IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA

UNDER SEAL
CRIMINAL NO. 15-067 (RDM)

v.

MIRISLAM
Defendant.

GOVERNMENT'S MEMORANDUM IN AID OF SENTENCING

Defendant Mir Islam entered a guilty plea on July 6, 2015, to three counts alleged in the
Information filed in this case, charging Islam in count One with Conspiracy, in violation of 18
U.S.c. 371 ; in Count two with False Bomb Threats, in violation of 18 U.S.c. 844(e); and in
Count Three with Cyber-stalking, in violation of 18 US.C . 2261A(2).

The conspiracy to which

Islam pled guilty had seven (7) distinct criminal objectives, as alleged in Count One of the
Information.

These objectives were (1) fraudulent use of personal identification information in

aid of the commission of another federal offense, in violation of Title 18 US.c. 1028(a)(7); (2)
Access Device Fraud, in violation of 18 US.C. 1029(a)(3); (3) Social Security Number Fraud, in
violation of 18 US.C. 408(a)(7)(B); (4) Computer Fraud, in vio lation of 18 U.S.c.
1030(a)(2)(A); (5) Wire Fraud, in violation of 18 US.c. 1343; (6) Assault and Intimidation of a
Federal Official , in violation of 18 US.c. 111(a) and (b) ; and (7) Interstate Transmission of
Threats, in violation of 18 U.S.C. 875(c). At the time of his guilty plea in this case, Islam had a
separate, pending federal case in the Southern District of lew York ("SDNY") in which Islam had
entered a guilty plea but had yet to be sentenced.

Upon entering his plea in this case. Islam was

returned to the SD Y for sentencing and was not sentenced until March 7, 2016. Thereafter,
Islam was promptly returned to this District for sentencing which is now scheduled for July 11 ,

2016.

In accordance with hi s plea and accompanying Statement of Offense, Islam acknowledges

a general pattern of criminal conduct from February 2013 through September 2013 in which he,
and others conspi ring with him, used the Internet intentionally to harass, intimidate, assault, harm,
or inflict substantial emotional distress upon dozens of celebrities and state and federal public
officials, and a student at a university, none of whom Islam knew personally. Islam and hi s
coconspirators embarked on thi s digital crime spree to entertain themselves; to exact revenge for
official conduct they found objectionable; to express animus; for their own notoriety; and, in the
case of the university student, to inflict emotional distress because the student spurned contact
from Islam who had developed an online obsession with her. Some of the victi ms, to thi s day,
continue to suffer from the aftereffects of Islam's and his coconspirators' criminal conduct.
Respecting the conspiracy alleged in Count One. Islam acknowledges that he and his
coconspirators agreed to commit, and did commit, two fundamen tal types of abuses that resul ted in
the commission of at least seven different types federal criminal offenses. The firs t of these
abuses, in the jargon of Islam and his coconspirators, is known as "doxing." "Doxing" is the act
of gathering, by licit and illicit means, and posting on the Internet personal identifying information
("P I]'} and other sensitive information about an individual, including, for example, addresses,
dates of birth, social security numbers, telephone numbers, email addresses, credit information,
employers, and details regarding the indi vidual's children and other family members. Islam and
his coconspirators posted the PII of at least fifty (50) celebrities and state and federal offici als on
different web sites that all shared the domain name "Exposed." Islam . and his coconspirators,
stole much of the PII of those doxed, including credit reports, and posted that personal information

-2 -

on public "Exposed" websites for all the world to view. The natural, inevitable, and intended
consequence of this publication of names, social security numbers, dates of birth, addresses, credit
reports, and the like, was the use of that information by countless others to illicitly obtain credit
cards and other finance-related accounts using the identities of the doxing victims, thereby causing
many of the victims to suffer continuing credit issues. The publication of the victims' PIT also
revealed to any other would-be harassers or assailants how and where to contact the victims.
The second abuse, in the jargon of Islam and his coconspirators, is known as "swatting."
" Swatting" is the act of placing emergency 9-1-1 type calls to police departments, usually through
Internet-based telecommunication relay services, to make false claims of homicides or other
assaultive or criminal conduct by, or against, other targeted individuals at the locations of those
individuals. These false 9-1-1 communications are intended to result in, and usually do result in,
a tactical police response, including SWAT teams, to the targeted, unsuspecting individuals '
residences.

Swatting is, in fact, a crime of violence. It is an assault with a deadly weapon in

which the police are used as proxies to commit the assault. By definition, the crime entails an
armed police response.

When the responding officers are threatened in the fake 9-1-1

communication with physical harm or death if they respond, the officers invariably arrive at the
premises in force, with guns drawn and trained on the premises and its occupants . The prospect
for injuries or fatalities in the police response is manifest.
The offenses alleged in Counts Two and Three of the Information are wholly unrelated to
the conspiracy alleged in Count One. Respecting the false explosives report alleged in Count
Two, Islam acknowledges that, on March 22, 2013, he falsely reported a fal se shooter-on-campus
and bomb threat on the campus of the University of Arizona, in Tucson, ,t.\rizona, through a 9-1-1

-3-

call communicated via an Internet-based telecommunication relay service, similar to the swats.
Respecting the cyber-stalking alleged in Count Three, Islam acknowledges that from March 22,
2013, through July 2013 he engaged in a sustained online campaign of harassment against a
student at the University of Arizona in Tucson, of which the false shootinglbomb threat alleged in
Count two was a part. Islam 's harassment of the student included the bomb threat; incessant
texting to the student and some of her friends; impersonating federal and state law enforcement to
obtain information about her; hacking or otherwise obtaining unauthorized access to efnail -and
social media accounts of the student, downloading information from those accounts, and changing
the passwords so the student could not access her accounts; and creating false social media
accounts of his own with false information and pictures to try to friend the student under false
pretenses. The harassment inflicted such serious emotional distress upon the student that she
sought counseling, considered withdrawing from the university and moving away, and feared for
her personal safety.
The offenses in this case were egregious. The sentence imposed upon Islam should reflect
that.

The parties agree with the Probation office's determination that Islam's total adjusted

offense level is 22 and his criminal history category is I. Accordingly, Islam's corresponding
sentencing range is 41-51 months. Considering the severity of the offenses committed by Islam;
unique circumstances of his sentencing that significantly and fortuitously inure to Islam's benefit,
discussed in greater detail below; and cooperation matters addressed in the accompanying sealed
addendum, the government respectfully submits that this Court should sentence defendant Islam to
a term of imprisonment of 46 months.

-4-

Factual Background
A detai led description ofMir Islam's crimes is set forth in the Statement of Offense filed in
this case and will not be repeated here in full ; rather, particular aspects of that criminal conduct
wi ll be highlighted or elaborated upon here.
A.

Count One: Conspiracv

The "ex posed" conspiracy included at least five coconspirators, including Mir Islam who
resided in New York City. Two of the coconspirators resided in Southern California, one resided
in Fredericksburg, Virginia, and one resided in the country of Finland. Mir Islam was the only
member of the conspiracy who had attained the age of majority; all the other coconspirators were
juveniles during the conspiratorial period.

Mir Islam and his coconspirators selected their

victims, that is, those whom they intended to "dox" and/or "swat," on the basis of ideological,
po liti cal, or personal animus against those individuals, or because they thought doxing or swatting
a certain individual would draw public and media attention, not to themselves personally, but to
their conduct including to their 'exposed" websites where the Pll of the doxed individuals was
posted.
l.

The Exposed Websites

On or before March 11 , 2013 , a website with the URL "exposed.su" became accessible to
the public on the Internet.

Exposed. su was the first website used by Mir Islam and his

coconspirators to commit the abuse of doxing.

The home page of the website consisted

principally of the names of numerous high-level present and former government officials as well
as vari ous celebrities. Approximately 37 individuals were ultimately named on Exposed.su.
l\ext to the names of some of the gowmment officials, in parentheses, were the respective

-5-

government positions of those individuals.

Each of the names listed on the exposed.su website was a link to other content pages on the
website that were accessible to anyone visiting the site.

The content pages on the website

contained PI! for each of the individuals listed on the site. The PI! usually included, variously,
social security numbers; dates of birth; phone numbers; present and previous physical addresses;
and photographs.

For most of those individuals listed on the website, the PH also included

financial credit reports.

So, for example, if persons visiting the website exposed.su cl icked on

one of the names/links, they would have been transferred to a webpage normally contain ing the
social security number, date of birth, phone number, address, photograph, and previous addresses
for that named individual. They would also usually have been instructed to "Click here to view
[individual's] Credit Report. "

Cl icking on that link would have transferred the viewer to a

different content page on the site that contained a financial credit report for that individual. The
exposed.su website was hosted on one or more servers located in The Netherlands. Public access
to the website was through a "proxy" server, however, which masked the actual location of the
webserver.

On or near March 19, 2013, the exposed.su went offline.

On or about April 2, 2013, another "exposed" website was launched by the conspirators,
including Mir Islam, with the URL 'exposed.re." The si te was eventually, in practical terms,
identical to the exposed.su site, with at least three exceptions. The first was that the site contained
at least 50 names and associated PI!.

Second, immediately adjacent to some of the names on the

site, inside brackets, was the term 'Swatted." These individuals. along with others named on the
exposed.re website without the "Swatted" reference, and still others not named on the website,
were in fact "swatted" by members of the conspiracy. Finally, the conspirators attempted to

-6-

monetize the exposed.re website by creating a "Linkbucks" account.

Linkbucks is a social

advertising and marketing network that allows subscribers to earn money, in various ways, from
visitors to a website. The attempt to monetize the website created another incentive for Islam and
his coconspirators to commit swats because swats drove traffic to the website, particularly when
the conspirators notified TMZ that a swat was going to be committed by those who had created the
exposed websites. Like the site exposed.su, exposed.re was proxied to hide the location of its
webserver which was Malaysia. On April 22, 2013 , Malaysian authorities took the exposed.re
website offline at the request of U.S. law enforcement.
On or about July 22, 2013, a third "exposed" website was launched by some of the
conspirators, including Mir Islam, this time with the URL "exposed.ws." The site was similar in
design and content to the exposed.su site, and was again proxied to hide the locations of its
web servers which were Latvia, the United Kingdom, and/or Ukraine. The site was taken offline
sometime before August 12, 2013.
II.

Acquisition of PH Posted on Exposed Websites

The PII posted on the exposed web sites by the conspirators was obtained predominantly in
the following manner. In about February and March 2013, members of the conspiracy collected
personal information about their targets from open source websites. To obtain the social security
numbers, dates of birth, and addresses of their targets, the conspirators usually resorted to the
websites SSNDOB .ru and SSNDOB.ms (collectively "SSNDOB"). SSNDOB was a website that
collected from computer intrusions and other means PII, including social security numbers, dates
of birth, last known addresses, and associated identities, belonging to individuals located around
the world, including within the United States. SSNDOB sold this PII online. The conspirators,

-7-

including Mir Islam, in some cases used the online money transfer service known as WebMoney
Transfer to pay for the SSNDOB PlI, but in most instances they were able to obtain the SSNDOB
PI! without paying a fee due to Mir Islam's and another conspirator's association with SSNDOB's
owner/operator.
Once the conspirators obtained the social security numbers, dates of birth, addresses, and
any other personal information they could learn about their intended victims, the conspirators used
that PII and the Internet to steal the victims ' consumer credit reports from the servers of credit
reporting agencies. In most instances, members of the conspiracy obtained credit reports through
credit report websites like annualcreditreport.com, which charged no fees.

To obtain a victim's

credit report from annualcreditreport.com, a conspirator created a fake user account on the
website, entering into the site the name, social security number, date of birth, and address of the
intended victim.

The conspirator was then permitted to select from various credit reporting

agencies to obtain the desired credit report.

Once the conspirator selected a particular credit

reporting agency, such as Equifax, Experian, or TransUn ion, the conspirator was transferred to
that credit reporting agency's server whereupon the conspi rator was prompted to reenter the name,
social security number, date of birth, and address of the individual whose credit report was sought
and whom the conspirator was fraudulently representing to be.

The conspirator then had to

answer a series of multiple choice security questions. If the conspirator answered the questions
correctly, either as a result of information the conspirator learned about the target or by guesswork,
the conspirator was granted access to and dovl'llloaded the victim's credit report from the
respective credit reporting agency's server.

If the conspirator failed to answer the questions

correctly, he was eventually prevented from further attempts through the chosen credit reporting

-8-

agency and the conspirator simply went back to the annualcreditreport.com website and selected
another credit reporting agency to try the process again.

On some occasions when the

conspirators were unable to obtain a free credit report of an intended doxing victim , they, and Mir
Islam in particular, were able to obtain the report from a website that charges a fee for the reports,
where the security questions are often easier to answer. As with other fees incurred in furtherance
of the conspiracy, to pay the fee for these credit reports , the conspirators used stolen credit card
account information.

In thi s manner, the conspirators, including Mir Islam, were able

fraudul ently to obtain from various credit reporting agencies, including Equifax, TransUnion, and
Experian, the consumer credit reports of most of the individuals doxed on the exposed websites,
and to post those credit reports on the exposed sites.
Ill.

The Swattings

Mir Islam and his coconspirators swatted in excess of 20 individuals. As stated above,
Islam and his coconspirators selected persons to be swatted on the basis of various criteria,
including ideological, political , or personal animus; anlUsement and whim; a desire for media
attention; and revenge.

Nearly every intended victim of the swats whom investigating FBI

Agents were able to interview described to the agents some kind of trauma and/or dramatic police
response resulting from the swat call. A former United States Congressman from Michigan,
identified herein as "M.R.," swatted because of federal legislation he sponsored, described how
police responding to the call commandeered the home of an adjacent neighbor and set up a sniper
position inside the neighbor's home. Brian Krebs. a blogger swatted in part because of an article
he wrote, described in a later article how he was ordered to put his hands in the air and then
handcuffed and observed about a half-dozen squad cars, lights flashing and officers pointing

-9-

firearms in his direction, including a shotgun and a semi-automatic rifle.

A former State

Representative and now United States Congressman, identified herein as "T.L.," swatted because
of anti-swatting state legislation he sought to pass, described how he received a call from police
asking him whether he, T.L., had shot his own wife, causing him worry that she had in fact been
shot, and then later learned that his wife had been home during the police response, was ordered
out of the house with her arms raised , and was shaken up.
The Poli ce responses to the swats were dramatic and potentially catastrophic partially
because at least seven (7) of the swats committed by Islam and his coconspirators included
language in the 9-1-1 communication that the person to be swatted had killed someone and would
kill responding officers.

So, for example, on March 31, 2013, members of the con spiracy

committed a swat against an Assistant United States Attorney in retaliation for a particular
prosecution he participated in. The swat language included the following:
Hello my wife is dead . I shot her and now she's dead. I don't know what to do.
I'm having thoughts of hurting people and I don't know what to do. If anyone
comes in my house I might shoot them.
I am just letting you know now if I see any police outside of my house I wi ll start
shooting.
I will not be taken alive. Mark my words. I am not going to prison for the rest of
my life. I will not. Don ' t worry about where I am at in the house. Ifany cops are
outside in my yard or on the street I will start shooting.
By the way I have my police scanner right next to me and I can hear everything and
you guys think I'm joking. I will shoot anyone who comes near my property.
I see cars outside my house I swear I will shoot. I am not playing. I am not
fucki ng around. I will shoot them.
You know I work with the police a lot but I am not afraid to shoO! them.

-10-

On April 4, 2013, members of the conspiracy committed a swat against an individual

identified herein by the initials "W.L." at W.L.'s residence in Virginia. In communicating the
false 9-1-1 report, the conspirator stated that he had shot his wife and that if the police responded
he would not be taken alive and that he would shoot the police. On April 27,2013, members of
the conspiracy swatted an individual identified herein by the initials "W.B ." at W.B. 's residence in
Mary land, and the conspirator making the false 9-1-1 communication stated that he had shot his
wife, that he had a gun, that he would execute anyone who responded, and that he would not be
taken alive. There were other similar swat calls.
IV.

Mir Islam's Participation in the Conspiracy

Mir Islam participated in nearly all facets of the conspiracy, including the fraudulent
procurement of credit reports for posting on the exposed websites, the creation of the exposed
websites, and the swatting. Islam participated with other conspirators in conceptualizing the
exposed websites, choosing doxing and swatting victims, and more generally, executing the broad
contours ofthe conspiracy. He assisted, to a small degree, in the creation of the appearance of the
exposed websites. Islam's contribution to the creation of the exposed websites was relatively
small because he was less adept at coding than some of his coconspirators. Islam chose specific
individuals to be doxed and swatted, and discussed with his coconspirators swats they intended to
commit, including the swat of the Assistant United States Attorney.

He purchased the PII of

several victims from the website SS DOB, and he pulled credit reports from pay-for-report sites
for a number of victims. Islam participated in the swat of Brian Krebs. He swatted at least two
celebrities, using language in the 9-1-1 communication that threatened responding officers. On
April 23, 2015, he communicated a false bomb threat at the White House, claiming there were

-11-

eight (8) bombs planted around the perimeter of the White House.

Islam also contacted the

celebrity media entity TMZ to alen the entity to the conspirators' doxing and swatting activities to
promote media reponing about the activities. TMZ did in fact report on some of the doxing and
swatting activity committed by the conspirators.
B.

Count Two: Conveving False Information Concerning Use of Explosive

On March 22, 2013 , Mir Islam falsely reponed a shooting and explosives incident on the
campus of the University of Arizona in Tucson. Islam's communication, sent again over an
Internet relay system, stated, "[my] friend has a gun and a rifle and is shooting people on campus."
Islam terminated his relay connection, then reestablished it to continue his false report.

Islam

stated to the rel ay operator, "OMG OMG where are the Police ... he is shooting up the area ... he
is going to blow up the buildings . .. he has explosiyes."
In response to Mir Islam' s false report of a shooter and explosives on the university
campus, the local police, university police, and the FBI responded to the campus to investigate.
The response by the local Police Department included numerous officers, SWAT Teams, and the
Police Department Bomb Squad. The university's administration building was evacuated and
searched, and the campus was placed in lockdown, with flash text messaging sent to the st udent
population advising of a potential active shooter situation.
Later that same evening Islam made another false emergency call, this time claiming that a
man located on the same university campus was holding a rifle to the head of a woman and was
going to kill her if he did not receive S50.000 in ransom. Islam further stated that the male had
placed explos ives in eight campus buildings and was going to blow them up and stan shooting.

In

light of the previous false report, authorities investigating that report assumed this second threat

- J 2-

was part of the same course of conduct and also false.

Mir Islam made the false shooting and explo sives report because Islam was obsessed with
a woman, identified herein by the initials "A. R.T.," who was then a student at the university and
whom Islam believed had spurned his continued attempts to contact her.

A.R.T . was a

cheerl eader at the university. Another cheerleader at the University with whom A.R.I. conducted
cheerleading was an indi vidual with the initials "T. E.M." T.E.M. was identified by A.R.I. as "TJ
Mitch" on A.R.I. ' s Facebook page to which Islam had access . In Islam's fa lse report, "TJ Mitch"
was the name provided by Islam of the shooter and the individual intending to set off explosives.

C.

Count Three: Cyberstalking

Beginning in about March 2013 and continuing through at least July 2013, Mir Islam
engaged in a campaign of harassment again st A.R.I., the student at the University of Arizona.
Though Islam had never met A.R.I., he developed a romantic obsession with her through the
Internet. Islam harassed A.R.I. to attempt to coax and coerce A.R.I. to communicate with him ;
to obtain info rmation about A.R.I.; in retaliation for A. R.T.'s refusal to communicate with him;
and to intimidate and cause substantial emotional distress to A. R.T.
Mir Islam learned about A.R.I. and acquired information about her from Internet searches.
He knew that A.R.I. was a student and cheerleader at the university. Islam communicated the
false shooting and bomb threat at the university on March 22, 2013 , because he expected A.R.I.
would be affected, disturbed, and upset by the threats . Indeed , Islam identified the campus
shooter and bomber in his call as a person who was a frien d of A.R.I.'s and in the call feigned
being a female, suggesting that A.R.T. was the caller reporting her friend's terrorism on campus.
Shortly before making the false shootinglbomb threats, Islam called a university facility dedicated

- 13 -

to honoring the uni vers ity' s athletes and athletics programs, and spoke to a receptionist. Islam
identified himself as a Police Officer named "Thomas Ryan," and requested a cell phone number
for A.R.T., whom he identified as a cheerleader at the university. The recepti onist refused to
provide Islam the number.
Mir Islam did eventually obtain the cell phone number for A.RT, as well as for three other
students and cheerleaders at the university, one of whom, identified herein by the initials
"M,A.G.," was a friend of A.RT Over the course of several months , beginning in about April
2013, Islam repeatedly called or sent text messages to A.RT , M,A.G. , and the other two students,
some of which were threatening. Islam also sent harassing emails to A.RT at A.RT's Cox
communications email account.
Towards the end of April , Mir Islam began frequently calling and sendi ng text messages to
the cell phone ofM .A,G. Some nights, Islam sent as many as 30 text messages to M.A.G. In one
such call, on about May 1,2013, Islam stated to M.A.G. that he was an FBI Agent dealing with a
case about a friend of hers whom Islam identified by a nickname as A.R.T, Islam stated he
needed some information for the investigation. When ,\1.A.G. hung up, she received numerous
text messages from Islam containing her social security number.

In still other text messages to

M.A. G. , Islam identified himself as "Batman" or "TJ," and stated that he had personal information
about M,A.G. that Islam would release unless M,A.G. provided Islam information about A.RT
Islam sent similar text messages to two other student cheerleaders, seeking information about
A.RT
Sometime on or before July 17, 2013, through soc ial engineering techniques. Mir Islam
acquired unauthorized access to A,R.T's Cox Communications email account. Upon gaining

-14-

unauthorized access to the account, Islam changed the password to AR.T.'s account, thereby
denying her access to her account. On or about July 17,2013, Is lam socially engineered into, and
obtained unauthorized access to, A.R.T.'s Facebook and Instagram accounts , changing the
passwords to those accounts too . Islam dovmloaded personal photographs of AR.T. from her
Facebook and Instagram accounts and stored them on a cloud server.

Within the same time

frame , Islam created a Facebook page of his own in which he assumed the false identity of "Adrian
Cosgrove," including photographs of someone other than Islam , and pretended to be a student
attending AR.T.'s university. Islam used this Facebook account and identity to send a "friend"
request to AR.T.'s Facebook account.

Islam also created fake Twitter accounts in the nickname

of A.R.T.
Mir Islam's continued harassment of AR.T. profoundly affected A.R.T. It caused AR.T.
a great deal of emotional distress, anxiety, and fear for her safety, and caused AR.T. to alter her
behavior and seek counseling. AR.T. feared the source of her harassment may have been
physically stalking her, and she feared she was subject to attack and phys ical injury, including in
her own place of residence. She sought escort from campus security after studying late for fear of
personal attack. AR.T. considered withdrawing from the university, abandoning cheerleading,
and moving away from the area in which her university was located. The incidents affected
A.R.T.'s abi lity to concentrate in school, disrupted her sleep, and made her paranoid that she was
being watched by someone at any given time or location. Members of AR.T's family at times
had to stay with her to comfort her.

-15-

Argum ent
A.

Legal Standards

In United States v. Booker, 125 S. C!. 738 (200 5), the Supreme Court ruled that the United
States Sentencing Guidelines are no longer mandatory. However, "[a]s a matter of administration
and to secure nationwide consistency, the Sentencing Guidelines should be the starting point and
the initial benchmark" for determining the defendant's sentence. Gall v. United Stales, 128 S.Ct.
586, 596 (2007).

While, to be sure, "[i]n accord with 18 U.S.C . 3553(a), the Gu id el ines,

formerly mandatory, now serve as one factor among several courts must consider in determini ng
an appropriate sentence," Kimbrough v. United States, 128 S.Ct. 558, 564 (2007), it remains the
case that "the Commission fi ll s an important institutional role: It has the capacity courts lack to
'base its determ inations on empirical data and national experience, guided by a professional staff
with appropriate expertise,'" id. at 574 (quoti ng United Slates v. Pruill, 502 F.3d 1154, 1171 (lOlh
Cir. 2007) (McConnell, J., concurring. The Supreme Court "accordingly recognized that, in the
ord inary case, the Commission 's recommendation of a sentencing range wi ll 'reflect a rough
approx imation of sentences that might achieve 3553(a)'s objectives. '"

Kimbrough, 128 S.C!. at

562-63 (quoting Rita v. United Stales, 127 S. Ct. 2456, 2465 (2007. As one member of this
Court has held , "Booker requires judges to engage in a two-step analysis to determine a reasonable
sentence." United States v. Doe, 413 F. Supp.2d 87, 90 (D. D.C. 2006) (Bates, 1.)
[A] district court shall first calculate (after making the appropriate findings offact)
the range prescribed by the guidelines. Then, the court shall consider that range as
well as other relevant factors set forth in the guidelines and those factors set forth in
[18 U.S.C .] 3553(a) before imposing sentence.

Un iled Slates v. Hughes, 401 F.3d 540, 546 (4th Cir. 2005).
When weighing the 3553(a) factors as part of its calculus of an appropriate sentence, the

- 16-

Court should consider not only the nature and circumstances of the offense and the history and
characteristics of the defendant, but also the applicable sentencing objectives-that is, that the
sentence: (1) reflect the seriousness of the offense; (2) promote respect for the law; (3) provide just
punishment; (4) afford adequate deterrence; (5) protect the public; and (6) effectively provide the
defendant with needed educational or vocational training and medical care. See IS U.S.c.
3553(a)(1) and (2).

In addition, the sentence should reflect "the need to avoid unwarranted

sentence disparities among defendants with similar records who have been found guilty of similar
conduct."
B.

IS U.S.C. 3553(a)(6).
An Analysis of the Factors Enunciated in IS U.S.C. 3553(a) Demonstrates
That a Sentence of 46 months for Islam Is Appropriate
1.

The

ature and Circumstances of the Offense

The offenses for which Islam is to be sentenced are indisputably serious. Count One, the
conspiracy charge, effectively consists of seven (7) separate but related offenses. All seven of the
objects of the conspiracy were achieved, many times over, and could have been charged as
multiple substantive offenses. To illustrate:

Object (1): 18 U.S.C. 102S(a)(7)

Islam and his coconspirators doxed at least 50 individuals. There were, therefore, close to
50 instances of Islam and his coconspirators possessing and using means of identification
of the doxing victims in furtherance of wire and computer fraud to obtain, without
authorization, credit reports of the victims from the credit reporting agency servers. It is
close to but not actually 50 because the conspirators stole and published on the exposed
websites credit reports for nearly all, but not all, doxing victims .

Object (2): IS U.S.c. 1029(a)(3)

Similarly the coconspirators actually possessed at least 50 different social security
numbers with intent to use those SSNs to defraud the credit reporting agencies of the credit
reports.

- 17 -

Object (3): 42 U.S.C. 408(a)(7)(B)

The conspirators falsely represented a SSN to be their own each time they used it to create
an account with a credit reponing agency in the name of a victim to obtain a credit repon.
This offense is adminedly closely related to Object (2). Nevenheless, it was committed at
least 50 times by the conspirators.

Object (4) : 18 U.S.C. 1030(a)(2)(A)

The conspirators intentionally accessed the computers of the credit reporting agencies well
over 50 times when they fraudulently obtained the doxing victims' credit reports for
publication on the exposed websites.

Object (5): 18 U.S.C. 1343

To obtain property, that is, credit reports, by means of materially false representations and
to execute a scheme to defraud credit reponing agencies of credit repons, the conspirators
transmined wire communications in excess of 50 times.

Object (6): 18 U.S .c. 111(a), (b)

The conspirators used the police to commit assaults with firearms upon two federal
officials on account of those officials' performance of their official duties.

Object (7): 18 U.S.C. 875(c)

Of the more than twenty (20) swats comm ined by the conspirators, at least seven (7) of the
swats included language in the 9-1-\ interstate communications threatening to kill police
officers who responded to the calls. Only three of these section 875(c) violations are
incorporated into the plea agreement and included in the Guidelines calculations.

Most, though not all, of these numerous offenses, if actually incorporated into the plea agreement
and Sentencing Guidelines calculations, would have been grouped under USS G 301.2 and so
would not have changed Islam 's total offense level. But the criminal conduct of the conspirators
was more prolific and persistent than the plea agreement suggests.
Another aggravating circumstance oflslam's criminal conduct is its breadth, continuity,
and timing of commission. As the Presentence Investigation Report makes clear, beginning in
20 I 0 and continuing through June 2013, a period that oyerlaps with the Exposed conspiracy, the
false bomb threat at the University of Arizona, and the cyber-stalking of the university student,
Islam was engaged in separate carding activities and offering doxing services, distinct from his

-1 8-

Exposed doxing, on an Undercover carding forum set up by the FBI , as well as other carding
forums.

"Carding" consi sts of criminal activities associated with stealing PH and financial

information belonging to others, including account information related to credit cards, bank cards,
debit cards, and other access devices, and selling that information or using it to obtain money,
goods, or services without the victims' authorization. Islam was also involved with a computer
hacking group known as UG Nazi. Islam was arrested by the FBI in June 2013 and charged in the
SDNY by Information with five (5) counts related to Islam 's carding and computer hacking
activities.
During hi s debriefings with the FBI in New York pursuant to a cooperation plea
agreement, Islam fai led to disclose his criminal activities in the Exposed conspiracy, the fa lse
bomb threat, and the cyber-staIking.

He was released in June 2013 as part of a cooperation,

whereupon Islam continued his Exposed activities and cyber-stalking, and Islam disclosed to his
Exposed coconspirators his cooperation with the FBI and the name of the FBI Agent who was
responsible for supervi sing his cooperation.

The disclosure of the FBI Agent's identity

compelled the Agent to take security precautions for his own safety. Islam was rearrested in
September 2013 on the basis of his criminal activities in this case as well as the violation of the
terms of his release in the SD"lY case.
2.

The History and Characteristics of the Offender

From the government' s limited perspective, Islam is an extremely intelligent, shrewd,

cormiving, and manipulative individual.

He is daring and criminally ambitious.

We

acknowledge that Islam has a psychological disorder that may have contributed to some of these
other attributes, including his intelligence, manipUlative nature, and anlbition. But nothing in his

-19-

disorder, to our knowledge, predisposes Islam to crime. Islam has the capacity to appreciate right
from wrong, and to direct hi s energy towards productive and lawful endeavors. He chose not to.
Based on all the circumstances of the offense and Islam's inveterate crim inal activity, he is
deserving of a significant punishment.
3.

The Need to Reflect the Seriousness of the Offen se, to Promote Respect for
the Law, to Provide Just Punishment, to Afford Adequate Deterrence, and
to Protect the Public

The need to reflect the seriousness of the offense, to promote respect fo r the law, to provide
just puni shment, to afford adequate deterrence, and to protect the public all strongly support a
sentence for Islam at the high end of the Guidelines range of Islam's total offense level. First,
Islam has received a substantial sentencing calculati on benefit from having two entirely separate
cri minal schemes combined in the Info rmation and the sentencing. As previously noted, the
Exposed conspiracy, charged in Count One, is unrelated to the false bomb threat and cyberstalking
charged in Counts Two and Three.

The fal se bomb threat and cyberstalking offenses were

committee by Islam , in New York City, against a university and student in Arizona.
offenses were originally being investigated by the FB I in Phoenix.

Those

In the course of the

investigation of the Exposed conspiracy by the FBI's Washington Field Office ("WFO"), the FBI
WFO also deve loped evidence identifying Islam as the perpetrator of the offenses in Phoenix. To
expedite resoluti on of all the charges, it was agreed that Islam would be charged in this District for
all the offenses in one plea agreement and charging instrument. While this was just, it was also
unusual. No rmally, separate offenses are charged and sentenced separately. Had Islam been
charged and sentenced in this District solely on the Exposed conspiracy, and then transferred to the
District of Arizona fo r sentencing on the false bomb threat and cyberstalking. Islam would have

-20-

been eligible to receive, and almost certainly would have received, a considerably greater total
sentence than he is subject to now.

Islam' s total offense level under Count One, including

acceptance of responsibility, would have been 18 , rather than 22, with a corresponding Guidelines
incarceration range of 27 -33 months. At a subsequent sentencing in Phoenix, Islam , who would
have certainly been sentenced to a considerable period of incarceration in the Exposed case, would
have been a criminal history category II. See USSG 4Al.l(a), (b). Islam's total offense level
for the District of Phoenix offenses, including acceptance of responsibility , would have been 19,
with a corresponding Guidelines incarceration range of 33-41 month s.

Therefore, instead of

fac ing a maximum of 51 months' incarceration, Islam would have been facing a maximum of 74
months had a sentencing Judge in Phoenix chosen to impose a fully consecutive sentence, which
would have been appropriate given the seriousness of the Phoenix offenses and their lack of any
relation to the Exposed conspiracy.
Second, in Islam 's case in the SDNY, which was completely unrelated to both the Exposed
conspiracy and the false bomb threats and cyber-stalking offenses, Islam received what can only
be described as an extraordinarily light and charitable sentence, even considering his cooperation
with law enforcement in that case - cooperation, it should be recalled, that was marred by
continuing criminal activity in the Exposed conspiracy and Islam 's divulgence of his cooperation
to hi s coconspirators. The Probation Office calculated Islan1's total offense level in that case to
be 33, with a corresponding Guidelines incarcerati on range of 135-168 months . From 135
months, the sentencing Judge departed to one day's incarceration. Such a dramatic departure was
never contemplated by the goverrunent when negotiating the plea agreement in this case, as is
reflected in the written plea agreement where Islam 's criminal history category is estimated for

-21-

sentencing in this case to be II.

Had the Court in the SDNY imposed a sentence of just 60 days,

Islam's Guidelines incarceration range in this case, with a criminal history category II, would be

46 -57. See USSG 4AI .I(b). Furthermore, if Islam were to be sentenced in this case with a
criminal history of category II, and then subsequently sentenced in the District of Phoenix for his
separate offenses there, he would in the Phoenix case have a criminal history category of Ill, not II,
with a corresponding Guidelines incarceration range of 37-46 months, rather than 33-41 months.
Finally, as a result of receiving a sentence of only one day's incarceration in the SDNY case, all of
Islam's incarceration period since hi s arrest and re-arrest in New York on the SDN Y charges are
now to be credited toward any sentence imposed by this Court.

By any reasonable metric,

therefore, a sentence in this case at even the high end of the Guidelines would not reflect the
seriousness of the full scope oflslam 's criminal conduct in thi s case.
There is yet another reason the Guidelines calculations in this case understate the severity
ofIs lam 's crimes and why, therefore, a sentence at the upper end of the Guidelines is appropriate.
There were, as we previously noted, more than twenty (20) swats committed by Islam and his
coconspirators during the Exposed conspiracy.

Onl y four (4) of those swats are reflected in the

Guidelines cal culations, as violations of 18 U.S.C. lll(a), (b) and 875(c). This is because,
unless the swat victim was a federal official swatted because of that official's performance of
official duties, or the swat involved an interstate transmission ofa threat to harm responding police
officers. there is no Federal statute adequately addressing the remaining swats in this case and its
underlying facts.

The trauma suffered by innocent swat \'ictims not accounted for in the

Guidelines calculations should appropriately be considered by this Court in imposing a sentence

that both reflects the seriousness of the offenses and is a just puni shment.

-22-

Islam was arrested in the SDNY in June 2013 for carding, doxing and computer hacking
activities and agreed to enter a guilty plea to an Information and cooperate with the FBI in the
SDNY. Instead of ceasing his criminal activity and cooperating in good faith, Islam lied to the
FBI in the SDNY, disclosed his SDNY agreement to cooperate to his coconspirators in this case,
implying that he was toying with his FBI handlers, and continued his criminal activity in the
Exposed conspiracy and his cyber-stalking.

Islam manipulated the FBI in SD Y as he continued

to attempt to manipulate students at the University of Arizona in the pursuit of his obsession. His
swatting crimes were serious offenses which risked serious injury or death to many swat targets
and responding police officers, and his doxing offenses exposed some fifty (50) individuals to
identity theft, credit and financial complications, and personal assault (including swats) through
disclosure of residential addresses. There is little to suggest that anything but incarceration will
deter Islam from future criminal activity. Based on Islam's duplicity in his SDNY case, any
expression of remorse or contrition by Islam should be viewed with a great deal of skepticism.
Swatting and doxing are both increasingly common offenses, yet prosecutions of these
offenses are infrequent.

Would be offenders, as much as Islam himself, need to be put on notice

that these serious offenses will be treated with the severity they deserve, commensurate with the
harm and potential harm they present.

These considerations, and the cooperation matters

addressed in the accompanying sealed addendum, we respectfully submit, support the imposition
of a sentence of 46 months, at a minimum.

-23-

4.

The eed to Provide the Defendant with Educational or

Vocational Training

Islam does not appear to need such training. In any event, the other factors bearing on the
seriousness of the offenses and the need for strong deterrence outweigh this element in fashioning

a Just sentence.

Conclusion

For the foregoing reasons, the Government asks the Court to impose a sentence of 46
months of imprisonment.

Respectfully submitted,
CHANNING D. PHILLIPS
United States Attorney
District of Columbia
D.C. Bar No. 415 793

By :
CORBIN A. WEISS
Assistant United States Attorney
CHIP/Cybercrime Coordinator
California Bar No. 122961
555 4th Street, N.W.
Washington, D.C. 205 30
(202) 252-1 71 8
corbin.weiss@usdoj.gov

I 18 V.S.c. 3553(a)(6) instructs courts to consider the need to avoid unwarranted sentence disparities among
defendants with similar records who have been foun d guilty of similar conduct. The facts and charges in th is case are
uniq ue, and fu rther complicated by the joint charging and now sentencing for t\",O courses of unrelated conduct. Th e
government is unaware of any individuals sentenced fo r conduct similar to Islam's. Islam 's case is un ique,
particularly given Islam's prior convi ction and the unusual sentence he received for that conviction .

-24-

Certificate of Service
Undersigned counsel hereby certifies that a copy of the foregoing Sentencing
Memorandum was served upon counsel for defendant, Matthew 1. Peed, Esq. , this 5th day of July,
2016, by U. S. Postal Service and email at:
Matthew 1. Peed
Clinton Brook & Peed
1455 Pennsylvania Ave W, Suite 400
Washington, DC 20004
Email : matt@ clintonbrook.com

Dafe

Corbin A. Weiss

-25 -

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA

UNDER SEAL
CRIMINAL NO. 15-067 (RDM)

v.
MIRISLAM

Defendant.

ADDENDUM TO GOVERNMENT'S MEMORANDUM IN AID OF SENTENCING AND

MOTION PURSUANT TO USSG 5K1.1

This Addendum to the Government's Memorandum in Aid of Sentencing seeks to

summarize the nature and extent of Mir Islam 's cooperation with the Government.

It also

constitutes the Government's Motion, pursuant to USSG 5KI.I , authorizing this Court to depart
from the Guidelines should the Court deem it appropriate. While the Government submits that
the defendant, Mir Islam, has provided substantial assistance to the Government in the
investigation or prosecution of another person, the Government respectfully submits that a
departure under all the facts and circumstances of this case, including consideration of the factors
prescribed in 18 U.S.c. 3553(a), is unwarranted and that a sentence of 46 months is appropriate
for the reasons set forth in the Government's Memorandum in Aid of Sentencing, filed herewith.

Background
As set forth in greater detail in the Government's sentencing memorandum, between
February 2013 and September 2013 , defendant Mir Islam conspired to commit at least seven
different crimes involving "doxing" and "swatting" abuses; communicated a false bomb threat on
the campus of the University of Arizona in Tucson; and committed cyber-stalking against a
student at that University. On or about September 4, 2013 , Islam was arrested for violating the

terms of his release in a separate case pending then in the Southern District of New York based
upon Islam 's criminal conduct in this case.
Cooperation
Immediatel y after his arrest, Islam began cooperating. On September 4, September 19,
and December 18, 2013, Mir Islam met with Special Agents from the FB I in New York City,
where Islam was incarcerated. During those debriefings, Islam initially false ly ascribed
responsib ili ty for the "Exposed" websites to certain individuals, but quickly recanted and provided
relatively detailed accounts of those who did participate in the larger Exposed conspiracy,
including the doxing and the swatting. During the three interviews, Islam described, to the
apparent best of his recollection, the respective responsibilities of the three principal participants
in the conspiracy, which included Islam and two others. Islam described the conspi rators'
respective roles and participation in various specific aspects of the conspiracy, and the unique
cyber, carding, social engi neering, or coding skills of each coconspirator.

He explained the

conceptualization and creati on of the Exposed websites, and the manner and means of both the
theft of PII for the websites and the swattings. He told the interviewing Agents how the
conspirators covered costs for the web servers, the theft of cred it reports for posting , and other
costs by using stolen credit cards. Islam informed the interviewing Special Agents which
coconspirators doxed or swatted specific victims, though his recollection regard ing a number of
victims and who, among the three principal coconspirators doxed or swatted a particular victim,
was often incomplete. He described the different "story lines" used by different perpetrators in
the execution of the swats, as wel l as the means by which the other two principal coconspirators
jointly or individually committed swats through one conspirator's computer. Islam also

-2-

explained how he and other conspirators monitored police frequencies in the jurisdictions where
swats were committed to witness the fruits of their efforts. He described to the Agents how the
conspirators used the celebrity website TMZ to publicize their swats and auract attention to their
Exposed websites.

In addition to the foregoing, Islam:

Id entified email addresses used by one or more of his coconspirators;

Explained how the conspirators used online currency to make payment for certain
services associated with the doxing;
Described how the top level domains for the exposed websites were chosen and by
whom;
Identified the coconspirator primarily responsible for the coding of the websites
and for the design of the website;
Described how the conspirators accessed credit reporting agency computers
without authorization to steal credit reports for posting on the websites;
Described carding activity by one coconspirator, meaning the theft of credit cards
and use of the stolen credit cards, for any purchase, such that Islam and the other
coconspirator became worried they would be caught and therefore precluded that
coconspirator from further participation in the conspiracy;
Described the attempt to monetize the website using "Linkbucks" to earn income
based on website traffic;
Identified the specific providers one coconspirator used to commit swats;
Stated that the reason one coconspirator committed most of his swats unilaterally or
jointly with the other coconspirator through that other coconspirator's computer
was to ensure that, if the source of the swats was ever identified, it would appear
that the coconspirator who owned that computer had committed all those swats.

Both ofMir Islam's principal coconspirators have both been charged in District Court
pursuant to plea agreements reached with each. One coconspirator has an arraignment date, and
is expected to enter a guilty plea at that hearing. The other coconspirator does not have an
arraignment date yet but is expected to enter a guilty plea soon. The Government has good reason
to believe that each of these coconspirators agreed to enter a guilty plea. in part, with the
knowledge and because of Mir Islam's cooperation, debriefings, and

\.\~llingnes s

to testify.

Though the Government did not disclosed Islam's cooperation to the other two defendants or their

counsel, the Government made clear in plea negotiations that the Government's evidence would
include testimony by at least one coconspirator, and both of the coconspirators understand that Mir
Islam , having already pled and having cooperated in another investigation in the SDNY which
cooperation Islam disclosed to the coconspirators, would be one of the Government's witnesses in
this matter.
Conclusion
Based upon the foregoing, the Government submits that Islam has provided substantial
assistaoce to the Goverrunent in the investigation and prosecution of these two coconspirators,
within the meaning of US SG 5K 1.1. Therefore, pursuant to section 5K 1.1, the Government
hereby moves to authorize this Court to depart from the Guidelines should the Court deem it
appropriate.

While the Government file s this Motion under section 5K l.l , the Government

nevertheless respectfully submits that a departure from the Guidelines is unwarranted based upon
consideration of the factors set forth in 18 U.S.C. 3553(a) for all the reasons set forth in the
Government's sentencing memorandum filed herewith. But for Islam 's substantial assistance,
the Government would be requesting this Court to sentence Islam to fifty-one months'
incarceration, the maximum period of incarceration within the Guidelines range as calcu lated by
the Probation Office and agreed to by the parties. In recognition of defendant 's cooperation, the

-4-

Government respectfully requests that this Court sentence Islam to a period of incarceration of 46
months .

Respectfully submitted,
CHANNING D. PHILLIPS
United States Attorney
District of Columbia
D.C . Bar 0. 415793

By :
CORBIN A. WEISS
Assistant United States Attorney
CHIP ICybercrime Coordinator
California Bar No. 122961
555 4th Street, N.W.
Washington, D.C. 20530
(202) 252-1718
corbin. weiss@usdoj .gov

-5-

Certificate of Service
Undersigned counsel hereby certifies that a copy of the foregoing Sentencing
Memorandum was served upon counsel for defendant, Matthew J. Peed, Esq. , this 5th day of July,
2016, by U.S. Postal Service and email at:
Matthew J. Peed
Clinton Brook & Peed
1455 Pennsylvania Ave W, Suite 400
Washington, DC 20004
Email : mattra>.c1intonbrook.com

Corbin A. Weiss

-6-