Thread by @MariaDinzeo

The jury trial of accused hacker Yevgeniy Nikulin,kicks off today in San Francisco. Nikulin is charged with breaching @LinkedIn and @Dropbox in 2012. I'll have coverage of opening arguments for @CourthouseNews

@LinkedIn @Dropbox @CourthouseNews Assistant U.S. Attorney Michelle Kane is up first for opening arguments. Tells the jury that despite his methods, Nikulin is "just an ordinary thief."

Nikulin's attorney Adam Gasner points the finger at the Russians, painting the cyberattacks as a state-sponsored conspiracy to sell American data for profit. He says Nikulin wasn't involved and that anyone could have used his email accounts.

Day 1 of testimony ends with an observation from Judge Alsup: "We have two jurors on the verge of going to sleep. This is very boring. To you it might be exciting, but they’re doing their best to stay awake. My advice is pick up the pace considerably. We’re in boring city now."

Yevgeniy Nikulin- crimimal hacker or hapless fall guy? Today’s trial dispatch @CourthouseNews courthousenews.com/trial-of-accus…

Back in federal court for day 2 of testimony in the Nikulin hacking trial. AUSA Kane opens by saying the gov't objects to the defense's suggestion during its opening statement yesterday that the Russian FSB is somehow tied to the 2012 LinkedIn, DropBox and Formspring hacks.

Defense lawyer Valery Nechay says part of their theory is that other nefarious actors were involved in the hack, not #Nikulin. Nechay: "The overall structure and relationship between the cyber hacker community and Russian government is very well documented."

Nechay adds that defense will try to get the theory that FSB conspired with other hackers to breach commercial databases into evidence through cross examination of the FBI. "We are allowed to explore those connections through the FBI officers in this case."

Day 2 of the #Nikulin trial has wrapped and I gotta say, the gov't hasn't done a great job proving its case. I'm a legal journalist not a tech writer, and this is my first foray into cybercrime, but jeez. The DOJ has so far not tied anything to Nikulin as far as evidence goes.

So far the DOJ has shown that LinkedIn, Dropbox and Formspring were hacked by someone with an IP address originating in Russia, but they have not connected it to #Nikulin so far.

Judge Alsup seems to share my concerns. Today he told the gov't attorneys that he is still waiting for "some magic witness" who can tie it all together. An FBI agent specializing in cybercrime testified today, but he could only explain how the hack occurred, not by whom.

The gov't wants to play the jury a video showing a meeting an alleged co-conspirator driving to meet Nikulin in March 2012, around the time of the LinkedIn hack. This guy supposedly refers to Nikulin as a hacker. Nikulin's lawyers claim it's hearsay.

Alsup won't rule yet on whether to admit the video, but told gov't today: "If your case turns on some person in a car calling him a hacker you’d better throw in the towel now. We ought to have higher standards. I thought you had actual evidence that he did this."

The gov't has connected the hacker's IP address originating in Russia to the email account "[e-mail]" but has not shown it was controlled by Nikulin, though surely it must plan to do so. (Chinabig01, btw, is the worst hacker alias ever.)

At this point we've got jurors nodding off and seemingly pointless technical questioning of witnesses on direct. Expecting better from the gov't next week. Today's Yevgeniy Nikulin trial dispatch for @CourthouseNews courthousenews.com/prosecution-of…

#Nikulin trial update. Defense attorneys Adam Gasner and @AttorneyNechay have asked for a 30-day trial continuance, considering a DOJ witness was possibly exposed to #coronavirus during his travels. Awaiting an order from Judge Alsup.

Further #Nikulin update: Judge Alsup has suspended the trial for two days.

Yevgeniy Nikulin's attorney Valery Nechay said in an email that she is concerned about the suspension of due process resulting from the pandemic:

Judge Alsup has suspended the #Nikulin trial until April 13. A status conference has been set for April 9 to reassess, if necessary. Yevgeniy Nikulin remains in jail.

#Nikulin update: Judge Alsup likely to further postpone the @LinkedIn & @Dropbox hacking trial. He is prepared to forge ahead on May 4 even if SF's shelter in place order is extended. "It hurts me to know somebody has been in custody for 41 months," he says. @CourthouseNews

Alsup also orders the U.S. Marshals Service to have Yevgeniy Nikulin tested for #coronavirus. "Don’t wait to see if he’s got a fever. We’re in the middle of the trial. These lawyers need to go see their client."

The hacking trial of Yevgeniy #Nikulin is set to resume today in San Francisco federal court. The trial was abruptly halted after only two days of testimony in March due to Covid-19. Here's where we left off: courthousenews.com/prosecution-of…

Judge William Alsup is on the bench. There's already some logistical wrangling over whether attorneys can take off their masks when addressing the jury directly. Alsup says no.

The jury is waiting to be let into the courtroom. While we wait, I'll reintroduce the players.
For the government:
AUSAs Michelle Kane & Katherine Wawrzyniak.
For the defense:
Valery Nechay & Adam Gasner.

The parties have stipulated that the jury may be reduced from 12 to 6 if necessary. One juror has already asked to be excused because her husband's co-worker has tested positive for Covid-19. Alsup has told her not to come in today. She may be excused permanently.

Alsup: "Our first order of business is to see if we can even get six to serve."
The plan is to slowly bring them in and quiz each of them separately.

Everyone must wear a mask except witnesses. The witness box has protective glass around it. Alsup: "Some people sit in that box and they just lie. So I want the jury to see their face so you can decide if they may be lying."

We have 15 of the 16 jurors in the courtroom, spaced out. Alsup will now let them address the court about their concerns.

Alsup asks the jury: "Raise your hand if you're willing to serve and try to complete this case." Eleven hands go up.

One juror says she lives with a relative who is dying of brain cancer. Another says he is worried about his health He's 70 and has emphysema. He also has a fuzzy memory of the trial. "You expect people to remember four months ago what went down? I resent a lot of this," he says.

"We can't just shut down trials because of Covid-19. People have a right to due process," Judge Alsup says.

A third juror says he has type 1 diabetes. A fourth juror says she has a vacation planned for next week, reservations for which were made last August.

Alsup agrees to excuse the three jurors who presented health-related hardships. The juror with the vacation will remain as the trial is expected to wrap this week. If it runs longer, she will be excused.

On a 15 minute break. At some point we'll get started with the trial. Each side will get 15 minutes to refresh the jury then it's on to actual witnesses. I'll be thrilled if they get through one today.

AUSA Kane now giving a brief summary of the govt's case against Nikulin, accused of hacking into LinkedIn, Dropbox and Formspring in 2012 and stealing users' credentials.

Adam Gasner up for the defense. "There has been no evidence that Mr. Nikulin was the person responsible" for the three corporate intrusions.

Today's resumption of the #Nikulin hacking trial got off to a good start: the government got through more witnesses than I expected and we only lost four jurors. My recap @CourthouseNews courthousenews.com/trial-of-accus…

Judge Alsup is back on the bench for Day 2 of testimony in the #Nikulin trial. The jury is not present.
Alsup observes, "So far there's no evidence in the case that this defendant did it."
This isn't the first time he's called the government's case into question.

There is evidence that someone in Russia committed the hack, and Nikulin has been seen hanging out with hackers, but the DOJ hasn't tied it directly to him. "There are plenty of people who know how to hack. Russia, Lithuania, Estonia, it's like hack city over there," Alsup says.

Alsup calls in the jury. Tells them it's likely they will get the case tomorrow.

A Russian interpreter is now on the stand, explaining the ubiquity of the name Yevgeniy in Russia along with it's many English spellings. The defense seems to be trying to show that the hack Nikulin is accused of doing could have been committed by another Yevgeniy.

In a jailhouse phone call with his girlfriend, Nikulin allegedly made jokes about "hacking the prison." The defense believes he meant "break into pieces," as the words are similar in Russian.

FBI cyber crime investigator Jeffrey Miller is up on direct. He is the government's last chance at tying these data breaches to the defendant, and his testimony will probably take most of the day.

Miller says LinkedIn alerted the FBI to a list of passwords posted to the Russian forum Insidepro.

Explosive testimony from Miller- LinkedIn employee Nick Berry was investigated and found not to be responsible for hacking his employer. What a revelation.

The gov't is questioning Miller on Berry's VPN logs, showing it was accessed by someone with a Russian IP address. Not that they haven't already been over this dozens of times. And again I find myself wondering to what end.

Judge Alsup mercifully interrupts: "What are we getting at?"
Miller replies that the logs show that the same attacker who breached LinkedIn's systems is going back in and compromising more user accounts.

Great, but when do we get to the proof of Nikulin's guilt?

Miller testifies that one Russian IP address used to remotely access LinkedIn's system was traced to a Moscow residence that belonged to Nikulin. This has been the best piece of evidence so far.

The government is very slowly coming around to a point. Perhaps it will get there after lunch.

Judge Alsup very kindly turned his #Zoom camera around so we can all see the courtroom setup. He muses, "Ever noticed how orange everything looks on Zoom?"
Turning the camera back to himself, he adds, "On the other hand it looks like I've been worked over by a mortician."

We're getting ready to start back up with Miller's testimony. Last we left off, he was describing how the LinkedIn & Dropbox hacks were traced the Gmail account chinabig01. This account is supposedly Nikulin's though we haven't gotten to that yet.

Google search history shows the owner of the chinabig01 account searched for and visited the Insidepro forum on June 6, 2012, around the time of the hacks. Also reveals a June 7 search for LinkedIn password hashes, and visits to news sites with articles on the LinkedIn hack.

The prosecution just spent 15 minutes reading transcripts of prison phone calls in which Nikulin asks for magazines. There seems to be no other reason to put this before the jury other than to show that he was in prison. Alsup admonishes jury that this is irrelevant.

The jury has been excused for the day. AUSA Michelle Kane says she still has about an hour of questions left for Agent Miller.

Alsup reprimanded AUSA Kane for bringing up Nikulin's request for computer magazines in prison. "Why did you possibly want that in evidence other than to prejudice the defendant?"
Kane says it shows his interest in high tech topics.

Alsup: "If that's evidence of guilt God help us in this country. That's terrible. I think it's going to backfire on you. The jury is going to say what case does the government have if that's what they resort to? You may end up losing this case because of stunts like that."

Alsup tells attorneys to be ready for closing arguments tomorrow. Tells government: "I don't see a lot of evidence this particular defendant did this. Maybe the scales will fall from my eyes when I hear your brilliant summation."

Back on Zoom for the thrilling conclusion of the #Nikulin hacking trial. Special Agent Jeffrey Miller is on the stand, discussing the IP history for a Gmail account belonging to the person behind the LinkedIn, Formspring & Dropbox hacks.

Morning break. The prosecution still hasn't connected the email account to Nikulin. Alsup asks if they have any evidence. Apparently it's coming up.
"That's going to be like a blockbuster," he says. "The room will shake when that finally comes out."

So here's the blockbuster: the email account received an automated message from the Russian social networking site VK, alerting the owner of the profile that a friend commented on his post. This shows that Nikulin is the owner of both the VK profile and the email account.

Miller testifies that another email sent to Nikulin's account addresses the recipient as "China, China." The FBI traced the LinkedIn hack to a Gmail account with the username chinabig01. FBI believes Nikulin controls the two email accounts.

Def. attny. Adam Gasner up on cross, trying to show that Miller focused on building a case around Nikulin rather than known Russian hackers, for example Olexsandr Ieremenko, indicted in New Jersey for hacking the SEC's computer systems or Evgeniy Bogachev, wanted by the FBI.

Gasner's cross is cut short as today's proceedings must end at 2pm. No closing arguments today. Alsup dismisses the jury saying, "I'm still hoping we can get the case to you tomorrow. We took a lot more time today than I expected."

Foiled by a flat tire on day 4 of the #Nikulin hacking trial. Still waiting for one juror. Judge Alsup, hoping to get an early start today, is visibly frustrated by the delay and has left the bench. There's only so much small talk you can make with attorneys.

All jurors now present. Attorney Adam Gasner has picked up his cross examination of FBI agent Miller. Gasner questions him about wanted Russian hacker Evgeniy Bogachev, noting that he shares a first name with Nikulin.

Miller adamantly denies that Bogachev could be responsible for the crimes with which Nikulin is charged. "At no point in my investigation did I find any ties to Mr. Bogachev," Miller says.

Through his questioning of Miller, Gasner is now suggesting that #Nikulin could have been a victim of identity theft, and his email address stolen and used to commit cybercrimes.

Gasner further suggests that Nikulin's social media account on VK, the Russian Facebook equivalent, could have been hacked, and his email credentials stolen.

Gasner questions the credibility of IP address information provided by the Russian government in response to the FBI's Mutual Legal Assistance Treaty request.
"You're not skeptical of information you receive from the Russian government sir?" he asks.

Miller responds that he did not have any reason to doubt the information: "Not in response to an MLAT request, no."

Miller testifies that he was never able to track whether #Nikulin received any money from the LinkedIn, Dropbox, and Formspring data breaches.
Gasner: Did Mr. Nikulin ever receive any financial gain that you were able to track from these breaches?"
Miller: "No."

Gasner just finished cross-examining Agent Miller.

AUSA Michelle Kane says her redirect is after the lunch break and should take 30 minutes, meaning it will take at least an hour.

Since this trial is going to drag on for another day, I propose during the breaks that Judge Alsup do an Ask Me Anything with the folks watching on #Zoom.

Kane trying to verify authenticity of documents provided by Russia to the FBI. She asks Miller if he speaks Russian and, laughing, he replies that he does not, as if the very idea is an absurdity.

Since Miller does not speak or read Russian he must rely on translations, sometimes prepared by different people. Kane suggests that the spelling variations of Yevgeniy resulted from multiple translations.

Testimony just wrapped. Alsup says he will read most of jury instructions today. Closing arguments will be tomorrow. The jury could get the case by noon.

Closing arguments are about to start in the #Nikulin hacking trial. Judge Alsup is ecstatic that all 12 jurors managed to make it to court before 8am, "while the rest of California is laying in bed."

AUSA Katherine Wawrzyniak is up, walking the jury through the three intrusions of LinkedIn, Dropbox, and Formspring. She says: "The data from one intrusion facilitated the next."

Kane finishes her closing with this entreaty: "At the end of the day this case is not about computers. This case is about stealing-- plain, ordinary, run of the mill theft. We need you not to be intimidated by the evidence of this case."

Wawrzyniak was the speaker there, but Kane said the same thing almost word for word in her opening statement.

Now we're on to Gasner's closing. He calls the government's evidence "Unreliable, circumstantial, and at times confusing."
Definitely agree with that last part.

Gasner says the IP address evidence the Russian government provided the FBI implicating #Nikulin is unreliable, suggesting he was framed by his own government.

"Why would the Russian government provide misinformation to the U.S.? Perhaps allowing a real culprit to be caught and tried in the U.S. would lead to a lot of revelations the Russians don't want us to know."

Kane is doing the rebuttal. She immediately attacks the idea that the hacker could be Evgeniy Bogachev, wanted by the FBI for stealing bank account information in the U.S. using GameOver Zeus malware.

Kane: "Defendant is literally pointing to some other guy with the same first name and saying maybe he did it."

Kane also disputes the theory that #Nikulin was framed by the Russian government: "If you think about that for more than one second it completely falls apart."

Closing arguments have ended. Alsup tells jurors it would be wrong to rush to reach a verdict today because one of them has a vacation planned next week.

Officially on #Nikulin verdict watch now. Judge Alsup is allowing the jury to set their own hours, and has even said they can deliberate until midnight if they so choose.

Judge Alsup just issued a notice to counsel saying, "In the event we have to excuse a juror, counsel should be prepared to advise the court on what, if any, admonitions to give the remaining jurors."
Could this be a sign that deliberations may go into next week?

Response from counsel to the question of what the jury should do if a fellow juror is excused to go on vacation.

Judge Alsup back on the bench. Looks like the jury has its first question: If we don't unanimously agree to both the subsection A & B but agree to one of the subsections, does it nullify our overall answer? This is regarding the computer intrusion count.

Alsup's answer is that it doesn't nullify their overall answer.

Alsup: "What do we do if they report after this that they are continuing to try to reach agreement on one of these subparts but they are deadlocked? Do we tell them to come back Monday? To me that's kind of pointless if this is the only thing that's holding them up."

AUSA Michelle Kane says it depends on what their answer is on the subpart:

Alsup says the jury has agreed to keep deliberating until 5:45 PM.

Alsup is back on the bench. Could there be a verdict?

#Breaking: We have a verdict in the #Nikulin hacking case. Stay tuned @CourthouseNews

Alsup wants to ask the jury first if they have reached a unanimous answer on all subparts.

The jury answers that they are unanimous on all counts.

#Breaking: Russian national Yevgeniy Nikulin is found guilty of hacking LinkedIn in March 2012 and stealing user credentials. @CourthouseNews

Also found guilty of committing the hack for financial gain and that the information's value exceeded $5,000.

Nikulin is also found guilty of causing damage to a LinkedIn employee's computer.

Nikulin is also found guilty of aggravated identity theft for using a LinkedIn employee's credentials.

Nikulin is also found guilty of hacking into #Dropbox in May 2012.

But the jury finds him not guilty on the financial gain question.

Nikulin is found guilty of conspiring to traffic in usernames, email addresses, and passwords belonging to Formspring users in May 2012.

Nikulin is also found guilty of actually trafficking the Formspring data.

Nikulin is also found guilty of hacking into the Formspring database in 2012, but not guilty on the question of whether the offense was committed for financial gain.

Nikulin is also found guilty of damaging a computer belonging to a Formspring computer, causing losses in excess of $5,000.

Finally, Nikulin is found guilty of aggravated identity theft related to the Formspring hack for using employee John Sanders' credentials.

Jury has been dismissed. Alsup says: "Our country thanks you for your service in this time of pandemic. If any of you becomes ill in the next two weeks and tests positive for Covid-19, please let me or the clerk know immediately so we can notify anyone else."

Alsup adds: "You are the first jury to sit as a jury in this district since the pandemic. A lot of the country has been following the case in order to learn about how we can continue the criminal justice system in this time."

U.S. Attorney David Anderson has offered this statement on the guilty verdict. #Nikulin

Sentencing is set for September 29 before Judge Alsup. Thank you to all who have followed along with me. If you're interested in more legal news, be sure to give my @CourthouseNews colleague @NicholasIovino a follow as well.