Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 1 of 25

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLU IBIA
UNDER SEAL

UNITED STATES OF A IERICA

CRIMINAL NO

V.

15

067(RDM)

IIR ISLA I

Defendant.

GOVERNMENT'S MEMORANDUM IN AID OF SENTENCING

Defendant Mir Islam entered a guilty plea on July 6, 2015, to three counts alleged in the

Information filed in this case, charging Islam in count One with Conspiracy, in violation of l8
U.S.C. $ 371; in Count two with False Bomb Threats, in violation of l8 U.S.C. $ 844(e); and in
Count Three with Cyber-stalking, in violation of 18 U.S.C . S 2261A(2). The conspiracy to which

Islam pled guilty had seven (7) distinct criminal objectives, as alleged in Count One of the

Information. These objectives were (l) fraudulent

use

of personal identification information in

aid of the commission of another federal offense, in violation of Title l8 U,S.C. $ 1028(aX7); (2)
Access Device Fraud, in violation

violation

of l8 U.S.C. $ 1029(a)(3); (3) Social Security Number Fraud, in

of 18 U.S.C. $ a08(a)(7XB); (4) Computer Fraud, in violation of 18 U.S.C. $

1030(a)(2)(A); (5) Wire Fraud, in violation of l8 U.S.C. $ 1343; (6) Assault and Intimidation of a
Federal Official, in violation

of l8 U.S.C.$ lll(a)

and (b); and (7) Interstate Transmission

of

Threats, in violation of l8 U.S.C. $ 875(c). At the time of his guilty plea in this case, Islam had a
separate, pending federal case in the Southern

District of New York ("SDNY") in which Islam had

entered a guilty plea but had yet to be sentenced. Upon entering his plea in this case, Islam was

returned to the SDNY for sentencing and was not sentenced until March 7, 2016. Thereafter,

Islam was promptly returned to this District for sentencing which is now scheduled for July I 1,

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 2 of 25

20r6.
In accordance with his plea and accompanying Statement of Offense, Islam acknowledges
a general pattern of criminal conduct from February 2013 through September 2013 in which he,
and others conspiring with him, used the Intemet intentionally to harass, intimidate, assault, harm,

or inflict substantial emotional distress upon dozens of celebrities and state and federal public
officials, and a student at a university, none of whom Islam knew personally. Islam and his
coconspirators embarked on this digital crime spree to entertain themselves; to exact revenge for

official conduct they found objectionable; to express animus; for their own notoriety; and, in the
case

of the university student, to inflict emotional distress

from Islam who had developed an online obsession with

because the student spurned contact

her. Some of the victims, to this day,

continue to suffer from the aftereffects of Islam's and his coconspirators' criminal conduct.
Respecting the conspiracy alleged

in Count One, Islam acknowledges that he and his

coconspirators agreed to commit, and did commit, two fundamentaltypes of abuses that resulted in

the commission of at least seven different types federal criminal offenses. The first of these
abuses, in the jargon of Islam and his coconspirators, is known as "doxing."

"Doxing" is the act

of gathering, by licit and illicit means, and posting on the Internet personal identiffing information

("PII") and other sensitive information about an individual, including, for example, addresses,
dates

of birth, social security numbers, telephone numbers, email addresses, credit information,

employers, and details regarding the individual's children and other family members. Islam and

his coconspirators posted the PII of at least fifty (50) celebrities and state and federal officials on

different websites that all shared the domain name "Exposed." Islam, and his coconspirators,
stole much of the PII of those doxed, including credit reports, and posted that personal information

-2-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 3 of 25

on public "Exposed" websites for all the world to view. The natural, inevitable, and intended
consequence of this publication of names, social security numbers, dates of birth, addresses, credit

reports, and the like, was the use of that information by countless others to illicitly obtain credit
cards and other finance-related accounts using the identities of the doxing victims, thereby causing

many of the victims to suffer continuing credit issues. The publication of the victims' PII also
revealed to any other would-be harassers or assailants how and where to contact the victims.
The second abuse, in the jargon of Islam and his coconspirators, is known as "swatting."

"Swatting" is the act of placing emergency

9- I - I type calls to

Internet-based telecommunication relay services,

police departments, usually through

to make false claims of homicides or other

assaultive or criminal conduct by, or against, other targeted individuals at the locations of those

individuals.

These false

9-l-l

communications are intended to result in, and usually do result in,

a tactical police response, including SWAT teams, to the targeted, unsuspecting individuals'
residences. Swatting is, in fact, a crime of violence. It is an assault with a deadly weapon in
which the police are used as proxies to commit the assault. By definition, the crime entails an
armed police response. When the responding officers are threatened
communication with physical harm or death

in the fake 9-1-l

if they respond, the officers invariably arrive at the

premises in force, with guns drawn and trained on the premises and its occupants. The prospect

for injuries or fatalities in the police response is manifest.

The offenses alleged in Counts Two and Three of the Information are wholly unrelated to

the conspiracy alleged in Count One. Respecting the false explosives report alleged in Count
Two, Islam acknowledges that, on March 22,2013, he falsely reported a false shooter-on-campus
and bomb threat on the campus of the University of Arizona, in Tucson

-3

, Arizona, through

a 9- I - I

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 4 of 25

call communicated via an Intemet-based telecommunication relay service, similar to the swats.
Respecting the cyber-stalking alleged in Count Three, Islam acknowledges that from March 22,

2013, through July 2013 he engaged in a sustained online campaign of harassment against a
student at the University of Arizona in Tucson, of which the false shooting/bomb threat alleged in

Count two was a part. Islam's harassment of the student included the bomb threat; incessant
texting to the student and some of her friends; impersonating federal and state law enforcement to
obtain information about her; hacking or otherwise obtaining unauthorized access to email and
social media accounts of the student, downloading information from those accounts, and changing

the passwords so the student could not access her accounts; and creating false social media
accounts of his own with false information and pictures to try to friend the student under false

pretenses. The harassment inflicted such serious emotional distress upon the student that

she

sought counseling, considered withdrawing from the university and moving away, and feared for
her personal safety.

The offenses in this case were egregious. The sentence imposed upon Islam should reflect

that. The parties

agree with the Probation office's determination that Islam's total adjusted

offense level is 22 and his criminal history category is

I.

Accordingly, Islam's corresponding

sentencing range is 4l-51 months. Considering the severity of the offenses committed by Islam;
unique circumstances of his sentencing that significantly and fortuitously inure to Islam's benefit,
discussed in greater detail below; and cooperation matters addressed in the accompanying sealed
addendum, the govemment respectfully submits that this Court should sentence defendant Islam to
a term

of imprisonment of 46 months.

-4

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 5 of 25

Factual Background
A detailed description of Mir Islam's crimes is set forth in the Statement of Offense filed in
this case and will not be repeated here in full; rather, particular aspects of that criminal conduct

will

be highlighted or elaborated upon here.

A.

Count One: Conspiracy

The "exposed" conspiracy included at least five coconspirators, including Mir Islam who
resided in New York

City.

Two of the coconspirators resided in Southem California, one resided

in Fredericksburg, Virginia, and one resided in the country of Finland. Mir Islam was the only
member of the conspiracy who had attained the age of majority; all the other coconspirators were

juveniles during the conspiratorial period.

Mir lslam and his coconspirators

selected their

victims, that is, those whom they intended to "dox" and/or "swat," on the basis of ideological,
political, or personal animus against those individuals, or because they thought doxing or swatting
a certain individual would draw public and media attention, not to themselves personally, but to

their conduct including to their "exposed" websites where the PII of the doxed individuals was
posted.

I.

The Exposed Websites

On or before March 11,2013, a website with the URL "exposed.su" became accessible to

the public on the Internet. Exposed.su was the first website used by Mir Islam and his
coconspirators

to commit the abuse of doxing. The home page of the website

consisted

principally of the names of numerous high-level present and former government officials as well
as various celebrities. Approximately 37 individuals were ultimately named on Exposed,su.

Next to the names of some of the goverrunent officials, in parentheses, were the respective

-5-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 6 of 25

govemment positions of those individuals.

Each of the names listed on the exposed.su website was a link to other content pages on the

website that were accessible to anyone visiting the

site. The

contained PII for each of the individuals listed on the

site. The PII usually included, variously,

content pages on the website

social security numbers; dates of birth; phone numbers; present and previous physical addresses;
and photographs. For most of those individuals listed on the website, the PII also included

financial credit reports. So, for example, if persons visiting the website exposed.su clicked on
one of the names/links, they would have been transferred to a webpage normally containing the
social security number, date of birth, phone number, address, photograph, and previous addresses

forthatnamedindividual.Theywouldalsousuallyhavebeeninstructedto..@toview
[individual's] Credit Report." Clicking on that link would have transferred the viewer to

different content page on the site that contained a financial credit report for that individual. The
exposed.su website was hosted on one or more servers located in The Netherlands. Public access

to the website was through a "proxy" server, however, which masked the actual location of the
webserver. On or near March 19,2013, the exposed.su went offiine.
On or about April 2, 2013, another "exposed" website was launched by the conspirators,

including Mir Islam, with the URL "exposed.re." The site was eventually, in practical terms,
identical to the exposed.su site, with at least three exceptions. The first was that the site contained
at least 50 names and associated

PII.

Second, immediately adjacent to some of the names on the

site, inside brackets, was the term "Swatted." These individuals, along with others named on the
exposed.re website without the "Swatted" reference, and still others not named on the website,

were in fact "swatted" by members of the conspiracy. Finally, the conspirators attempted to

-6-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 7 of 25

monetize the exposed.re website by creating a "Linkbucks" account. Linkbucks is a social

advertising and marketing network that allows subscribers to eam money, in various ways, from
visitors to a website. The attempt to monetize the website created another incentive for Islam and
his coconspirators to commit swats because swats drove traffic to the website, particularly when
the conspirators

notifiedTMZ that

a swat was going to be committed by those who had created the

exposed websites. Like the site exposed.su, exposed.re was proxied to hide the location of its
webserver which was Malaysia. On April 22,2013, Malaysian authorities took the exposed.re
website offline at the request of U.S. law enforcement.

On or about July 22, 2013, a third "exposed" website was launched by some of the
conspirators, including Mir Islam, this time with the URL "exposed.ws." The site was similar in

design and content to the exposed.su site, and was again proxied to hide the locations of its
webservers which were Latvia, the United Kingdom, and/or Ukraine. The site was taken offline
sometime before August 12,2013.

II.

Acquisition of PII Posted on Exposed Websites

The PII posted on the exposed websites by the conspirators was obtained predominantly in
the following manner. In about February and March 2013, members of the conspiracy collected
personal information about their targets from open source websites. To obtain the social security
numbers, dates of birth, and addresses of their targets, the conspirators usually resorted to the
websites SSNDOB.ru and SSNDOB.ms (collectively "SSNDOB"). SSNDOB was a website that

collected from computer intrusions and other means PII, including social security numbers, dates

of birth, last known addresses, and associated identities, belonging to individuals located around
the world, including within the United States. SSNDOB sold this PII

-7

online. The conspirators,

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 8 of 25

including Mir Islam, in some cases used the online money transfer service known as WebMoney
Transfer to pay for the SSNDOB PII, but in most instances they were able to obtain the SSNDOB

PII without paying a fee due to Mir Islam's and another conspirator's association with SSNDOB's
owner/operator.
Once the conspirators obtained the social security numbers, dates of birth, addresses, and
any other personal information they could learn about their intended victims, the conspirators used

that PII and the Intemet to steal the victims' consumer credit reports from the servers of credit
reporting agencies. In most instances, members of the conspiracy obtained credit reports through
credit report websites like annualcreditreport.com, which charged no fees. To obtain a victim's

credit report from annualcreditreport.com, a conspirator created a fake user account on the
website, entering into the site the name, social security number, date of birth, and address of the

intended

victim. The conspirator

was then permitted to select from various credit reporting

agencies to obtain the desired credit

report. Once the conspirator selected a particular credit

reporting agency, such as Equifax, Experian, or TransUnion, the conspirator was transferred to
that credit reporting agency's server whereupon the conspirator was prompted to reenter the name,
social security number, date of birth, and address of the individual whose credit report was sought

and whom the conspirator was fraudulently representing to

be.

The conspirator then had to

answer a series of multiple choice security questions. If the conspirator answered the questions

correctly, either as a result of information the conspirator leamed about the target or by guesswork,

the conspirator was granted access to and downloaded the victim's credit report from
respective credit reporting agency's server.

If

the

the conspirator failed to answer the questions

correctly, he was eventually prevented from further attempts through the chosen credit reporting

-8-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 9 of 25

agency and the conspirator simply went back to the annualcreditreport.com website and selected

another credit reporting agency

to try the

process

again. On some

occasions when the

conspirators were unable to obtain a free credit report of an intended doxing victim, they, and Mir
Islam in particular, were able to obtain the report from a website that charges a fee for the reports,
where the security questions are often easier to

answer. As with other fees incurred in furtherance

of the conspiracy, to pay the fee for these credit reports, the conspirators used stolen credit card
account information.

In this manner, the conspirators, including Mir

Islam, were able

fraudulently to obtain from various credit reporting agencies, including Equifax, TransUnion, and
Experian, the consumer credit reports of most of the individuals doxed on the exposed websites,
and to post those credit reports on the exposed sites.

III.

The Swattings

Mir Islam and his coconspirators swatted in

excess

of 20 individuals. As stated above,

Islam and his coconspirators selected persons to be swatted on the basis of various criteria,
including ideological, political, or personal animus; amusement and whim; a desire for media
attention; and revenge. Nearly every intended victim of the swats whom investigating FBI
Agents were able to interview described to the agents some kind of trauma and/or dramatic police
response resulting from the swat

call. A former United

States Congressman from Michigan,

identified herein as "M.R.," swatted because of federal legislation he sponsored, described how
police responding to the call commandeered the home of an adjacent neighbor and set up a sniper
position inside the neighbor's home. Brian Krebs, a blogger swatted in part because of an article
he wrote, described in a later article how he was ordered to put his hands in the air and then
handcuffed and observed about a half-dozen squad cars, lights flashing and officers pointing

9-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 10 of 25

firearms

in his direction, including a

shotgun and

a semi-automatic rifle. A former State

Representative and now United States Congressman, identified herein as "T.L.," swatted because

of anti-swatting state legislation he sought to pass, described how he received a call from police
asking him whether he, T.L., had shot his own wife, causing him worry that she had in fact been
shot, and then later learned that his wife had been home during the police response, was ordered
out of the house with her arms raised, and was shaken up.

The Police responses to the swats were dramatic and potentially catastrophic partially
because at least seven (7)
language in the

kill

of the swats committed by Islam and his coconspirators included

9-1-l communication that the person to be swatted had killed

responding

someone and would

officers. So, for example, on March 31, 2013, members of the conspiracy

committed a swat against an Assistant United States Attorney in retaliation for a particular
prosecution he participated

in.

The swat language included the following:

Hello my wife is dead. I shot her and now she's dead. I don't know what to do.

I'm having thoughts of hurting people and I don't know what to do. If

anyone

comes in my house I might shoot them.

am

just letting you know now if I

see any police outside

of my house I will start

shooting.

I will not be taken alive. Mark my words. I am not going to prison for the rest of
my life. I will not. Don't worry about where I am at in the house. If any cops are
outside in my yard or on the street I will start shooting.
By the way I have my police scanner right next to me and I can hear everything and
you guys think I'm joking. I will shoot anyone who comes near my property.

I see cars outside my house I

swear
fucking around. I will shoot them.

I will shoot. I

am not playing.

You know I work with the police a lot but I am not afraid to shoot them.

-10-

I am not

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 11 of 25

On April 4, 2013, members of the conspiracy committed a swat against an individual

identified herein by the initials "'W.L." at W.L.'s residence in Virginia. In communicating the
false

9-l-l

report, the conspirator stated that he had shot his wife and that if the police responded

he would not be taken alive and that he would shoot the

police. On April 27,2013, members of

the conspiracy swatted an individual identified herein by the initials "'W.B." at W.B.'s residence in

Maryland, and the conspirator making the false

9-l-l

communication stated that he had shot his

wife, that he had a gun, that he would execute anyone who responded, and that he would not be
taken

alive.

There were other similar swat calls.

IV.

Mir Islam's Participation in the Conspiracy

Mir Islam participated in nearly all facets of the conspiracy, including the

fraudulent

procurement of credit reports for posting on the exposed websites, the creation of the exposed

websites, and the swatting. Islam participated with other conspirators in conceptualizing the
exposed websites, choosing doxing and swatting victims, and more generally, executing the broad

contours of the conspiracy. He assisted, to a small degree, in the creation of the appearance of the
exposed websites. Islam's contribution to the creation of the exposed websites was relatively

small because he was less adept at coding than some of his coconspirators. Islam chose specific
individuals to be doxed and swatted, and discussed with his coconspirators swats they intended to

commit, including the swat of the Assistant United States Attorney. He purchased the PII of
several victims from the website SSNDOB, and he pulled credit reports from pay-for-report sites

for a number of victims. Islam participated in the swat of Brian Krebs. He swatted at least two
celebrities, using language in the 9-1-l communication that threatened responding officers. On

April 23, 2015, he communicated a false bomb threat at the White House, claiming there

-11-

were

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 12 of 25

eight (8) bombs planted around the perimeter of the White House. Islam also contacted the
celebrity media entity TMZto alert the entity to the conspirators' doxing and swatting activities to
promote media reporting about the activities. TMZ did in fact report on some of the doxing and
swatting activity committed by the conspirators.

B.

Count Two: Conveying False Information Conceming Use of Explosive

On March 22,2013, Mir Islam falsely reported a shooting and explosives incident on the
campus

of the University of Arizona in Tucson. Islam's communication, sent again over an

Internet relay system, stated, "[my] friend has a gun and a rifle and is shooting people on campus."

Islam terminated his relay connection, then reestablished it to continue his false report. Islam
stated to the relay operator, "OMG OMG where are the Police . . . he is shooting up the area . . . he

is going to blow up the buildings . . . he has explosives."

In response to Mir Islam's false report of a shooter and explosives on the university
campus, the local police, university police, and the FBI responded to the campus to investigate.
The response by the local Police Department included numerous officers, SWAT Teams, and the

Police Department Bomb Squad. The university's administration building was evacuated and
searched, and the campus was placed

in lockdown, with flash text messaging sent to the student

population advising of a potential active shooter situation.

Later that same evening Islam made another false emergency call, this time claiming that a
man located on the same university campus was holding a rifle to the head of a woman and was

going to kill her if he did not receive $50,000 in ransom. Islam further stated that the male had
placed explosives in eight campus buildings and was going to blow them up and start

shooting. In

light of the previous false report, authorities investigating that report assumed this second threat

-12-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 13 of 25

was part of the same course of conduct and also false.

Mir Islam

made the false shooting and explosives report because Islam was obsessed with

a woman, identified herein by the

initials "A.R.T.," who was then a student at the university and

whom Islam believed had spumed his continued attempts to contact

cheerleader at the

university. Another

her. A.R.T. was a

cheerleader at the University with whom A.R.T. conducted

"T.E.M." T.E.M.

cheerleading was an individual with the initials

was identified by A.R.T. as "TJ

Mitch" on A.R.T.'s Facebook page to which Islam had access. In Islam's false report, "TJ Mitch"
was the name provided by Islam of the shooter and the individual intending to set off explosives.

C.

Count Three: Cyberstalking

Beginning in about March 2013 and continuing through at least July 2013, Mir Islam
engaged in a campaign of harassment against A.R.T., the student at the University of Arizona.

Though Islam had never met A.R.T., he developed a romantic obsession with her through the

Intemet. Islam harassed A.R.T. to attempt to coax and coerce A.R.T. to communicate with him;
to obtain information about A.R.T.; in retaliation for A.R.T.'s refusal to communicate with him;
and to intimidate and cause substantial emotional distress to A.R.T.

Mir Islam learned about A.R.T. and acquired information about her from Internet

searches.

He knew that A.R.T. was a student and cheerleader at the university. Islam communicated the
false shooting and bomb threat at the university on March 22,2073, because he expected A.R.T.

would be affected, disturbed, and upset by the threats. Indeed, Islam identified the campus
shooter and bomber in his call as a person who was a friend of A.R.T.'s and in the call feigned
being a female, suggesting that A.R.T. was the caller reporting her friend's terrorism on campus.

Shortly before making the false shooting/bomb threats, Islam called a university facility dedicated

l3-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 14 of 25

to honoring the university's athletes and athletics programs, and spoke to a receptionist. Islam
identified himself as a Police Officer named "Thomas Ryan," and requested a cell phone number

for A.R.T., whom he identified as a cheerleader at the university. The receptionist refused to
provide Islam the number.

Mir Islam did eventually obtain the cell phone number for A.R.T.,
students and cheerleaders at the university, one

as

well

as for three other

of whom, identified herein by the initials

"M.A.G.," was a friend of A.R.T. Over the course of several months, beginning in about April
2013,lslam repeatedly called or sent text messages to A.R.T., M.A,G., and the other two students,
some of which were threatening. Islam also sent harassing emails to A.R.T. at A.R.T.'s Cox
communications email account.
Towards the end of April, Mir Islam began frequently calling and sending text messages to
the cellphone of

M.A.G.

Some nights, Islam sent as many as 30 text messages to

M.A.G.

In one

such call, on about May I ,2013,lslam stated to M.A.G. that he was an FBI Agent dealing with a
case about

a friend of hers whom Islam identified by a nickname as A.R.T. Islam stated

needed some information for the

he

investigation. When M.A.G. hung up, she received numerous

text messages from Islam containing her social security number. In still other text messages to

M.A.G., Islam identified himself

as

"Batman" or "TJ," and stated that he had personal information

about M.A.G. that Islam would release unless M.A.G. provided Islam information about A.R.T.

Islam sent similar text messages to two other student cheerleaders, seeking information about
A.R.T.
Sometime on or before July 17,2013, through social engineering techniques, Mir Islam

acquired unauthorized access to A.R.T's Cox Communications email account. Upon gaining

-14-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 15 of 25

unauthorized access to the account, Islam changed the password to A.R.T.'s account, thereby
denying her access to her account. On or about July

l7,2ll3,lslam socially engineered into, and

obtained unauthorized access to, A.R.T.'s Facebook and Instagram accounts, changing the
passwords to those accounts

too.

Islam downloaded personal photographs of A.R.T. from her

Facebook and Instagram accounts and stored them on a cloud server. Within the same time
frame, Islam created a Facebook page of his own in which he assumed the false identity of "Adrian

Cosgrove," including photographs of someone other than Islam, and pretended to be a student
attending A.R.T.'s university. Islam used this Facebook account and identity to send a "friend"
request to A.R.T.'s Facebook

account. Islam also created fake Twitter accounts in the nickname

of A.R.T.

Mir Islam's continued harassment of A.R.T. profoundly affected A.R.T. It caused A.R.T.
a great deal of emotional distress, anxiety, and fear for her safety, and caused A.R.T. to alter her

behavior and seek counseling. A.R.T. feared the source of her harassment may have been
physically stalking her, and she feared she was subject to attack and physical injury, including in
her own place of residence. She sought escort from campus security after studying late for fear

of

personal attack. A.R.T. considered withdrawing from the university, abandoning cheerleading,

and moving away from the area in which her university was located. The incidents affected

A.R.T.'s ability to concentrate in school, disrupted her sleep, and made her paranoid that she was
being watched by someone at any given time or location. Members of A.R.T's family at times
had to stay with her to comfort her.

-15-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 16 of 25

Arqument

A.

Lesal Standards

In United States v. Booker,l25 S. Ct. 738 (2005), the Supreme Court ruled that the United
States Sentencing Guidelines are no longer

mandatory. However, "[a]s

a matter

of administration

and to secure nationwide consistency, the Sentencing Guidelines should be the starting point and

the initial benchmark" for determining the defendant's sentence. Gall v. United States, 128 S.Ct.

586,596 (2007). While, to be sure, "[i]n accord with

l8 U.S.C. $ 3553(a), the Guidelines,

formerly mandatory, now serve as one factor among several courts must consider in determining
an appropriate sentence," Kimbrough v. United States,l28 S.Ct. 558, 564 (2007), it remains the
case that

"the Commission fills an important institutional role: It has the capacity courts lack to

'base its determinations on empirical data and national experience, guided by a professional staff

with appropriate expertise,"' id. at574 (quoting United States v. Pruitt, 502 F.3d I154, I l7l (lOth
Cir.2007) (McConnell, J., concurring)). The Supreme Court "accordingly recognized that, in the
ordinary case, the Commission's recommendation of a sentencing range

will 'reflect a rough

approximation of sentences that might achieve $ 3553(a)'s objectives."' Kimbrough,l2S S.Ct. at

562-63 (quoting Rita v. United States, 127 S. Ct. 2456,2465 (2007)). As one member of this
Court has held, "Booker requires judges to engage in a two-step analysis to determine a reasonable

sentence." United States v. Doe,413 F. Supp.2d 87,90 (D. D.C. 2006) (Bates, J.)
[A] district court shall first calculate (after making the appropriate findings of fact)
the range prescribed by the guidelines. Then, the court shall consider that range as
well as other relevant factors set forth in the guidelines and those factors set forth in
[ 8 U.S.C.] $ 3553(a) before imposing sentence.
United States v. Hughes, 401 F.3d 540, 546 (4th Cir. 2005).
When weighing the $ 3553(a) factors as part of its calculus of an appropriate sentence, the
-16

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 17 of 25

Court should consider not only the nature and circumstances of the offense and the history and
characteristics of the defendant, but also the applicable sentencing objectives-that is, that the
sentence:

(l)

reflect the seriousness of the offense; (2) promote respect for the law; (3) provide just

punishment; (4) afford adequate deterrence; (5) protect the public; and (6) effectively provide the
defendant with needed educational or vocational training and medical care. See 18 U.S.C.

3553(aXl) and

(2). In addition, the sentence should

reflect "the need to avoid unwarranted

sentence disparities among defendants with similar records who have been found guilty of similar

conduct." l8 U.S.C. $ 3553(a)(6).

B.

An Analysis of the Factors Enunciated in l8 U.S.C. $ 3553(a) Demonstrates

That a Sentence of 46 months for Islam Is Appropriate

The Nature and Circumstances of the Offense

The offenses for which Islam is to be sentenced are indisputably serious. Count One, the
conspiracy charge, effectively consists of seven (7) separate but related offenses. All seven of the

objects of the conspiracy were achieved, many times over, and could have been charged

as

multiple substantive offenses. To illustrate:

Object (1): l8 U.S.C. $ 1028(a)(7)
Islam and his coconspirators doxed at least 50 individuals. There were, therefore, close to
50 instances of Islam and his coconspirators possessing and using means of identification
of the doxing victims in furtherance of wire and computer fraud to obtain, without
authorization, credit reports of the victims from the credit reporting agency servers. It is
close to but not actually 50 because the conspirators stole and published on the exposed
websites credit reports for nearly all, but not all, doxing victims.
Object (2): 18 U.S.C. $ 1029(a)(3)
Similarly the coconspirators actually possessed at least 50 different social security
numbers with intent to use those SSNs to defraud the credit reporting agencies of the credit
reports.

-t7-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 18 of 25

object Q): a2 U.S.C. $ a08(a)(7)(B)

The conspirators falsely represented a SSN to be their own each time they used it to create
an account with a credit reporting agency in the name of a victim to obtain a credit report.
This offense is admittedly closely related to Object (2). Nevertheless, it was committed at
least 50 times by the conspirators.

Object (4): 18 U.S.C. g 1030(aX2)(A)

The conspirators intentionally accessed the computers of the credit reporting agencies well
over 50 times when they fraudulently obtained the doxing victims' credit reports for
publication on the exposed websites.

Object (5): l8 U.S.C. $ 1343

To obtain property, that is, credit reports, by means of materially false representations and
to execute a scheme to defraud credit reporting agencies of credit reports, the conspirators
transmitted wire communications in excess of 50 times.

Object (6): 18 U.S.C. g I I I (a), (b)

The conspirators used the police to commit assaults with firearms upon two federal
officials on account of those officials' performance of their official duties.

Object (7): 18 U.S.C. g 875(c)

Of the more than twenty (20) swats committed by the conspirators, at least seven (7) of the
swats included language in the 9-l-l interstate communications threatening to kill police
officers who responded to the calls. Only three of these section 875(c) violations are
incorporated into the plea agreement and included in the Guidelines calculations.

Most, though not all, of these numerous offenses, if actually incorporated into the plea agreement
and Sentencing Guidelines calculations, would have been grouped under USSG $ 3D1.2 and so

would not have changed Islam's total offense

was more

level. But the criminal

prolific and persistent than the plea agreement

conduct of the conspirators

suggests.

Another aggravating circumstance of Islam's criminal conduct is its breadth, continuity,

and timing of commission. As the Presentence Investigation Report makes clear, beginning in
2010 and continuing through June 2013, a period that overlaps with the Exposed conspiracy, the
false bomb threat at the University of Arizona, and the cyber-stalking of the university student,

Islam was engaged in separate carding activities and offering doxing services, distinct from his

-18-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 19 of 25

Exposed doxing, on an Undercover carding forum set up by the FBI, as well as other carding

forums. "Carding" consists of criminal activities associated with stealing PII and financial
information belonging to others, including account information related to credit cards, bank cards,
debit cards, and other access devices, and selling that information or using it to obtain money,
goods, or services without the victims' authorization. Islam was also involved with a computer
hacking group known as UG

Nazi.

Islam was arrested by the FBI in June 2013 and charged in the

SDNY by Information with five (5) counts related to Islam's carding and computer hacking
activities.

During his debriefings with the FBI

in New York pursuant to a cooperation

plea

agreement, Islam failed to disclose his criminal activities in the Exposed conspiracy, the false

bomb threat, and the cyber-stalking. He was released in June 2013 as part of a cooperation,
whereupon Islam continued his Exposed activities and cyber-stalking, and Islam disclosed to his
Exposed coconspirators his cooperation with the FBI and the name of the FBI Agent who was

responsible

for supervising his cooperation. The disclosure of the FBI Agent's identity

compelled the Agent to take security precautions for his own safety. Islam was rearrested in
September 2013 on the basis of his criminal activities in this case as

well

as the

violation of the

terms of his release in the SDNY case.

2.

The History and Characteristics of the Offender

From the government's limited perspective, Islam is an extremely intelligent, shrewd,

conniving, and manipulative individual. He

is daring and criminally ambitious.

We

acknowledge that Islam has a psychological disorder that may have contributed to some of these
other attributes, including his intelligence, manipulative nature, and ambition. But nothing in his

-l 9-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 20 of 25

disorder, to our knowledge, predisposes Islam to

crime. Islam

has the capacity to appreciate

right

from wrong, and to direct his energy towards productive and lauful endeavors. He chose not to.
Based on

all the circumstances of the offense and Islam's inveterate criminal activity, he

is

deserving of a significant punishment.

3.

The Need to Reflect the Seriousness of the Offense, to Promote Respect for
the Law, to Provide Just Punishment, to Afford Adequate Deterrence, and
to Protect the Public

The need to reflect the seriousness of the offense, to promote respect for the law, to provide

just punishment, to afford adequate deterrence, and to protect the public all strongly support
sentence

for Islam at the high end of the Guidelines range of Islam's total offense level. First,

Islam has received a substantial sentencing calculation benefit from having two entirely separate

criminal schemes combined in the Information and the sentencing. As previously noted, the
Exposed conspiracy, charged in Count One, is unrelated to the false bomb threat and cyberstalking

charged

in Counts Two and Three. The false bomb threat and cyberstalking offenses were

committee by Islam, in New York City, against a university and student in Arizona. Those
offenses were originally being investigated

by the FBI in Phoenix. In the course of

the

investigation of the Exposed conspiracy by the FBI's Washington Field Office ("WFO"), the FBI
WFO also developed evidence identifying Islam as the perpetrator of the offenses in Phoenix. To
expedite resolution of all the charges, it was agreed that Islam would be charged in this District for

all the offenses in one plea agreement and charging instrument. While this was just, it was also

unusual. Normally, separate offenses are charged and sentenced separately. Had Islam been
charged and sentenced in this District solely on the Exposed conspiracy, and then transferred to the

District of Arizona for sentencing on the false bomb threat and cyberstalking, Islam would have

-20-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 21 of 25

been eligible to receive, and almost certainly would have received, a considerably greater total
sentence than he is subject

to now. Islam's total offense level under Count One, including

acceptance of responsibility, would have been 18, rather than22, with a corresponding Guidelines

incarceration range of 27-33 months. At a subsequent sentencing in Phoenix, Islam, who would
have certainly been sentenced to a considerable period of incarceration in the Exposed case, would
have been a criminal history category

II.

See USSG $ 4A1.1(a),

(b).

Islam's total offense level

for the District of Phoenix offenses, including acceptance of responsibility, would have been

19,

with a corresponding Guidelines incarceration range of 33-41 months. Therefore, instead of

facing a maximum of 51 months' incarceration, Islam would have been facing a maximum of 74
months had a sentencing Judge in Phoenix chosen to impose a fully consecutive sentence, which

would have been appropriate given the seriousness of the Phoenix offenses and their lack of any
relation to the Exposed conspiracy.
Second, in Islam's case in the SDNY, which was completely unrelated to both the Exposed

conspiracy and the false bomb threats and cyber-stalking offenses, Islam received what can only
be described as an extraordinarily light and charitable sentence, even considering his cooperation

with law enforcement in that case - cooperation, it should be recalled, that was marred by
continuing criminal activity in the Exposed conspiracy and Islam's divulgence of his cooperation

to his coconspirators. The Probation Office calculated Islam's total offense level in that case to

be 33, with a corresponding Guidelines incarceration range

of

135-168 months. From 135

months, the sentencing Judge departed to one day's incarceration. Such a dramatic departure was

never contemplated by the government when negotiating the plea agreement in this case, as is
reflected in the written plea agreement where Islam's criminal history category is estimated for

-21-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 22 of 25

sentencing in this case to be

II.

Had the Court in the SDNY imposed a sentence ofjust 60 days,

Islam's Guidelines incarceration range in this case, with a criminal history category II, would be

46-57. See USSG $ 4Al.l(b). Furthermore, if Islam were to be sentenced in this case with

criminal history of category II, and then subsequently sentenced in the District of Phoenix for his
separate offenses there, he would in the Phoenix case have a criminal history category of

III, not II,

with a corresponding Guidelines incarceration range of 37-46 months, rather than 33-41 months.
Finally, as a result of receiving a sentence of only one day's incarceration in the SDNY case, all of
Islam's incarceration period since his arrest and re-arrest in New York on the SDNY charges are

now to be credited toward any sentence imposed by this Court. By any reasonable metric,
therefore, a sentence in this case at even the high end of the Guidelines would not reflect the
seriousness of the

full scope of Islam's criminal conduct in this case.

There is yet another reason the Guidelines calculations in this case understate the severity

of Islam's crimes and why, therefore, a sentence at the upper end of the Guidelines is appropriate.
There were, as we previously noted, more than twenty (20) swats committed by Islam and his
coconspirators during the Exposed conspiracy. Only four (a) of those swats are reflected in the

Guidelines calculations, as violations of

l8 U.S.C. $$ 111(a), (b) and 875(c). This is because,

unless the swat victim was a federal official swatted because of that official's performance

of

official duties, or the swat involved an interstate transmission of a threat to harm responding police
officers, there is no Federal statute adequately addressing the remaining swats in this case and its

underlying

facts. The trauma suffered by innocent swat victims not

accounted

for in

the

Guidelines calculations should appropriately be considered by this Court in imposing a sentence

that both reflects the seriousness of the offenses and is a just punishment.

., "''

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 23 of 25

Islam was arrested in the SDNY in June 2013 for carding, doxing and computer hacking
activities and agreed to enter a guilty plea to an Information and cooperate with the FBI in the

SDNY. Instead of ceasing his criminal activity and cooperating in good faith, Islam lied to the
FBI in the SDNY, disclosed his SDNY agreement to cooperate to his coconspirators in this case,
implying that he was toying with his FBI handlers, and continued his criminal activity in the
Exposed conspiracy and his

cyber-stalking. Islam manipulated the FBI in SDNY

as he continued

to attempt to manipulate students at the University of Arizona in the pursuit of his obsession. His

swatting crimes were serious offenses which risked serious injury or death to many swat targets
and responding police officers, and his doxing offenses exposed some

fifty (50) individuals to

identity theft, credit and financial complications, and personal assault (including swats) through
disclosure of residential addresses. There is little to suggest that anything but incarceration will

deter Islam from future criminal activity. Based on Islam's duplicity in his SDNY case, any
expression of remorse or contrition by Islam should be viewed with a great deal of skepticism.

Swatting and doxing are both increasingly common offenses, yet prosecutions of these
offenses are infrequent. Would be offenders, as much as Islam himself, need to be put on notice
that these serious offenses

will

be treated with the severity they deserve, commensurate with the

harm and potential harm they present. These considerations, and the cooperation matters
addressed in the accompanying sealed addendum, we respectfully submit, support the imposition

of a sentence of 46 months, at a minimum.

-23-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 24 of 25

4.

The Need to Provide the Defendant with Educational or

Vocational Trainins
Islam does not appear to need such

training. In any event,

the other factors bearing on the

seriousness of the offenses and the need for strong deterrence outweigh this element in fashioning

ajust sentence.l
Conclusion
For the foregoing reasons, the Government asks the Court to impose a sentence of 46
months of imprisonment.

Respectfully submitted,

CHANNING D.PHILLIPS
Unitcd States Attomey
District of Columbia

D.C.Bar No.415793
By:

.
CORBIN A.WEISS

Assistant United States Attorney

CHIP/Cybercrime Coordinator
Califorllia Bar No.122961
555 4th Street,N.W.

Washington,D.C.20530
(202)252-1718

' l8 U.S.C. $ 3553(a)(6) instructs courts to considerthe need to avoid unwarranted sentence disparities among
defendants with similar records who have been found guilty of similar conduct. The facts and charges in this case are
unique, and further complicated by the joint charging and now sentencing for two courses of unrelated conduct. The
government is unaware of any individuals sentenced for conduct similar to Islam's. Islam's case is unique,
particularly given Islam's prior conviction and the unusual sentence he received for that conviction.
-24-

Case 1:15-cr-00067-RDM Document 25 Filed 07/05/16 Page 25 of 25

Certiflcate of Se yice

Undersigncd counsel hercby ccrtiflcs that a copy ofthc

Mcmorandum was se ed upon counsel for defcndant,

2016,by U.S,Postal Scrvicc and email at:

latthew

.:1l

IIlili11: day OfJuly,

Matthew J.Pccd
Clinton Brook&Pccd
1455 Pennsylvania Ave NW,Suite 400
Washington,DC 20004
Ema :matt dintOnbrook.com

Corbin A. Weiss

-25