together with al Thani and the State of Qatar, the “Qatari Defendants”), and
10 Does 1-10, for Defendants’ unlawful conduct, as set forth below.1
11 NATURE OF THE ACTION
S C H I L L E R
9 Defendants Stonington and Muzin) while others worked secretly for the State
10 of Qatar and did not make filings (such as Joseph (“Joey”) Allaham and the
11 GRA Defendants).
S C H I L L E R
16 stood in the way of the State of Qatar’s aggressive public relations and
17 governmental relations efforts that sought to ingratiate Qatar with the new
18 Trump Administration and to deflect attention from Qatar’s record of
19 supporting terrorist organizations.
20 5. On information and belief, Defendant Chalker is a former CIA
21 cyber-operative who runs GRA, which is headquartered in New York, New
22 York. On information and belief, Defendant Powell is a former British
23 intelligence operative who runs GRA operations out of Qatar and established
24 GRA’s office there through a Gibraltar subsidiary in October 2017 – just
25 weeks prior to the commencement of the attack on Plaintiffs.
26 6. On information and belief, the Qatari Defendants retained and
27 used the GRA Defendants to coordinate and implement the hack, and the
28 -- 3 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 4 of 70 Page ID #:437
9 On information and belief, the individuals and entities identified by the GRA
10 Defendants and used by the Qatari Defendants to attack Plaintiffs are:
11 Omniscope Limited, a U.K. security and intelligence firm; a naturalized
S C H I L L E R
8 stolen emails on March 22 and 26, 2018. In that same meeting, Muzin
F L E X N E R
9 discussed meetings he had with his client the State of Qatar while serving as
10 its registered agent. Muzin told Mowbray: “Broidy’s name comes up in
11 Embassy meetings often” and “I definitely identified him as somebody who,
S C H I L L E R
12 was not, didn’t like them too much.” Muzin further acknowledged that
13 everyone he “fingered” was “in danger.” He warned Mowbray that
14 Mowbray and Plaintiff Broidy needed “to be very careful,” that the State of
15 Qatar is “going after you,” and that “Honestly, I know they’re after you
B O I E S
16 and Broidy.”
17 12. At that meeting, Muzin tried to persuade Mowbray that the
18 blame for the hacks on Plaintiffs and attempted hacks on Mowbray and
19 subsequent media leaks should fall on Muzin’s principal (the State of Qatar)
20 and not Muzin because “I was doing my job.” Muzin was aware that the
21 State of Qatar utilized computer hacking as one of its cyber-weapons and
22 even admitted to Mowbray that he was “positive” that he himself had
23 been hacked by the Qataris. Muzin’s admissions to Mowbray inculpate
24 both Muzin and his principal and co-conspirator the State of Qatar, since
25 Muzin admitted that he and his principal orchestrated and participated in the
26 scheme to harm Plaintiffs by hacking and disseminating their computer
27 systems and information.
28 -- 5 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 6 of 70 Page ID #:439
1 from within North America, sorting them by topic, and delivering them (in
2 some cases by hand) to news organizations in the United States, knowing that
3 the news organizations would publish the stolen emails under the cloak of the
4 First Amendment – all for the purpose of discrediting Plaintiff Broidy in the
5 United States and interfering with his business relationships. Defendants’
6 efforts to target Plaintiff Broidy in this manner have been largely successful:
7 several media organizations published articles (including front page stories in
L L P
8 the March 22 and 26, 2018 editions of the New York Times, a March 26, 2018
F L E X N E R
9 story by the Associated Press, a story in the March 1, 2018 edition of the Wall
10 Street Journal, and additional articles in The Huffington Post, McClatchy,
11 Esquire, The Intercept and Bloomberg News, which stories were reprinted or
S C H I L L E R
1 19. Defendant the State of Qatar is a foreign state. The head of state
2 and head of government of Qatar is the current Emir of Qatar, Sheikh Tamim
3 bin Hamad Al Thani. The Emir has made visits to Los Angeles, California
4 and has hosted the Mayor of Los Angeles, Eric Garcetti, in Doha, the capital
5 of Qatar, as part of an effort to strengthen the partnership between the cities of
6 Los Angeles and Doha. Additionally, the State of Qatar maintains a
7 Consulate in Los Angeles, California.
L L P
12 company formed under the laws of Delaware, with its primary place of
13 business in New York, New York. It has not registered as a FARA agent of
14 the State of Qatar.
15 23. Defendant Kevin Chalker is the founder and Chief Executive
B O I E S
9 modern-day slavery.”
10 27. On information and belief, after its neighboring Middle Eastern
11 countries began their quarantine of Qatar in 2017, Defendant the State of
S C H I L L E R
12 U.S.C. § 1602 et seq., because its conduct falls within the exception to foreign
13 sovereign immunity set forth in 28 U.S.C. § 1605(a)(5). Multiple entire torts
14 as described herein occurred within the United States, and additional tortious
15 misconduct described herein occurred at a minimum predominately within the
B O I E S
16 United States.
17 31. This Court also has subject matter jurisdiction over the State of
18 Qatar because its conduct falls within the exception to foreign sovereign
19 immunity set forth in 28 U.S.C. § 1605(a)(2). The State of Qatar entered into
20 numerous commercial contracts with persons to provide consulting, public
21 relations, offensive cyber and other lawful and unlawful commercial services
22 in order to further the State of Qatar’s public relations efforts and economic
23 and commercial interests, which included most significantly the lifting of a
24 comprehensive trade and commercial embargo on Qatar. In furtherance of
25 those commercial contracts, Defendants then targeted Plaintiff Broidy. Upon
26 information and belief, the State of Qatar engaged the GRA Defendants and
27 the Agent Defendants to use illegal commercial means to promote its own
28 -- 11 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 12 of 70 Page ID #:445
to this claim occurred in this judicial district, and a substantial part of property
8
that is the subject of this action is situated in this judicial district. In
F L E X N E R
9
particular, the private communications, documents, trade secrets and
10
intellectual property that was unlawfully accessed, converted, and stolen was
11
located in this district and the unlawful access to those materials necessarily
S C H I L L E R
12
took place in this district.
13
38. Venue also is proper in this judicial district under 28 U.S.C.
14
§1391(f)(1) for the same reasons and because Defendant the State of Qatar is
15
B O I E S
a foreign state.
16
39. Alternatively, venue is proper in this judicial district under 28
17
U.S.C. § 1391(b)(3) because there is no judicial district in a State in which all
18
non-foreign defendants are resident, and at least one Defendant is subject to
19
personal jurisdiction in California.
20
STATEMENT OF FACTS
21
40. This is a case about a civil and criminal conspiracy undertaken by
22
a foreign nation on the territory of the United States against a successful,
23
influential United States citizen and his California corporation. Qatar targeted
24
Plaintiff Broidy because he spoke out forcefully and effectively against
25
Qatar’s support for terrorism, entered into significant business relationships
26
relating to defense and counterterrorism with a neighboring nation, and stood
27
28 -- 13 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 14 of 70 Page ID #:447
8 Plaintiffs’ email accounts, and transmission of the illicitly obtained data to the
F L E X N E R
9 media.
10 I. INTERNATIONAL SANCTIONS WERE IMPOSED ON THE
STATE OF QATAR IN JUNE 2017 AS THE RESULT OF ITS
11 HISTORY OF SUPPORTING AND HARBORING TERRORISTS
S C H I L L E R
8 48. On May 25, 2017, a bill (H.R. 2712) was introduced in the
F L E X N E R
12 Hamas, stated in its findings that “Hamas has received significant financial
13 and military support from Qatar.”
14 49. On June 5, 2017, neighboring Middle Eastern states severed
15 diplomatic relations with the State of Qatar because of the State of Qatar’s
B O I E S
16 support for terrorism and its close ties to Iran. Other governments quickly
17 followed. Some countries closed their airspaces to Qatari aircraft, closed their
18 borders with the State of Qatar and/or banned Qatari-flagged ships from
19 docking at their ports. The sanctioning states issued a set of demands to the
20 State of Qatar including that the State of Qatar curb ties with Iran and stop
21 funding terrorist organizations. Those demands were rejected.
22 50. President Trump denounced Qatar and sided with the efforts to
23 embargo Qatar, tweeting on June 6, 2017: “During my recent trip to the
24 Middle East I stated that there can no longer be funding of Radical Ideology.
25 Leaders pointed to Qatar - look!”
26
27
28 -- 15 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 16 of 70 Page ID #:449
1 51. On June 9, 2017, once again siding with the sanctioning states
2 and criticizing the more conciliatory tone of the then-Secretary of State,
3 President Trump stated:
4 The nation of Qatar, unfortunately, has historically been a funder
of terrorism at a very high level, and… nations came together and
5 spoke to me about confronting Qatar over its behavior. So we
had a decision to make: Do we take the easy road, or do we
6 finally take a hard but necessary action? We have to stop the
funding of terrorism. I decided, along with Secretary of State
7 Rex Tillerson, our great generals and military people, the time
L L P
had come to call on Qatar to end its funding — they have to end
8 that funding — and its extremist ideology in terms of funding…
This is my great priority because it is my first duty as President to
F L E X N E R
16 economy and plunged Qatar into crisis. The sanctioning states threatened to
17 expel the State of Qatar from the Gulf Cooperation Council, a regional
18 economic and security cooperation body made up of six nations. The
19 economic quarantine led to a massive drop-off in foreign investment in Qatar.
20 According to the International Monetary Fund, “following the rift, foreign
21 financing (non-resident deposits and inter-bank placements) and resident
22 private-sector deposits fell by about US$40 billion.”
23 53. These international sanctions on the State of Qatar remain in
24 effect today.
25
26
27
28 -- 16 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 17 of 70 Page ID #:450
specific agreements with those agents for those agents to provide public
8
relations, consultancy, and related services. The Qatari Defendants launched
F L E X N E R
9
a public relations campaign to obfuscate Qatar’s ties to, and financial and
10
logistical support of, some of the world’s worst extremist and terrorist
11
organizations—including Al Qaeda (and its affiliate Al-Shabab), Hamas, the
S C H I L L E R
12
Taliban, and the Muslim Brotherhood—and to change Qatar’s image in the
13
United States, including particularly in the Jewish community in the United
14
States. As Tablet Magazine, an online publication focused on Jewish news,
15
B O I E S
wrote on February 13, 2018, the Qatari influence operation reflected “a Qatari
16
preoccupation with American Jewish communal power, as well as a desire to
17
address whichever challenges Doha believes Jewish influence raises for the
18
country’s vast ambitions in Washington and beyond.”
19
55. This campaign was aimed at: (1) bolstering the image of the State
20
of Qatar in circles perceived as influential with the Trump Administration;
21
and (2) curtailing the influence of individuals that could undermine the
22
standing of the State of Qatar in the United States.
23
24
25
26
27
28 -- 17 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 18 of 70 Page ID #:451
bolster Qatar’s image in the United States. Al-Rumaihi and Al Thani have
8
access to billions of dollars in capital from the Qatar Investment Authority to
F L E X N E R
9
use for this purpose. As one example, in 2017 Al-Rumaihi was a significant
10
investor in the “Big3” basketball league, started by Rapper Ice Cube and Jeff
11
Kwatinetz, a Los Angeles businessman. Al-Rumaihi then sought to use his
S C H I L L E R
12
association with Kwatinetz to gain contact with Kwatinez’s former business
13
associate, Steve Bannon, who was at that time the Chief White House
14
Strategist for President Trump. In litigation relating to Al-Rumaihi’s
15
B O I E S
Tower to visit with the Trump Transition Team. Michael Flynn, at that time
8
the incoming National Security Adviser, was at Trump Tower on that same
F L E X N E R
9
day. Both Al-Rumaihi and Flynn were photographed in the lobby of the
10
Trump Tower that day.
11
60. The attempted purchase of Newsmax is another example of how
S C H I L L E R
12
Al-Rumaihi and Al Thani sought to use millions of dollars from the Qatari
13
Investment Authority to bolster Qatar’s image in the United States in an effort
14
to address the commercial embargo. Politico reported on May 8, 2018 that
15
B O I E S
1 officials who held very senior positions within the Intelligence Community,
2 the Federal Bureau of Investigation, the Department of Treasury and the
3 Department of Homeland Security[.]” That $2.5 million retainer agreement
4 was signed for the State of Qatar by Dr. Ahmed Al-Hammadi, the Secretary
5 General of the State of Qatar’s Ministry of Foreign Affairs and the Acting
6 Head of Investments of the State-owned Qatar Investment Authority.
7 B. Defendants Stonington And Muzin Initially Focused On
L L P
16 Qatar. Their agreement specifies that Muzin and Stonington were to provide
17 “consulting services” including the “development and implementation of a
18 government relations strategy for the State of Qatar, as requested and directed
19 by the Embassy.” The initial agreement provided that the State of Qatar
20 would pay Muzin and Stonington $50,000 a month for these services.
21 64. Defendant Muzin’s efforts as an agent of the State of Qatar
22 quickly focused on an effort to put a pro-Jewish spin on the State of Qatar. A
23 September 5, 2017 article in O’Dwyer’s, an online magazine covering the
24 public relations industry, quotes Muzin as stating: “Engagement with Qatar
25 can only be in the best interests of the United States and the Jewish
26 community, as we cannot allow Qatar to be ostracized by its neighbors and
27 pushed into Iran’s sphere of influence.”
28 -- 20 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 21 of 70 Page ID #:454
8 leaders.
F L E X N E R
12 “received an invitation to meet with” the Emir of Qatar during the United
13 Nations General Assembly, he had “decided not to accept this invitation.”
14 Mr. Klein further stated: “Any Jewish leader meeting with the Qatari Emir or
15 Crown Prince likely means well, but he will serve as an unwitting prop in
B O I E S
16 their PR ploy to whitewash the legitimate reasons why its Arab Muslim
17 neighbors are boycotting them and why Israel and Jews are horrified by them,
18 meaning it will only strengthen Qatar’s embrace of Iran and critical backing of
19 Hamas.”
20 67. According to a February 13, 2018 article in Tablet Magazine,
21 “Muzin largely failed to persuade Jewish leaders to agree to meetings with
22 influential Qataris visiting New York for the opening of the United Nations
23 General Assembly.”
24 68. Soon after the failure of the United Nations General Assembly
25 initiative, Muzin began to invite American Jewish leaders on all-expense-paid
26 trips to Qatar to further the State of Qatar’s public relations campaign.
27 Plaintiff Broidy and others again encouraged American Jewish leaders to
28 -- 21 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 22 of 70 Page ID #:455
16 70. On information and belief, Defendant Muzin also met with White
17 House aide Victoria Coates, the Senior Director for International Negotiations
18 on the National Security Council and a former aide to Senator Ted Cruz, to
19 advocate for United States policies that would be supportive of the State of
20 Qatar. On information and belief, Defendant Muzin got Coates to have her
21 boss, Jason Greenblatt, the Special Envoy for International Negotiations, send
22 out the following tweet on February 9, 2018, that was supportive of Qatar:
23 “Qatar partnering with Israel can bring real relief to the people of Gaza.
24 Ending support for Hamas and focusing on humanitarian aid and
25 reconstruction will end the suffering.”
26 71. Defendant Al-Rumaihi also engaged in efforts similar to
27 Defendants Muzin and Stonington with respect to the United States Jewish
28 -- 22 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 23 of 70 Page ID #:456
16 undisclosed rate;
17 i. McDermott, Will & Emery (July 13, 2017 agreement) at the
18 rate of $40,000 per month;
19 j. Nelson Mullins Riley & Scarborough LLP (July 26, 2017
20 agreement, renewed on March 19, 2018) at the rate of
21 $100,000 per month for three months;
22 k. Portland PR (December 6, 2017 agreement) at the rate of
23 $123,195 per month;
24
25
26 2
Stonington notably has not filed its mandatory supplemental FARA filing
disclosing the specifics of its FARA activities. That filing was due in March
27 2018. 28 C.F.R. § 5.200.
28 -- 24 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 25 of 70 Page ID #:458
1 Party for decades, and during pertinent periods frequently and directly
2 interacted with the President of the United States. His advocacy against
3 terrorism and extremism is well known. Plaintiff Broidy served on the
4 Homeland Security Advisory Council from 2006 to 2009 and specifically on
5 the Future of Terrorism Task Force of that Council. The “Findings” report of
6 that Task Force, issued on January 11, 2007, stated: “Factors that will
7 influence the future of terrorism include: the leadership of the terrorists, US
L L P
12 75. Since September 11, 2001, Plaintiff Broidy has increased his
13 involvement in supporting the safety of his homeland, the United States. As
14 part of his involvement, he became active in fundraising for the Republican
15 Party because its views on how to defend the United States were aligned with
B O I E S
16 at that June 2017 meeting, stated: “Broidy was like sitting in the front row
17 and that he had somehow prompted Trump to say that.”
18 81. After Defendants Muzin and Stonington were retained by the
19 State of Qatar, Mr. Broidy extended his criticism of the State of Qatar to the
20 efforts by Muzin and Stonington to arrange meetings between the Emir and
21 American Jewish leaders.
22 82. Beginning in or around September 2017, Plaintiff Broidy began
23 to urge American Jewish leaders to decline the invitations of the State of
24 Qatar and Muzin to meet with the Emir in New York City and/or to visit
25 Qatar.
26 83. Plaintiff Broidy was not alone in this effort. On September 15,
27 2017, Forbes published a piece by a contributing writer titled “Why is Qatar
28 -- 27 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 28 of 70 Page ID #:461
1 offering to trade dead Israelis for meetings with live Jews?” The article
2 reported that an offer was being made to American Jewish leaders to return
3 the corpses of two Israeli soldiers whom Hamas had killed if those leaders
4 would meet with the Emir. The article stated:
5 a. Rabbi Shmuel Boteach (who according to Newsweek is one of
6 the ten most influential rabbis in the United States) stated that
7 “all who agreed to whitewash the terror-stained hands of the
L L P
8 paid for the trips taken. Among those participating in the trips were:
F L E X N E R
8 Qatar.
F L E X N E R
12 which arose from Broidy’s successful efforts in 2016 to block Muzin from
13 receiving a highly questionable commission on a large political donation that
14 Muzin believed he had been instrumental in arranging.
15 IV. DEFENDANTS TARGET BROIDY
B O I E S
16
88. In connection with his work for the State of Qatar, Defendant
17
Muzin had weekly meetings at the Embassy of Qatar in Washington, D.C.,
18
where he discussed his ongoing efforts. On information and belief, the
19
agendas for these meetings were set by Defendants Al Thani and Al-Rumaihi,
20
and the meetings began in 2017 in anticipation of the Emir’s April 2018 visit
21
to the United States for bilateral meetings with the Trump Administration and
22
visits to Capitol Hill. On information and belief, at those meetings, Defendant
23
Muzin became increasingly upset about Plaintiff Broidy’s efforts to
24
undermine his lobbying for the State of Qatar and felt that these were personal
25
attacks on him. On information and belief, Defendant Muzin brought up
26
27
28 -- 31 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 32 of 70 Page ID #:465
9 Defendant Muzin, acting as the agent of the State of Qatar, to influence the
10 United States Jewish community were manifestly unsuccessful. As alleged
11 above, by and large, American Jewish leaders declined to meet with the Emir
S C H I L L E R
12 of Qatar when he was at the United Nations and declined offers of all-
13 expenses-paid trips to visit Qatar. Notwithstanding Muzin’s lack of success,
14 the State of Qatar nevertheless raised his monthly payment to $300,000 a
15 month in November 2017 – shortly before the attacks on Plaintiffs began. On
B O I E S
16 information and belief, the increase in Muzin’s monthly pay was necessary to
17 support activities related to the hacks for which Muzin had responsibility.
18 91. Although Plaintiff Broidy was not the only outspoken critic of
19 the State of Qatar and of Muzin’s efforts on its behalf, on information and
20 belief, Defendants the State of Qatar, Al Thani, Al-Rumaihi, Stonington, and
21 Muzin, targeted Plaintiff Broidy specifically because he had exercised his
22 right to speak out on an issue of national and international concern and by
23 doing so, had negatively impacted Qatar’s interests.
24 92. Thereafter, the Qatari Defendants and the Agent Defendants
25 agreed to engage in and did in fact engage in or coordinate a series of hacks
26 and/or other misappropriation of the private communications, documents,
27
28 -- 32 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 33 of 70 Page ID #:466
16 Defendant State of Qatar to known and unknown threat actors to execute the
17 attacks, and supervised this work and were responsible for the overall
18 execution of the project.
19 95. Approximately one month before the cyberattacks against
20 Plaintiffs and their associates began, on information and belief, in October
21 2017 the GRA Defendants also opened a subsidiary of GRA organized under
22 the laws of Gibraltar and physically located in Doha, Qatar.
23 96. On information and belief, the GRA Defendants were actively
24 recruiting new employees within the small community of former U.S.
25 government offensive cyber operatives, and the GRA Defendants made it
26 clear within that community that they had been retained to conduct or
27 coordinate offensive cyber operations on behalf of Defendant State of Qatar.
28 -- 33 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 34 of 70 Page ID #:467
9
information and belief, the email used Google trademarks without the
10
permission of Google, including the Google logo and the Gmail logo. The
11
email was sent from a Gmail address, which had been disguised to look like
S C H I L L E R
12
an authentic security alert from Google. The email purported to alert Ms.
13
Rosenzweig that the security on her account had been compromised and that
14
she needed to verify or change her account credentials. When she clicked on
15
B O I E S
the link in the email it directed her to a TinyURL website that appeared as if it
16
was an authentic Google account login page. TinyURL is a redirecting
17
service that provides shortened URLs that redirects a website visitor to the
18
website associated with the longer URL. It is known to be used by hackers
19
and scammers to avoid detection and circumvent spam and malware filters.
20
The URL address for that page was http://tinyurl.com/yaw4jmpn. When the
21
TinyURL link was clicked it redirected Ms. Rosenzweig to the following
22
website that contained Google’s logo and appeared to be an authentic Google
23
account update page: https://mailchallenge-service-userupdate-myprofile-
24
authsupport-
25
key.userupdate.info/m/pn?tR0Il12=cHpXbG8yeXhyR0lOTTIxdW5KamhMM
26
jln&nrn=SHo5dm5KNHREYVdpbkpFNQ==&cr=SkQ9PQ==&lan=en&rD3c
27
28 -- 34 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 35 of 70 Page ID #:468
1 notifying her that a user or users of the Mail.ru app had obtained access to
2 read, send, delete, and manage Ms. Rosenzweig’s Gmail account, all without
3 her awareness or consent.
4 2. The Mowbray Attack
5 101. Joel Mowbray is a U.S. citizen and resident of New York, New
6 York. Prior to December 27, 2017, Mr. Mowbray was known by Defendants
7 to be an associate of Plaintiff Broidy as well as a critic of both the Defendant
L L P
8 only a password and username for login, but also something that only that user
F L E X N E R
9 has available to them, such as a mobile phone or other email address. Mr.
10 Mowbray’s second factor was his mobile phone, which he had set to receive
11 verification text messages or a phone call from Google containing a
S C H I L L E R
12 verification code.
13 105. Beginning on or about December 27, 2017, Mr. Mowbray
14 received a call from a United States telephone number purportedly associated
15 with Google and containing a recording providing the verification code for his
B O I E S
16 account. Contemporaneous with that call from Google, Mr. Mowbray also
17 received from the Defendants several spearphishing text messages and calls
18 from U.S. phone numbers that were purportedly from Google. These phone
19 numbers are associated with U.S. phone carriers such as Hook Mobile. These
20 text messages and calls directed Mr. Mowbray to log in to his Gmail account
21 so that he could verify his account. Mr. Mowbray also received spearphishing
22 text messages such as those pictured below, and phone calls from phone
23 numbers with U.S. area codes and registered to U.S. carriers, such as Hook
24 Mobile, which mimicked two-factor authentication messages and made the
25 phishing emails appear authentic.
26
27
28 -- 37 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 38 of 70 Page ID #:471
1
2
3
4
5
6
7
L L P
8
F L E X N E R
9
10
11
S C H I L L E R
12
13
14
15
B O I E S
16
17 106. The Defendant attackers sent Mr. Mowbray these messages
18 because they could not access his Google account without his two-factor
19 authentication code.
20
21
22
23
24
25
26
27
28 -- 38 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 39 of 70 Page ID #:472
8
F L E X N E R
9
10
11
S C H I L L E R
12
13
14
15
B O I E S
16
17
18
19
20
21 108. These spearphishing emails were designed to lure Mr. Mowbray
22 to a malicious website seeking his Google login credentials. For example, one
23 of the links went to a Bitly URL address: http://bit.ly/2lber5Z. If the Bitly
24 link had been clicked, it would have redirected Mr. Mowbray to the following
25 website that contained Google’s logo and appeared to be an authentic Google
26 account page at the same domain (userupdate.info) as one of the spearphishing
27 emails that Ms. Rosenzweig received seeking her Google login information:
28 -- 39 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 40 of 70 Page ID #:473
1 https://authsupport-myprofilelogon-servicemail-userowavalue-
2 key.userupdate.info/m/vc/?tR0Il12=bnpFZ28zcXZwelNOTTIxdW5KamhM
3 Mjln&nrn=Vk49PQ==&cr=SkQ9PQ==&lan=en&rD3cIn=&rCv=WGxiZFh2
4 YmRYd3A0&VrCe2Ph=&VrCe2Em. As with Ms. Rosenzweig, this link led
5 to a fraudulent login page that is no longer active. The Bitly link was created
6 on December 27, 2017, which is contemporaneous with the email that Mr.
7 Mowbray received. This Bitly link has been terminated by Bitly for
L L P
8 suspicious activity.
F L E X N E R
12 employee of Plaintiff BCM. She has a private Gmail account that she uses to
13 send and receive personal emails. Her Gmail account contains private
14 communications and requires at least a username and password for access.
15 110. On information and belief, on or around January 14, 2018, just
B O I E S
16 weeks after Ms. Rosenzweig and Mr. Mowbray were attacked, the Executive
17 Assistant began to receive spearphishing emails disguised as Google security
18 alerts, which bore Google trademarks used without Google’s permission and
19 were sent through Google’s Gmail service in violation of Google’s Terms of
20 Service and Gmail’s Program Policies.
21 111. On information and belief, one of the spearphishing emails
22 contained a fictitious security alert with a picture of her face and part of her
23 phone number. The email was sent from a misleading Gmail account with the
24 name “Gmail Account” and the email address
25 [email protected], which had been drafted to look like
26 an authentic security alert from Google. The email purported to alert the
27 Executive Assistant that the security on her account had been compromised
28 -- 40 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 41 of 70 Page ID #:474
1 and that she needed to verify or change her Google credentials. When she
2 clicked on the link in the email, it directed her to an Owly address, which
3 redirected her to a website that appeared as if it was an authentic Google
4 account login page. Like TinyURL and Bitly, Owly is a redirecting service
5 that provides shortened URLs that redirect a website visitor to the website
6 associated with the longer URL. It is known to be used by hackers and
7 scammers to avoid detection and circumvent spam and malware filters. The
L L P
8 URL address for that page was http://ow.ly/FJZ030hLxof. When the Owly
F L E X N E R
9 link was clicked, it redirected her to the following website that contains
10 Google’s logo and appeared to be an authentic Google account login page:
11 http://loms.96.lt/BDHRov58?platform=hootsuite. However, that page was a
S C H I L L E R
16
17
18
19
20
21
22
23
24
25
26
27
28 -- 41 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 42 of 70 Page ID #:475
1 115. On February 14, 2018 and February 19, 2018, unlawful and
2 unauthorized connections originated from an IP address in Qatar. These two
3 unlawful and unauthorized intrusions into BCM’s California email server
4 were not masked by VPNs, even though the connections immediately before
5 and immediately after the access were routed through VPNs, possibly because
6 the VPN failed or because the accessing computer automatically connected to
7 Plaintiff BCM’s network before the VPN could be activated. These
L L P
12 same threat actors have involved similar fraudulent news alerts, malicious
13 Google login pages, email addresses designed to resemble legitimate Google
14 security addresses, fraudulent two-factor authentication messages, and the use
15 of Mail.ru to control victims’ accounts. In addition, one of the IP addresses
B O I E S
1 the original documents – and instead bear time stamps from the Central and
2 Eastern Time Zones.
3 118. Upon information and belief, some of the unlawfully obtained
4 documents were given to United States media outlets in hard-copy form by
5 hand-delivery within the United States.
6 119. On February 24, 2018, Defendants registered the email address
7 “[email protected]” through the company 1&1 Internet, Inc., which
L L P
16 domain registrar and web hosting service that sells website domains to users
17 so they may create their own webpage and hosts websites. Defendants further
18 obfuscated their identity using a registration masking service, Domain by
19 Proxy LLC, which allows a user to replace their own personal information
20 with information belonging to Domain by Proxy LLC for purposes of
21 registration. Domain by Proxy LLC is a company owned by GoDaddy LLC.
22 121. On March 1, 2018, the contents of emails stolen from Plaintiffs’
23 California-based computer accounts and servers appeared in the Wall Street
24 Journal in an article titled, “Trump Ally Was in Talks to Earn Millions in
25 Effort to End 1MDB Probe in U.S.” Additional emails stolen from those
26 California computer accounts and servers were published or reported on in
27
28 -- 44 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 45 of 70 Page ID #:478
1 other media outlets including the Huffington Post on March 2, 2018 and the
2 New York Times on March 3, 2018 and the BBC on March 5, 2018.
3 122. On March 8, 2018, Defendant Muzin demonstrated his
4 knowledge that Plaintiff Broidy had been successfully targeted by the State of
5 Qatar by stating: “I did not cause the Broidy stuff, just because I have
6 information” and “I don’t know all the details, but I know that I am hearing
7 repeatedly that there’s a lot more coming.”
L L P
8 123. On March 22, 2018, the New York Times published a front page
F L E X N E R
16 124. On March 26, 2018, the New York Times published another front
17 page story on Plaintiff Broidy that again acknowledged that it relied on
18 “[h]undreds of pages of Mr. Broidy’s emails, proposals and contracts”
19 received from “an anonymous group critical of Mr. Broidy’s advocacy of
20 American foreign policies in the Middle East.”
21 125. Media outlets in the United States and abroad continue to publish
22 – and to threaten to publish – materials stolen from Plaintiffs. Plaintiffs
23 continue to receive numerous press inquiries concerning such materials.
24 126. On information and belief, the State of Qatar, acting through the
25 Agent Defendants, was responsible for disseminating the emails and
26 documents stolen from Plaintiffs’ California-based email accounts and
27 servers.
28 -- 45 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 46 of 70 Page ID #:479
9 Defendants and the Agent Defendants, while in the United States, conspired to
10 unlawfully access Plaintiffs’ private communications, documents, trade
11 secrets and intellectual property located in California, and to disseminate that
S C H I L L E R
16 Defendants and the Agent Defendants also carried out that conspiracy and
17 unlawfully accessed Plaintiffs’ private communications, documents, trade
18 secrets and intellectual property located in California, and further engaged in
19 distribution of that information to media outlets in both the United States and
20 abroad. Upon information and belief, many of the instances of unlawful
21 distribution of illegally obtained took place within the United States.
22 130. The actions of the Qatari Defendants, the GRA Defendants and
23 the Agent Defendants as alleged herein were specifically proscribed by law
24 and were not matters left to the discretion, choice or judgment of a sovereign
25 state.
26
27
28 -- 46 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 47 of 70 Page ID #:480
9
7, 2018, discussed Plaintiff Broidy’s political activities in the United States
10
and his business interests in Romania. The article did not mention either of
11
Muzin’s clients at the time (Qatar and Albania). Indeed, the article did not
S C H I L L E R
12
mention the Middle East at all. There is no apparent connection between
13
Wieder’s January 28th remark to Muzin (that it was “time to rock”) and the
14
February 7th article.
15
B O I E S
1 Plaintiff Broidy, the Middle East and Nader that were about to become the
2 focus of media attention.
3 135. On March 5, 2018, Defendant Muzin informed Mowbray that
4 there was “more stuff coming” from the New York Times.
5 136. In the same meeting with Mowbray, Defendant Muzin discussed
6 meetings he had with his client the State of Qatar while serving as a registered
7 agent of Qatar. Muzin told Mowbray: “Broidy’s name comes up in Embassy
L L P
8 meetings often” and “I definitely identified him as somebody who, was not,
F L E X N E R
9 didn’t like them too much.” Muzin further acknowledged that everyone he
10 “fingered” was “in danger.” He warned Mowbray that Mowbray and Plaintiff
11 Broidy needed “to be very careful,” that the State of Qatar is “going after
S C H I L L E R
12 you,” and that “Honestly, I know they’re after you and Broidy.”
13 137. In the same meeting, when Mowbray accused Defendant Muzin
14 of targeting Plaintiff Broidy for the State of Qatar and assisting in the hacks
15 on Plaintiffs and attempted hacks on Mowbray, Muzin responded “I was
B O I E S
8 Agent Defendants, the GRA Defendants and Defendants Al Thani and Al-
F L E X N E R
12 to the manner in which they would carry out their parts of the unlawful
13 conspiracy. As such, for these and other reasons, they are not entitled to
14 derivative sovereign immunity for their conduct in furtherance of the
15 conspiracy.
B O I E S
16 CAUSES OF ACTION
17 FOR A FIRST CAUSE OF ACTION AGAINST ALL
DEFENDANTS
18
Computer Fraud and Abuse Act
19 18 U.S.C. §§ 1030(a)(2)(C) & (a)(5)
20 140. Plaintiffs incorporate and adopt by reference the allegations
21 contained in each and every preceding paragraph of this First Amended
22 Complaint.
23 141. On information and belief, Defendant the State of Qatar, by itself
24 and/or through the Agent Defendants and the GRA Defendants, accessed or
25 caused to be accessed Plaintiffs’ servers, and emails and documents physically
26 located on those servers, at BCM’s offices in Los Angeles, California, as well
27 as Google servers located in California, specifically by accessing or causing to
28 -- 49 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 50 of 70 Page ID #:483
8 Defendants acted with knowledge that they were accessing these accounts
F L E X N E R
9 and costs, including but not limited to the investigation costs associated with
10 identifying the cyber-attacks; verifying the integrity of the computers,
11 computer systems or computer networks, computer programs and/or computer
S C H I L L E R
12 data, and/or data; and repairing the integrity of Plaintiffs’ computer systems
13 after the attack, including by hiring forensic investigators and data security
14 experts. Plaintiffs are also entitled to recover their attorneys’ fees pursuant to
15 § 502(e).
B O I E S
9
housed on Plaintiffs’ and Google’s servers, and in emails and documents
10
physically located on those servers, all of which were located in California,
11
and were stolen from Plaintiffs in California or otherwise obtained from
S C H I L L E R
12
Plaintiffs in California in a manner that constitutes theft.
13
164. Upon information and belief, in at least some instances,
14
Defendants were in the United States when they received or possessed the
15
B O I E S
DEFENDANTS
8
Invasion of Privacy by Intrusion
F L E X N E R
9 Upon Seclusion
10 169. Plaintiffs incorporate and adopt by reference the allegations
11 contained in each and every preceding paragraph of this First Amended
S C H I L L E R
12 Complaint.
13 170. Plaintiffs have a legally protected privacy interest in their
14 personal information, including in information contained on Plaintiffs’ and
15 Google’s servers, and in emails and documents physically located on those
B O I E S
9
180. Defendant the State of Qatar, acting by itself and/or through the
10
Agent Defendants, converted or disposed of Plaintiffs’ property including the
11
rights to that property, by unlawfully accessing, or at a minimum receiving
S C H I L L E R
12
that property, including private communications, documents, trade secrets and
13
intellectual property with knowledge that it had been unlawfully taken, and
14
disseminating them to the media in the United States and abroad.
15
B O I E S
9 Action.
10 FOR A SIXTH CAUSE OF ACTION AGAINST ALL
DEFENDANTS
11
Stored Communications Act
S C H I L L E R
12 18 U.S.C. §§ 2701-12
13
188. Plaintiffs incorporate and adopt by reference the allegations
14
contained in each and every preceding paragraph of this First Amended
15
B O I E S
Complaint.
16
189. Plaintiffs are “persons” within the meaning of 18 U.S.C.
17
§§ 2510(6) and 2707(a).
18
190. Defendants willfully and intentionally accessed without
19
authorization a facility through which an electronic communication service is
20
provided, namely, BCM’s computer systems, including its email servers, as
21
well as Google’s servers, thereby obtaining access to wire or electronic
22
communications while they were in electronic storage in such systems, in
23
violation of 18 U.S.C. § 2701(a).
24
191. As a result of Defendants’ willful and intentional violations,
25
Plaintiffs have suffered damages and, as provided for in 18 U.S.C. § 2707, are
26
entitled to an award of the greater of the actual damages suffered or the
27
28 -- 58 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 59 of 70 Page ID #:492
1 statutory damages, punitive damages, attorneys’ fees and other costs of this
2 action, and appropriate equitable relief.
3 192. Defendants’ conduct has caused, and will continue to cause
4 Plaintiffs irreparable injury, including reputational harm, loss of goodwill, an
5 increased risk of further theft, and an increased risk of harassment. Such
6 injury cannot be compensated by monetary damages. Plaintiffs accordingly
7 seek an injunction prohibiting Defendants from engaging in the conduct
L L P
9 including, but not limited to, damage resulting from harm to Plaintiffs’
10 computers, loss in the value of Plaintiffs’ trade secrets and proprietary
11 business information, and harm to the business.
S C H I L L E R
9 economic value, actual or potential, from not being generally known to the
10 public or to other persons who can obtain economic value from its disclosure
11 or use; and (2) Is the subject of efforts that are reasonable under the
S C H I L L E R
1 209. Plaintiffs have made, and continue to make, efforts that are
2 reasonable under the circumstances to maintain the secrecy of their trade
3 secrets.
4 210. Defendants improperly disclosed Plaintiffs’ trade secrets without
5 Plaintiffs’ consent when they widely disseminated those trade secrets to media
6 organizations for publication and at the time of such disclosure, knew or had
7 reason to know that the information disclosed consisted of trade secrets.
L L P
9 Plaintiffs have suffered damages, which include, but are not limited to,
10 damage resulting from harm to Plaintiffs’ computers, servers, and accounts,
11 loss in the value of Plaintiffs’ trade secrets and business information, and
S C H I L L E R
and knowingly agreed and conspired with each other and with others to
8
engage in the wrongful conduct alleged herein, including but not limited to
F L E X N E R
9
a. Intentionally accessing Plaintiffs’ and Google’s servers, and
10
emails and documents physically located on those servers
11
accounts without authorization and then stealing and/or
S C H I L L E R
12
doctoring Plaintiffs’ data and emails, in violation of the
13
Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2)(C) &
14
(a)(5);
15
B O I E S
8 information;
F L E X N E R
16 agents of the State of Qatar under FARA, as well as unregistered agents of the
17 State of Qatar, were incentivized to do the bidding of the State of Qatar and
18 engage in any acts that would further the overall scheme.
19 235. Upon information and belief, the conspiracy was agreed to within
20 the United States, and at least one step in furtherance of the conspiracy
21 occurred within the United States.
22 236. On information and belief, Plaintiffs have been injured and have
23 suffered monetary damages as a result of Defendants’ conspiratorial actions in
24 an amount to be proven at trial, but in any event, in excess of $75,000,
25 exclusive of interest and costs.
26 237. Defendants’ conduct has caused, and will continue to cause
27 Plaintiffs irreparable injury, including reputational harm, loss of goodwill, an
28 -- 67 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 68 of 70 Page ID #:501
9
239. Plaintiffs repeat and re-allege the allegations contained in each
10
and every preceding paragraph of this Complaint.
11
240. Plaintiffs request that this Court order the following relief:
S C H I L L E R
12
a. Grant judgment in favor of Plaintiffs and against
13
Defendants;
14
b. Declare that Defendants’ conduct constitutes violations of
15
B O I E S
8
F L E X N E R
9
10
11
S C H I L L E R
12
13
14
15
B O I E S
16
17
18
19
20
21
22
23
24
25
26
27
28 -- 69 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
Case 2:18-cv-02421-JFW-E Document 47 Filed 05/24/18 Page 70 of 70 Page ID #:503
CL 7
By:
8
9 LEE S. WOLOSKY
u._
11
12
13
14
(/)
15
0 16
17
18
19
20
21
22
23
24
25
26
27
28 -- 70 -- Case No. 18-cv-02421-JFW
FIRST AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL