DENISE COTE, UNITED STATES DISTRICT JUDGE

For plaintiff: Andrew Zenner Michaelson Kathleen Elizabeth McCarthy Laura Elizabeth Harris King & Spaulding LLP (NYC), Bethany Rupert King & Spalding, David Paul Mattern Sumon Dantiki King & Spalding LLP (DC)

For Defendants: Igor B. Litvak The Litvak Law Firm, PLLC

OPINION AND ORDER

DENISE COTE, UNITED STATES DISTRICT JUDGE

Google LLC (“Google”) has brought claims against the defendants for operating a botnet to steal and exploit Google users' personal information. Dmitry Starovikov and Alexander Filippov, the two named individual defendants (the “Defendants”) failed to timely appear in this action, and after their default was vacated, produced almost no discovery. The Defendants assert that the discovery Google requests is held by their former employer, Valtron LLC (“Valtron”), which Google alleges operated many of the Defendants' criminal schemes. Google contends that the Defendants misrepresented their relationship with Valtron to this Court and to Google, and that the Defendants spoliated critical evidence. Google has filed a motion for sanctions, in the form of monetary sanctions and entry of a default judgment, against Dmitry Starovikov, Alexander Filippov, and sanctions against their attorney, Igor Litvak. The Defendants have cross-moved for sanctions. For the following reasons, Google's motion is granted, and the Defendants' motion is denied.

Background

This Court presumes familiarity with its prior Opinions in this action. See Google LLC v. Starovikov, 21CV10260, 2022 WL 1239656 (S.D.N.Y. Apr. 27, 2022) (vacating the entry of default); Google LLC v. Starovikov, 21CV10260, 2022 WL 4592 899 (S.D.N.Y. Sept. 30, 2022) (issuing default judgment against defendants Does 1-15). The complaint alleges that the Defendants control the Glupteba botnet, a network of private computers infected with malware. This malware hijacks the infected computers, instructing them to execute commands issued by a command-and-control server (also called a “C2 server”), which controls the computers that are part of the botnet.

Conventional botnets receive instructions from C2 servers whose domains or IP addresses are hardcoded in the botnet malware. This means that a conventional botnet can be disabled by taking the server at the hardcoded address offline. The Glupteba malware, however, instructs infected computers to look for the addresses of its C2 servers by referencing transactions associated with specific accounts on the Bitcoin blockchain. The blockchain is not controlled by any central authority, and each transaction is disseminated to and viewable by any user on the blockchain. These features make the Glupteba botnet unusually resistant to disruption. If the botnet's C2 servers are disabled, then its operators can simply set up new servers and broadcast their addresses on the blockchain.

Google alleges that the Defendants use the Glupteba botnet to further several unlawful schemes (collectively, the “Glupteba Enterprise”). In particular, the Defendants use the botnet to harvest personal and financial information from the infected computers, which they then sell; the Defendants use the botnet to place disruptive ads on the infected computers; the Defendants use the infected computers to mine cryptocurrency; and the Defendants use the infected computers as proxies, directing third-party internet traffic through the infected computers to disguise the origin of the traffic. The Defendants operate these criminal schemes through various corporate entities, including Valtron. Google also alleges that Starovikov and Filippov used some of the botnet's C2 servers when signing up for their own Google accounts, that they operate the botnet, and that they acted as administrators for Valtron's Google Workspace account.

Google filed the present lawsuit on December 2, 2021, bringing claims for violation of the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, trademark and unfair competition law, and for tortious interference with a business relationship and unjust enrichment. Along with the complaint, Google requested a temporary restraining order enjoining the defendants from their alleged unlawful activities, and permitting Google to request that entities providing services to domains and IP addresses associated with the Glupteba botnet take reasonable best efforts to disrupt the botnet. The temporary restraining order was issued on December 7, granting the requested relief, and authorizing Google to use alternative service “via mail, email, text, and/or service through ICANN.” The temporary restraining order was converted into a preliminary injunction on December 16 after no defendant made an appearance to challenge it.

A. The Defendants' Default

On February 7, 2022, Google requested an entry of default from the Clerk of Court against Defendants Starovikov and Filippov, describing their efforts on December 8 through 10 to serve the Defendants by the methods authorized in the temporary restraining order. Default was entered by the Clerk of Court against them on February 8. An Order of February 1 required Google to move for entry of a default 21 days thereafter.

On February 24, Litvak submitted a letter requesting that the February 1 Order be suspended, and proposed a schedule for filing a motion to vacate the default entered against the two Defendants. The schedule for the motion was set at a conference held on March 1. At the March 1 conference, Litvak represented that the Defendants had never received notice of the action, and that they only found out about it from their friends toward the end of January. Google argued that the Defendants had received notice, however, because they had actively set up new C2 servers after Google had taken the previous ones offline. Google explained that the Defendants would have known when the original C2 servers were taken offline, because they had used the IP addresses associated with those servers when signing up for their Google accounts.

On March 14, the Defendants submitted a motion to vacate the default, arguing that they had not been served, that the Court lacked jurisdiction over them, and that they had meritorious defenses, including that Google had failed to state a claim against them. In support of their motion, the Defendants submitted nearly identical signed declarations, each of which stated: “I work for Valtron LLC as a software engineer.” The declarations also asserted that the Defendants had never received service of process, and did not receive actual notice of the action until late January, when they heard about it from “friends.” Google submitted a cross-motion for default judgment against the Defendants on March 25, arguing that the Defendants had agreed to waive personal jurisdiction in their discussions with Google, and that they had no other meritorious defenses. The motions became fully submitted on April 19.

In an Opinion of April 27, this Court denied Google's motion for default judgment and vacated the entry of default against the Defendants. See id. at *10. Although the Opinion found it “improbable” that “all of Google's attempts at service . . . failed to provide the defendants with actual notice,” the Opinion was unwilling to find that the Defendants' default was “willful” on the record before it. Id. at *3. The Opinion also held that the Defendants had not waived personal jurisdiction, but that the Court had jurisdiction over the Defendants regardless. Id. at *4. And the Opinion found that the Defendants should be provided the opportunity to mount a defense by contesting their involvement in or knowledge of the botnet, although they were unlikely to successfully seek dismissal of the complaint for failure to state a claim. Id. at *7-10. With these rulings, the Court allowed the Defendants to proceed so that they could contest their participation in or knowledge of the unlawful acts alleged in the complaint. Id. at *3. Finally, the Opinion found that the Defendants' delay did not significantly prejudice Google, because the parties could still “conduct expeditious and targeted discovery.” Id. at *10.

B. Case Management Plan

On May 11, the Defendants answered the complaint, bringing a counterclaim for tortious interference with a prospective business relationship. In support of this counterclaim, the Defendants alleged that Google “improperly interfered with Defendants' present and prospective relationships with their employer, its clients and customers.” The Defendants voluntarily dismissed their counterclaims on May 24, before Google submitted a response.

At around the same time, the parties began to discuss a discovery plan. On May 17, Google shared with Litvak a proposed plan indicating that Google intended to request the electronic devices that the Defendants used in connection with their business. On May 20, Litvak responded, proposing discovery of any computers or devices used in Google's investigation of the Defendants, and limiting discovery of the Defendants' devices to those devices “over which the Defendants have actual physical control and possession.” Google rejected the Defendants' modifications, instead proposing on May 31 to remove all language specifically referencing a device exchange. Litvak replied, however, that he liked the “initial version” much better, asking to keep it. Ultimately, the parties submitted a report pursuant to Rule 26(f), Fed. R. Civ. P., that did not specifically mention a device exchange.

C. Rule 16 Conference

On June 1, the Court held a Rule 16 conference. At the conference, the parties agreed that the case would proceed as a nonjury action because Google had withdrawn its claim for damages, seeking only injunctive relief. Google explained that the Defendants had told them that they were interested in settling, and that they could potentially help Google by taking the botnet offline. But Google expressed frustration that the Defendants were unwilling to consent to a permanent injunction, and unable to articulate why an injunction forbidding them from engaging in unlawful activities would pose a problem. The Defendants insisted that they were not engaged in criminal activity, and that any alleged activity in which they were engaged was legitimate. Nevertheless, the Defendants resisted entry of a permanent injunction, asserting that Google's use of the preliminary injunction had disrupted their normal business operations.

The parties also expressed at the conference that they were unable to agree on a location at which the Defendants could be deposed. Nevertheless, the Defendants affirmed their commitment to the discovery process, and stated their willingness to produce documents and to be deposed, so long as their deposition took place in a country to which they could realistically travel. The Defendants also stated that they would be willing to appear at trial, so long as they could travel to the United States and secure the appropriate visas.

When the parties conferred after the conference to discuss potential locations for the Defendants' depositions, however, the Defendants began to raise additional objections. Litvak stated that the Defendants were opposed to depositions in a country from which the Defendants might be extradited to the United States.Additionally, Litvak also revealed the next day that the Defendants did not have international passports, and therefore could only be deposed in Russia, Belarus, or Kazakhstan.

On June 3, the parties submitted letters to the Court stating that they were unable to agree on a location for the Defendants' depositions. The same day, the Court vacated the scheduling Order issued only two days before. The Court issued an additional Order on June 9 staying discovery of the plaintiff, and ordering the Defendants to comply with their initial disclosure obligations pursuant to Rule 26(a)(1), Fed. R. Civ. P., by June 17. The Order of June 9 also explained that there was reason to believe that the Defendants sought discovery only “to learn whether they could circumvent the steps that Google has taken to block the malware described in its complaint,” and expressed concern that the Defendants would “not participate in good faith in the discovery process and that their counsel has not been candid with the Court.”

The June 9 Order required Google to propose three countries in Europe at which it would be willing to depose the Defendants, and ordered the parties to update the Court by June 14 as to whether the Defendants were willing to be deposed there. On June 14, the parties submitted letters explaining that they had still not come to an agreement. On June 17, the Court ordered the Defendants to diligently attempt to obtain a passport, and to update the Court on their progress doing so by September 16.

D. Initial Disclosures

The Defendants served their initial disclosures on June 17, and served amended initial disclosures on June 27. In their disclosures, the Defendants identified seven individuals who potentially had discoverable information at Valtron's office address, but did not provide their surnames. The Defendants also listed themselves as potential witnesses, describing Filippov as a “Valtron Software Engineer.” The Defendants declined to provide any electronic devices to Google, however, stating that any relevant electronic device was in Valtron's possession, not theirs. As Google continued to press the Defendants to turn over any devices to which they had access, the Defendants on July 19 represented for the first time that they no longer worked at Valtron, and so did not have access to any of the devices they used while working there.

The same day, Google filed a letter before this Court requesting a discovery conference to address the deficiencies in the Defendants' initial disclosures. Google argued that the Defendants were failing to comply with their discovery obligations by refusing to provide their colleagues' last names, and by refusing to identify where discoverable documents could be located.

The Court held a conference on July 29. During the conference, the Court asked Litvak when the Defendants stopped working at Valtron. Litvak at first declined to provide any answer, stating only that they left in 2021. The Court asked Litvak if he could identify a specific month, and he stated that, to the best of his memory, the Defendants left Valtron sometime in the latter half of 2021. The Court then asked Litvak if he knew that the Defendants had no electronic devices to produce in discovery at the time the parties discussed an exchange of devices in May. The Court explained that “if the correspondence or evidence shows that you discussed in May an exchange of devices, at a time that you knew there were no devices in your clients' possession that could be exchanged, that is troubling.” Litvak stated that he could not remember exactly when he first learned that the Defendants no longer worked at Valtron, but he denied representing that his clients had ever had access to any electronic devices, and insisted that he had preferred to take out any mention of a device exchange entirely.

After the July 29 conference, this Court issued an Order requiring the plaintiff to serve the Defendants and their counsel with any questions regarding their knowledge of or access to discoverable information. On August 8, the Defendants submitted identical declarations to Google stating that they had been fired by Valtron at the end of 2021 and had left their laptops with Valtron in mid-January 2022. The Defendants did not identify any devices that they used in 2021 or 2022 other than their work laptops, nor did they identify the categories of documents or methods of communication they used while at Valtron. Litvak also sent a letter to Google on August 8 stating that he believed the Defendants would likely find more discoverable electronic devices and electronically stored information.

The parties submitted letters to the Court on August 12, in which the Defendants stated that they were fired from Valtron in December of 2021 due to a lack of work, that they each used a laptop while working at Valtron, and that that laptop had been returned to Valtron in the first half of January 2022. Additionally, Litvak stated that he first learned that the Defendants no longer worked for Valtron on May 20.

Each party's letter requested sanctions against the other party. In a conference on August 12, the Court set a briefing schedule on the parties' motions for sanctions. Google filed its motion for sanctions on August 22. The Defendants filed their motion for sanctions, and opposed Google's motion, on September 2. Google's motion became fully submitted on September 16. The Defendants' motion became fully submitted on September 23.

E. Further Discovery and Settlement Discussion

On September 6, Litvak emailed Google that his clients were willing to discuss settlement. The parties held a call on September 8, at which Litvak explained that the Defendants would be willing to provide Google with the private keys for Bitcoin addresses associated with the Glupteba botnet, and that they would promise not to engage in their alleged criminal activity in the future (without any admission of wrongdoing). In exchange, the Defendants would receive Google's agreement not to report them to law enforcement, and a payment of $1 million per defendant, plus $110,000 in attorney's fees. The Defendants stated that, although they do not currently have access to the private keys, Valtron would be willing to provide them with the private keys if the case were settled. The Defendants also stated that they believe these keys would help Google shut down the Glupteba botnet. Google rejected the Defendants' offer as extortionate, and reported it to law enforcement.

On September 15, while the parties' cross-motions were being briefed, the Defendants submitted responses to Google's discovery requests. The Defendants produced 15 documents, consisting largely of contracts between the Defendants and Valtron, license agreements, webpage printouts, and several code files used to interface with a bank associated with the Glupteba credit card scheme. The Defendants refused to respond to Google's request for inspection of each electronic device the Defendants have used or owned since 2011. Additionally, the Defendants responded to Google's request for the private keys of the Bitcoin accounts associated with the Glupteba botnet by stating that they had no such information in their possession, and that the Bitcoin accounts were owned by Valtron's CEO.

Discussion

I. Google's Motion for Sanctions

Google moves to sanction the Defendants and their attorney for spoliating evidence, and for making various misrepresentations to the Court in an effort to evade discovery. The Defendants and Litvak dispute that they ever made any intentional misrepresentation to either Google or to the Court, and insist that they were willing to engage in good faith in discovery. But, by Litvak's own admission, he misrepresented the Defendants' employment status to Google and to the Court, and attempted to induce an exchange of electronic devices at a time when he knew that the Defendants had no devices to exchange. The Court finds that the Defendants have intentionally withheld information and misrepresented their willingness and ability to engage in discovery in order to disadvantage Google in this litigation, avoid liability, and further profit off of the criminal scheme described in the complaint.

Because of the Defendants' shifting representations and obstinacy during discovery, it is difficult to establish some facts with certainty. The Court cannot be sure precisely when or even if the Defendants left their employment at Valtron, and when their attorney learned that this happened. Nevertheless, the parties have not requested a hearing regarding their motions for sanctions, nor would one be helpful. See In re 60 E. 80th St. Equities, Inc., 218 F.3d 109, 117 (2d Cir. 2000) (holding that, on a motion for sanctions, “a full evidentiary hearing is not required; the opportunity to respond by brief or oral argument may suffice.”). Both parties have submitted evidence, revealing few, if any, disputes of material fact. Moreover, the Defendants have had multiple opportunities to explain their conduct at conferences, in briefs, in response to Google's motion for sanctions, and in their own motion for sanctions. Rather than provide an explanation, however, the Defendants have frequently used these opportunities to proffer even more falsehoods.

No further factual inquiry is necessary. The record here is sufficient to find a willful attempt to defraud the Court and resist discovery. Despite evidence that the Defendants received actual notice of this action in early December of 2021, in March of this year, the Court granted the Defendants' application to vacate their default in order that this case could be adjudicated on the merits. It is now clear that the Defendants appeared in this Court not to proceed in good faith to defend against Google's claims but with the intent to abuse the court system and discovery rules to reap a profit from Google. Accordingly, for the reasons given below, Google's motion is granted.

A. Factual Findings

i. Misrepresentation Regarding the Defendants' Employment

When they first appeared in this action, the Defendants represented through their attorney that they continued to work at Valtron. The Defendants submitted signed declarations in connection with their motion to vacate the default that they each “work for Valtron LLC as a software engineer.” They asserted in their counterclaim that Google's actions harmed their “prospective relationship with their employer.” They stated at the June 1 initial pretrial conference that the preliminary injunction was preventing the Defendants “from engaging in normal business activity.” And they identified Filippov as a “Valtron Software Engineer” in their initial disclosures. Each of these statements was false or misleading if the Defendants had in fact left Valtron in December of 2021, months before they appeared in this action.

Additionally, these misrepresentations severely prejudiced Google. The Defendants now insist that they have no discoverable information regarding Valtron because they returned their work laptops to Valtron in January 2022, shortly after they ended their employment, and weeks after Google made efforts to serve them. But, in moving to vacate the default against them, the Defendants stated that their delay in appearing “did not . . . create increased difficulties of discovery.” The Defendants stated during the March 1 conference that they were ready to “get the discovery and litigate the case.” And in vacating the default, the Court found that the Google was not prejudiced by the Defendants' delay, because the parties could “conduct expeditious and targeted discovery.” Google LLC, 2022 WL 1239656, at *10. Accordingly, were it not for the Defendants' misrepresentation of their employment status and of their willingness to participate in discovery, it is unlikely that the default against them would have been vacated. Since the Defendants' appearance, any progress in the action has been impeded by that falsehood.

Litvak argues that these misrepresentations were unintentional, and that they accordingly do not provide a basis for sanctions. Litvak concedes that he misrepresented that the Defendants continued to work at Valtron. But he says that he was simply mistaken, and that the Defendants simply failed to notice the use of the present tense “work” when signing their affidavits. Litvak states that, when he discovered on May 20 that the Defendants had left their jobs months earlier, he ceased representing that they were currently employed by Valtron. The Defendants also argue that their allegations in their counterclaim, and comments regarding their prospective business relations, did not affirmatively state that the Defendants continued to work at Valtron, and so should not be considered sanctionable misrepresentations.

Although Litvak disputes that he made any intentional misrepresentation, he provides no explanation for his “misunderstanding” for roughly five months of his clients' employment status. Google's complaint mentions Valtron, among other organizations, several times in connection with the Glupteba Enterprise's criminal schemes, and it alleges that the Defendants operated Google accounts associated with these organizations. Litvak asserts that, from “the day [he] was retained in mid-February until May 20th, 2022, [he] was under the impression that the Defendants still worked at Valtron.” But Litvak does not describe what conversations, if any, he had with the Defendants about their relationships with the organizations mentioned in Google's complaint, nor does he explain how he arrived at the conclusion that they had been employed by Valtron and were still working there.

When an attorney makes a representation to the court, the attorney “certifies to the best of [his] knowledge, information, and belief, formed after an inquiry reasonable under the circumstances” that the representation has “evidentiary support” or “will likely have evidentiary support after a reasonable opportunity for further investigation or discovery.” Fed.R.Civ.P. 11(b), 11(b)(2). Additionally, an attorney has an ethical obligation not to knowingly “make a false statement of fact or law to a tribunal or fail to correct a false statement of material fact or law previously made.” N.Y. Rules of Prof. Conduct 3.3(a)(1). As Litvak and the Defendants now concede, their representations regarding their employment status were false, and the Defendants provide no explanation for this falsehood except to label it a “misunderstanding.” But such labels, without more, cannot excuse a false allegation about a matter entirely within the Defendants' knowledge and central to the claims in this action and the Court's decisionmaking. Moreover, Litvak made no attempt to correct the misrepresentation to this Court for months after he first made it, until Google raised the issue itself.

The Defendants' relationship with Valtron, and their access to discoverable information relevant to Valtron, was essential to the Defendants' duty to preserve evidence, to discovery obligations, and to their motion to vacate the default. Upon becoming aware of this litigation, the Defendants and their attorney had an obligation to preserve evidence that they knew or should have known would be relevant to the litigation. Fujitsu Ltd. v. Fed. Exp. Corp., 247 F.3d 423, 436 (2d Cir. 2001). Here, however, Litvak asserts that he did not even ascertain whether the Defendants were still employed at Valtron, much less determine what information related to their employment they might be able to preserve, and advise them appropriately. Litvak has provided no explanation for this failure, and has declined to respond to Google's discovery requests asking that he detail his preservation efforts. Given Litvak's refusal to provide these explanations, the record shows that Litvak misrepresented the Defendants' employment status to the Court and to Google, that he then failed to correct that misrepresentation, that he failed to comply with his duty to instruct his clients about document preservation rules, and that the Defendants failed to comply with their preservation obligations.

Although the Defendants concede that they misstated their employment status when they said they “work” at Valtron in the declarations, they dispute that they mischaracterized their employment status in their counterclaims or in later statements to Google and to the Court. But the Defendants alleged in their counterclaim that Google's actions harmed their “prospective relationship with their employer.” This allegation -- made at a time when Litvak asserts he still believed the Defendants worked at Valtron -- can only be reasonably construed to represent that the Defendants continued to work for Valtron. The allegation refers to their “employer” rather than their “former employer,” and refers to a “prospective relationship” that the Defendants would have little reason to expect if their employment had been terminated.

Moreover, the Defendants continued to exploit this “misunderstanding” even after Litvak asserts that he became aware that the Defendants no longer worked for Valtron and had returned their work laptops to Valtron. On May 20, Litvak proposed that the parties exchange electronic devices in discovery, and proposed limiting the Defendants' discovery obligations to devices “over which the Defendants have actual and physical control and possession.” When Google rejected this language and removed the device exchange, Litvak on May 31 requested that it be added back.

Litvak contends that this exchange does not involve any misrepresentation, as he never stated that the Defendants had access to any devices, and proposed limiting language to qualify the Defendants' discovery obligations. But, until this point, the Defendants had made uncorrected misrepresentations that they continued to work at Valtron. Litvak did not inform Google by May 31 that these representations were false, and he therefore would have known that Google would rely on them when negotiating the discovery plan. The limiting language proposed by Litvak does nothing to ameliorate these misrepresentations. On the contrary, it exacerbates them, by ensuring that the device exchange would not be genuinely reciprocal, as Litvak knew by at least that time that the Defendants would not be providing critical devices in discovery. Litvak's conduct is sharp practice and will not be condoned. His negotiations over an exchange of devices with Google support Google's contention that the Defendants and Litvak sought to weaponize the discovery obligations contained in the Federal Rules of Civil Procedure to undermine Google's efforts to neutralize the Glupteba Entperise and stop the frauds perpetrated by it.

The parties dispute precisely when Google became aware that the Defendants no longer worked at Valtron, and therefore no longer had access to discoverable devices. Litvak asserts that he explained all of this on a June 27 call. Google, however, contends that Litvak did not mention the Defendants' employment status on the June 27 call, and instead simply asserted that the Defendants had no discoverable devices. According to Google, it was not until a July 19 email exchange over the Defendants' initial disclosures that the Defendants revealed they no longer worked for Valtron.

The precise date at which Litvak revealed that the Defendants no longer worked for Valtron, however, is not material. Even crediting his assertion, the record shows that the Defendants alleged more than once that they worked for Valtron while they did not, and that their attorney did not disclose this misrepresentation for weeks after he alleges he became aware that it was false, even as he continued to negotiate a discovery plan premised on that misrepresentation. This conduct alone would justify sanctions against the Defendants and Litvak. See Mitchell v. Lyons Prof. Servs., Inc., 708 F.3d 463, 467 (2d Cir. 2013) (terminating sanctions appropriate “upon a finding of willfulness, bad faith, or reasonably serious fault” (citation omitted)). As explained below, however, the Defendants' conduct likely constituted deliberate spoliation of evidence.

ii. Intentional Spoliation

Although Litvak concedes that he misstated the Defendants' relationship with Valtron, he argues that this was an innocent error, and did not constitute an attempt to intentionally obstruct discovery. The Defendants' course of conduct throughout the case, however, evinces a deliberate attempt to deceive Google and the Court, and to avoid their discovery obligations while attempting to obtain information from Google that might weaken its efforts to protect Google's users and the security of its business.

The Defendants now assert that they stopped working for Valtron in December of 2021, and that they turned over their work laptops to Valtron in early January of 2022. And in their motion to vacate the default against them, the Defendants stated that they became aware of the case only in late January. Although the April 27 Opinion found it “improbable” that the Defendants had not received actual notice of this action until late January, it nevertheless declined to find the Defendants' default willful at the time and opted to let the case proceed on the merits. Google LLC, 2022 WL 12396656, at *3.

In light of the Defendants' subsequent dishonesty and the shifting explanations for their conduct, however, their representations as to when they received actual notice can no longer be credited. As the April 27 Opinion explained, the Defendants were served “at the address listed on [Valtron's] website, via email to their Google accounts, via notification through ICANN, via SMS text message, and through WhatsApp.” Id. at *3. Additionally, this action was widely reported in Russian-language media. Id.

These facts alone made it “improbable” that the Defendants had not received actual notice of this action before late January. But their conduct since the default was vacated make this even less likely. The Defendants now assert that they left Valtron in December of 2021 -- just as this action was filed -and that they turned their work laptops over to Valtron in early 2022 -- just before acquiring counsel to defend this action. But the Defendants also now assert that they were aware of Google's attempts to disrupt the Glupteba botnet, claiming that Google's efforts have disrupted their normal business operations. Those efforts, however, have been ongoing since December 7, 2021, when Google obtained the TRO. Additionally, although the Defendants originally asserted that they first heard about this action from “friends,” they now assert that they were instead informed by two other sources: Valtron's CEO, and Starovikov's mother. Finally, the Defendants insist that this action has made them a “pariah in the Russian IT industry,” and that they can no longer seek employment or even find housing as a result of their damaged reputation.

Each of these representations supports a finding that the Defendants received actual notice before January, when they allege that they turned over their work laptops to Valtron. The Defendants cannot credibly assert both that they had no knowledge of this action, and that it damaged their reputation to such an extent that even Russian landlords were generally aware of it. Additionally, Google's efforts to disrupt the Glupteba botnet would have at least put them on notice that Google was shutting down some of their servers, and therefore put them on inquiry notice of any legal action. Finally, the Defendants' shifting explanations for where they first heard about the lawsuit reduce the credibility of their assertion that they were first informed about it by third parties almost two months after it was initiated.

The Court finds that the Defendants were aware of this action before the dates on which they assert they left Valtron and turned over their work laptops. As a result, they had an obligation to preserve discoverable evidence upon becoming aware of it. Rather than complying with that obligation, however, the Defendants either got rid of (or more likely have refused to produce) any incriminating devices, and have consistently disclaimed any ability to recover them during discovery. Tellingly, the Defendants have refused to identify or produce any other electronic devices they still possess that might contain discoverable information. There is little doubt that their cellphones and personal computers contain a wealth of information relevant to this litigation and to each of the issues discussed in this Opinion. Beyond this failure to cooperate in discovery and produce their currently possessed devices, their September 8 settlement offer indicates that they continue to have a working relationship with Valtron's CEO. As explained in more detail below, the Defendants' resistance to discovery and spoliation of electronically stored information requires the entry of default judgment against them. See Fed.R.Civ.P. 37(e)(2)(C).

iii. Other Misconduct

Finally, even if the Defendants in fact were not aware of this action until January of 2022, and even if they left Valtron and returned their work laptops without any reason to believe that the devices would be discoverable, their behavior since appearing in this action still constitutes intentional misconduct. When the Defendants first appeared, they stated that they were willing to participate in the discovery process. Almost every time discovery has been requested of them, however, they put forth a new reason to resist. When Google attempted to arrange the Defendants' deposition, they informed the Court that they could not be deposed outside of Russia because they lacked international passports. And once the Court indicated that the Defendants would have to attempt to obtain those passports, the Defendants came forth with a new reason for resisting deposition: that they were concerned about extradition.

Additionally, when Google requested electronic devices and electronically stored information from the Defendants, the Defendants insisted they did not have any; and when pressed, they stated that they no longer worked for Valtron, and had turned over all relevant electronic devices. The Defendants have refused to identify even so much as a cell phone with communications relevant to their work at Valtron, despite the fact that they assert that they have continued to maintain contact with Valtron's CEO. At the very least, this pattern of behavior demonstrates an intentional attempt to mislead the Court and the plaintiff regarding the Defendants' ability and willingness to participate in discovery.

Much of the Defendants' conduct during the case, however, evinces a more insidious motive. Since its motion for default judgment, Google has sought only injunctive relief against the Defendants to forbid them from engaging in criminal activity in the future. The Defendants have refused to consent to any such injunction,while at the same time telling Google that they have the ability to shut down the Glupteba botnet. Google represented at the June 1 conference -- without contradiction from the Defendants -- that the Defendants had stated that they had the ability to help disable the botnet. And in their September 8 settlement demand, the Defendants told Google that they could acquire the private keys for the Bitcoin accounts associated with the botnet, thereby enabling Google to shut it down. In that offer, however, the Defendants demanded $1 million each from Google and a payment to their counsel. The Defendants' offers of cooperation, but refusal to consent to a preliminary injunction, indicates an intention to use the litigation as a means of extorting Google, or at least seeking discovery against Google that could help them evade its efforts to shut down the botnet.

Additionally, even though the Defendants offered Google the private keys to the Glupteba Enterprise's Bitcoin accounts as part of their offer, the Defendants refused to turn over those private keys when they were requested in discovery. The Defendants have attempted to explain this inconsistency by asserting that, although they do not currently possess the private keys, Valtron would be willing to provide them if the case were settled.But this is inconsistent with the Defendants' representation -- made only one sentence later in their brief -- that the Defendants' request for money as part of their settlement offer was not a condition for providing Google with these private keys. If the Defendants can access these private keys and produce them to Google, they must do so. See Scherbakovskiy v. Da Capo Al Fine, Ltd., 490 F.3d 130, 138 (2d Cir. 2007) (“[I]f a party has access and the practical ability to possess documents not available to the party seeking them, production may be required.”). If not, they cannot misrepresent their ability to do so in exchange for money. Either way, the Defendants have intentionally misled Google and the Court and failed to participate in this litigation in good faith.

B. Default Judgment Sanction

“If a party fails to obey an order to provide or permit discovery, the district court may impose sanctions, including rendering a default judgment against the disobedient party.” Guggenheim Capital, LLC v. Birnbaum, 722 F.3d 444, 450 (2d Cir. 2013) (quoting Fed.R.Civ.P. 37(b)(2)(A)(vi)). In determining what sanctions are warranted, a court should consider “(1) the willfulness of the non-compliant party; (2) the efficacy of lesser sanctions; (3) the duration of the noncompliance; and (4) whether the non-compliant party had been warned that noncompliance would be sanctioned.” Id. at 451; see also Funk v. Belneftekhim, 861 F.3d 354, 366 (2d Cir. 2017). Entry of a default is an extreme sanction, and may be appropriate “when a court finds willfulness, bad faith, or any fault on the part of the noncompliant party.” Guggenheim Capital, LLC, 722 F.3d at 451 (citation omitted).

Additionally, a court may award sanctions “[i]f electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery.” Fed.R.Civ.P. 37(e). Upon a finding “that the party acted with the intent to deprive another party of the information's use in litigation”, the court may issue an adverse inference as to the lost information “or enter a default judgment.” Fed.R.Civ.P. 37(e)(2)(C). Courts in this district have found that a party acts with intent to deprive another party of discoverable evidence when:

(1) evidence once existed that could fairly be supposed to have been material to the proof or defense of a claim at issue in the case; (2) the spoliating party engaged in an affirmative act causing the evidence to be lost; (3) the spoliating party did so while it knew or should have known of its duty to preserve the evidence; and (4) the affirmative act causing the loss cannot be credibly explained as not involving bad faith by the reason proffered by the spoliator.

Each of these provisions justifies the entry of a default judgment against the Defendants. On June 9, this Court ordered the Defendants to serve their initial disclosures by June 17.

And on July 29, the Court ordered the Defendants to respond to Google's questions regarding their knowledge of or access to discoverable information. As explained above, the Defendants' incomplete and dishonest disclosures constituted a willful violation of those orders. The Defendants' misconduct began almost as soon as they entered the case, when they misrepresented their ability or willingness to engage in the discovery process, and has continued since. At each stage, the Defendants have proffered new reasons for resisting Google's discovery efforts, even when those reasons contradict previous representations. Additionally, the Defendants were warned in the June 9 Order and the July 29 conference that they appeared to be engaging in misconduct. Finally, the Defendants have been given ample opportunity to explain their behavior, and to respond to Google's request for sanctions.

For similar reasons, the record shows that the Defendants acted with an intent to deprive Google of discoverable information. The Defendants knew shortly after the lawsuit was filed, when Google's efforts to combat the Glupteba botnet pursuant to the TRO took effect, that they would face litigation. And they would also have known that their work laptops would contain evidence relevant to the case, as the Complaint alleges that the Defendants operated their criminal schemes at least in part through Valtron. Nevertheless, the Defendants assert that they turned the laptops over to Valtron, and if they in fact did so, turned them over without taking any effort to preserve discoverable information on those laptops, or to obtain any such information since. Finally, because the Defendants have known of this action nearly since its inception, their conduct cannot be explained by any good faith justification. Entry of a default judgment is therefore appropriate under Rule 37(e), Fed. R. Civ. P.

Lesser sanctions would not be appropriate. The Defendants have produced almost no discovery, and there is no indication that they would be willing or able to produce any more. Lesser sanctions requiring an adverse inference as to facts about which the Defendants resisted discovery would effectively vitiate the Defendants' entire case, as the Defendants have resisted almost all discovery. An adverse inference would therefore result in the functional equivalent of a judgment.

Additionally, a sanction of a judgment is particularly appropriate here because the Defendants' misconduct began as a means to vacate the default against them. In vacating the default, the Court relied on the Defendants' representations that they continued to work at Valtron, and that their delay in appearing would not inhibit discovery. Google LLC, 2022 WL 1239656, at *10. Those representations were false, and the Defendants now claim that they have no discoverable information. Accordingly, entry of a judgment against the Defendants is necessary to adequately deter such misrepresentations, and to “restore the prejudiced party to the same position [it] would have been in” absent the Defendants' wrongful conduct. West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999) (citation omitted).

C. Monetary Sanctions

“Every district court has the inherent power to supervise and control its own proceedings and to sanction counsel or a litigant.” Mitchell, 708 F.3d at 467 (2d Cir. 2013) (citation omitted). “Indeed . . . district judges have an obligation to act to protect the public, adversaries, and judicial resources from litigants and lawyers who show themselves to be serial abusers of the judicial system.” Liebowitz v. Bandshell Artist Mgmt., 6 F.4th 267, 280 (2d Cir. 2021). A district court's inherent power to sanction includes the power to “sanction a party . . . to deter abuse of the judicial process and prevent a party from perpetrating a fraud on the court.” Yukos Cap. S.A.R.L. v. Feldman, 977 F.3d 216, 235 (2d Cir. 2020). Accordingly, federal courts have the “inherent power” to award monetary sanctions against a party for that party's “bad faith, vexatious, or wanton” misconduct. Int'l Techs. Marketing, Inc. v. Verint Sys. Ltd., 991 F.3d 361, 368 (2d Cir. 2021) (citation omitted).

The power to sanction “must be exercised with restraint and discretion.” Chambers v. NASCO, Inc., 501 U.S. 32, 44 (1991). Nevertheless, even a single misrepresentation is enough to justify sanctions: “A court need not wait until a party commits multiple misrepresentations before it may put a stop to the party's chicanery.” Int'l Techs. Marketing, Inc., 991 F.3d at 368-69.

The Federal Rules of Civil Procedure also authorize monetary sanctions for misconduct during discovery. See Fed.R.Civ.P. 26(g) (allowing monetary sanctions, including the “reasonable expenses” and “attorney's fees” incurred as a result of an incomplete or incorrect initial disclosure); Fed.R.Civ.P. 37(b)(2)(C) (allowing monetary sanctions for refusal to obey a discovery order); 37(c)(1)(A) (allowing monetary sanctions for refusal to provide information in an initial disclosure); 37(f) (allowing the court to require payment of “reasonable expenses, including attorney's fees” if a party “fails to participate in good faith in developing and submitting a proposed discovery plan.”). Monetary sanctions may also be awarded against a party that participates in a Rule 16 conference in bad faith. See Liebowitz, 6 F.4th at 290 & n.28 (quoting Fed.R.Civ.P. 16(f)((1)(B)).

Monetary sanctions are appropriate both under the Rules of Civil Procedure, and as an exercise of the Court's inherent powers. As explained above, the Defendants attempted to negotiate a discovery plan in bad faith, requesting an exchange of electronic devices that they knew would not be reciprocal. They attended the June 1 Rule 16 conference in bad faith, misrepresenting their ability and willingness to engage in discovery. And they disobeyed this Court's Orders and the Rules of Civil Procedure in declining to provide information about their coworkers or discoverable evidence in their initial disclosures.

The Defendants' misconduct has caused Google to incur significant expense since they moved to vacate the default. Aside from the normal expense that would attach litigating any case, Google has also had to engage in additional conferences and motion practice regarding the Defendants' misrepresentations and resistance to discovery. Had the Defendants been honest from the start, it is likely that the default against them would not have been vacated, and that Google would have been able to secure judgment against them immediately. Accordingly, Google is entitled to recoup its reasonable expenses and attorney's fees since the entry of the default. See Int'l Techs. Marketing, Inc., 991 F.3d at 367 (monetary sanctions are appropriate to “make[] the wronged party whole for the expenses caused by his opponent's obstinacy” (citation omitted)).

The same monetary sanction is also imposed against Litvak. A court may impose costs as sanctions against an attorney who has “negligently or recklessly failed to perform his responsibilities as an officer of the court.” Id. at 368 n.5 (citation omitted); Wilder v. GL Bus Lines, 258 F.3d 126, 130 (2d Cir. 2001). As an attorney, Litvak has a duty of candor to the Court -- including a duty to promptly correct any unintentional misrepresentations made to the court. N.Y. Rules of Prof. Conduct 3.3(a)(3); see also In re Gordon, 780 F.3d 156, 160 (2d Cir. 2015) (disciplinary proceeding). Rather than promptly alerting Google or the Court when he alleges he learned that the Defendants no longer worked at Valtron, however, Litvak continued to exploit that misrepresentation in his discovery negotiations with Google, seeking to induce an exchange of electronic devices that he knew would not be reciprocal. Furthermore, Litvak has continued to insist that the Defendants have no access to information at Valtron, even while he used their access as leverage in settlement discussions.

Finally, Litvak has refused to respond to inquiries about his compliance with his obligations as an officer of the court, except in a conclusory statement in his affidavit asserting that he instructed the Defendants during their initial consultation on February 17 to preserve all discoverable information and ESI. Google's complaint alleged that the Defendants committed serious misconduct in connection with Valtron, among other organizations. Litvak does not explain how he could have discussed entering the case and informed his clients about the duty to preserve and produce relevant information without learning about the Defendants' relationship to Valtron and the location of their work laptops. Accordingly, Litvak either failed to explain his clients' discovery obligations to them, or knew as early as February that the Defendants were never going to turn over any discoverable electronic devices.

Throughout this litigation, the Defendants have engaged in a willful campaign to resist discovery and mislead the Court. Their attorney has been complicit in this scheme, making inconsistent representations to the plaintiff and to the Court, and exploiting these representations in discovery and settlement negotiations. Google is therefore entitled to recover from Litvak and the Defendants, jointly and severally, the reasonable fees and expenses that it has incurred litigating this action against Defendants Starovikov and Filippov since their appearance in the case.

II. Defendants' Motion for Sanctions

The Defendants have moved for sanctions against Google. In response to Google's motion for sanctions, they argue that Google repeatedly misled the Court about Defendants' conduct during the litigation in order to gain an advantage in the case and tarnish their attorney's reputation. In their reply brief, the Defendants also request sanctions against Google for threatening to make a criminal referral against them in order to obtain an advantage in a civil matter. Google's conduct, however, is not sanctionable, and the Defendants' motion is denied.

A. Misrepresentations

The Defendants argue that Google falsely represented to the Court that 1) the Defendants had agreed to waive personal jurisdiction, 2) the Defendants refused to travel to any country that might extradite them, 3) the Defendants worked “closely” with the individuals identified in their initial disclosures, 4) the Defendants were following advice given by Litvak that hackers should leave their work laptops in Russia, and 5) Google learned only on July 19, rather than on June 27, that the Defendants had stopped working at Valtron. Each of these statements by Google, however, is either true, or represents a good faith dispute as to what Litvak stated on certain occasions. And regardless, no statement was materially misleading.

i. Waiver of Personal Jurisdiction

In its opposition to the Defendants' motion to vacate the default, Google argued that the Defendants had waived any defense that the Court lacked personal jurisdiction over them. In their motion for sanctions, the Defendants assert that Google misled the Court, because they had only stated they would waive personal jurisdiction if Google agreed to vacate the default against them.

With its motion for default judgment, however, Google provided a copy of the emails between its attorneys and Litvak, as well as a copy of the transcript of the March 1 conference. In the email exchange, Litvak requests that Google withdraw its motion for default judgment, and represents that the Defendants “will consent to personal jurisdiction in this matter.” The email does not clearly state that the Defendants' consent to personal jurisdiction was conditional. Accordingly, Google did not mislead the Court in arguing waiver. Regardless, the Court found that the Defendants had not waived any personal jurisdiction defense. Google LLC, 2022 WL 1239656, at *4. The Defendants have therefore failed to show that Google's characterization of their stance was misleading in any material respect.

ii. Concerns over Extradition

The Defendants also dispute Google's assertion that, at a June 1 discussion between Litvak and counsel for Google, Litvak stated that the Defendants would refuse to appear in any country that could extradite them to the United States. According to Litvak, he stated only that the Defendants were “concerned” about going to a country with an extradition treaty. Google's counsel, however, maintains that her recollection of the conversation is correct.

Even if Litvak's characterization is correct, it does not suggest that Google's characterization of the conversation was intentionally, recklessly, or even negligently misleading. Nor does it explain why any difference between the parties' accounts is material. In either case, the Defendants began to add constraints on the locations at which they were willing to be deposed, just after representing to the Court that they were willing to be deposed in another country if they could travel there. The Defendants, not the plaintiff, have misled the Court in this respect.

iii. Names of Coworkers

The Defendants argue that Google mischaracterized Litvak's statements in a June 27 call, during which the parties discussed the Defendants' failure to provide information about their coworkers (including surnames) in their initial disclosures. In Google's July 19 letter, Google's counsel represented that Litvak had stated on the call that the Defendants worked “closely” with the individuals named in their initial disclosures. This would be unsurprising given the breadth and complexity of the activities described in the complaint. According to Litvak, though, he only stated that the Defendants worked “with the individuals in question in the same location at some point in the past.” Google's counsel has submitted an affidavit stating that Litvak described the Defendants as working “very closely” with the coworkers named in their initial disclosures. The Defendants have provided no reason to think that Google misrepresented Litvak's statements in bad faith, or that Google's account of the conversation was materially misleading in any way.

iv. Timing of Defendants' Disclosure that They No Longer Worked at Valtron

The Defendants insist that they first informed Google on June 27 that they no longer worked at Valtron, rather than on July 19, as Google claims. In support of this argument, the Defendants note that they stated without objection at the July 29 conference that they first disclosed the end of the employment with Valtron on June 27. The Defendants have also provided excerpts from emails after a June 27 call with plaintiff's counsel, showing that the Defendants expressed on the June 27 call that they did not have any discoverable electronic devices because those devices were in Valtron's possession.

These emails, however, only show that the Defendants told Google they no longer had access to any electronic devices. They do not show that the Defendants disclosed on June 27 that their employment with Valtron had ended. On the contrary, Google's email suggests that it continued to believe that the Defendants would have access to their work devices as part of their employment.

Regardless, whether the Defendants first disclosed the end of their employment with Valtron on June 27 or July 19 is not material to these proceedings. When they appeared in this action, the Defendants asserted that they continued to work at Valtron. And even by his own admission, the Defendants' counsel did not correct this misrepresentation until at least a month after he learned it was incorrect, and continued to exploit it in the meantime. Whether the Defendants' employment status was first disclosed on June 27 or July 19 is not material.

v. Litvak's Interview

Finally, the Defendants move for sanctions based on Google's submission of transcripts of Litvak's Russian-language interview, conducted for a documentary in 2016, in which Litvak is asked: “What mistakes do hackers usually make that turn them into your clients?” Litvak responds by saying that their biggest mistake is failing to separate their work laptop and personal laptops, and that they should leave their work laptop at home when they leave the country.

The Defendants argue that Google has misled the Court by characterizing Litvak's interview response as an instruction to the Defendants, even though the interview took place years before the events giving rise to this action took place. But the Defendants do not dispute the accuracy of Google's translation of the interview, nor do they point to any specific misleading statement Google made. When Google submitted the interview, it described it as an interview that took place years before this lawsuit was filed. Nothing in Google's characterization of Litvak's statements was misleading. Nor can the Defendants argue that the interview was irrelevant to this litigation. The Defendants have refused to produce not only their work laptops, but also any other electronic devices.

B. Threat of Criminal Prosecution

Finally, the Defendants request sanctions against Google for characterizing its September 8 settlement demand as extortionate, and for telling them and the Court that the demand would be reported to law enforcement. The Defendants do not deny that they made the demand described by Google. Instead, they argue that Google's conduct violates New York Rule of Professional Conduct 3.4(e), which states that an attorney may not “present, participate in presenting, or threaten to present criminal charges solely to obtain an advantage in a civil matter.” Courts interpreting this rule have generally found a violation only when the threat of criminal prosecution is used as leverage to demand civil relief, and only when the threat is made solely for that purpose. See United States v. Huntress, 13CV00199, 2015 WL 631976, at *22 (W.D.N.Y. Feb. 13, 2015).

Google's response to the Defendants' settlement demand did not violate Rule 3.4(e), and regardless was not sanctionable. The Defendants do not explain how Google's report to law enforcement was used to advance its position in this action. Google had already moved for sanctions before the Defendants' settlement demand, and Google has not made its criminal report contingent on any demands of the Defendants. Additionally, Google has a good-faith basis to believe that the Defendants have committed the crime of extortion by demanding payment in exchange for halting criminal activity. See United States v. Jackson, 196 F.3d 383, 387 (2d Cir. 1999) (a demand for money is extortionate when “the defendant has no plausible claim of right to the money demanded or if there is no nexus between the threat and the defendant's claim”). The Defendants have therefore failed to show that Google has reported their activity to gain advantage in this litigation, rather than to report a crime. Accordingly, the Defendants have not shown that Google has violated the Rules of Professional Conduct, or that it has otherwise engaged in sanctionable conduct.

Conclusion

The plaintiff's August 22, 2022 motion for sanctions is granted. The Defendants' September 2, 2022 motion for sanctions is denied. Default judgment is issued against the Defendants pursuant to Fed.R.Civ.P. 37. A monetary sanction in the amount of the plaintiff's reasonable attorneys' fees, costs, and expenses associated with litigating the case against the Defendants since March 14, 2022 is assessed jointly and severally against Dmitry Starovikov, Alexander Filippov, and Igor Litvak as an exercise of this Court's inherent power and pursuant to Fed.R.Civ.P. 37. A scheduling order addressing the calculation of the monetary sanction accompanies this Opinion.