ONTARIO COURT OF JUSTICE DATE: February 1, 2022 COURT FILE No.: Brampton 3111 998 22 237

BETWEEN:

HER MAJESTY THE QUEEN

— AND —

SEBASTIEN VACHON-DESJARDINS

Before Justice G.P. Renwick Heard on 31 January 2022 Reasons for Judgment released on 01 February 2022

M. Flagg................................................................................................ counsel for the Crown R. Victorin............................ counsel for the defendant Sebastien Vachon-Desjardins

Reasons for Sentence

RENWICK J.:

Introduction

[ 1 ] The Defendant pleaded guilty before me to five counts in relation to a complex set of offences involving mischief and theft of computer data, extortion, the payment of cryptocurrency ransoms, and participating in the activities of a criminal organization. The 17 Canadian victims to which this activity relates suffered losses in the millions of dollars.

[ 2 ] The parties jointly submitted that a sentence of 7 years imprisonment, partial restitution, forfeiture of assets seized, and a DNA order would be appropriate in the circumstances.

[ 3 ] Yesterday, I indicated that I would accede to the joint proposal, with reasons to follow. These are my reasons for imposing the sentence sought.

Background Investigation [^1]

[ 4 ] In August 2020, the Royal Canadian Mounted Police (“RCMP”) received information from the American Federal Bureau of Investigation (“FBI”) in relation to a NetWalker ransomware affiliate operating in Gatineau Quebec. [^2] The FBI advised the RCMP that their suspect was responsible for ransomware attacks in several countries, and he was suspected to have received over $15,000,000.00 USD in ransom payments.

[ 5 ] Eventually, based on internet protocol addresses, data gleaned from U.S. investigations into various Apple, Google, Microsoft, and Mega.nz accounts, aliases, email addresses, and personal information revealed on social media platforms, the Defendant was identified by the Canadian authorities.

Current Investigation

[ 6 ] The RCMP applied for various court authorizations to further their investigation into the suspected activities of the Defendant. To maximize the efficient use of judicial resources, the investigators sought the assignment of a single judge to whom applications for various searches and seizures would be directed. I was assigned to act as the applications judge by the local administrative judge, Justice P. Monahan. In this role, I granted many of the orders sought.

[ 7 ] Eventually, in January 2021, the police searched the Defendant’s home and bank accounts. I am told that the fruits of the search warrants and general warrant to seize cryptocurrency resulted in many devices seized with approximately 20 tera-bytes of data contained therein. During an application to extend the detention of items seized, in the absence of any charges, I was told that the data seized from the Defendant, if printed, would fill an entire hockey arena. Given this reality, but for the Defendant’s decision to cooperate with Canadian authorities, the police would not have charged the Defendant for several years while they sifted through the mountain of data to identify victims and searched for proof to mount a successful prosecution.

[ 8 ] The Defendant was arrested in January 2021 under the auspices of an American extradition Order for similar offences committed in that country. His surrender to the U.S. has been delayed because he had outstanding drug trafficking charges in Quebec. [^3] In November 2021, over the course of two days, the Defendant gave a statement to the RCMP to detail his criminal activities involving Canadian victims. Needless to say, this guilty plea would not have occurred at this point in time without the Defendant’s cooperation.

[ 9 ] Given my involvement with many of the prior judicially authorized searches and seizures, the parties asked if I would be the pre-trial judge to manage the matter in light of my familiarity with this large investigation. There were several pre-trials held before the guilty plea was entered.

Evidence and Findings of Fact

[ 10 ] Between May 2020 and January 2021, the Defendant victimized 17 Canadian entities and others throughout the world by breaching private computer networks and systems, hi-jacking their data, holding the stolen data for ransom, and distributing stolen data when ransoms were not paid.

[ 11 ] The Defendant excelled at what he did. Between 10-15 unknown individuals hired the Defendant to teach them his methods. Some of these activities benefitted those interested in securing computer networks from these types of attacks. Some of the Defendant’s students were likely other cyber threat actors.

[ 12 ] In the days leading up to the search warrant for his residence, the Defendant transferred 224 Bitcoins out of his electronic wallet (“e-wallet”). He told investigators that this was a payment made to invest in the NetWalker group and the next generation of malicious code that could be used to infiltrate secure computer systems and steal protected data.

[ 13 ] The Defendant even improved upon the ransom messages used by NetWalker affiliates and eventually convinced the creator of NetWalker to use “mixing services” to disguise funds paid for ransoms in Bitcoin.

[ 14 ] The Defendant admitted to investigators that over 1,200 Bitcoins related to his NetWalker malware activities passed through his e-wallet and were shared with his unindicted co-conspirators and the developer of the NetWalker ransomware. As well, the Defendant admits that his entire ransomware activities involved over 2000 Bitcoins. The RCMP seized slightly less than 720 Bitcoins from the Defendant’s e-wallets and accounts. [^4]

[ 15 ] It is acknowledged by the Defendant that he converted some of his ill-gotten cryptocurrency into Canadian dollars through unlawful channels. [^5] He told investigators of several instances when he obtained bags of money ranging from $100,000 to $150,000. Cash seized ($640,040) from the Defendant’s home and his bank account balances ($420,941) [^6] indicate that the Defendant had liquid assets of over one million dollars in January 2021.

Mitigating and Aggravating Features of this Offence

[ 16 ] There are a few mitigating features of this guilty plea:

i. The Defendant pleaded guilty at the earliest possible point in time; [^7] ii. The Defendant’s guilty plea saves untold investigative, prosecutorial, judicial, and court resources; [^8] and iii. The Defendant cooperated with the authorities and helped to identify the victims and their losses.

[ 17 ] There are several aggravating features:

i. The offences involved many victims, over an extended period of time; ii. The offences are sophisticated and involved a high degree of expertise, planning, and deliberation; iii. But for the intervention of international law enforcement, the Defendant’s offending would have continued; iv. These offences caused direct losses of at least $2.8 million in Canada; [^9] v. Victims suffered commercial, reputational, and operational harm; these offences caused other unquantifiable losses to the victims in terms of time, productivity, and resources dedicated to replacing/reinforcing security measures to prevent similar attacks; victims lost secret and confidential data; in some cases the data was leaked (when ransoms were not paid) causing untold further harm; vi. The Defendant’s illegal activities were solely motivated by greed; vii. The Defendant personally profited greatly from these offences; he earned the equivalent of over $600,000 in cash (seized by police), bank balances of over $400,000, and Bitcoin transfers to money spent estimated at $1,755,000, and the value of at least 944 Bitcoins (720 seized and 224 paid in the days leading up to the seizure to invest in NetWalker), worth over $30,000,000 when seized; [^10] viii. The Defendant was not an insignificant actor in these and other offences; he played a dominant, almost exclusive, role in these offences and he assisted NetWalker and other affiliates by improving their ability to extort their victims and disguise their proceeds; ix. The Defendant committed these offences as part of and to benefit a criminal organization; and x. The Defendant has an unrelated criminal record for drug trafficking and he was sentenced to 3.5 years imprisonment in 2015 and 4.5 years imprisonment, last week; during the commission of these offences, the Defendant was awaiting the disposition of some of his outstanding charges in Quebec.

The Offender’s Background and Character

[ 18 ] The Defendant did not produce any character letters, counselling reports, or other information to assist the court to understand his motivations, prior character, or employment history. The agreed facts indicate that the Defendant has been employed in the IT field for the Canadian government for over four years.

[ 19 ] The Defendant was pleasant and respectful in court. He is good-looking, presentable, and instantly likeable.

[ 20 ] During his allocution, the Defendant sincerely apologized for the harm he has caused his victims and the community. I accept that the Defendant is genuinely remorseful for his criminal behaviour. His police confession reinforces this view.

Determining an Appropriate Sentence

General Sentencing Principles

[ 21 ] Some believe that determining an appropriate sentence is more art than science. Support for this view may be found in R. v. Lacasse, where the Supreme court held that:

The determination of a just and appropriate sentence is a highly individualized exercise that goes beyond a purely mathematical calculation. It involves a variety of factors that are difficult to define with precision. [^11]

[ 22 ] The fundamental purpose of sentencing as expressed in section 718 of the Criminal Code (R.S.C. 1985, c. C-46) is to contribute to respect for the law, the maintenance of a just, peaceful and safe society by imposing just sanctions that have one or more of the objectives of denunciation, deterring the offender and other persons from committing offences, separating offenders from society, where necessary, assisting in rehabilitating offenders, providing reparation for harm done to victims or to the community, and promoting a sense of responsibility in offenders and acknowledgment of the harm done to victims and to the community.

[ 23 ] The fundamental principle of sentencing is that the punishment should be proportionate to the gravity of the offence and the degree of responsibility of the offender. The punishment should fit the crime. There is no single fit sentence for any particular offence. The relevance and relative importance of each of these objectives will vary according to the nature of the crime and the circumstances of the offender. [^12]

[ 24 ] In R. v. Hamilton and Mason, Justice Doherty of the Ontario Court of Appeal stated:

The "gravity of the offence" refers to the seriousness of the offence in a generic sense as reflected by the potential penalty imposed by Parliament and any specific features of the commission of the crime which may tend to increase or decrease the harm or risk of harm to the community occasioned by the offence…

The "degree of responsibility of the offender" refers to the offender's culpability as reflected in the essential substantive elements of the offence - especially the fault component - and any specific aspects of the offender's conduct or background that tend to increase or decrease the offender's personal responsibility for the crime. [^13]

[ 25 ] The Court quoted Rosenberg J.A. who had previously described the proportionality requirement in R. v. Priest:

The principle of proportionality is rooted in notions of fairness and justice. For the sentencing court to do justice to the particular offender, the sentence imposed must reflect the seriousness of the offence, the degree of culpability of the offender, and the harm occasioned by the offence. The court must have regard to the aggravating and mitigating factors in the particular case. Careful adherence to the proportionality principle ensures that this offender is not unjustly dealt with for the sake of the common good. [^14]

[ 26 ] Section 718.1 of the Code ensures that proportionality is the fundamental principle of sentencing. However, proportionality is not the sole principle to be considered. A sentence should be similar to those imposed on similar offenders for similar offences. [^15]

[ 27 ] In the circumstances of this case, where the parties jointly submit that a significant penitentiary sentence is appropriate, it is trite to note that s. 718.2 of the Code requires that “an offender should not be deprived of liberty if less restrictive sanctions may be appropriate in the circumstances” and “all available sanctions other than imprisonment that are reasonable in the circumstances should be considered for all offenders.” Obviously, as a sentencing tool, imprisonment is to be used only as a last resort when required by the circumstances of the crime and the background of the perpetrator.

[ 28 ] Our Supreme Court has instructed that section 718 requires a sentencing judge to consider more than simply denunciation and deterrence. The court must also consider the restorative goals of repairing the harms suffered by complainants and by the community as a whole, promoting a sense of responsibility and an acknowledgment of the harm caused on the part of the offender, and attempting to rehabilitate or heal the offender. [^16] Although the rehabilitation of the Defendant is a much reduced consideration in the overall sentencing calculus in this case, it is still a factor I must consider.

[ 29 ] Sentencing parity is extremely difficult in this case. The parties submit that this is one of the first cases (or in light of the scale, possibly the first) of its kind in Canada. The Defendant is not a first-offender. He is a sophisticated cyber-terrorist who preyed in an organized way with others on entities in educational, health-care, governmental, and commercial sectors. His crimes are extreme and significant. The losses, beyond three million dollars (and likely much more), [^17] are monumental. The effects of this type of criminality upon the victims and the wider IT security community are destabilizing and potentially crippling. The detection of these offences involved international investigative initiative.

[ 30 ] The parties suggested that after taking denunciation, deterrence, rehabilitation, totality, parity, restraint, proportionality, and the jump principle [^18] of sentencing into account, a sentence as high as 8 years could result for these offences. In this case, in consideration of the guilty plea, the proposed restitution to victims, the forfeiture of significant assets, and the cooperation of the Defendant in identifying his victims and the extent of his offending, the parties have suggested that there ought to be a significant discount applied (1 year) to what would otherwise be an appropriate sentence for these offences by this Offender.

[ 31 ] I agree with the parties that the seven year suggested sentence is appropriate.

[ 32 ] The proposed sentence is adequate and within the range of an appropriate sentence for this level of criminality, by this Offender, in the circumstances of these crimes. Moreover, I find that this proposed sentence is not contrary to the public interest.

[ 33 ] The parties have also agreed though not strictly required, that it is appropriate to apply a small additional discount to the sentence to reflect the suspension of the Defendant’s extradition and the accumulation of more than two additional months of custody in a detention centre, during a global pandemic. [^19] Balancing these matters is imprecise. However, I find that it is appropriate to deduct 4 months of imprisonment from the total sentence to be imposed in recognition of the Defendant’s situation and the hardship of his conditions awaiting this resolution.

Sentence of Imprisonment for These Offences

[ 34 ] No lesser sentence than a significant period of imprisonment can adequately address all of the sentencing principles at play. No lesser period of incarceration can adequately address the harm caused by these offences and this particular Offender.

[ 35 ] Sebastien Vachon-Desjardins is hereby sentenced to serve 6 years and 8 months in a federal penitentiary as follows:

i. Count 1 – mischief to data, s. 430(5)(a) – 1 year of imprisonment, less 4 months, equals 8 months of imprisonment; ii. Count 2 – unauthorized use of computer, s. 342.1(1)(a) – is conditionally stayed, on consent, pursuant to R. v. Kienapple, 1974 SCC 14, [1975] 1 S.C.R. 729; iii. Count 3 – extortion, s. 346(1.1)(b) – 4 years of imprisonment, consecutive to count 1; iv. Count 4 – extortion, s. 346(1.1)(b) – 4 years of imprisonment, concurrent to count 3; and v. Count 5 – participate in the activities of a criminal organization, s. 467.11 – 2 years of imprisonment, consecutive to count 3.

[ 36 ] The parties have advised that they have agreed that the Defendant’s sentence of imprisonment can begin to run now and it will continue to run during and subsequent to the resolution of his charges in the U.S., and concurrent to any sentence of imprisonment he receives there. The parties have also agreed that this sentence can run concurrently to the 54 months of imprisonment recently ordered for the Defendant’s drug trafficking offences in Quebec.

[ 37 ] I will leave to another day a consideration of this court’s jurisdiction to order how and where the Defendant will serve this sentence of imprisonment in relation to other sentences in other jurisdictions. Suffice to say, in consideration of the principles of totality, in recognition of the Defendant’s extraordinary cooperation with the RCMP, and the demonstrated value of this early guilty plea, all mitigate toward respecting the agreement of the parties for the concurrence of various prison sentences, in my estimation.

Ancillary Orders

[ 38 ] Extortion and participating in the activities of a criminal organization are both primary designated offences for the provision of a sample of deoxyribonucleic acid (“DNA”). The Defendant did not contest the granting of this Order. On this basis, it is appropriate to require that the Defendant provide a sample of his DNA to the authorities for analysis and inclusion in the national DNA databank.

[ 39 ] As part of this Order, I am directing that on or before 28 February 2022, while in custody, the Defendant shall provide his DNA in conditions which respect his privacy, bodily integrity, and health and safety. All appropriate precautions of hygiene and health shall be taken. If the Defendant does not accede to this Order, reasonable force may be used to take the Defendant’s DNA.

[ 40 ] I am directing that restitution in the listed amounts shall be made by the Defendant as follows:

• Cegep St. Felicien - $999,239;
• Elite Group (Continental Casualty Company) - $725,963.52;
• Endoceutics Inc. - $72,503.43;
• Enterprise Robert Thibert Inc. $289,472.00 + $417,449.00 to Travelers Ins. Co. of Canada, for a total amount of $706,921.00;
• Robson Carpenter LLP $2,500;
• Ville de Montmagny $206,737; and
• Windward Software Systems Inc. $91,966.02.

[ 41 ] The parties agree and I Order that the provisions of s. 462.37(2.01) apply. The Defendant has been convicted of a criminal organization offence punishable by five or more years of imprisonment. Within the past 10 years the Defendant has also been involved with a pattern of criminal activity for the purpose of receiving a financial benefit. Lastly, the Defendant’s legitimate employment income cannot reasonably account for the value of all of his property. In these circumstances it is appropriate to Order forfeiture of the following assets (in addition to other property seized by police and agreed to be forfeited by the parties as contained in a draft Forfeiture Order):

• 680.49591411 Bitcoins seized and currently held by police;
• 15.725489349111 Monero (XMR) seized and currently held by police;
• $299,150.00 CAD seized from the Defendant’s residence;
• $238,620.00 CAD seized from National Bank Safe Deposit box #118;
• $98,070 CAD seized from National Bank Safe Deposit box #123; and
• $107,000 CAD seized from Caisse Populaire account 829-00107-85188.

[ 42 ] I also find that s. 462.49(2) of the Code applies. The forfeited property shall first be applied to satisfy the restitution ordered concurrently, above. In other words, I direct that restitution be paid out of proceeds of the forfeiture Order signed on 31 January 2022.

[ 43 ] I will sign a draft Return of Forfeited Property Order prepared and consented to by the parties in respect of items and property seized by the police which is no longer required for this or any other proceeding.

[ 44 ] I am especially indebted to the prosecutor and defence counsel for their commitment and perseverance in arriving at this resolution. After extensive negotiations and reasonable compromises, this matter has concluded in a way that has benefitted the Defendant, our community, and the administration of justice. This resolution would not have been possible without the diligence and superb advocacy of both counsel, for which I am grateful.

Released: 01 February 2022 Justice G. Paul Renwick

[^1]: Details of the investigation are taken from the 35-paged Agreed Statement of Facts, which became exhibit 1 on the guilty plea and sentencing proceedings. [^2]: It is acknowledged by the Defendant that NetWalker was a group dedicated to creating data-theft-for- ransom software and attack strategies that shared its capabilities with cyber threat actors on a split-fee basis. Affiliates were individuals who carried out these data thefts, extorted their victims, and shared up to 20% of the ransoms paid with NetWalker developers. [^3]: These charges were resolved on 21 January 2022. The Defendant was sentenced to 54 months imprisonment for five drug trafficking and related charges and possession of property obtained by crime. [^4]: To put this in perspective, 1 Bitcoin is worth approximately $48,000 CAD today. At this value, 720 Bitcoin is worth approximately $34.5 million CAD. However, it is acknowledged that the value of this cryptocurrency is incredibly volatile. When seized in January 2021, the 720 Bitcoins were only worth about 2/3 as much. [^5]: Exhibit 1B (Appendix B to the Agreed Statement of Facts) estimates that the Defendant received approximately $1.755 million in cash from Bitcoin exchanges from June to September 2020. This exhibit was sealed to prevent unauthorized access to the seized e-wallets. [^6]: Exhibit 1A (Appendix A to the Agreed Statement of Facts) was sealed to protect the Defendant’s privacy interests. Detailed banking and other personal information of the Defendant appeared in this document. [^7]: Yesterday was the Defendant’s first time appearing before the court on these charges. [^8]: This guilty plea took over four hours of actual court time (from 10:00 a.m. until 5:18 p.m.) to complete. It is not an exaggeration to estimate that it saved weeks, if not months, of trial resources. [^9]: This is a gross underestimate, but it is the total value of monies for which restitution is claimed by 7 of the Defendant’s 17 Canadian victims. Several victims were reimbursed for losses by insurance carriers or they have not responded to requests for information about potential restitution claims: Xpertdoc, for example, reported a total loss of $258,300, but because it was re-imbursed by their insurance for $255,800 (a loss which is not included in the $2.8 million estimate), no claim for restitution was sought. [^10]: The Defendant’s legitimate employment income in the two years prior to these allegations was approximately $57,000/year. His income cannot account for his cash on hand or bank savings. [^11]: 2015 SCC 64, [2015] 3 S.C.R. 1089 at para. 58. [^12]: R. v. Hamilton and Mason, [2004] O.J. No. 3252 (C.A.) at para. 102. [^13]: Hamilton, supra, at paras. 90-91. [^14]: R. v. Priest, [1996] O.J. No. 3369 (C.A.) at para. 26, as quoted in Hamilton, supra, at para. 92. [^15]: See subsection 718.2(b) of the Code. [^16]: R. v. Gladue, [1999] S.C.J. No. 19 at paras. 43 and 48. [^17]: For some unknown reason, the Provincial Police Association of Quebec has made no claim for their losses estimated at $1,014,154.39. GoodFellow Inc. never paid any ransom. As a result, their financial information, contracts, and employee data were leaked on the NetWalker blog for others to exploit. It is difficult to quantify the losses (commercial, competitive, and reputational) suffered by this large re-manufacturer and distributor of lumber products. [^18]: Generally, increased and repeated criminality require more onerous sentences in a proportional and measured way. [^19]: To be clear, the Defendant was never arrested or taken into custody for these crimes. The police were trying to analyze the avalanche of data seized from the Defendant’s home and banking records to determine the extent of his culpability when he offered to make a confession. From 24 November 2021, when his confession began, the Defendant could have been arrested. Instead, he remained in a detention facility while his extradition was ordered to be suspended until after these and other charges (in Quebec) were completed. But for these charges, the Quebec matter could have been completed in November, and the Defendant could have been extradited to the U.S. to begin criminal proceedings months ago.