After struggles over whether the defendants could obtain Russian passports, give depositions in Europe, and submit work files, Google’s lawyers and Litvak accused each other of lying. In 2022, U.S. District Judge Dennis Cote sided with Google. In a 48-page ruling, he found that the defendants “intentionally concealed information” and “misrepresented their willingness and ability to disclose information” to “avoid liability and further benefits” from Grupteva. “The record is sufficient to find a deliberate attempt to mislead the Court,” Cote wrote.
Judge Cote sanctioned Litvak, who agreed to pay Google a total of $250,000 in settlement payments through 2027. He also ordered him to pay Google’s attorneys’ fees to Starobykov and Filippov totaling about $526,000. Judge Castañeda said Google has received payments from all three.
Litvak told WIRED he still disagrees with the judge’s decision, and that tensions between Russia and the US may have influenced who the judge trusted. “After I filed a motion for reconsideration, raising serious issues with the court’s decision, the court reversed its original decision and referred the case to arbitration, so that I didn’t have to admit that I did anything wrong,” he said in an email.
Google’s Castaneda said the attack had its intended effects: Russian hackers stopped exploiting Google services, the company shut down its marketplace for stolen login information, and the number of computers infected with Grupteva fell by 78 percent.
Not all lawsuits have produced tangible results. Defendants in Google’s three other hacking cases have not responded to the allegations. As a result, Google won a default judgment last year against three Pakistani individuals accused of infecting more than 672,000 computers with malware disguised as a download for Google’s Chrome browser. It expects to win outright victories in the remaining cases, including one against an overseas app developer accused of violating YouTube’s community guidelines by allegedly stealing money with a fake investment app.
Royal Hansen, Google’s vice president of privacy, safety and security engineering, said that even lawsuits in which the defendants don’t pay damages or agree to stop the misuse could make life harder for the suspects. Google has used the rulings as evidence to convince banks, cloud providers and other companies to cut off business with the defendants. Other hackers may be less willing to work with them when they know they’ve been exposed. Defendants may also be more cautious about crossing borders and exposing themselves to new scrutiny from local authorities. “That’s a win, too,” Hansen said.
More to come
These days, Google’s small litigation team meets about twice a week with other parts of the company to discuss possible legal action, considering whether it could set a precedent that would further enforce Google’s policies or help raise awareness of new threats.
Day, the team leader, said Google has refined its litigation process, making it cheaper to bring lawsuits, which he said should lead to an increase in the number of lawsuits filed each year, including some filed outside the U.S. for the first time and some on behalf of specific victimized users.
The ever-expanding empires of big tech companies have no shortage of novel lawsuits to pursue: Google sister company Waymo recently adopted an aggressive litigation approach, suing two people who allegedly vandalized and slashed its self-driving taxis, while Microsoft is considering lawsuits against people who use its generative AI technology for malicious or fraudulent purposes, says Steven Masada, deputy general counsel for the company’s digital crimes division.
Questions remain as to whether the increase in litigation has deterred cybercriminals at all, and whether a wider range of internet companies will launch legal attacks.
Erin Bernstein, who runs the California office of Bradley Bernstein & Sons, a law firm that helps governments with civil litigation, says she has recently approached several companies in a variety of industries about pursuing aggressive litigation on their own. No one has taken her up on her offer yet, but she’s optimistic. “This is going to be a growth area,” Ms. Bernstein says.
But Google’s DeLaine Prado is hopeful that aggressive litigation will eventually slow. “In an ideal world, this work would fade away over time if we were successful,” she says. “We want to make sure that, at least with regard to this kind of work, our success makes us largely obsolete.”
