Page No. 1- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CURTIS, MALLET-PREVOST, COLT & MOSLE, LLP 

JACQUES SEMMELMAN (Admitted Pro Hac Vice) 

MICHAEL J. MOSCATO (Admitted Pro Hac Vice) 

MICHAEL R. GRAIF (NY Bar No. 2499929) 

NICOLE M. MAZANITIS (Admitted Pro Hac Vice) 

101 Park Avenue 

New York, New York 10178 

Telephone: (212) 696-6000 

jsemmelman@curtis.com 

mmoscato@curtis.com 

mgraif@curtis.com 

nmazanitis@curtis.com

DILLINGHAM & MURPHY, LLP 

WILLIAM F. MURPHY, ESQ. (SBN 82482) 

J. CROSS CREASON, ESQ. (SBN 209492) 

ANNA NAGORNAIA, ESQ. (SBN 311549) 

601 Montgomery Street, Suite 1900 

San Francisco, California 94111 

Telephone: (415) 397-2700 

Facsimile: (415) 397-3300 

wfm@dillinghammurphy.com

jcc@dillinghammurphy.com

an@dillinghammurphy.com 

Attorneys for Plaintiff 

The Republic of Kazakhstan 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

THE REPUBLIC OF KAZAKHSTAN,

 Plaintiff, 

 v. 

MURATBEK KETEBAEV and 

ILYAS KHRAPUNOV, 

 Defendants. 

CASE NO. 5:17-cv-00246 

THIRD AMENDED 

COMPLAINT FOR 

DAMAGES AND 

INJUNCTIVE RELIEF 

Plaintiff THE REPUBLIC OF KAZAKHSTAN (“Plaintiff”), as and for its Third Amended 

Complaint against MURATBEK KETEBAEV and ILYAS KHRAPUNOV (Ketebaev and Khrapunov 

are referenced collectively as the “Defendants”), alleges as follows: 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 1 of 34
Page No. 2- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

NATURE OF THE ACTION 

1. This is a civil action for injunctive relief and damages arising under the Computer 

Fraud and Abuse Act, 18 U.S.C. § 1030, and the Stored Communications Act, 18 U.S.C. §§ 2701 et 

seq. As alleged more fully below, Defendants, acting in concert between themselves and with others, 

planned, organized, financed, and executed multiple hackings of computer servers owned by Google 

Inc. (“Google”) and Microsoft, Inc. (“Microsoft”) in order to unlawfully access without authorization 

Gmail and Hotmail accounts used, at the direction of the Republic of Kazakhstan, by its officials to 

conduct its government business. Defendants’ hackings enabled the Defendants and their coconspirators to steal from the Plaintiff thousands of sensitive, proprietary, confidential, and privileged 

government emails and other documents (the “Stolen Materials”). 

2. Defendants and/or their co-conspirators stole and uploaded onto the internet thousands 

of documents from among the Stolen Materials, including privileged and confidential attorney-client 

communications between the Plaintiff and its New York-based law firm. 

3. As set forth below in greater detail, Defendant Muratbek Ketebaev a/k/a Ketebayev has 

invoked his right against self-incrimination when questioned under oath about his involvement in the 

hackings. 

4. As further set forth below in greater detail, Defendant Ilyas Khrapunov has admitted to 

a close business associate and confidante that he orchestrated and paid for the hackings of the officials 

of the Republic of Kazakhstan. 

THE PARTIES 

5. Plaintiff is a sovereign nation in Central Asia. 

6. Upon information and belief, Defendant Muratbek Ketebaev (“Ketebaev”) is a citizen 

of the Republic of Kazakhstan and currently resides in Poland. 

7. Upon information and belief, Defendant Ilyas Khrapunov (“Khrapunov”) is a citizen of 

the Republic of Kazakhstan and currently resides in Switzerland. 

8. Plaintiff is informed and believes, and on that basis alleges and avers, that in engaging 

in the wrongful acts alleged in this Complaint, Defendants Ketebaev and Khrapunov acted in concert 

and in conspiracy between themselves and with other persons or entities, whose identities and 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 2 of 34
Page No. 3- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

locations are presently unknown to Plaintiff and its counsel. Once the identities and locations of such 

persons and entities are ascertained by Plaintiff, Plaintiff will seek leave of Court to amend this 

Complaint pursuant to Rule 15 of the Federal Rules of Civil Procedure to add such persons and entities 

as named defendants in this action. 

JURISDICTION AND VENUE 

9. This Court has jurisdiction over the subject matter of this action pursuant to 28 U.S.C. 

§ 1331, as the action arises under the laws of the United States. 

10. This Court has personal jurisdiction over the Defendants as a result of the Defendants’ 

unauthorized access into, and theft of emails and other documents from, a “protected computer” as 

defined in 18 U.S.C. § 1030(e)(2)(B) which is used in and affects interstate or foreign commerce and 

communication, and as a result of Defendants’ intentional and wrongful tortious conduct purposefully 

directed at and causing injurious effect to Plaintiff and third parties in the United States, including in 

the Northern District of California, as alleged herein in greater detail. 

11. In addition, pursuant to N.Y. C.P.L.R. § 302, the United States District Court for the 

Southern District of New York has personal jurisdiction over the Defendants as a result of the 

Defendants’ unauthorized access into, and theft of emails and other documents from, a “protected 

computer” as defined in 18 U.S.C. § 1030(e)(2)(B) which is used in and affects interstate or foreign 

commerce and communication, and as a result of Defendants’ intentional and wrongful tortious 

conduct purposefully directed at and causing injurious effect to Plaintiff and third parties in the United 

States, including in the Southern District of New York, as alleged herein in greater detail. 

12. Pursuant to N.Y. C.P.L.R. § 301, Defendant Khrapunov is also subject to general 

jurisdiction in New York, as he has been doing business in the state, including purchasing and selling 

tens of millions of dollars of real estate in New York through controlled alter ego entities. 

13. This Court has determined that Defendant “Khrapunov is subject to personal 

jurisdiction in the Southern District of New York.” See Order Granting Motion to Dismiss Second 

Amended Complaint With Leave to Amend, ECF No. 067, at 22. 

14. In addition, there is nationwide general jurisdiction over Defendant Khrapunov 

pursuant to Fed. R. Civ. P. 4(k)(2) as a result of his substantial, continuous and systematic contacts 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 3 of 34
Page No. 4- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

with the United States, including engaging, through controlled alter ego entities, in purchases and sales 

of tens of millions of dollars of U.S. real estate, including purchases and sales in California, New 

York, and Ohio. 

15. There is also nationwide specific jurisdiction over Defendant Khrapunov pursuant to 

Fed. R. Civ. P. 4(k)(2) as Defendant Khrapunov knowingly and intentionally (personally and/or acting 

through agents): (1) unlawfully accessed without authorization computer servers owned by Google (a 

California-based company) and Microsoft (a Washington-based company), and thereby unlawfully 

accessed without authorization email accounts hosted by Google and Microsoft; (2) used the services 

of WordPress, a platform operated by Automattic, Inc. (a website hosting company based in San 

Francisco, CA), to create a website that provided links to tens of thousands of documents from among 

the Stolen Materials; and (3) directed his actions toward and intended to cause harm to two U.S.-based 

law firms – Curtis, Mallet-Prevost, Colt & Mosle LLP (“Curtis”) (a New York-based firm), and 

Latham & Watkins LLP (“Latham”) (a California-based firm). 

16. Upon information and belief, Defendant Khrapunov has not consented, and does not 

consent, to jurisdiction in any court of the United States. 

17. Venue is proper in this judicial district pursuant to 28 U.S.C. §§ 1391(b) & (c). 

FACTS 

Plaintiff Becomes Aware it Has Been Hacked 

18. On or about January 21, 2015, Plaintiff learned of unauthorized public postings of 

certain of its confidential government documents, and thus became aware that it had been the victim of 

computer hackings. The hackings included unlawfully accessing without authorization computer 

servers owned by Google and Microsoft, and thereby unlawfully accessing without authorization 

Gmail accounts hosted by Google, and a Hotmail account hosted by Microsoft (collectively, the 

“Hacked Accounts”) used, at the direction of the Republic of Kazakhstan, by its officials to conduct 

government business. 

19. Defendants, acting in concert and in conspiracy between themselves and with other 

presently unknown persons or entities, planned, organized, financed, and executed the hackings of the 

Hacked Accounts and computer servers, and thereby obtained the Stolen Materials. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 4 of 34
Page No. 5- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

20. Defendants perpetrated a series of such hackings over a period of months. 

21. Among the government officials who were hacked was Marat Beketayev, at that time 

Executive Secretary of the Ministry of Justice (Gmail and Hotmail accounts). 

22. In addition to the aforementioned hackings of the Google and Microsoft servers in 

order to unlawfully access Gmail and Hotmail accounts, the Defendants and/or their co-conspirators 

unlawfully accessed other email accounts used, at the direction of the Republic of Kazakhstan, by 

various officials to conduct its government business, as well as email accounts of other hacking targets 

not part of the government of the Republic of Kazakhstan. 

23. It is believed that the hackings began in or around November of 2013. 

24. Upon information and belief, in a series of uploadings over a period of months, Defendants 

and/or one or more of their co-conspirators uploaded onto the internet thousands of stolen government 

emails and other documents from among the Stolen Materials, as well as materials hacked from other 

email accounts of government officials and other hacking targets. Many of these emails and other 

documents contain sensitive, proprietary, privileged, and highly confidential governmental 

communications. 

25. Among the thousands of hacked emails and other hacked documents posted on the 

internet by the Defendants were privileged and confidential communications between the Plaintiff and 

its New York-based counsel, the Curtis law firm, which at all times has been headquartered in New 

York City, as expressly stated on its website. 

26. Curtis lawyers who represent and provide legal advice and assistance to the Republic of 

Kazakhstan include, inter alia, Askar Moukhitdinov, Esq. (a member of the bar of the State of 

Connecticut and of the Republic of Kazakhstan), and Jacques Semmelman, Esq. (a member of the bar 

of the States of New York, New Jersey, and Pennsylvania). Mr. Semmelman maintains his office in 

Curtis’ New York headquarters. The Defendants and/or their co-conspirators specifically selected 

some of these privileged and confidential emails between Plaintiff and the Curtis law firm as among 

the very first hacked emails to single out for publication on the internet. In doing so, Defendants 

caused harm to the Plaintiff in the United States (including in New York) and elsewhere by breaching 

the attorney-client privilege between Plaintiff and its New York-based counsel. The first known 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 5 of 34
Page No. 6- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

publication of these privileged and confidential hacked emails occurred on February 11, 2015 and 

February 19, 2015. 

27. Additionally, the hacked emails included privileged and confidential attorney-client 

email communications sent to and from the California-based Latham law firm, which represents the 

City of Almaty, Kazakhstan, in an action in the United States District Court for the Central District of 

California (the “Central District RICO Action”), alleging, inter alia, violations of the Racketeering 

Influenced and Corrupt Organizations Act (“RICO”), breach of fiduciary duty, conversion, and fraud, 

against various members of the Khrapunov family, including Defendant Ilyas Khrapunov, and related 

entities. 

28. Latham lawyers who represent and provide legal advice and assistance to the City of 

Almaty include multiple attorneys who are members of the bar of the State of California, and who 

maintain their offices in Latham’s Los Angeles, CA office. Upon information and belief, the 

Defendants and/or their co-conspirators directed their actions toward and intended to cause harm in 

California by obtaining without authorization and improperly using privileged and confidential 

attorney-client communications between Latham and its clients. 

Plaintiff Takes Remedial Measures 

29. After having learned of the hackings, Plaintiff began to take steps to respond to the 

offenses by investigating the hackings in order to understand how the hackings had been perpetrated 

and the extent and scope of the hackings; to assess the damage the hackers had caused; and to take 

appropriate remedial measures. 

30. In connection with these steps, Plaintiff retained an international forensic consulting 

firm (the “Forensic Consultant”). 

31. The Forensic Consultant concluded that, more likely than not, the hackers had used a 

“phishing” technique to obtain email account usernames and passwords from the officials of the 

government of the Republic of Kazakhstan. 

32. “Phishing” expeditions can take several forms. In one form, a hacker sends an email to 

a target, either from a legitimate email account (such as a Gmail or Hotmail account), or from a 

spoofed email account intended to trick the recipient into believing the account is legitimate. The 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 6 of 34
Page No. 7- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

email invites the target to log into a familiar account (such as Gmail or Hotmail) by clicking on a link 

embedded in the email. The link, which is designed by hackers to appear legitimate, directs the target 

to a replica of the familiar account’s website (oftentimes a webmail login page), which is, again, 

crafted by the hacker to appear authentic. When the target logs into the seemingly legitimate – but 

bogus – website, malicious software captures the user’s login keystrokes and the login information 

(i.e., the target’s account username and password), which is thereby stolen by the hacker. The hacker 

is then able to access the target’s email account directly, by using the stolen login information. The 

Forensic Consultant concluded that, more likely than not, the hackers used this form of “phishing” to 

access the Hacked Accounts. 

33. Specifically, the Defendants and their co-conspirators established Gmail and Hotmail 

accounts and used them to send “phishing” emails to their targets, disguised as if they came from 

Google and Microsoft, respectively. The “phishing” emails contained a link that, when clicked on, 

took the targets to bogus but realistic-looking replicas of the login pages for Gmail and Hotmail, 

respectively. The hackers created these bogus webpages in order to deceive the targets into believing 

they were logging into actual Gmail and Hotmail websites. The targets logged into the counterfeit 

websites, and malware captured the login keystrokes, which thereby enabled the hackers to obtain the 

targets’ usernames and passwords. Using that information, the hackers were thereafter able to login to 

the targets’ Gmail and Hotmail accounts at will. 

34. By stealing the usernames and passwords for the Hacked Accounts, the hackers 

compromised the security and impaired the integrity of the Hacked Accounts, thereby causing damage 

to Plaintiff, and increased the risk of further damage to Plaintiff, as it enabled the hackers to continue 

to access the Hacked Accounts, the emails and other data in the Hacked Accounts, and the servers that 

store those emails and other data in order to further damage Plaintiff. 

35. As of January 15, 2016, Plaintiff had incurred and paid expenses to the Forensic 

Consultant in excess of $274,000 during a one-year period, to perform the investigative, damage 

assessment, and remedial services described above. Of that sum, at least $5,000 was for the purpose 

of investigating the hackings and assessing the damage. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 7 of 34
Page No. 8- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

The Hacked Accounts 

36. Gmail is a cloud-based email service provided by Google. Google is renowned 

internationally as a company based in the United States, specifically in California. Google is 

headquartered in Mountain View, California, within the Northern District of California. Upon 

information and belief, the Defendants were aware that Google is a U.S.-based company 

headquartered in California. 

37. Hotmail is a cloud-based email service provided by Microsoft. Microsoft is renowned 

internationally as a company based in the United States, specifically in Washington. Microsoft is 

headquartered in Redmond, Washington. Upon information and belief, the Defendants were aware that 

Microsoft is a U.S.-based company headquartered in Washington. 

38. As reported by Google on its website, the majority of its data centers (where its servers 

are located) are in the United States. 

39. A provider of cloud-based email services stores the contents of all of its users’ emails 

on a network of servers designed to be accessible to its users from anywhere that an internet 

connection is available. While the servers can be located anywhere in the world, the provider of the 

services is able to access and manage the emails wherever they are located, and therefore has 

possession, custody, and control of all of its users’ emails. 

40. Certain cloud-based email service providers, including Google, “shard” their users’ 

data, resulting in data storage not being static. Instead, the data is broken into pieces – shards – and 

stored as strings of 0’s and 1’s in various places around the world. The storage location of the data is 

changed from time to time, based on considerations of efficiency. At any given moment in time an 

email can be stored in fragments in several locations, and at a different moment in time, the same 

email can be stored in fragments in several other locations. Regardless of where the shards of data are 

stored at any given moment, control of Google’s data is maintained from Google’s headquarters in 

California, where Google exercises security over its customers’ accounts. 

41. Accordingly, anyone who, without authorization, accesses email accounts established 

with a cloud-based email service, is accessing, without authorization, emails within the possession, 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 8 of 34
Page No. 9- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

custody, and control of the provider of the cloud-based email service and breaching the security of the 

provider – in this case Google and Microsoft. 

42. The Hacked Accounts were hosted by Google and Microsoft, as part of their 

cloud-based email services, on computer servers that are “protected computers” under 18 U.S.C. 

§ 1030(e)(2)(B). The servers that hosted the Hacked Accounts are connected to the internet and 

controlled by Google and Microsoft, and thus are used in and affect interstate or foreign commerce or 

communication. 

43. By accessing the Hacked Accounts without authorization, Defendants Ketebaev and 

Khrapunov and their co-conspirators knowingly and intentionally accessed emails within the 

possession, custody, and control of Google and Microsoft, without authorization. 

44. Defendants Ketebaev and Khrapunov and their co-conspirators also knowingly and 

intentionally accessed protected computer servers of Google and Microsoft, without authorization. 

45. Defendants Ketebaev and Khrapunov and their co-conspirators knew that without 

authorization they were accessing protected computer servers of Google and Microsoft, both of which 

are internationally-renowned U.S. companies. 

46. Defendants Ketebaev and Khrapunov and their co-conspirators intended their tortious 

actions, which included unlawfully accessing the computer servers of major U.S. email service 

providers, and disseminating on the internet privileged and confidential communications of the 

Plaintiff with its New York-based law firm, to cause harm to the Plaintiff in the United States 

(including in California and New York) and to cause harm to the Plaintiff through conduct in the 

United States. 

47. Defendants Ketebaev and Khrapunov and their co-conspirators also intended their 

actions to cause harm to third parties (Google, Microsoft, Latham, and Curtis) in the United States, 

including in California and New York. 

48. In its annual 10-K’s filed with the Securities and Exchange Commission, Google and 

its parent Alphabet have disclosed that phishing attacks on Google’s customers can harm Google. The 

10-K’s disclose that phishing attacks on Google’s customers “can result in significant legal and 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 9 of 34
Page No. 10- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

financial exposure, damage to our reputation and a loss of confidence in the security of our products 

and services that could potentially have an adverse effect on our business.” 

49. Similarly, in its annual 10-K filed with the Securities and Exchange Commission, 

Microsoft has disclosed that phishing attacks on Microsoft’s customers can harm Microsoft. 

Microsoft’s 10-K for 2017 states that hackers use “social engineering techniques to induce our 

employees, users, partners, or customers to disclose passwords or other sensitive information or take 

other actions to gain access to our data or our users’ or customers’ data. . . . Breaches of our network 

or data security could disrupt the security of our internal systems and business applications, impair our 

ability to provide services to our customers and protect the privacy of their data, result in product 

development delays, compromise confidential or technical business information harming our 

reputation or competitive position, . . . or otherwise adversely affect our business.” 

The Mega Website 

50. Multiple archives of Stolen Materials as well as hacked materials stolen from accounts 

used by officials of the Republic of Kazakhstan as well as by other hacking targets (the “Mega 

Archives”) have been uploaded onto https://mega.nz (the “Mega Website”), a website maintained by 

Mega Limited (“Mega”), a provider of cloud-based services based in New Zealand. 

51. Each of the Mega Archives contains thousands of documents. 

52. Certain Mega Archives contain emails hacked from the Gmail or Hotmail account of a 

particular custodian (each one a “Mega Custodian”). 

53. The uploading of the Mega Archives was done in stages. In early August 2014, 

someone (upon information and belief, Defendants Ketebaev and Khrapunov and/or one or more of 

their co-conspirators) created an account with Mega for the purpose of uploading various materials 

obtained via illegal hacking, including Stolen Materials. 

54. Given the sheer volume of documents in each of the Mega Archives, it would be 

extremely unlikely (if not impossible) for someone who is not a hacker or working directly with a 

hacker to have somehow independently collated such a large volume of Stolen Materials and 

catalogued them by Mega Custodian. Upon information and belief, the Mega Archives were uploaded 

by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 10 of 34
Page No. 11- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

55. When Defendant Ketebaev was asked under oath at deposition whether he had ever 

uploaded anything onto the Mega Website, he invoked his right not to incriminate himself. 

The Kazaword Website 

56. On or before August 8, 2014, a website was created through an open-source blog and 

website hosting platform – WordPress – under the URL https://kazaword.wordpress.com (the 

“Kazaword Website”). 

57. WordPress is operated by Automattic, Inc., a website hosting company based in San 

Francisco, CA. 

58. Upon information and belief, the Kazaword Website was created by Defendants 

Ketebaev and Khrapunov and/or one or more of their co-conspirators. 

59. This conclusion is reinforced by the fact that, when Defendant Ketebaev was asked 

under oath at deposition whether he was involved in any way in setting up the Kazaword Website, he 

invoked his right not to incriminate himself. 

60. This conclusion is also reinforced by the fact that on July 19, 2017, in the federal case 

described below as the “New York RICO Action,” Defendant Khrapunov filed Affidavits of André 

Tronchet, a Swiss bailiff hired by Defendant Khrapunov to attest to the printing and downloading of 

various documents from the internet, including from the Kazaword Website. In the Affidavits, Mr. 

Tronchet identified Defendant Khrapunov as his “principal.” Mr. Tronchet also referred to “my 

principal’s website, at the following address: https://kazaword.wordpress.com.” Thus, Defendant 

Khrapunov’s agent has admitted under oath that the Kazaword Website is Defendant Khrapunov’s 

website. Moreover, by filing these Affidavits in the New York RICO Action, Defendant Khrapunov 

has relied upon and ratified Mr. Tronchet’s statements. 

61. On or about August 8, 2014, a hyperlink was placed on the Kazaword Website that 

enabled a user to access a Mega Archive. 

62. Over time, as additional Mega Archives were uploaded onto the Mega Website, 

hyperlinks to each of the Mega Archives were added to the Kazaword Website. Each hyperlink 

enabled a user to access a corresponding Mega Archive. Upon information and belief, the hyperlinks 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 11 of 34
Page No. 12- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

were added to the Kazaword Website by Defendants Ketebaev and Khrapunov and/or one or more of 

their co-conspirators. 

63. The Kazaword Website does not describe or comment on the content of the Mega 

Archives, except in the most perfunctory manner. As a result, the Kazaword Website is not readily 

found using Google or a comparable search engine. To access the Mega Archives through the 

hyperlinks on the Kazaword Website, a user must first be aware of the existence of the Kazaword 

Website. 

Other Websites That Post or Reference Stolen Materials 

64. Documents from among the Stolen Materials have also been posted or otherwise 

referenced on https://www.facebook.com/mur.ketebayev (the “Ketebaev Facebook Page”); 

www.respublika-kaz.info (the “Respublika Website”); and 

https://www.facebook.com/respublika.kaz.info (the “Respublika Facebook Page”). 

65. The Ketebaev Facebook Page is the personal Facebook Page of Defendant Ketebaev. 

66. Defendant Ketebaev is a poster and user of documents believed to be hacked from 

officials of the Republic of Kazakhstan, some of which are apparently not available in the Mega 

Archives. For example, on February 5, 2015, a post appeared on the Ketebaev Facebook Page that 

included screenshots of emails and other documents sent to and from Vladimir Shkolnik, at relevant 

times the Minister of Energy of the Republic of Kazakhstan. Mr. Shkolnik is not a Mega Custodian, 

and the emails and other documents are not believed to be in any of the Mega Archives. The email 

address for Mr. Shkolnik that appears in the post was neither a Gmail address nor a Hotmail address. 

67. At relevant times, the Respublika Website has been operated by LLC Media-Consult, 

an entity owned by Irina Petrushova and her brother Alexander Petrushov. Irina Petrushova founded 

and has served as editor-in-chief of the Respublika Website. Irina Petrushova is the wife of Defendant 

Ketebaev. 

68. At relevant times, IRC Company, Inc. d/b/a Black Lotus Communications (“Black 

Lotus”), which is based in San Francisco, CA, was the web host for the Respublika Website. 

69. Defendant Ketebaev has been listed in the files of Black Lotus as the first primary 

contact for the entity that at relevant times operated the Respublika Website. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 12 of 34
Page No. 13- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

70. Documents from among the Stolen Materials have been posted or referenced on the 

Respublika Website and on the Respublika Facebook Page. 

Other Federal Litigations Pending Against Defendant Ilyas Khrapunov 

71. On May 13, 2014, Latham, on behalf of the City of Almaty, Kazakhstan, filed the 

Central District RICO Action alleging, inter alia, violations of RICO, breach of fiduciary duty, 

conversion, and fraud, against various members of the Khrapunov family, including Defendant Ilyas 

Khrapunov. 

72. The Central District RICO Action seeks primarily to recover funds stolen by Almaty’s 

corrupt former mayor, Viktor Khrapunov, and his co-conspirators, including his stepson Ilyas 

Khrapunov and other members of the Khrapunov family. 

73. In substance, the City of Almaty alleges that Viktor Khrapunov and his co-conspirators 

stole many millions of dollars in assets from the City of Almaty, and conspired with Ilyas Khrapunov 

and other family members, using alter ego sham entities they own and control, to launder and hide 

significant portions of the misappropriated assets in the United States, including in California. 

74. Among the hacked emails were privileged attorney-client email communications 

between lawyers at Latham’s Los Angeles, CA office and Latham’s clients. In these email 

communications, exchanged during the period March 5-13, 2014, Latham and its clients made 

reference to a complaint that was to be filed against “VK” – Viktor Khrapunov (Defendant Ilyas 

Khrapunov’s stepfather), as well as members of Viktor Khrapunov’s “family.” 

75. Upon information and belief, the complaint referenced in these communications was a 

draft of the complaint filed by Latham on May 13, 2014 to commence the Central District RICO 

Action. Upon information and belief, Defendant Khrapunov and his co-conspirators used this 

information to unlawfully gain advance knowledge of Latham’s and the City of Almaty’s plan to 

initiate asset-recovery litigation in California against Viktor Khrapunov and members of his family, 

including Defendant Ilyas Khrapunov. 

76. On October 12, 2015, the City of Almaty and BTA Bank JSC (“BTA Bank”) filed 

claims in a pending action in the United States District Court for the Southern District of New York 

(the “New York RICO Action”), alleging, inter alia, violations of RICO, fraudulent transfer, 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 13 of 34
Page No. 14- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

conversion, and fraud against Ilyas Khrapunov, his stepfather Viktor Khrapunov, and his father-in-law 

Mukhtar Ablyazov. 

77. The New York RICO Action seeks primarily to recover funds stolen by Viktor 

Khrapunov and his co-conspirators from the City of Almaty, as well as funds stolen by Mukhtar 

Ablyazov and his co-conspirators from BTA Bank. 

78. In substance, the City of Almaty and BTA Bank allege that (i) Viktor Khrapunov and 

his co-conspirators stole many millions of dollars in assets from the City of Almaty, and conspired 

with Ilyas Khrapunov and other family members, using alter ego sham entities they own and control, 

including Triadou SPV S.A. (“Triadou”), to launder and hide significant portions of the 

misappropriated assets in the United States, including in New York real estate; (ii) Mukhtar Ablyazov 

stole several billions of dollars from BTA Bank, and conspired with his son-in-law Ilyas Khrapunov 

and other family members, using alter ego sham entities they own and control, including Triadou, to 

launder and hide significant portions of the misappropriated assets in the United States, including in 

New York real estate. 

79. Upon information and belief, Defendant Khrapunov’s motivation in orchestrating and 

funding the hackings described herein was to steal confidential government documents from the 

Republic of Kazakhstan (and other victims) in order to help his father-in-law Mukhtar Ablyazov, his 

stepfather Viktor Khrapunov, and other conspirators, including Ablyazov’s driver, henchman and 

accomplice Alexandr Pavlov, escape justice for their criminal wrongdoings. 

The Two Posts 

80. On February 11, 2015, and on February 19, 2015, articles were posted on the 

Respublika Facebook Page that contained screenshots of fourteen privileged and confidential attorneyclient email communications between and among officials of the Republic of Kazakhstan, Curtis, and 

Gomez-Acebo & Pombo (“Gomez”), a global law firm headquartered in Spain. Attached as Exhibit 1 

are true and correct copies of these articles. Both law firms were performing legal services on behalf 

of, and providing legal advice to, the Republic of Kazakhstan (the “Two Posts”). 

81. The majority of the fourteen posted emails concerned efforts by the Republic of 

Kazakhstan and its counsel in New York and Spain to extradite Pavlov (Ablyazov’s accomplice) from 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 14 of 34
Page No. 15- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Spain to the Republic of Kazakhstan. Accompanying the posted emails were allegations, intended to 

discredit the Republic of Kazakhstan and its New York and Spanish extradition counsel (Curtis and 

Gomez, respectively), to the effect that they had engaged in unlawful, and possibly criminal, 

interference with the judicial process in the Pavlov extradition case in Spain. 

82. Thus, the post dated February 11, 2015 alleged: 

 That “Spanish judges are working for Kazakhstan”; 

 That information supplied to Spain by “British and Polish judicial authorities were 

generated under the influence of lobbyists of the Kazakh authorities”; and 

 That Curtis supposedly engaged in “unlawful interference with the judiciary” of Spain 

which could be a “criminal offense in Spain[.]” 

83. The posted emails and other materials did not support these accusations, but the 

Defendants and their co-conspirators used the fact that they had obtained privileged and confidential 

emails to lend credibility to their assertions, causing harm to the Plaintiff and to Curtis in the United 

States (including in New York) and elsewhere. 

84. In a similar vein, the post dated February 19, 2015 expressed the “hope that our posts 

about how Kazakh authorities have used illegal and politically motivated pressure on certain Spanish 

officials and judges, will be taken into account by the Spanish public and press.” 

85. The screenshots in the Two Posts also displayed, inter alia, Gmail and Hotmail 

addresses used by an official of the Republic of Kazakhstan, Marat Beketayev, at that time the 

Executive Secretary of the Ministry of Justice. Upon information and belief, these documents were 

obtained by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators through 

their hackings of the Gmail and Hotmail accounts of that government official. 

86. By unlawfully accessing and posting privileged and confidential attorney-client 

communications between the Plaintiff and Curtis, Defendants Ketebaev and Khrapunov and their 

co-conspirators knowingly and intentionally breached the Plaintiff’s attorney-client privilege and 

thereby intentionally caused harm to the Plaintiff and Curtis in the United States (including in New 

York). 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 15 of 34
Page No. 16- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

The S.D.N.Y. Hacking Case 

87. On March 12, 2015, Plaintiff filed a lawsuit under the Computer Fraud and Abuse Act, 

18 U.S.C. § 1030, in the United States District Court for the Southern District of New York against 

fictitiously named Does 1-100, inclusive (the “S.D.N.Y. Hacking Case”). See The Republic of 

Kazakhstan v. Does 1-100, Inclusive, 15 Civ. 1900 (ER) (S.D.N.Y.). 

88. On March 13, 2015, the Court in the S.D.N.Y. Hacking Case issued a Temporary 

Restraining Order (the “TRO”) finding good cause to believe that a hacking of the computers of 

Kazakhstan government officials had occurred, and enjoining the (then-unidentified) hackers, and 

those acting in concert with the hackers, from, inter alia, using, disseminating, or posting any of the 

Stolen Materials. 

89. In accordance with the Court’s order regarding service of the TRO, on March 13, 2015 

counsel for Plaintiff posted “Comments” on the Respublika Facebook Page, alerting Respublika to the 

litigation and to the TRO, and including a link to a special-purpose Facebook page that Plaintiff's 

counsel created pursuant to the TRO that contained PDF copies of the Complaint, the TRO, and the 

supporting papers. 

90. On March 20, 2015, the Court issued a Preliminary Injunction against the hackers and 

those acting in concert with the hackers (ECF No. 10). The Preliminary Injunction is a matter of 

public record and is incorporated by reference. 

91. Inter alia, the Court found good cause to believe: 

a. “Defendants have engaged in acts and practices that violate the Computer Fraud 

and Abuse Act (18 U.S.C. ¶ 1030)” (¶ 2); 

b. “[T]his Court has jurisdiction over the Defendants as a result of Defendants’ 

unauthorized access into, and misappropriation of information from, a 

‘protected computer’ as defined in 18 U.S.C. § 1030(e)(2)(B), which is used for 

commerce and communication with persons and entities in New York, and as a 

result of Defendants’ wrongful conduct causing injurious effect in New York” 

(¶ 4); 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 16 of 34
Page No. 17- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

c. “Defendants have already posted some of the Stolen Materials to various 

websites” (¶ 16); 

d. “At least fourteen posted emails from among the Stolen Materials have been 

posted to these sites. The fourteen posted emails consist of privileged and 

confidential attorney-client communications sent to officials of the Republic of 

Kazakhstan by Curtis or by Gomez-Acebo & Pombo” (¶ 16); 

e. “The fourteen emails that have been publicly disclosed by the Defendants are 

attorney-client privileged communications from the two law firms to their 

mutual client, the Republic of Kazakhstan” (¶ 16); 

f. “Plaintiff has already been damaged by the illegal misappropriation, and by the 

public dissemination of just a small portion of the Stolen Materials” (¶ 17); 

g. “[A]ny further disclosure of the Stolen Materials will inevitably result in 

additional irreparable harm to Plaintiff, as it is likely that further disclosures of 

the Stolen Materials will reveal additional, sensitive, proprietary, and 

confidential information that belongs to the Republic of Kazakhstan, including 

privileged communications between the Republic of Kazakhstan and its 

attorneys located in the U.S. and elsewhere” (¶ 19) (emphasis in original); 

h. “Plaintiff has suffered and continues to suffer damage and loss (in excess of 

$5,000) by reason of Defendants’ wrongful conduct” (¶ 20); 

i. “Plaintiff is likely to prove a violation of 18 U.S.C. §§ 1030(a)(2)(C), (a)(5)(B), 

and (a)(5)(C)” (¶ 21); 

j. “Plaintiff will continue to suffer irreparable harm if Defendants are not 

preliminarily enjoined from further dissemination of the Stolen Materials. 

Defendants have already posted at least fourteen emails from among the Stolen 

Materials to various publicly available websites. The fourteen emails are 

attorney-client privileged communications from two law firms (one based in 

New York City) to their mutual client, the Republic of Kazakhstan. The harm 

from such disclosure cannot be quantified and is irreparable.” (¶ 22); 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 17 of 34
Page No. 18- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

k. “[A]ny further disclosure of the Stolen Materials will inevitably result in 

additional irreparable harm to Plaintiff, as it is likely that further disclosures of 

the Stolen Materials will reveal additional sensitive, proprietary, and 

confidential information that belongs to the Republic of Kazakhstan, including 

privileged communications between the Republic of Kazakhstan and its 

attorneys located in the U.S. and elsewhere.” (¶ 23). 

92. The Court authorized certain third-party discovery, including, as discussed below, the 

deposition of Defendant Ketebaev. 

Ketebaev Invokes His Right Against Self-Incrimination 

93. On May 22, 2015, Plaintiff filed a motion in the S.D.N.Y. Hacking Case, pursuant to 

Fed. R. Civ. P. 28(b) and The Hague Convention on the Taking of Evidence Abroad in Civil or 

Commercial Matters, March 18, 1970, 23 U.S.T. 2555, T.I.A.S. No. 7444 (reprinted at 28 U.S.C. § 

1781), for the issuance of a Letter of Request to take the deposition of Defendant Ketebaev in Poland, 

where he resides. 

94. By Order dated October 28, 2015, the Court in the S.D.N.Y. Hacking Case granted the 

motion (as amended). 

95. Pursuant to the Letter of Request, on June 7, 2016, Defendant Ketebaev was deposed 

by counsel for the Plaintiff in the District Court for the Śródmieście Borough of the Capital City of 

Warsaw, Poland. A Polish judge (Hon. Małgorzata Klonowska) presided over the deposition. 

Ketebaev's primary language is said to be Russian. The Court supplied a Polish-Russian interpreter. 

Also present was a Polish-English interpreter. 

96. At the outset of the deposition, Defendant Ketebaev announced on the record that he 

was refusing to testify. The Court instructed the Polish-Russian interpreter to translate for Ketebaev 

Article 261 of the Code of Civil Procedure of the Republic of Poland, which sets forth all of the 

grounds upon which a witness may lawfully refuse to testify. Paragraph 2 of that Article provides, in 

relevant part: “A witness may refuse to answer a question if his testimony could expose him . . . to 

criminal liability . . . .” 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 18 of 34
Page No. 19- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

97. Defendant Ketebaev again stated to the Court on the record that he was refusing to 

testify. Asked by the Court to identify the specific ground in Article 261 upon which he based his 

refusal to testify, Ketebaev invoked Paragraph 2 of Article 261, and stated his fear of exposure to 

criminal liability. 

98. The Court instructed Defendant Ketebaev that he had the right to invoke this ground 

(i.e., self-incrimination) as a basis to refuse to answer questions, but that he could not do so on an 

anticipatory basis without first hearing each question. The Court stated to Ketebaev that “you are 

asked a question and then you refuse, if you feel that you may be exposed to criminal liability, but you 

need to find out what the question is.” The Court then administered the oath to Ketebaev. 

99. Counsel for the Plaintiff asked Defendant Ketebaev a series of questions related to the 

hackings. In response to virtually every question, Ketebaev invoked his right against selfincrimination under Article 261, paragraph 2, and refused to answer the question on that basis. Such 

questions included: 

a. “Were you involved in any manner in the hacking of Gmail and Hotmail 

accounts used by officials of the government of Kazakhstan?” 

b. “Were you involved in financing of the hacking of Gmail and Hotmail accounts 

used by officials of the government of Kazakhstan?” 

c. “Were you involved in the advance planning of any of the hackings that were 

perpetrated either on - or against the computer servers of the Republic of 

Kazakhstan or the Gmail and Hotmail accounts used by officials of the 

Government of Kazakhstan?” 

d. “Mr. Ketebaev, could you tell us please who planned the hackings of the 

computer servers of the Republic of Kazakhstan and of the Gmail and Hotmail 

accounts used by officials of the Republic of Kazakhstan?” 

e. “Could you please tell us who financed the hackings of the computer servers of 

the Republic of Kazakhstan and of the Gmail and Hotmail accounts of officials 

of the government of Kazakhstan?” 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 19 of 34
Page No. 20- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

f. “Could you tell us please the identity of the hacker or the hackers who actually 

hacked the computer servers of the Republic of Kazakhstan and the Gmail and 

the Hotmail accounts used by officials of the government of Kazakhstan?” 

g. “Did you know in advance of any of the hackings, that the hackings were going 

to take place?” 

h. “Were you involved in any way in setting up a website called Kazaword?” 

i. “Are you familiar with a website operated by a company called Mega?” 

j. “Have you ever uploaded anything onto the website operated by Mega?” 

100. As noted above, while under oath, Defendant Ketebaev invoked his right against 

self-incrimination as the ground for his refusal to answer every single one of these questions. 

101. Over the course of approximately 22 months following the inception of the S.D.N.Y. 

Hacking Case, Plaintiff gradually came to learn information that revealed that the purpose and scope 

of the hackings were broader than originally believed. While initially it was reasonably believed, 

based upon the Two Posts, that the goal of the hackings was to misappropriate and publish privileged 

and confidential attorney-client communications in an attempt to discredit the Plaintiff and its New 

York-based counsel in connection with the extradition proceedings against Pavlov, additional 

information came to light that indicated that this was part of a larger scheme. 

102. As described above, the hackers’ modus operandi (which was not known to Plaintiff at 

the time it filed the S.D.N.Y. Hacking Case) involved the impersonation by the hackers of Google and 

Microsoft in order to perpetrate “phishing” attacks, deceive the targets, steal their login information, 

access their Gmail and Hotmail accounts and Google’s and Microsoft’s servers without authorization, 

and use the Stolen Materials in various ways. Accordingly, while there was and remains a basis for 

specific jurisdiction in the Southern District of New York, there appeared to be a different, and 

potentially stronger basis, premised on the deliberate targeting of Google, for specific jurisdiction in 

the Northern District of California, where Google is headquartered, and where Google exercises 

security over its customer’s accounts, and maintains control of the data in those accounts. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 20 of 34
Page No. 21- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

103. On January 17, 2017, Plaintiff filed a notice of voluntary dismissal without prejudice in 

the S.D.N.Y. Hacking Case. On January 18, 2017, Plaintiff initiated the instant action in the Northern 

District of California. 

The Hacking Admissions by Defendant Khrapunov

104. Defendant Khrapunov has admitted to, and in fact has boasted of, being the organizer 

and funder of, and the mastermind behind, the hackings. 

105. Nicolas Bourg was a long-time business associate and confidante of Defendant 

Khrapunov’s. He has known Defendant Khrapunov since 2006. Between 2011 and late 2014, at 

Defendant Khrapunov’s invitation, Bourg was retained by, and worked closely with Defendant 

Khrapunov on various operational, management, and investment matters. 

106. Bourg has stated, under oath, that he was present at a meeting with Defendant 

Khrapunov in Geneva, Switzerland in or around November of 2013. 

107. At the meeting, Defendant Khrapunov admitted that he had planned and orchestrated 

multiple hackings by retaining the services of a hacking firm based in Israel. The hackings to which 

he admitted included the hacking of the cell phone and email account of the French prosecutor 

handling an extradition case against Mukhtar Ablyazov, Defendant Khrapunov’s father-in-law. 

108. Defendant Khrapunov also admitted to Bourg that he had orchestrated the hacking of 

the email accounts of numerous employees of the Republic of Kazakhstan. 

109. Bourg reaffirmed that testimony on September 11, 2017, when he was deposed in the 

New York RICO Action. He testified that in late 2013, he attended a meeting with Defendant 

Khrapunov in Geneva. At the end of the meeting, “Ilyas showed us a pile of documents and claimed 

that this was proof of hacking, and he maintained that this was hacking of the – into the accounts of 

the French prosecution authorities and the Kazak – Kazak prosecution.” Bourg testified that 

Defendant Khrapunov admitted to him that some of the hacked documents in the pile were “from the 

Kazakhstani prosecutor.” Bourg further testified that Defendant Khrapunov told him the hackings had 

been carried out by an Israeli company, and that Defendant Khrapunov told him “that he received all 

these documents every week in printed form, and that he paid every week the sum of $200,000 for this 

service.” 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 21 of 34
Page No. 22- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

110. At relevant times, Defendant Khrapunov’s father-in-law Mukhtar Ablyazov was 

incarcerated in France, facing extradition demands by the Russian Federation and the Ukraine for his 

crimes against BTA Bank. 

111. At relevant times, Ablyazov’s henchman and accomplice Alexandr Pavlov was in 

Spain, facing an extradition demand by the Republic of Kazakhstan for his role in Ablyazov’s crimes 

against BTA Bank as well as his involvement in a terrorist plot in the Republic of Kazakhstan that was 

intercepted and aborted. 

112. Defendant Khrapunov hired and paid the hackers in order to obtain confidential 

communications, including privileged attorney-client communications, of government officials and 

others, including French government officials involved in the efforts to extradite Ablyazov from 

France, and Republic of Kazakhstan government officials involved in the efforts to extradite Pavlov, 

Ablyazov’s accomplice, from Spain. 

113. As part of and in furtherance of the scheme, Defendant Khrapunov and his coconspirators stole and publicly disseminated privileged and confidential attorney-client 

communications, including communications between Plaintiff and Curtis, in order to derail the 

extradition attempts. 

Facts Relating to General Jurisdiction Over Defendant Khrapunov 

114. In addition to specific jurisdiction in California and New York, Khrapunov is subject to 

nationwide general jurisdiction under Fed. R. Civ. P. 4(k)(2). 

115. Defendant Khrapunov, acting through owned and controlled alter ego entities, has had 

substantial, continuous, and systematic contacts with the United States, subjecting him to general 

jurisdiction in accordance with Fed. R. Civ. P. 4(k)(2). Upon information and belief, there is such a 

unity of interest and ownership between Defendant Khrapunov and the alter ego entities that separate 

personalities do not exist; and the failure to disregard their separate identities would result in fraud or 

injustice. 

116. As described in more detail below, starting in 2012, and continuing through the present, 

Defendant Khrapunov has purchased and sold tens of millions of dollars of U.S. real estate, including: 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 22 of 34
Page No. 23- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Purchasing two luxury homes in Beverly Hills, CA (one in 2012, the other in 2013) for 

more than $5 million each, and selling each home at a profit; 

 Purchasing a $34 million interest in 2012 in a New York City real estate development 

project to convert a hotel into luxury condominiums, and selling the interest in 2014 for 

$32 million; 

 Purchasing a $6 million interest in 2013 in a New York City real estate development 

project to convert a former medical center into luxury condominiums, and selling the 

interest in 2014 for $6 million; 

 Purchasing a shopping mall in Cincinnati, OH in 2013 for approximately $29 million, 

and selling the mall later that year for approximately $40 million; and 

 Purchasing real estate in Syracuse, NY in 2013 for $1.9 million, which he has 

attempted to sell since 2015, apparently without success. 

117. Annexed as Exhibit 2 is a chart that summarizes these purchases and sales. 

A. Defendant Khrapunov’s Purchase and Sale of Two Luxury Homes in Beverly Hills, CA

118. Defendant Khrapunov and his wife Madina (the daughter of Mukhtar Ablyazov) 

purchased two luxury homes in Beverly Hills, CA, the first in 2012, the second in 2013. They owned 

the first home until they sold it in July of 2013, and the second home until they sold it in March of 

2016. 

119. Specifically, on or about March 16, 2012, Defendant Khrapunov and his wife used their 

owned and controlled alter ego entity, Candian International Ltd. (“Candian”), to purchase the first 

California home at 606 North Alta Drive, Beverly Hills, CA (the “606 Home”), for $5.45 million. 

120. According to public record sources, on or about July 30, 2013, the 606 Home was sold 

for approximately $6.975 million. 

121. On or about January 22, 2013, Defendant Ilyas Khrapunov and his wife used another 

owned and controlled alter ego entity, 628 Holdings LLC, to purchase their second California home, at 

628 North Alta Drive, Beverly Hills, CA (the “628 Home”) for $6.2 million. 

122. According to public record sources, on or about March 29, 2016, the 628 Home was 

sold for $7.2 million. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 23 of 34
Page No. 24- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

B. Defendant Khrapunov’s Purchases and Sales of 

Commercial Real Estate in the United States 

123. In addition to the two luxury homes in Beverly Hills, starting in or around 2012, 

Defendant Khrapunov, acting through owned and controlled alter ego sham entities, purchased and 

sold tens of millions of dollars of real estate assets in New York and Ohio. These purchases and sales 

were made by Defendant Khrapunov through Triadou and its subsidiaries. 

124. Triadou is a subsidiary of the Swiss Development Group (“SDG”). 

125. At certain relevant times, Nicolas Bourg was the sole Director of Triadou. 

126. Bourg has stated under oath that at the direction of Defendant Khrapunov, he formed a 

series of entities under the laws of Luxembourg for the purpose of investing Khrapunov and Ablyazov 

funds in real estate. One such entity “was Triadou, an investment vehicle wholly owned and 

controlled by SDG. SDG itself was owned and controlled by Ilyas and his family, and used to conceal 

the movement and investment of his family’s money, including that of Ablyazov.” 

127. Bourg has also stated under oath that “Triadou is a shell entity for SDG, and has no 

corporate presence separate from SDG. Triadou had no employees and no offices or headquarters. 

Although I was Triadou’s sole director, I was paid by SDG as an ‘independent consultant,’ conducted 

all business meetings at SDG’s offices, had an SDG e-mail address, and received all of my instructions 

from Ilyas, acting as SDG’s president.” 

128. Bourg has further stated under oath that “any funds transferred for Triadou’s benefit 

would immediately be moved overseas through a chain of other Ablyazov- or Khrapunov-controlled 

entities. Where Triadou has been owed funds in the past, that money never went directly to Triadou or 

remained in the United States, and was always moved directly to other” Ablyazov-Khrapunov entities. 

1. Defendant Khrapunov’s Purchases and Sales of Real Estate in New York City 

129. In 2012, through Triadou, Defendant Khrapunov purchased an interest from the Chetrit 

Group, a New York-based real estate company, in a New York City real estate project that involved 

converting the Flatotel property in Manhattan into luxury condominiums (the “Flatotel Project”). 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 24 of 34
Page No. 25- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

130. Defendant Khrapunov, through Triadou, acquired a 37.5% interest in the Flatotel 

Project. Through Triadou, Defendant Khrapunov’s capital invested in the Flatotel property totaled 

$34,885,565. 

131. In 2014, Defendant Khrapunov, through Triadou, sold his interest in the Flatotel Project 

back to the Chetrit Group for a sum believed to be approximately $32 million. 

132. In 2013, Defendant Khrapunov purchased a $6 million interest with the Chetrit Group 

in a second New York City real estate project, which involved converting the former Cabrini Medical 

Center in Manhattan into luxury condominiums (the “Cabrini Project”). 

133. The purchase of the interest in the Cabrini Project was made by Defendant Khrapunov 

through Triadou’s wholly-owned subsidiary, Argon Holding Corp. (“Argon”). 

134. At certain relevant times, Nicolas Bourg was the sole Director and President of Argon. 

135. Upon information and belief, like its parent Triadou, Argon was an alter ego sham 

entity beneficially owned and controlled by Defendant Ilyas Khrapunov and members of his family. 

136. In 2014, Defendant Khrapunov, through Triadou and Argon, sold his interest in the 

Cabrini Project back to Chetrit for a sum believed to be $6 million. 

137. Bourg has stated under oath that at least $7 million in funds due Triadou for its sales of 

its real estate interests did not go to Triadou but instead were wired to an account in Geneva, 

Switzerland “for the benefit of SDG, identified as a ‘loan on behalf of Triadou SPV S.A.’” 

2. Defendant Khrapunov’s Purchase and Sale in Cincinnati, OH 

138. In April of 2013, through Triadou’s wholly-owned subsidiary Tri-County Mall 

Investors, LLC (“Tri-County”), Defendant Ilyas Khrapunov purchased the mortgage on the Tri-County 

Mall in Cincinnati for approximately $29 million (the “Ohio Mall Property”). 

139. At relevant times, Nicolas Bourg was sole Member and Manager of Tri-County. 

140. Upon information and belief, like its parent Triadou, Tri-County was an alter ego sham 

entity beneficially owned and controlled by Defendant Ilyas Khrapunov along with members of his 

family. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 25 of 34
Page No. 26- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

141. On or about July 18, 2013, Tri-County sold its interest in the Ohio Mall Property at a 

foreclosure auction for approximately $45 million. The net sale proceeds after expenses were 

approximately $40 million. 

142. Bourg has stated under oath that the approximately $40 million from the sale “did not 

flow to Triadou, but were instead moved to other Ablyazov-Khrapunov entities and then out of the 

United States.” 

3. Defendant Khrapunov’s Purchase in Syracuse, New York 

143. In 2013, through Triadou’s wholly-owned subsidiary Argon, and Argon’s whollyowned subsidiary Syracuse Center LLC, Defendant Ilyas Khrapunov purchased the Syracuse MixedUse Complex (the “Syracuse Property”), a 600,000 square foot property in Syracuse, New York, at 

auction for $1.9 million. 

144. Upon information and belief, at the time, the assessed market value of the Syracuse 

Property was $4,250,000. 

145. At certain relevant times, Nicolas Bourg was the Sole Member and Manager of 

Syracuse Center LLC. 

146. Upon information and belief, as a subsidiary of Argon and Triadou, Syracuse Center 

LLC is an alter ego sham entity beneficially owned and controlled by Defendant Ilyas Khrapunov 

along with members of his family. 

147. Email correspondence demonstrates that at least during 2015 and 2016, an individual 

who identifies himself as “Ilias” (believed to be Defendant Ilyas Khrapunov) has been actively 

attempting to find a buyer for the Syracuse Property, through the services of Syracuse real estate 

brokers. 

148. To date, upon information and belief, Defendant Khrapunov has not sold the Syracuse 

Property. 

The June 24, 2016 Memorandum and Order 

149. On May 19, 2016, the Hon. Alison J. Nathan, United States District Judge for the 

Southern District of New York, presided over an evidentiary hearing in the New York RICO Action. 

Bourg testified at the evidentiary hearing. The Court ruled that it “finds Bourg’s testimony credible.” 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 26 of 34
Page No. 27- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

150. Following the evidentiary hearing, in a Memorandum and Order filed June 24, 2016, 

the Court issued an order of attachment in favor of the City of Almaty and BTA Bank against 

Triadou’s assets in the United States. See CF 135 Flat LLC v. Triadou SPV N.A., No. 15- CV-5345 

(AJN), 2016 U.S. Dist. LEXIS 82821, at *39 (S.D.N.Y. June 24, 2016). 

151. The Court made numerous findings of fact, including: 

a. “Ilyas Khrapunov Found[ed] SDG and Triadou[.]” Id. at *8. 

b. “Triadou, like SDG and Telford [another entity], was ‘used to conceal the 

movement and investment’ of Khrapunov and Ablyazov funds.” Id. at *37. 

c. “Ilyas Khrapunov, son-in-law to Ablyazov, and his sister Elvira provided initial 

funding of between 35 and 40 million Swiss Francs (CHF) to SDG.” Id. at *7. 

d. Ilyas Khrapunov purported to sell SDG to a crony named Glatz, but “SDG 

[Was] Sold to Glatz in a Sham Sale[.]” Id. at *12. 

e. “Glatz used funds loaned to him by the Khrapunov family to purchase” SDG. 

Id. at *16. 

f. “As a result of this arrangement, SDG was ‘sold’ for a mere CHF 3.5 million 

(its equity value) when Glatz’s investment bank valued the enterprise value of 

the company at CHF 150 million.” Id. at *16. 

g. Ilyas “Khrapunov and his sister did not withdraw their CHF 35-40 million 

investment 

from SDG after the purported sale.” Id. at *16. 

h. “Triadou’s argument that the sale of SDG to Glatz was legitimate is not 

credible.” Id. at *12-13. 

i. Various “‘badges of fraud’ are apparent in Triadou’s 2014 assignment of its 

Flatotel interest back to the Chetrit Entities.” Id. at *34. 

j. “As the Court found, and Triadou admitted, it had invested $34,885,565 . . . into 

the Flatotel project, Bourg valued the project between $62 and $100 million, the 

Board was informed that the project was worth $100 million, but the assignment 

was consummated for approximately $32 million.” Id. at *34. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 27 of 34
Page No. 28- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

k. “Due to Triadou’s implausible explanation of this below-market assignment and 

temporal proximity between the sale and the initiation of litigation [by Latham 

on behalf of the City of Almaty] in California, the Court found that the 

assignment was motivated by the threat of litigation in California.” Id. at *35. 

l. “[T]he ‘inadequacy of consideration’ and ‘general chronology of events and 

transactions under inquiry,’ notably the liquidation of assets in response to the 

threat of litigation in California, demonstrate that the 2014 assignment was 

undertaken with fraudulent intent.” Id. at *35. 

m. “Triadou has . . . already ‘with intent to . . . frustrate the enforcement of a 

judgment that might be rendered . . . assigned property’ (its Flatotel interest) 

and has attempted, through its enforcement efforts in New York, to ‘remove[] 

. . . from the state’ the consideration due on that assignment agreement.” Id. 

at *35. 

The June 7, 2017 Memorandum and Order 

152. In a Memorandum and Order dated June 7, 2017 and filed June 16, 2017, the Hon. 

Katharine H. Parker, United States Magistrate Judge for the Southern District of New York, issued 

various discovery rulings in the New York RICO Action. See City of Almaty v. Ablyazov, No. 15 Civ. 

5345, at ECF No. 330 (S.D.N.Y.). 

153. The Court found: “There is no dispute that Ilyas Khrapunov funded the New York real 

estate investments (the Flatotel and a new condominium complex being built at the site of the former 

Cabrini Medical Center) through defendant Triadou, an entity formed under the laws of Luxembourg 

with its principal place of business in Switzerland.” (ECF No. 330, at 2-3.) 

154. The Court further stated: “[T]he court finds that the Kazakh Entities [the City of 

Almaty and BTA Bank] have provided sufficient evidence to show that Triadou and SDG are alter 

egos for the purpose of this motion.” (ECF No. 330, at 16-17.) 

155. The Court explained that “[t]he Kazakh Entities argue that Triadou was intentionally 

kept insolvent and point to several examples where money owed to Triadou was instead directed to 

SDG by SDG, despite the fact that Triadou had debts it needed to pay off. Further, as the Kazakh 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 28 of 34
Page No. 29- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Entities point out, Cerrito, SDG’s CFO, has testified in this litigation that any funds Triadou receives 

from the Flatotel investment will be sent to SDG to fund SDG’s investments.” (ECF No. 330, at 17) 

(record citations omitted). 

FIRST CAUSE OF ACTION 

Violation of The Computer Fraud and Abuse Act 

(18 U.S.C. § 1030) 

156. Plaintiff incorporates by reference as though fully set forth herein the allegations 

contained in paragraphs 1 through 155 above. 

157. Defendants Ketebaev and Khrapunov and their co-conspirators violated the Computer 

Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2)(C), by intentionally accessing protected computers 

without authorization, and by obtaining the Stolen Materials from such protected computers. 

158. Defendants Ketebaev and Khrapunov and their co-conspirators violated the Computer 

Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(B), by intentionally accessing protected computers 

without authorization, and as a result of such conduct, recklessly causing damage to Plaintiff. In 

addition, the Defendants’ unlawful use of the “phishing” technique to steal the account names and 

passwords used by officials of the government of the Republic of Kazakhstan, and to use that 

information to intentionally access the Hacked Accounts without authorization, recklessly caused 

damage to Plaintiff. 

159. Defendants Ketebaev and Khrapunov and their co-conspirators violated the Computer 

Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(C), by intentionally accessing protected computers 

without authorization, and as a result of such conduct, causing damage and loss to Plaintiff. In 

addition, the Defendants’ unlawful use of the “phishing” technique to steal the account names and 

passwords used by officials of the government of the Republic of Kazakhstan, and to use that 

information to intentionally access the Hacked Accounts without authorization, caused loss to the 

Plaintiff in excess of $5,000 during a one-year period. 

160. Upon information and belief, Defendants Ketebaev and Khrapunov and the other, 

currently unknown, persons and entities acted jointly and in concert with one another. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 29 of 34
Page No. 30- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

161. 18 U.S.C. § 1030(g) of the Computer Fraud and Abuse Act provides that any “person 

who suffers damage or loss by reason of a violation of this section may maintain a civil action against 

the violator to obtain compensatory damages and injunctive relief or other equitable relief.” Pursuant 

to 18 U.S.C. §§ 1030(g), (a)(2)(C), and (c)(4)(A)(i)(I) of the Computer Fraud and Abuse Act, a civil 

action may be brought if the conduct involves a loss during any one-year period aggregating at least 

$5,000 in value. 

162. As a proximate result of the violations of the Computer Fraud and Abuse Act by 

Defendants Ketebaev and Khrapunov and their co-conspirators, Plaintiff has suffered damage and loss 

in excess of $5,000 within a one-year period, consisting of expenses (not including attorneys’ fees) to 

investigate the hackings and to assess and remediate the damage Defendants Ketebaev and Khrapunov 

and their co-conspirators caused. 

163. Plaintiff has also suffered damage and loss as a proximate result of the intentional, 

public dissemination by Defendants Ketebaev and Khrapunov and their co-conspirators of privileged 

and confidential attorney-client communications between the Republic of Kazakhstan and its U.S. and 

other counsel. 

164. Plaintiff has suffered and continues to suffer damage and loss by reason of Defendants 

Ketebaev’s and Khrapunov’s and their co-conspirators’ wrongful conduct. 

165. Plaintiff has been and continues to be irreparably harmed by the ongoing use and public 

dissemination of documents from among the Stolen Materials. 

166. As a proximate result of these violations, Plaintiff has suffered damage and loss in an 

amount to be proven at trial, and, absent injunctive relief, faces likely irreparable harm. 

167. Under 18 U.S.C. § 1030(g) of the Computer Fraud and Abuse Act, Plaintiff is entitled 

to an award of compensatory damages and injunctive and equitable relief. 

168. Defendants Ketebaev and Khrapunov and their co-conspirators are not entitled to 

benefit from their own wrongdoing by further disclosing, disseminating, posting, displaying, sharing, 

distributing, hosting, copying, viewing, accessing, providing access to or making available to anyone 

any documents from among the Stolen Materials. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 30 of 34
Page No. 31- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

169. The Court should therefore enjoin any further use, disclosure, dissemination, posting, 

display, sharing, distribution, hosting, copying, viewing, accessing, provision of access to or making 

available to anyone, in any manner whatsoever, any of the Stolen Materials. 

170. The Court should order the disabling of the Kazaword Website, the deletion of the 

Mega Archives, and the deletion of hyperlinks to the Mega Archives. 

171. The Court should also order the deletion of posts that contain or reference any 

documents from among the Stolen Materials, and the deletion of hyperlinks to files that contain or 

reference any documents from among the Stolen Materials. 

SECOND CAUSE OF ACTION 

Violation of The Stored Communications Act 

(18 U.S.C. §§ 2701 ET SEQ.) 

172. Plaintiff incorporates by reference as though fully set forth herein the allegations 

contained in paragraphs 1 through 171 above. 

173. Defendants Ketebaev and Khrapunov and their co-conspirators violated 18 U.S.C. 

§ 2701(a)(1) of the Stored Communications Act by knowingly and intentionally accessing without 

authorization a facility through which an electronic communication service is provided and thereby 

obtaining documents from among the Stolen Materials that included wire or electronic 

communications, while such communications were in electronic storage in such system. 

174. Defendants Ketebaev and Khrapunov and their co-conspirators knowingly and 

intentionally accessed without authorization the Hacked Accounts. To access the Hacked Accounts, 

Defendant Ketebaev and his co-conspirators accessed servers of Google and Microsoft, each of which 

is a “facility” within the meaning of 18 U.S.C. § 2701(a)(1) of the Stored Communications Act. 

Defendants Ketebaev and Khrapunov and their co-conspirators had no authorization to access any of 

these servers or any of the Hacked Accounts. 

175. The Stolen Materials obtained by Defendants Ketebaev and Khrapunov and their coconspirators from the Hacked Accounts were in electronic storage in the above-mentioned servers at 

the time Defendants Ketebaev and Khrapunov and their co-conspirators accessed them without 

authorization. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 31 of 34
Page No. 32- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

176. The actions of Defendants Ketebaev and Khrapunov and their co-conspirators violated 

the Stored Communications Act and were willful and intentional. Defendants Ketebaev and 

Khrapunov and their co-conspirators, despite knowing that their access to the above-mentioned servers 

was not authorized, continued over a period of months to repeatedly access and obtain electronic 

documents. 

177. Upon information and belief, Defendants Ketebaev and Khrapunov and their coconspirators acted jointly and in concert with one another. 

178. 18 U.S.C. § 2707(a) of the Stored Communications Act provides that any “person 

aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in 

with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, 

other than the United States, which engaged in that violation such relief as may be appropriate.” 

179. 18 U.S.C. § 2707(b) and (c) of the Stored Communications Act provide that “[i]n a 

civil action under this section, appropriate relief” may include equitable relief, an award of damages, 

reasonable attorneys’ fees, and litigation costs reasonably incurred. If the violation is willful or 

intentional, the court may also assess punitive damages. 

180. Plaintiff has also suffered damage and loss as a proximate result of the intentional, 

public dissemination by Defendants Ketebaev and Khrapunov and their co-conspirators of privileged 

and confidential attorney-client communications between the Republic of Kazakhstan and its U.S. and 

other counsel. 

181. Plaintiff has been and continues to be irreparably harmed by the theft and ongoing 

public dissemination of hacked documents from among the Stolen Materials. 

182. Plaintiff has suffered and continues to suffer damage and loss by reason of the wrongful 

conduct of Defendants Ketebaev and Khrapunov and their co-conspirators. 

183. As a proximate result of these violations, Plaintiff has suffered damage and loss in an 

amount to be proven at trial, and, absent injunctive relief, faces likely irreparable harm. 

184. Under 18 U.S.C. §§ 2707(a), (b) and (c) of the Stored Communications Act, Plaintiff is 

entitled to an award of compensatory and punitive damages, an award of reasonable attorneys’ fees 

and expenses, and injunctive relief. 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 32 of 34
Page No. 33- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

185. Defendants Ketebaev and Khrapunov and their co-conspirators are not entitled to 

benefit from their own wrongdoing by further disclosing, disseminating, posting, displaying, sharing, 

distributing, hosting, copying, viewing, accessing, providing access to or making available to anyone 

any of the Stolen Materials obtained from the Hacked Accounts. 

186. The Court should therefore enjoin any further use, disclosure, dissemination, posting, 

display, sharing, distribution, hosting, copying, viewing, accessing, provision of access to or making 

available to anyone, in any manner whatsoever, any documents from among the Stolen Materials 

obtained from the Hacked Accounts. 

187. The Court should order the disabling of the Kazaword Website, the deletion of the 

Mega Archives, and the deletion of hyperlinks to the Mega Archives. 

188. The Court should also order the deletion of posts that contain or reference any 

documents from among the Stolen Materials obtained from the Hacked Accounts, and the deletion of 

hyperlinks to files that contain or reference any documents from among the Stolen Materials obtained 

from the Hacked Accounts. 

PRAYER FOR RELIEF 

 WHEREFORE, Plaintiff the Republic of Kazakhstan demands judgment against the 

Defendants jointly and severally as follows: 

(a) Adjudging that the Defendants’ actions violated the Computer Fraud and Abuse Act, 

18 U.S.C. § 1030, and the Stored Communications Act, 18 U.S.C. §§ 2701 et seq.; 

(b) Enjoining the Defendants, their affiliates, employees, agents, and representatives, and 

all persons acting in concert or participation with Defendants, from using, disclosing, disseminating, 

posting, displaying, sharing, distributing, hosting, copying, viewing, accessing, providing access to or 

making available to anyone, in any manner whatsoever, any of the Stolen Materials; 

(c) Ordering the disabling of the Kazaword Website and of all hyperlinks to the Mega 

Archives; 

(d) Ordering the deletion of the Mega Archives from the Mega Website; 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 33 of 34
Page No. 34- Case No. 5:17-cv-00246 

THIRD AMENDED COMPLAINT FOR DAMAGES AND INJUNCTIVE RELIEF 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 (e) Ordering the deletion from the Ketebaev Facebook Page of all posts that contain or 

reference any documents from among the Stolen Materials, and of all hyperlinks to files on the Mega 

Website that contain or reference any documents from among the Stolen Materials; 

(f) Awarding Plaintiff compensatory and punitive damages in an amount to be determined 

at trial; 

(g) Awarding Plaintiff its costs and reasonable attorneys’ fees; and 

(h) Awarding such other and further relief as the Court deems just and proper. 

Dated: January 19, 2018 

Respectfully submitted, 

CURTIS, MALLET-PREVOST, 

 COLT & MOSLE LLP 

JACQUES SEMMELMAN 

MICHAEL R. GRAIF 

MICHAEL J. MOSCATO 

NICOLE M. MAZANITIS 

DILLINGHAM & MURPHY, LLP 

WILLIAM F. MURPHY 

J. CROSS CREASON 

ANNA NAGORNAIA 

By ______________________________ 

 Attorneys for Plaintiff the Republic 

 of Kazakhstan 

/s/ William F. Murphy 

Case 5:17-cv-00246-LHK Document 69 Filed 01/19/18 Page 34 of 34