Court File and Parties

COURT FILE NO.: CR-17-0034-MO DATE: 2017-04-11 ONTARIO SUPERIOR COURT OF JUSTICE

In the Matter of an Application for Judicial Interim Release

IN THE MATTER OF AN APPLICATION FOR JUDICIAL INTERIM RELEASE BY KARIM BARATOV a.k.a. KAY a.k.a. KARIM TALOVEROV a.k.a. KARIM AKEHMET TOKBERGENOV PURSUANT TO SECTION 18 OF THE EXTRADITION ACT , S.C., 1999, c. 18

B E T W E E N:

THE ATTORNEY GENERAL OF CANADA ON BEHALF OF THE UNITED STATES OF AMERICA Heather J. Graham, for the Respondent Respondent

- and -

KARIM BARATOV a.k.a. KAY a.k.a. KARIM TALOVEROV a.k.a. KARIM AKEHMET TOKBERGENOV Amedeo DiCarlo and Deepak Paradkar, for the Applicant Applicant

HEARD: April 5th and 11th, 2017

Reasons for Judgment on Judicial Interim Release

The Honourable Mr. Justice A.C.R. Whitten

[1] Mr. Baratov has moved for judicial interim release pending his extradition hearing. His application is resisted by the Attorney General of Canada on the basis of all three of the grounds enumerated in s. 515(10) of the Criminal Code of Canada, R.S.C., 1985, c. C-46.

I. Judicial Interim Release in the Context of Extradition

[2] S. 515(6)(ii) of the Criminal Code requires, and it is conceded, that this is a reverse onus situation. Within the particular subsection of s. 515(6)(a)(ii) is the reference to a “serious offence” alleged to have been committed for the benefit of and at the direction of a criminal organization. Two elements emerge from this concession: that the individual is alleged to have committed a “serious offence”, and that he did not act alone.

[3] Section 19 of the Extradition Act, S.C., 1999, c. 18 states that the judicial interim release provisions of the Criminal Code apply “with any modifications that the circumstances require” for persons detained for the purposes of extradition.

[4] In interpreting the application of the principles applicable for judicial interim release, jurists have made reference to “our international responsibilities,” ref. Justice Jane Milanetti in A.G. of Canada v. Brant, March 19th, 2008 (unpublished). Justice Low of the British Columbia Court of Appeal in United States of America v. Edwards, 2010 BCCA 149, [2010] B.C.J. No. 502 at para. 18, stated, “[t]his application for interim release must be considered in light of the need to honour Canada’s international treaty obligations. Therefore, the court must look at the risk of non-appearance even more cautiously than might be the case in domestic proceedings”. Similar comments as to the need for caution were expressed by Justice Trotter (as he then was) in United States of America v. Ugoh, 2011 ONSC 1810, [2011] O.J. No. 1383 at para. 13. United States of America v. Edwards was cited with approval by A.C.J. Marrocco in United States of America v. Mordi, 2010 ONSC 6666, [2010] O.J. No. 5204 at paras. 4 and 5.

[5] The grounds for detention of an individual are invoked if there is:

i. a flight risk; ii. a risk of further offences being committed and a consequential threat to public safety; and iii. the public perception of the effectiveness of the administration of justice is challenged.

[6] The first two grounds are rather obvious in terms of the proof required. The third is more abstract but is aided by specific references.

[7] I think it appropriate to discuss the third ground, which is often referred to as the tertiary ground. In R. v. St-Cloud, 2015 SCC 27, [2015] 2 SCR 328, the Supreme Court of Canada considered the interpretation of the tertiary ground, which in the English version of the statute, speaks of the maintenance of confidence in the administration of justice. The section does not expressly refer to the “public” per se. In the French translation, Justice Wagner noted at para. 72 that the section speaks of “sa détention est nécessaire pour ne pas miner la confiance du public envers l’administration de la justice, compte tenu de toutes les circonstances....” By repeated reference, “public confidence” has emerged as a quick title for this ground. That being said, it is not in the abstract. It is with an eye to:

i. the apparent strength of the prosecution’s case; ii. the gravity of the offence; iii. the circumstances of the commission of the offence; and iv. whether the individual, if convicted, would face a long period of incarceration.

[8] In his concluding remarks with respect to this section, Justice Wagner states the following:

• No single circumstance is determinative. The justice must consider the combined effect of all the circumstances of each case to determine whether detention is justified;
• This involves balancing all the relevant circumstances. At the end of this balancing exercise, the ultimate question to be asked by the court is whether detention is necessary to maintain confidence in the administration of justice. This is the test to be met under s. 515(10)(c);
• To answer this question, the court must adopt the perspective of the “public”, that is, the perspective of a reasonable person who is properly informed about the philosophy of the legislative provisions, Charter values and the actual circumstances of the case. However, this person is not a legal expert and is not able to appreciate the subtleties of the various defences that are available to the accused;
• This reasonable person’s confidence in the administration of justice may be undermined not only if a court declines to order detention where detention is justified having regard to the circumstances of the case, but also if it orders detention where detention is not justified.

[9] So, we note that the jurist, as in a domestic case, considers the strength of the prosecution’s case. Justice Macklin in United States of America v. Sharif, 2011 ABQB 62, [2011] A.J. No. 144 (Q.B.) at para. 39, spoke of “...consider[ing] the strength of the prosecution’s case in the context of the relaxed onus of proof the prosecution must meet at the extradition hearing. Further, the apparent strength of its case at this time does not have to reach the same level of proof necessary to satisfy the onus required of it at the extradition hearing itself.”

[10] Justice Thorburn in Mandall v. United States of America, 2010 ONSC 1202, [2010] O.J. No. 758, in interpreting the above remarks of Justice Macklin stated at para. 50:

In assessing the strength of the case against Mr. Mandall at this point, it must be remembered that this is an extradition proceeding. The role of this Court in an extradition is a limited one and does not involve weighing the merits of the evidence against the person sought and determining whether his conviction in the foreign jurisdiction is likely. In determining the strength of the case against Mr. Mandall in this jurisdiction, the question is not whether he is likely to be convicted in the United States, but rather, whether this Court is likely to order his extradition.

[11] Justice Moldaver (as he then was) in United States of America v. Thomlison, 2007 ONCA 42, [2007] O.J. No. 246 has made similar comments to that of Justice Thorburn. His comments reflect the seminal test expressed in United States of America v. Shephard, [1977] 2 S.C.R. 1067 (SCC), namely that “there is some evidence that is available for trial and not manifestly unreliable on every aspect of the parallel Canadian crime upon which a jury, properly instructed could convict, the test for committal would be met.” His Honour proceeded to add, “[i]n that regard, it matters not whether the case against the person sought is "weak" or whether the prospect for conviction "unlikely". The ultimate question of guilt or innocence is for the trial court in the foreign jurisdiction.”

II. Facts Specific to the Application

[12] From approximately 2014 through at least December 2016, officers of the Russian Federal Security Service ("FSB"), an intelligence and law enforcement agency of the Russian Federation ("Russia") headquartered in Lubyanka Square, Moscow, Russia, and a successor service to the Soviet Union's Committee of State Security ("KGB"), conspired together and with each other to protect, direct, facilitate, and pay criminal hackers to collect information through computer intrusions in the United States and elsewhere. The FSB officers, defendants Dmitry Dokuchaev, Igor Sushchin, and others, directed the criminal hackers, defendants Alexsey Belan, Karim Baratov, and others, to gain unauthorized access to the computers of companies providing webmail and internet-related services located in the Northern District of California and elsewhere (Yahoo, Inc., Google, Inc. and others), to maintain unauthorized access to those computers, and to steal information from those computers, including information regarding, and communications of, the providers' users.

[13] When Sushchin and Dokuchaev learned that a target of interest had email accounts at webmail providers other than Yahoo, including through information gained from the Yahoo intrusion (as referenced in the provisional arrest request) they would task Baratov to access the target's account at the other providers. When Baratov was successful in obtaining illicit access to the accounts, Dokuchaev paid him a bounty. Baratov told Dokuchaev that he could be paid in Russian rubles, U.S. dollars, Ukrainian hryvnia, or Euros, through online payment services. Further, once Baratov was successful in stealing the log-in credentials (personal identifiable information belonging to victims), he would send the password and email address he had unlawfully obtained to Dokuchaev for the co-conspirators' use. In sending this information, Baratov would also identify information that belonged to others. Baratov's intended victims, provided by Dokuchaev, included Russian government officials, such as senior political leaders and their counselors, a law enforcement official, and a prominent Kazakh banker, among others.

[14] Baratov and the co-conspirators undertook this conduct for the purpose of commercial advantage and private financial gain. Baratov's and Belan's purposes appear to have been entirely financial. Baratov was compensated directly by the FSB defendants for his hacking activity. Belan also benefited financially by stealing financial and other information from certain Yahoo user accounts. For example, on or about April 26, 2015, Belan searched within a victim user's account for credit card verification values ("cvv" numbers), and searched other victims’ Yahoo accounts for financial information. As noted in the provisional arrest request, Belan has been the subject of an Interpol "Red Notice" and has been listed as one of the Federal Bureau of Investigation's "Most Wanted" hackers since 2012. Belan is also wanted for prosecution by the District of Nevada and was arrested in 2013 in a European country on a U.S. provisional arrest warrant. He was released on bail and fled that country. Belan resides in Russia, within FSB's jurisdiction to arrest and prosecute. Rather than arrest him, however, the FSB officers used him, and it was Belan who provided Dokuchaev and Sushchin with the unauthorized access to Yahoo's network, which resulted in the unauthorized access into user data regarding more than 500 million Yahoo user's accounts.

[15] From the above, it appears that Baratov is highly skilled at “hacking”.

[16] The Concise Oxford English Dictionary defines hacker as “a person who uses computers to gain unauthorized access to data”. The investigation against Baratov revealed the creation of numerous websites and email accounts to facilitate his hacking activities. He actually had a website in Russian that advertised his services (see Attachment C to the correspondence for the United States Attorneys Stretch and Heman).

[17] Baratov would employ “spearphishing” messages, designed to trick unwitting recipients into providing access to their computers and accounts.

[18] One PayPal account registered to Baratov received an excess of $200,000 between February 2013 and October 22, 2016. Comparable amounts existed in a WebMoney account. In Attachment B-1 to the U.S. Attorney’s letter referred to, in one of his posts online Baratov speaks of making his first million by age 15. At ages 12 through to 14, he was making more than the combined income of his parents. His online financial statements are at complete odds to what he attested to in the bail hearing.

[19] The rapid accumulation of wealth from his activities in the latter part of his adolescence resulted in the serial procurement of luxury sports vehicles: Aston Martin, Porsche Turbo, Lamborghini, BMW, and Mercedes Benz. These are brand names that he acquired and disposed of with little thought for the inevitable trade-in deduction. His fleet and his upscale residence are pictured in Attachments A to A-2, and various Instagram posts. There was no other explanation proffered at the bail hearing with respect to his income source, aside from his internet activities.

[20] Attachment D demonstrates some of the postings of Baratov on the Canadian Airgun Forum. In his June 2012 posting, he noted, “I often travel to Russia.” This assertion is contrary to what he stated in the bail hearing.

[21] At the very least, he appears to be able to speak Russian, as revealed by his hacker-for-sale website, and he is familiar with the country.

[22] The U.S. Attorneys speak of possible imprisonment for up to 20 years.

III. Analysis of the Grounds for Detention and the Proposed Plans

[23] Although Dinara Tokbergenova, Baratov’s mother, volunteered in her testimony that Baratov had not killed anybody, he faces extradition for a very serious offence.

[24] The very aspects of internet usage that we all find so convenient and attractive are tools exploited by hackers. We can transfer funds, manage our bank accounts, pay bills, et cetera, from anywhere in the world. We can purchase flight tickets, train tickets and sign in online. Access to the internet, as Justice Gillese stated in United States v. Viscomi, 2016 ONCA 980, [2016] O.J. No. 6646 (C.A.) is “ubiquitous”. Baratov can access the internet at his nearest Tim Hortons or Starbucks. He can use the computers in a public library. The GTA is literally saturated with internet access.

[25] Hacking has increased proportionately with the growth of such internet access. Individuals are financially ruined by the pirating of their identifying details (which includes passwords) and the plundering of their accounts.

[26] Commercial mayhem flows from the pirating of trade secrets, technical information and confidential communication.

[27] National security is compromised by the acquisition of sensitive information. The hacker is a menace to a system that struggles to preserve its integrity. There are no known social benefits to the activity. We cannot afford to be romantic about this crime. This is a harsh reality far removed from the glorified forensic investigations in various television series.

[28] Baratov seeks to assuage concerns with respect to the grounds for detention in the main by proposing a form of house arrest assisted by electronic monitoring, his parents as wardens with conditions that preclude internet access and the pledging of assets and/or money approaching $1,000,000.00.

[29] Stephen Tan, principal and Director of Operations of Recovery Science Corporation, testified candidly about the scope of electronic monitoring. The program summary, which is attached to his affidavit, refers to the variables in para. 16 of the police response time. A court cannot assume that the communication of a violation whether it be the individual leaving the prescribed zone or tampering with a bracelet will result in an instantaneous police response. As the summary states, “there are many factors that create the potential for delay in the chain of communication that leads from a violation event to the ultimate police response”. Even with a rapid response, it may be too late.

[30] An additional aspect of monitoring that could be exploited is the time allowed for charging the battery and the device. Mr. Tan testified that the monitored individual has to charge the device twice a day. Up to an hour is allowed for the individual to commence to charge the unit. An hour in internet usage is astronomical.

[31] Again, as Mr. Tan testified, this is a tool that is not a preventative tool but a risk management tool. It has absolutely no effect with respect to what an individual does independent of leaving the prescribed zone or tampering with the device. In other words, Baratov could access the internet with the monitoring device in place.

[32] It is inevitable that a jurist would ponder whether a sophisticated hacker, as Baratov holds himself out to be, who allegedly breached the firewalls of Yahoo, could hack into the software related to the monitoring device. Mr. Tan could not address that possibility.

[33] No wonder jurists such as Justice Nordheimer in United States of America v. Pannell, [2004] O.J. No. 5715 expressed skepticism as to the effectiveness of electronic monitoring. His Honour was supported in his findings by Justice MacPherson in the appeal reported at [2005] O.J. No. 10.

[34] Akhmet Tokbergenov, Baratov’s father, testified that he would be such a warden to his son that jail would appear to be a paradise. Sounds pretty serious. But the court has to keep in mind that this was one of the parents who would have witnessed the pronounced growth of affluence by their teenage son while he was in the family home. If anything, it sounds like the father “rewarded” his 16 year old son with a gift of a Mercedes. A gift that the father had paid $55,000.00 outright for. The parents were obviously prepared to turn a blind eye to their son’s activities on the internet, and they benefitted in turn by his financial contribution to the household maintenance. They all lived in an upscale neighbourhood, which would be difficult, if not impossible, to enter given the income streams of the parents.

[35] As it is, the court has concerns about the credibility of the father. He volunteered, not in response to a question, that he had seen the income tax returns of his son. There was a witness exclusion order in place, but Mr. Baratov testified in the bail hearing while his parents waited outside. It was the court that posed the question to Baratov about the possibility of his tax returns. The father, excluded from that testimony, somehow felt it necessary to drive the point home about income tax returns even though he was not questioned about the point.

[36] The effectiveness of the parents’ supervision must be questioned. As mentioned, Baratov’s enterprise commenced while he was in the family home. In 2014, he apparently was generating $10,000.00 per month (despite his grander assertions in his online posts). There is no suggestion of any probing questions by parents of son. The acquisition of an upscale home and numerous high-end sports cars would lead even those who are not car appraisers or real estate agents to think that the internet activities were a proverbial goldmine.

[37] Past silence or passive acquiescence does not bode well for a complete volte-face in the emergence of a warden.

[38] The parents have proposed that Baratov will be denied access to their electronic devices. This undertaking does not address the possibility of a friend of Baratov bringing such a device to the household or mailing it to the household. The monitor does not detect the presence of such devices. Because of the possibility of response delay and the battery grace period, Baratov would have ample opportunity with any device to make flight arrangements and transfer funds.

[39] Perhaps the most salient feature of the proposed plan of supervision is the pledging of the family assets. Yet, it would appear that Baratov’s activities were quite the cash cow: a million by age 15 and the array of extremely expensive sports cars. There is the potential for further income referred to in the extradition documents. Baratov would appear to be a valuable operative for the FSB. These are interests which would value his services.

[40] The amount pledged would be a cost of access to his skillset. It is all relative; the amounts pledged are high but there is plenty more where that came from. If you have infinite sources, the value of the pledge diminishes.

[41] Baratov’s cavalier attitude towards money, his trading in of cars with a significant trade loss, his online photographs with a fan of $100.00 bills, reflects his attitude towards money and his infinite opportunities to make more. This is not a picture of an individual who would grieve the loss of $1,000,000.00.

[42] Dealing with the specific grounds of s. 515(10), is Baratov a flight risk? He certainly would be motivated, as he is facing a potential 20-year sentence. That would be quite a contrast to his youthful affluent existence. It is definitely a bleak prospect for someone who has enjoyed so much freedom in the last three years.

[43] Why would he stick around? He can continue his wealth-generating activities anywhere in the world. One of his alleged colleagues, Belan, has already disappeared from Greece and surfaced in Russia. The latter has no extradition treaty with either Canada or the United States. Baratov can speak Russian, or at least express himself in that language, as seen in one of his many websites.

[44] As it is in Canada now, excluding trips to the United States, there is no electronic screening of a passport as one leaves the country. The airline officials look at the passport to verify that the details coincide with the passengers who have booked the flight. Passport scrutiny takes place at the country of arrival. So, we have a low key verification of passport identity for those departing Canada. Baratov, given the allegations, is knowledgeable in identity theft. It is not beyond possibility that he would conjure sufficient identification to leave the country. There appears to be considerable variations in supervising countries of what is necessary to be admitted. Mr. Snowden has been a resident of Russia for the last two or three years. Whatever passport or identification he had did not appear to be an obstacle. Baratov already has connections with FSB officials. No doubt he has knowledge of Belan’s flight to Russia.

[45] Baratov is a flight risk. He could instantaneously access the necessary funds, whether it be as before in rubles, Ukrainian hryvnia, or Euros. He can ply his trade from anywhere in the world.

[46] As for the secondary ground, in order to fulfill flight as described above, he would have to hack. He had 80 websites that facilitated his trade. There is no way that a prohibition against internet access is effective. He has demonstrated his life and skills are there. There is a demand for his skills; mischief is inevitable.

[47] Concluding with the tertiary ground, one would think that our international reputation would be challenged if such an individual was released. Obviously, precedent mandates we do not think solely in terms of embarrassment. But how would our own citizens think of the administration of justice if Baratov was released? Would they be surprised that Baratov, like Houdini who escaped from his straightjacket, took to flight? Not very likely.

[48] You have an extremely strong and document-heavy case against Baratov. According to the Request for Provisional Arrest to Canada, the evidence will include:

• Large volumes of emails between Baratov and co-accused Dokuchaev, in which Dokuchaev instructs Baratov as to the target email accounts to hack,
• Google records demonstrating Baratov’s attempts to hack the target email accounts,
• Screenshots of victim email accounts sent by Baratov to Dokuchaev, proving that he had successfully hacked the accounts,
• Emails from Baratov to Dokuchaev instructing Dokuchaev as to how to send payment for the successful hacks to his PayPal and WebMoney accounts,
• PayPal records confirming that Baratov is the owner of the account to which he directed Dokuchaev to pay him for hacking activities, as well as the RBC checking and Visa accounts connected to the PayPal account,
• PayPal records confirming payment by Dokuchaev to Baratov,
• Three websites advertising Baratov’s hacking services, and
• Other electronic records showing that Baratov used his own name, phone number, and address to create the websites and email accounts that he used in the commission of computer hacking activities.

[49] Obviously the FBI has spent considerable time and resources connecting up all the dots. Their investigation has been assisted by Baratov’s online portrayals of wealth, and perhaps most importantly, his website offering hacking services. Additional corroboration comes from the sheer volume of money transferred into the PayPal account of this adolescent. His wealth speaks of his success.

[50] All in all, the case is far from weak. The United States of America v. Shephard requirements appear to be present, although that is for the hearing justice to determine.

[51] As stated in the outset of this analysis, Baratov faces extradition for a serious offence. It is an offence that has created individual and national misery.

[52] Public confidence in the administration of justice and the viability of the other grounds for detention merit that the application for judicial interim release be denied. Mr. Baratov simply has not met the onus of demonstrating, on a balance of probabilities, that judicial interim release is possible.

WHITTEN J. Released: April 11, 2017