Page No. 1- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CURTIS, MALLET-PREVOST, COLT & MOSLE, LLP 

JACQUES SEMMELMAN (Pro Hac Vice Pending) 

MICHAEL R. GRAIF (NY Bar No. 2499929) 

MICHAEL J. MOSCATO (Pro Hac Vice Pending) 

101 Park Avenue 

New York, New York 10178 

Telephone: (212) 696-6000 

mgraif@curtis.com 

jsemmelman@curtis.com

mmoscato@curtis.com 

DILLINGHAM & MURPHY, LLP 

WILLIAM F. MURPHY, ESQ. (SBN 82482) 

J. CROSS CREASON, ESQ. (SBN 209492) 

ANNA NAGORNAIA, ESQ. (SBN 311549) 

601 Montgomery Street, Suite 1900 

San Francisco, California 94111 

Telephone: (415) 397-2700 

Facsimile: (415) 397-3300 

wfm@dillinghammurphy.com

jcc@dillinghammurphy.com

an@dillinghammurphy.com 

Attorneys for Plaintiff 

The Republic of Kazakhstan 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

THE REPUBLIC OF KAZAKHSTAN,

 Plaintiff, 

 v. 

MURATBEK KETEBAEV and 

ILYAS KHRAPUNOV, 

 Defendants. 

CASE NO. 5:17-cv-00246 

FIRST AMENDED COMPLAINT 

FOR DAMAGES AND 

INJUNCTIVE RELIEF 

Plaintiff the Republic of Kazakhstan ("Plaintiff"), as and for its Amended Complaint against 

Muratbek Ketebaev, Ilyas Khrapunov, and fictitiously named defendants Does 1-100 (collectively 

with Muratbek Ketebaev and Ilyas Khrapunov, the "Defendants") alleges as follows: 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 1 of 16
Page No. 2- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

NATURE OF THE ACTION 

1. This is a civil action for injunctive relief and damages arising under The Computer 

Fraud and Abuse Act, 18 U.S.C. § 1030, and the Stored Communications Act, 18 U.S.C. §§ 2701 et 

seq. As alleged more fully below, Defendants, acting in concert, planned, organized, financed, and 

executed multiple hackings of Gmail and Hotmail accounts and computers used by officials of the 

government of the Republic of Kazakhstan to conduct government business. Defendants stole 

thousands of sensitive, proprietary, confidential and privileged government emails and other 

documents (the "Stolen Materials"). 

2. Defendants have uploaded onto the internet thousands of documents from among the 

Stolen Materials. 

3. As set forth below in greater detail, Defendant Muratbek Ketebaev a/k/a Ketebayev 

("Ketebaev") has invoked his right against self-incrimination when questioned under oath about his 

involvement in the hackings. 

THE PARTIES 

4. Plaintiff is a sovereign nation in Central Asia. 

5. Plaintiff is informed and believes, and on that basis alleges and avers, that in 

engaging in the wrongful acts alleged in this Complaint, Defendants Ketebaev and Khrapunov acted 

in concert and in conspiracy with other persons or entities, whose identities and locations are 

presently unknown to Plaintiff and its counsel. Once the identities and locations of such persons 

and entities are ascertained by Plaintiff, Plaintiff will seek leave of Court to amend this Complaint 

pursuant to Rule 15 of the Federal Rules of Civil Procedure to add such persons and entities as 

named defendants in this action. 

JURISDICTION AND VENUE 

6. This Court has jurisdiction over the subject matter of this action pursuant to 28 

U.S.C. § 1331, as the action arises under the laws of the United States. 

7. This Court has personal jurisdiction over the Defendants as a result of the 

Defendants' unauthorized access into, and misappropriation of information from, a "protected 

computer" as defined in 18 U.S.C. § 1030(e)(2)(B) which is used in and affects interstate or foreign 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 2 of 16
Page No. 3- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

commerce and communication, and as a result of Defendants' intentional and wrongful conduct 

purposefully directed at and causing injurious effect in the United States, including in the Northern 

District of California. 

8. In the alternative, the Court has personal jurisdiction over the Defendants pursuant to 

Fed. R. Civ. P. 4(k)(2). 

9. Venue is proper in this judicial district pursuant to 28 U.S.C. § 1391(b). 

FACTS 

10. On or about January 21, 2015, Plaintiff learned of unauthorized public postings of 

certain of its confidential government documents, and thus became aware that it had been the victim 

of computer hackings. The hackings included obtaining access without authorization to Gmail and 

Hotmail accounts (collectively, the "Hacked Accounts") and computers used by officials of the 

Republic of Kazakhstan to conduct government business. 

11. Defendants, acting in concert and in conspiracy with other presently unknown 

persons or entities, planned, organized, financed, and executed the hackings of the Hacked 

Accounts and computers, and thereby obtained the Stolen Materials. 

12. Defendants perpetrated a series of such hackings over a period of months. 

13. Upon information and belief, in a series of uploadings over a period of months, 

Defendants and/or one or more of their co-conspirators uploaded onto the internet thousands of 

misappropriated government emails and other documents from among the Stolen Materials. Many 

of these emails and other documents contain sensitive, proprietary, and highly confidential 

governmental communications. 

The Hacked Accounts 

14. Gmail is a cloud-based email service provided by Google Inc. ("Google"). Google is 

renowned internationally as a company based in the United States. Google is headquartered in 

Mountain View, California, within the Northern District of California. 

15. Hotmail (also known as "Outlook") is a cloud-based email service provided by 

Microsoft Inc. ("Microsoft"). Microsoft is renowned internationally as a company based in the 

United States. Microsoft is headquartered in Redmond, Washington. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 3 of 16
Page No. 4- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

16. A provider of cloud-based email services stores the contents of all of its users' emails 

on a network of servers that are accessible to its users from anywhere that an internet connection is 

available. While the servers can be located anywhere in the world, the provider of the services is 

able to access and manage the emails wherever they are located, and therefore has possession, 

custody and control of all of its users' emails. 

17. Accordingly, anyone who, without authorization, accesses email accounts 

established with a cloud-based email service, is accessing, without authorization, emails within the 

possession, custody and control of the provider of the cloud-based email service. 

18. The Hacked Accounts were hosted by Google and Microsoft, as part of their cloudbased email services, on computer servers that are "protected computers" under 18 U.S.C. § 

1030(e)(2)(B). The servers that hosted the Hacked Accounts are connected to the internet and 

controlled by Google and Microsoft, and thus are used in and affect interstate or foreign commerce 

or communication. 

19. By accessing the Hacked Accounts without authorization, Defendants Ketebaev and 

Khrapunov and their co-conspirators accessed emails within the possession, custody, and control of 

Google and Microsoft, without authorization. 

20. Defendants Ketebaev and Khrapunov and their co-conspirators knowingly and 

intentionally accessed protected computer servers of Google and Microsoft, without authorization. 

21. Defendants Ketebaev and Khrapunov and their co-conspirators knew that without 

authorization they were accessing protected computer servers of Google and Microsoft, both of 

which are internationally-renowned U.S. companies. 

22. Defendants Ketebaev and Khrapunov and their co-conspirators intended their actions 

to have an effect on, and cause harm to, persons in the United States, including in the Northern 

District of California where Google is headquartered and where effects of the wrongful access 

would be felt. 

23. When Defendant Ketebaev was asked at deposition under oath whether he was 

involved in any manner in the hacking of the Hacked Accounts, he invoked his right not to 

incriminate himself. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 4 of 16
Page No. 5- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

The Mega Website 

24. Twenty-three archives of Stolen Materials (the "Mega Archives") have been 

uploaded onto https://mega.nz (the "Mega Website"), a website maintained by Mega Limited 

("Mega"), a provider of cloud-based services based in New Zealand. 

25. Each of the Mega Archives contains thousands of documents. 

26. Most of the Mega Archives contain emails hacked from the Gmail or Hotmail 

account of a particular custodian, i.e., a specific government official (each one a "Mega 

Custodian"). 

27. The uploading of the Mega Archives was done in stages. In early August 2014, 

someone (upon information and belief, Defendants Ketebaev and Khrapunov and/or one or more of 

their co-conspirators) created an account with Mega and uploaded the first of the Mega Archives. 

Since then, an additional 22 Mega Archives have been uploaded on various occasions, at least as 

recently as April 28, 2015. 

28. Given the sheer volume of documents in each of the Mega Archives, it would be 

extremely unlikely (if not impossible) for someone who is not a hacker or working directly with a 

hacker to have somehow independently collated such a large volume of Stolen Materials and 

catalogued them by Mega Custodian. Upon information and belief, the Mega Archives were 

uploaded by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators. 

29. All 21 Mega Archives that were still active as of July 15, 2016 were uploaded by a 

single Mega account holder. 

30. When Defendant Ketebaev was asked under oath at deposition whether he had ever 

uploaded anything onto the Mega Website, he invoked his right not to incriminate himself. 

The Kazaword Website 

31. On or before August 8, 2014, a website was created under the URL 

https://kazaword.wordpress.com (the "Kazaword Website"). Upon information and belief, the 

Kazaword Website was created by Defendants Ketebaev and Khrapunov and/or one or more of 

their co-conspirators. On or about August 8, 2014, a hyperlink was placed on the Kazaword 

Website that enabled a user to access a Mega Archive. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 5 of 16
Page No. 6- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

32. Over time, as additional Mega Archives were uploaded onto the Mega Website, 

hyperlinks to each of the Mega Archives were added to the Kazaword Website. Each hyperlink 

enabled a user to access a corresponding Mega Archive. Upon information and belief, the 

hyperlinks were added to the Kazaword Website by Defendants Ketebaev and Khrapunov and/or 

one or more of their co-conspirators. 

33. The Kazaword Website does not describe or comment on the content of the Mega 

Archives, except in the most perfunctory manner. As a result, the Kazaword Website is not readily 

found using Google or a comparable search engine. To access the Mega Archives through the 

hyperlinks on the Kazaword Website, a user must first be aware of the existence of the Kazaword 

Website. 

34. When Defendant Ketebaev was asked under oath at deposition whether he was 

involved in any way in setting up the Kazaword Website, he invoked his right not to incriminate 

himself. 

Other Websites That Post or Reference Stolen Materials 

35. Documents from among the Stolen Materials have also been posted or otherwise 

referenced on https://www.facebook.com/mur.ketebayev (the "Ketebaev Facebook Page"); 

www.respublika-kaz.info (the "Respublika Website"); and 

https://www.facebook.com/respublika.kaz.info (the "Respublika Facebook Page"). 

36. The Ketebaev Facebook Page is the personal Facebook Page of Defendant Ketebaev. 

37. Defendant Ketebaev is a poster and user of documents believed to be Stolen 

Materials, some of which are apparently not available in the Mega Archives. For example, on 

February 5, 2015, a post appeared on the Ketebaev Facebook Page that contained Stolen Materials 

that consisted of emails and other documents sent to and from Vladimir Shkolnik, at relevant times 

the Minister of Energy of the Republic of Kazakhstan. Mr. Shkolnik is not a Mega Custodian, and 

the emails and other documents are not believed to be in any of the Mega Archives. The email 

address for Mr. Shkolnik that appears in the post was neither a Gmail address nor a Hotmail 

address. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 6 of 16
Page No. 7- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

38. At relevant times, the Respublika Website has been operated by LLC MediaConsult, an entity owned by Irina Petrushova and her brother Alexander Petrushov. Irina 

Petrushova founded and has served as editor-in-chief of the Respublika Website. Irina Petrushova 

is the wife of Defendant Ketebaev. 

39. Documents from among the Stolen Materials have been posted or referenced on the 

Respublika Website and on the Respublika Facebook Page. 

40. At relevant times, IRC Company, Inc. d/b/a Black Lotus Communications ("Black 

Lotus"), which is based in San Francisco, CA, was the web host for the Respublika Website. 

41. Defendant Ketebaev has been listed in the files of Black Lotus as the first primary 

contact for the entity that at relevant times operated the Respublika Website. 

The Two Posts 

42. On February 11, 2015, and on February 19, 2015, articles were posted on the 

Respublika Facebook Page that contained screenshots of privileged and confidential attorney-client 

communications sent to officials of the Republic of Kazakhstan by Curtis, Mallet-Prevost, Colt & 

Mosle LLP or by Gomez-Acebo & Pombo, a global law firm headquartered in Spain that was 

performing legal services on behalf of, and providing legal advice to, the Republic of Kazakhstan 

(the "Two Posts"). 

43. The screenshots in the Two Posts display, inter alia, Gmail and Hotmail addresses 

used by an official of the Republic of Kazakhstan. Upon information and belief, these documents 

were obtained by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators 

through their hackings of the Gmail and Hotmail accounts of that official. 

The S.D.N.Y. Case 

44. On March 12, 2015, Plaintiff filed a lawsuit in the United States District Court for 

the Southern District of New York against fictitiously named Does 1-100, inclusive (the "S.D.N.Y. 

Case"). See The Republic of Kazakhstan v. Does 1-100, Inclusive, 15 Civ. 1900 (ER) (S.D.N.Y.). 

45. On March 13, 2015, the Court in the S.D.N.Y. Case issued a Temporary Restraining 

Order (the "TRO"). 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 7 of 16
Page No. 8- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

46. In accordance with the Court's order regarding service of the TRO, on March 13, 

2015 counsel for Plaintiff posted "Comments" on the Respublika Facebook Page, alerting 

Respublika to the litigation and to the TRO, and including a link to a special-purpose Facebook 

page that Plaintiff's counsel created pursuant to the TRO that contained PDF copies of the 

Complaint, the TRO, and the supporting papers. 

47. Sometime between March 13 and March 18, 2015, the Two Posts were removed 

from the Respublika Facebook Page. 

48. According to Facebook, Inc., only the administrator of a Facebook page has the 

ability to remove a post. 

49. The Court in the S.D.N.Y. Case authorized certain third-party discovery. 

50. No defendant was named in the S.D.N.Y. Case. On January 17, 2017, Plaintiff filed 

a notice of voluntary dismissal without prejudice in the S.D.N.Y. Case. 

The KazNet Articles 

51. The Ketebaev Facebook Page has posted links to a series of articles about KazNet (a 

company in Kazakhstan) titled "Who is behind KazNet?" (the "KazNet Articles"). 

52. The KazNet Articles contain screenshots of, and excerpts from, documents from 

among the Stolen Materials that do not appear to be in any of the Mega Archives. 

53. The links on the Ketebaev Facebook Page are to PDFs of the KazNet Articles that 

have been uploaded onto the Mega Website (separate from the Mega Archives). 

54. Upon information and belief, the KazNet Articles have been uploaded to the Mega 

Website by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators. 

Ketebaev Invokes His Right Against Self-Incrimination 

55. On May 22, 2015, Plaintiff filed a motion in the S.D.N.Y. Case, pursuant to Fed. R. 

Civ. P. 28(b) and The Hague Convention on the Taking of Evidence Abroad in Civil or Commercial 

Matters, March 18, 1970, 23 U.S.T. 2555, T.I.A.S. No. 7444 (reprinted at 28 U.S.C. § 1781) for the 

issuance of a Letter of Request to take the deposition of Defendant Ketebaev in Poland, where he 

resides. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 8 of 16
Page No. 9- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

56. By Order dated October 28, 2015, the Court in the S.D.N.Y. Case granted the motion 

(as amended). 

57. Pursuant to the Letter of Request, on June 7, 2016, Defendant Ketebaev was deposed 

by counsel for the Plaintiff in the District Court for the Śródmieście Borough of the Capital City of 

Warsaw, Poland. A Polish judge (Hon. Małgorzata Klonowska) presided over the deposition. 

Ketebaev's primary language is said to be Russian. The Court supplied a Polish-Russian interpreter. 

Also present was a Polish-English interpreter. 

58. At the outset of the deposition, Defendant Ketebaev announced on the record that he 

was refusing to testify. The Court instructed the Polish-Russian interpreter to translate for 

Ketebaev Article 261 of the Code of Civil Procedure of the Republic of Poland, which sets forth all 

of the grounds upon which a witness may lawfully refuse to testify. Paragraph 2 of that Article 

provides, in relevant part: "A witness may refuse to answer a question if his testimony could expose 

him ... to criminal liability ..." 

59. Defendant Ketebaev again stated to the Court on the record that he was refusing to 

testify. Asked by the Court to identify the specific ground in Article 261 upon which he based his 

refusal to testify, Ketebaev invoked Paragraph 2 of Article 261, and stated his fear of exposure to 

criminal liability. 

60. The Court instructed Defendant Ketebaev that he had the right to invoke this ground 

(i.e., self-incrimination) as a basis to refuse to answer questions, but that he could not do so on an 

anticipatory basis without first hearing each question. The Court stated to Ketebaev that "you are 

asked a question and then you refuse, if you feel that you may be exposed to criminal liability, but 

you need to find out what the question is." The Court then administered the oath to Ketebaev. 

61. Counsel for the Plaintiff asked Defendant Ketebaev a series of questions related to 

the hackings. In response to virtually every question, Ketebaev invoked his right against selfincrimination under Article 261, paragraph 2, and refused to answer the question on that basis. Such 

questions included: 

a. "Were you involved in any manner in the hacking of Gmail and Hotmail 

accounts used by officials of the government of Kazakhstan?" 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 9 of 16
Page No. 10- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

b. "Were you involved in financing of the hacking of Gmail and Hotmail 

accounts used by officials of the government of Kazakhstan?" 

c. "Were you involved in the advance planning of any of the hackings that were 

perpetrated either on - or against the computer servers of the Republic of Kazakhstan or the 

Gmail and Hotmail accounts used by officials of the Government of Kazakhstan?" 

d. "Mr. Ketebaev, could you tell us please who planned the hackings of the 

computer servers of the Republic of Kazakhstan and of the Gmail and Hotmail accounts 

used by officials of the Republic of Kazakhstan?" 

e. "Could you please tell us who financed the hackings of the computer servers 

of the Republic of Kazakhstan and of the Gmail and Hotmail accounts of officials of the 

government of Kazakhstan?" 

f. "Could you tell us please the identity of the hacker or the hackers who 

actually hacked the computer servers of the Republic of Kazakhstan and the Gmail and the 

Hotmail accounts used by officials of the government of Kazakhstan?" 

g. "Did you know in advance of any of the hackings, that the hackings were 

going to take place?" 

h. "Were you involved in any way in setting up a website called Kazaword?" 

i. "Are you familiar with a website operated by a company called Mega?" 

j. "Have you ever uploaded anything onto the website operated by Mega?" 

62. As noted above, while under oath, Defendant Ketebaev invoked his right against 

self-incrimination as the ground for his refusal to answer every single one of these questions. 

Khrapunov States That He Orchestrated Numerous Hackings 

63. A confidential witness has stated, under oath, that he was present at a meeting with 

Defendant Khrapunov in Geneva, Switzerland in or around November of 2013. 

64. At the meeting, Defendant Khrapunov stated that he had orchestrated multiple 

hackings by retaining the services of a hacking firm based in Israel. These hackings included the 

hacking of the cell phone and email account of the French prosecutor handling the extradition case 

against Mukhtar Ablyazov, Defendant Khrapunov’s father-in-law. Defendant Khrapunov also 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 10 of 16
Page No. 11- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

stated that he had orchestrated the hacking of the email accounts of numerous employees of the 

Republic of Kazakhstan. 

65. According to the confidential witness, the hacked materials were delivered to 

Defendant Khrapunov. 

FIRST CAUSE OF ACTION 

Violation of The Computer Fraud and Abuse Act 

(18 U.S.C. § 1030) 

66. Plaintiff incorporates by reference as though fully set forth herein the allegations 

contained in paragraphs 1 through 65 above. 

67. Defendants Ketebaev and Khrapunov and their co-conspirators violated The 

Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2)(C), by intentionally accessing protected 

computers without authorization, and by obtaining the Stolen Materials from such protected 

computers. 

68. Defendants Ketebaev and Khrapunov and their co-conspirators violated The 

Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(B), by intentionally accessing protected 

computers without authorization, and as a result of such conduct, recklessly causing damage to 

Plaintiff. 

69. Defendants Ketebaev and Khrapunov and their co-conspirators violated The 

Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(C), by intentionally accessing protected 

computers without authorization, and as a result of such conduct, causing damage and loss to 

Plaintiff. 

70. Upon information and belief, Defendants Ketebaev and Khrapunov and the other, 

currently unknown, persons and entities acted jointly and in concert with one another. 

71. 18 U.S.C. § 1030(g) of the Computer Fraud and Abuse Act provides that any 

"person who suffers damage or loss by reason of a violation of this section may maintain a civil 

action against the violator to obtain compensatory damages and injunctive relief or other equitable 

relief." Pursuant to 18 U.S.C. §§ 1030(g), (a)(2)(C), and (c)(4)(A)(i)(I) of the Computer Fraud and 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 11 of 16
Page No. 12- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Abuse Act, a civil action may be brought if the conduct involves a loss during any one-year period 

aggregating at least $5,000 in value. 

72. As a proximate result of the violations of the Computer Fraud and Abuse Act by 

Defendants Ketebaev and Khrapunov and their co-conspirators, Plaintiff has suffered damage and 

loss in excess of $5,000 within a one-year period, consisting of expenses (not including attorneys' 

fees) to investigate the hackings and to control and remediate the damage Defendants Ketebaev and 

Khrapunov and their co-conspirators caused. 

73. Plaintiff has suffered and continues to suffer damage and loss by reason of 

Defendants Ketebaev's and Khrapunov's and their co-conspirators' wrongful conduct. 

74. Plaintiff has been and continues to be irreparably harmed by the ongoing use and 

dissemination of documents from among the Stolen Materials. 

75. As a proximate result of these violations, Plaintiff has suffered damage and loss in 

an amount to be proven at trial, and, absent injunctive relief, faces likely irreparable harm. 

76. Under 18 U.S.C. § 1030(g) of the Computer Fraud and Abuse Act, Plaintiff is 

entitled to an award of compensatory damages and injunctive and equitable relief. 

77. Defendants Ketebaev and Khrapunov and their co-conspirators are not entitled to 

benefit from their own wrongdoing by further disclosing, disseminating, posting, displaying, 

sharing, distributing, hosting, copying, viewing, accessing, providing access to or making available 

to anyone any documents from among the Stolen Materials. 

78. The Court should therefore enjoin any further use, disclosure, dissemination, 

posting, display, sharing, distribution, hosting, copying, viewing, accessing, provision of access to 

or making available to anyone, in any manner whatsoever, any of the Stolen Materials. 

79. The Court should order the disabling of the Kazaword Website, the deletion of the 

Mega Archives and the KazNet Articles, and the deletion of hyperlinks to the Mega Archives and to 

the KazNet Articles. 

80. The Court should also order the deletion of posts that contain or reference any 

documents from among the Stolen Materials, and the deletion of hyperlinks to files that contain or 

reference any documents from among the Stolen Materials. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 12 of 16
Page No. 13- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

SECOND CAUSE OF ACTION 

Violation of The Stored Communications Act 

(18 U.S.C. §§ 2701 ET SEQ.) 

81. Plaintiff incorporates by reference as though fully set forth herein the allegations 

contained in paragraphs 1 through 65 above. 

82. Defendants Ketebaev and Khrapunov and their co-conspirators violated 18 U.S.C. § 

2701(a)(1) of the Stored Communications Act by knowingly and intentionally accessing without 

authorization a facility through which an electronic communication service is provided and thereby 

obtaining documents from among the Stolen Materials that included wire or electronic 

communications, while such communications were in electronic storage in such system. 

83. Defendants Ketebaev and Khrapunov and their co-conspirators knowingly and 

intentionally accessed without authorization the Hacked Accounts. To access the Hacked 

Accounts, Defendant Ketebaev and his co-conspirators accessed servers of Google and Microsoft, 

each of which is a "facility" within the meaning of 18 U.S.C. § 2701(a)(1) of the Stored 

Communications Act. Defendants Ketebaev and Khrapunov and their co-conspirators had no 

authorization to access any of these servers or any of the Hacked Accounts. 

84. The Stolen Materials obtained by Defendants Ketebaev and Khrapunov and their coconspirators from the Hacked Accounts were in electronic storage in the above-mentioned servers 

at the time Defendants Ketebaev and Khrapunov and their co-conspirators accessed them without 

authorization. 

85. The actions of Defendants Ketebaev and Khrapunov and their co-conspirators 

violated the Stored Communications Act and were willful and intentional. Defendants Ketebaev 

and Khrapunov and their co-conspirators, despite knowing that their access to the above-mentioned 

servers were not authorized, continued over a period of months to repeatedly access and obtain 

electronic documents. 

86. Upon information and belief, Defendants Ketebaev and Khrapunov and their coconspirators acted jointly and in concert with one another. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 13 of 16
Page No. 14- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

87. 18 U.S.C. § 2707(a) of the Stored Communications Act provides that any "person 

aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged 

in with a knowing or intentional state of mind may, in a civil action, recover from the person or 

entity, other than the United States, which engaged in that violation such relief as may be 

appropriate." 

88. 18 U.S.C. § 2707(b) and (c) of the Stored Communications Act provide that "[i]n a 

civil action under this section, appropriate relief" may include equitable relief, an award of 

damages, reasonable attorneys' fees, and litigation costs reasonably incurred. If the violation is 

willful or intentional, the court may also assess punitive damages. 

89. Plaintiff has been and continues to be irreparably harmed by the illegal 

misappropriation and ongoing public dissemination of documents from among the Stolen Materials. 

90. Plaintiff has suffered and continues to suffer damage and loss by reason of the 

wrongful conduct of Defendants Ketebaev and Khrapunov and their co-conspirators. 

91. As a proximate result of these violations, Plaintiff has suffered damage and loss in 

an amount to be proven at trial, and, absent injunctive relief, faces likely irreparable harm. 

92. Under 18 U.S.C. §§ 2707(a), (b) and (c) of the Stored Communications Act, Plaintiff 

is entitled to an award of compensatory and punitive damages, an award of reasonable attorneys' 

fees and expenses, and injunctive relief. 

93. Defendants Ketebaev and Khrapunov and their co-conspirators are not entitled to 

benefit from their own wrongdoing by further disclosing, disseminating, posting, displaying, 

sharing, distributing, hosting, copying, viewing, accessing, providing access to or making available 

to anyone any of the Stolen Materials obtained from the Hacked Accounts. 

94. The Court should therefore enjoin any further use, disclosure, dissemination, 

posting, display, sharing, distribution, hosting, copying, viewing, accessing, provision of access to 

or making available to anyone, in any manner whatsoever, any documents from among the Stolen 

Materials obtained from the Hacked Accounts. 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 14 of 16
Page No. 15- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

95. The Court should order the disabling of the Kazaword Website, the deletion of the 

Mega Archives and the KazNet Articles, and the deletion of hyperlinks to the Mega Archives and to 

the KazNet Articles. 

96. The Court should also order the deletion of posts that contain or reference any 

documents from among the Stolen Materials obtained from the Hacked Accounts, and the deletion 

of hyperlinks to files that contain or reference any documents from among the Stolen Materials 

obtained from the Hacked Accounts. 

PRAYER FOR RELIEF 

 WHEREFORE, Plaintiff the Republic of Kazakhstan demands judgment against the 

Defendants jointly and severally as follows: 

(a) Adjudging that the Defendants' actions violated The Computer Fraud and Abuse Act, 

18 U.S.C. § 1030, and the Stored Communications Act, 18 U.S.C. §§ 2701 et seq.; 

(b) Enjoining the Defendants, their affiliates, employees, agents, and representatives, 

and all persons acting in concert or participation with Defendants, from using, disclosing, 

disseminating, posting, displaying, sharing, distributing, hosting, copying, viewing, accessing, 

providing access to or making available to anyone, in any manner whatsoever, any of the Stolen 

Materials; 

(c) Ordering the disabling of the Kazaword Website and of all hyperlinks to the Mega 

Archives; 

(d) Ordering the deletion of the Mega Archives from the Mega Website; 

(e) Ordering the deletion of the KazNet Articles from the Mega Website; 

(f) Ordering the deletion from the Ketebaev Facebook Page of all posts that contain or 

reference any documents from among the Stolen Materials, and of all hyperlinks to files on the 

Mega Website that contain or reference any documents from among the Stolen Materials, including 

hyperlinks to the KazNet Articles; 

(g) Awarding Plaintiff compensatory and punitive damages in an amount to be 

determined at trial; 

(h) Awarding Plaintiff its costs and reasonable attorneys' fees; and 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 15 of 16
Page No. 16- Case No. 5:17-cv-00246 

FIRST AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(i) Awarding such other and further relief as the Court deems just and proper. 

Dated: January 20, 2017 

Respectfully submitted, 

CURTIS, MALLET-PREVOST, 

 COLT & MOSLE LLP 

JACQUES SEMMELMAN 

MICHAEL R. GRAIF 

MICHAEL J. MOSCATO 

DILLINGHAM & MURPHY, LLP 

WILLIAM F. MURPHY 

J. CROSS CREASON 

ANNA NAGORNAIA 

By ______________________________ 

 Attorneys for Plaintiff the Republic 

 of Kazakhstan 

/s/ William F. Murphy 

Case 5:17-cv-00246-HRL Document 8 Filed 01/20/17 Page 16 of 16