After a trial over whether the defendants could obtain Russian passports, testify in Europe and turn over work files, Google and Litvak’s lawyers traded accusations of lying. In 2022, U.S. District Judge Denise Cote sided with Google, ruling in a 48-page ruling that the defendants “willfully withheld information” and “misrepresented their willingness and ability” to disclose it in order to “avoid liability and further profit” from Glupteba. “The record here is sufficient to establish a deliberate attempt to defraud the court,” Cote wrote.
Cote sanctioned Litvak, and he agreed to pay Google a total of $250,000 through 2027 to settle. The lawyer also ordered Starovikov and Filippov to pay a combined nearly $526,000 to cover Google’s attorney fees. Castañeda says Google has received payments from all three.
Litvak tells WIRED that he still disagrees with the judge's findings and that the tense relationship between Russia and the U.S. may have had a negative impact on who trusted the judge. “It is telling that after I filed a motion for reconsideration, raising serious problems with the court's decision, the court reversed its original decision and [the] “I sent the case to mediation, which resulted in me … not having to admit I had done anything wrong,” he said in an email.
Google's Castañeda says the case had the intended effect: Russian hackers stopped abusing Google services and shut down its marketplace for stolen credentials, while the number of computers infected with Glupteba dropped by 78 percent.
Not every case yields measurable results. Defendants in Google’s other three hacking cases have not responded to the allegations, leading Google to win a default judgment last year against three people in Pakistan accused of infecting more than 672,000 computers by disguising malware as downloads from Google’s Chrome browser. Uncontested victories are also expected in the remaining cases, including one in which foreign app developers allegedly stole money through fake investment apps and are facing charges of violating YouTube’s Community Guidelines.
Royal Hansen, Google's vice president of privacy, safety and security engineering, says lawsuits that don't result in defendants paying up or agreeing to stop the alleged abuse can still make life harder for alleged perpetrators. Google uses the rulings as evidence to convince companies like banks and cloud providers to shut the defendants out. Other hackers might be reluctant to work with them, knowing they've been exposed. Suspects might also be more cautious about crossing international borders and coming under fresh scrutiny from local authorities. “That's a win, too,” Hansen says.
There's more to come
These days, Google's small litigation team meets with other units within the company about twice a week to discuss potential lawsuits. They weigh whether a case could set a useful precedent that would reinforce Google's policies or draw attention to an emerging threat.
Team leader Day says that as Google has refined its process, filing cases has become more affordable. That should lead to more lawsuits each year, including, for the first time, lawsuits that may be filed outside the U.S. or represent specific users who have suffered harm, he says.
The tech giants’ ever-expanding empires leave no shortage of new cases to prosecute. Google’s sister company Waymo recently adopted the affirmative litigation approach, suing two people who allegedly vandalized and wrecked its self-driving taxis. Microsoft, meanwhile, is weighing cases against people who use generative AI technology for malicious or fraudulent purposes, says Steven Masada, assistant general counsel for the company’s Digital Crimes Unit.
The question is whether the increasing frequency of lawsuits has deterred cybercriminals to any extent and whether more Internet companies will comply with legal rules.
Erin Bernstein, who runs the law firm Bradley Bernstein Sands, which helps governments file civil lawsuits, says she recently pitched a handful of companies in various industries to do their own affirmative litigation. While no one has taken her up on her offer, she’s optimistic. “It’s going to be a growing area,” Bernstein says.
But Google’s DeLaine Prado hopes that the positive lawsuits will eventually slow down. “In a perfect world, this work would disappear over time if it were successful,” she says. “I actually want to make sure that our success makes us almost obsolete, at least for this kind of work.”
