Opinion ID: 6327348
Heading Depth: 3
Heading Rank: 2

Heading: Microsoft’s Investigation

Text: In February 2018, Microsoft’s fraud investigation strike team (“FIST”) noticed a suspicious spike in Xbox Live UNITED STATES V. KVASHUK 7 subscriptions paid for with CSV. The FIST traced the CSV to tokens ordered through two test accounts: mstest_sfwe2eauto@outlook.com, which belonged to UST member Andre Chen, and mstest_avestu@outlook.com, which belonged to UST member Roy Morey. Microsoft suspended these two test accounts on March 15, 2018, and cancelled any unredeemed tokens purchased through them. At the time, the FIST believed that an outside actor had ordered the tokens because the IP addresses associated with the transactions were external to Microsoft, 1 and the FIST investigator who interviewed Chen and Morey did not suspect their involvement. On March 22, 2018, the FIST noticed another spike in CSV purchases traceable to a third test account: mstest_zabeerj2@outlook.com, which belonged to UST member Zabeer Jainullabudeen. These transactions were made from a device using the same hosting IP company as the transactions that originated from the sfwe2eauto and avestu test accounts. The next day, Microsoft suspended the zabeerj2 test account and cancelled the unredeemed tokens purchased through it. In all, $10 million worth of tokens was stolen through the three test accounts, and Microsoft cancelled only $1.8 million worth before the tokens were redeemed for CSV, resulting in a loss to the company of approximately $8.2 million. Microsoft came to suspect Kvashuk when the FIST searched for other accounts that had accessed the Universal Store from the IP addresses used to steal CSV. Multiple IP 1 An Internet Protocol (“IP”) address is a numerical label assigned to each device that is connected to a computer network that accesses the internet. 8 UNITED STATES V. KVASHUK addresses associated with the sfwe2eauto or avestu test accounts were also associated with Kvashuk’s v-vokvas test account, his personal Outlook account (safirion@outlook.com), and his personal Gmail account, 2 as well as an additional account: pikimajado@tinoza.org. Kvashuk’s v-vokvas test account, the pikimajado account, and another account—xidijenizo@axsup.net— were also linked to the sfwe2eauto and avestu test accounts through the same “fuzzy device ID.” A fuzzy device ID is a “fairly unique” identifier generated by Microsoft—a string of information that identifies characteristics about the user’s browser, operating system, and other attributes. According to Microsoft, it is “theoretically possible” but “very unlikely” that two different devices would have the same fuzzy device ID. Microsoft discovered that in October 2017, Kvashuk’s v-vokvas test account ordered a single token that another account, linked to an email address at searchdom.io, redeemed for a subscription to Microsoft Office. Kvashuk was a registered owner of searchdom.io. Two weeks later, the v-vokvas test account ordered tokens worth approximately $10,000, of which approximately $2,500 was redeemed for CSV in the Universal Store by accounts linked to the pikimajado and xidijenizo email accounts. These two accounts used the CSV to purchase graphics cards and ship them to “Grigor Shikor” at Kvashuk’s apartment complex. 2 Microsoft knew Kvashuk’s personal Gmail account from his resume. Microsoft deduced that the safirion account belonged to Kvashuk because the name on the account was “volo kv” (i.e., the first few letters of Kvashuk’s first and last names) and one of the mailing addresses for the account was the apartment where Kvashuk lived until April 2018. UNITED STATES V. KVASHUK 9 In two interviews, Kvashuk admitted to Microsoft investigators that he had used his test account to generate tokens, which he claimed he redeemed to watch movies. He also admitted purchasing a graphics card on the Universal Store using CSV he obtained from the test account. He claimed that he had wanted to see whether it was possible to order physical items that way but that the graphics card never arrived. 3 When asked if he knew Grigor Shikor, Kvashuk first told the investigators, “It’s complicated,” and then denied knowing him. Microsoft terminated Kvashuk’s employment in June 2018 and informed the Department of Justice about the stolen CSV.