Roman - Case Document 5 Filed 03 16 11 Page 1 of 27 Presented to the Court by the foreman of the Grand Jury in open Court in the presence of the Grand Jury and FILED tn the US DISTRICT COURT at Seattle Judge Richard A Jones UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE UNITED STATES OF AMERICA NO CR1 Plaintiff SUPERSEDING INDICTMENT v - SEALED ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak Defendant The Grand Jury charges that Bank Fraud A The Offense I 1 Beginning at a time unknown but no later than October 2 2009 and continuing through on or about February 22 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAM-VELICH aka nCuX aka Bulba aka aka smaus UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 206 553-7970 Case Document 5 Filed 03 16 11 Page 2 of 27 I aka Zagreb aka shmak hereinafter Roman Selezhev and others unknown to the Grand Jury knowingly and willfullydevisedand executed and aided and abetted a scheme and arti ce to defraud various nancial institutions including but not limited to Boeing Employees Credit Union Chase Bank Capital One Citibank and Keybank the banks nancial institutions as de ned by Title '18 United States Code Section 20 and to obtain moneys tnds and credits under the custody and control of the banks 7 by means of material false and fraudulent pretenses representations and promises as further described below 2 The object of the scheme and arti ce to defraud was to hack into the computers of retail businesses within the Western District of Washington and elsewhere to install malicious computer code onto those hacked computers that would effectively steal the credit card numbers of the victim businesses customers to market and Sell the stolen credit card numbers on criminally inspired Websites for the purpose and with the intent that the stolen credit card numbers would then in turn be used for fraudulent transactions across the United States and in foreign countries and by way of the scheme to obtain illicit lprOceeds funded by and derived primarily from the banks located in the Western District of Washington and elsewhere that had originally issued the stolen credit card numbers By way of this series of criminal actions the defendants intended to and did generate and receive millions of dollars in illicit pro ts that they then converted to their own personal bene t and use B Manner and Means of the Scheme and Arti ce to Defraud 7- 3 ROMAN SELEZNEV has used nics or online nicknames in his dealings and his communications with others regarding and promoting the theft and Sale of stolen credit card numbers that include nCuX Bulba smaus Zagreb and shmak 7 i 4 It was part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury created a criminally inspired Internet-based UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-127l Roman - 2 206 553-1970 Case Document 5 Filed 03 16 11 Page 3 of 27 1 infrastructure to facilitate the theft and then the sale over the Internet of credit card 2 account numbers that had been issued by banks including BECU I 3 5 It was further part of the scheme and arti ce to defraud that aspart of that 4 criminal Internet-based infrastructure ROMAN SELEZNEV and others unknown to the 5 Grand Jury rented Con gured and controlled server computers in countries outside of 6 7 the United States including the Ukraine and Russia that contained malware or malicious 7 computer code which servers would provide downloads of that malware onto other 8 computers when the requesting computers were commanded to made such a request 9 The server that hosted the malware was named aka 10 aka 188 120 225 66 and all of the malware was located on the server 11 at The server stored pieces of malware that been 12 denominated with names that included shmak shmak2 kameo hameo zameo 13 dtc dtc2 dtc4 dtca rsca remcomsvc and others All'of the malware was 14 located at the root of the server 15 6 - It was further part of the scheme and arti ce to defraud that as part of that 16 criminal Internet-based infrastructure ROMAN SELEZNEV and others unknown to the 17 Grand Jury rented and con gured server computers in countries outside of the United 18 States for the purpose of hosting carding forum websites or websites used to sell stolen 19 credit card numbers including carding forums named bulba cc secure bulba cc 20 J Track2 name and secure Track2 name 21 7 It was further part of the scheme and arti ce to defraud that as part of that 22 criminal Internet based infrastructure ROMAN SELEZNEV and others unknown to the 23 Grand Jury rented and con gured server computers including servers in McLean 24 Virginia to receive and compile stolen credit card track data 25 8 It was further part of the scheme and arti ce to defraud that ROMAN 26 SELEZNEV and others unknown to the Grand Jury developed and used automated 2 techniques such as port scanning to identify computers and computer systems that were 28 connected to the Internet that were dedicated to or involved with credit card processing UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101427 Roman 3 - 206 553-7970 1 Case Document5 Filed 03 16 11 Page 4of 27 by retail businesses and that would be vulnerable to criminal hacks for the purpose of stealing credit card numbers 7 i 9 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury used those automated techniques to identify credit card processing computers at the Broadway Grill restaurant and at other businesses in the Western District of Washington as well as throughout the United States as target computers for their criminal scheme I 10 it was further part of the scheme and arti ce to defraud that once ROMAN SELEZNEV and others unknown to the Grand Jury identi ed credit card processing computers that were vulnerable to criminal hacks they issued commands to the target computers to connect over the Internet to the servers that they had previously rented and con gured and that they controlled in the Ukraine and Russia and to download malware from those servers so that it would be installed on the victim target computers Speci cally once ROMAN SELEZNEV and others unknown to the Grand Jury had remote control of a Victim computer they would launch a web browser on the victim computer They would then type the address for the server hosting the malware followed by the name ofthe piece of malware they wished to have downloaded for example The piece of malware speci ed could vary as between the many different pieces of malWare that were being hosted on the Ukraine Russian server Once this web address was typed into the address bar of the victim computer the Victim computer would download this piece of malware from the Ukraine Russian server Once the malware was installed on the Victim computer ROMAN SELEZNEV and others unknown to the Grand Jury could disconnect frOm the victim computer The malware that had been downloaded was precon gured to upload credit card data that subsequently passed through the victim computer to the server that had been designated by SELEZNEV and others unknown to the Grand Jury for that purpose UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98 i 0 1-127 1 Roman 4 206 553-7970 Case Document 5 Filed 03 16 11 Page 5 of 27 In some cases ROMAN SELEZNEV and others unknown to the Grand Jury also installed a piece of software that would enable them to easily remotely reconnect to the Victim servers again at a later date 11 It was further part of the scheme and arti ce to defraud that the malware that ROMAN SELEZNEV and others unknown to the Grand Jury caused to be installed on the targeted victim computers included software that monitored network activity within the business internal computer network The businesses that were targeted typically had several computers running including a few point of sale terminals and or other computers that employees used to process orders and to swipe customer credit cards when purchases were made These computers were in turn connected to a computer commonly referred to as the the back of the house computer or the manager s computer that would receive all of the credit card track data that had been gathered from the point of sale terminals that data and transmit it to the merchant card processor for approval The malware that ROMAN SELEZNEV and others unknown to the Grand Jury caused to be downloaded to the victim business computers monitored the traf c within the business computer network and intercepted the communications between the point of sale terminals and the back of the house computer The malware would extract and copy the data that included credit card track data and every ve minutes compile the stolen credit card track data and transmit and upload it to a server identi ed by a speci ed IP address That server had been previously rented and con gured and was controlled by ROMAN SELEZNEV and others unknown to the Grand Jury for that purpose and could be located in a variety of geographic locations including in Russia the Ukraine or for a time in McLean Virginia 7 12 It was further part of the scheme and arti ce to defraud that one of the business computer networks that was found vulnerable and was hacked by ROMAN SELEZNEV and others unknown to the Grand Jury was that of the Broadway Grill restaurant in Seattle WA In the case of the Broadway Grill in particular every credit UNITED STATES ATTORNEY A 700 Stewan Street Suite 5220 Seattle Washington 98101-1271 Roman 5 206 553 7970 Case Document 5 Filed 03 16 11 Page 6 of 27 card number that had been swiped at the restaurant between December 1 2009 and October 22 2010 over 32 000 unique Credit card numbers had been saved to a text le that was stored on the business back of the house computer ROMAN SELEZNEV and others unknown to the Grand Jury commanded the computer they hacked at the Broadway Grill restaurant to steal transmit and upload that complete text le containing all of those unique Credit card numbers to computer servers speci ed by ROMAN SELEZNEV and others unknown to the Grand Jury that had previously been rented and con gured and that were under their control for that purpose ROMAN SELEZNEV and others unknown to the Grand Jury also caused and commanded the DTC2 exe malware to be installed on the manager s credit card processing computer at the Broadway Grill in the manner described above which malware then continued to steal any additional credit card track data including credit card numbers run after October 22 2010 That data as well was transmitted from the infected Broadway Grill computer over the Internet to computer servers speci ed con gured and controlled by ROMAN SELEZNEV and others unknown to the Grand Jury for that purpose The theft of credit card track data from Broadway Grill continued thereafter until the intrusion and theft were discovered on October 27 2010 13 It was further part of the scheme and arti ce to defraud that using the same techniques described above that were used to hack into install malware and steal credit card track data from the Broadway Grill restaurant in Seattle WA ROMAN SELEZNEV and others unknown to the Grand Jury hacked into installed malware and stole credit card tract data from a number of other small retail businesses in the Western District of Washington including but not limited to Grand Central Baking Company restaurant in Seattle four Mad Pizza restaurants three Seattle WA locations and a location in Tukwila Village Pizza in Anacortes WA and Casa Mia Italian restaurant in Yelm WA 1 14 It was further part of the scheme and arti ce to defraud that using the same techniques described above that were used to hack into install malware and steal credit UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 206 553-7970 Roman - 6 Case DocumentS Filed 03 16 11 Page of 27 card track data from the Broadway Grill restaurant and other businesses in the western District of Washington ROMAN SELEZNEV and others unknown to the Grand Jury likewise hacked into installed malware and stole credit card tract data from hundreds of retail businesses in other locations throughout the United States including but not limited to Deli in Coeur d Alene Idaho Active Networks in Frostburg Maryland Days Jewelry in Waterville Maine Latitude Bar and Grill in New York New York Grand Canyon Theatre in Tusayan Arizona the Phoenix Zoo in Phoenix Arizona Mary s Pizza Shack in Sonoma California and City News Stand a convenience store I at multiple store 10cations in Evanston and Chicago Illinois 15 It was further part of the scheme and arti ce to defraud that after credit card track data was transmitted from hacked businesses and then compiled on the servers that ROMAN SELEZNEV and others unknown to the Grand Jury had previously rented con gured and controlled for that purpose ROMAN SELEZNEV and others unknown to the Grand Jury harvested the data and extracted and segregated from it credit card account numbers Bank Identi cation Numbers numbers and any other data possible including names of the account holders or PIN numbers that would enhance the value of the data for sale to those who wished to use it for criminal fraudulent purposes 16 It was further part of the scheme and arti ce to defraud that after ROMAN SELEZNEV and others unknown to the Grand Jury had stolen harvested and segregated the data that was valuable for sale to their would be criminal customers they then posted and marketed that data for sale on carding forum websites including those named bulba- cc and Track2 name which websites they had established on computer servers that they had rented con gured and which they controlled for this purpose The stolen credit card numbers that they marketed and sold on these carding forum websites included credit card numbers that had been issued by BECU and by other banks in the Western District of Washington and throughout the United States I 17 It was further part of the scheme and arti ce to defraud that when ROMAN SELEZNEV and others unknown to the Grand Jury advertised and sold stolen credit Card UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattie Washington 98l01 127l Roman - 7 206 553-7970 Roman 8 Case Document 5 Filed 03 16 11 Page 8 of 27 numbers BIN numbers and related stolen data for sale on their carding forum websites they priced that data at varying levels depending on its relative worth for use in I fraudulent transactions For example credit card numbers with a guarantee for validity were pricedbetween- $20 and $30 per credit card track This comprised the majority of the cards listed for sale There were also credit card numbers listed at lower sale prices These were listed with a guarantee of validity of and were listed for sale at around $7 per track 18 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury wOuld seek to attract and entice customers to their carding forum websites by advertising fresh clumps of stolen data which included for example an advertisement on November 24 2010 as follows UPDATE OF 38 000 USA AND 5 000 USD TRACK2 ONLYTOTALLY 90% BIG BASE NEW60 - NEW61 - TRACK2 ONLY And through an advertisement on December 23 2010 as follows 1 UPDATE 17 000 FRESH DUMPS TOTALY VALID 7 VERY HIGH 95% 1 a 75% TRACKI TRACK2 AND OTHER TRACK2 Base NEW65 7 1 Warning today checker notwork at all Sorry for that Merry THAT IS THE LAST UPDATE IN THIS YEAR Hurry up to fund account 8 7 7 19 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury sought to enhance the value and to spur sales of the stolen credit card data they marketed for-fraudulent use by offering a checker service through the carding forum websites which for a fee would enable customers to obtain instant validation information for the stolen credit card numbers and UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 206 553-7970 Case Document 5 Filed 03 16 11 Page 9 of 27 through which they also offered to replace numbers that were found to be invalid - through the checking service with an equal number of other stolen credit card numbers 20 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury who contrOlled and operated the bulba cc and Track2 narne carding forum websites would only accept payment for the stolen data that they sold through a limited number of payment services including webmoney services such as Liberty Reserve because those services hinder efforts to trace the proceeds of the transactions and effectively conceal the identity of both the payers and-the recipients of the proceeds of the same 21 It was furtherpart of the scheme and arti ce to defraud that in order to expand and maXimize their customer base for stolen credit card numbers ROMAN SELEZNEV and others unknown to the Grand Jury advertised the carding forums that they owned and controlled on other well known carding forum websites such as crdsusu and carderbiz 22 It was further part of the scheme and arti ce to defraud that in order to quash competition from other criminal carders ROMAN SELEZNEV and others unknown to the Grand Jury assumed total control and a monopoly over stolen credit card sales made on the previously established and preeminent carder forum website named crdsusu in or around May of 2010 23 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury stole over 200 000 credit card - numbers and sold over 140 000 stolen credit card numbers through their carding forum websites bulbacc and Track2 name during the period from November 15 2010 to February 22 2011 7 24 It was further part of the scheme and arti ce to defraud that ROMAN SELEZNEV and others unknown to the Grand Jury generated illicit pro ts totaling at least $2 000 000 00 from the sale of stolen credit card information on the bulba cc and track2 name websites during the period from November 15 2010 to February 22 2011 UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 981014271 Roman 9' 206 553 7970 Case Document 5 Filed 03 16 11 Page 10 of 27 25 It was further part of the scheme and arti ce to defraud that the stolen credit card numbers sold by ROMAN SELEZNEV and others unknown to the Grand Jury have 2 been used to commit fraudulent transactions throughout the United States including speci cally in the States of Texas and New York and throughout the world a 26 It was further part of the scheme and arti ce to defraud that credit card numbers in particular that were stOlen from the Broadway Grill by ROMAN SELEZNEV and others unknown to the Grand Jury which credit card numbers had been issued by BECU were used in fraudulent transactions after their sale on the bulba cc and track2 name websites for fraudulent transactions that have caused losses to BECU of at least $79 317 00 and that credit card numbers stolen from BrOadway Grill that were issued by other banks and sold on the bulba cc and Track2 name Websites have caused - losses to the other banks that issued those cards in the amount of at least $1 763 140 56 C Execution of the Scheme and Arti ce to Defraud 27 On or about the below listed dates within the Western District of 7 Washington and elsewhere for the purpose of executing and attempting to execute this scheme and arti ce to defraud ROMAN SELEZNEV and others unknown to the Grand Jury did knowingly and willfully steal the credit card account numbers speci ed below that had been issued by BECU which account numbers subsequently were used in fraudulent transactions causing a less to BECU in the amounts speci ed below Count Date CC CC Acct Number Issued by BECU Fraud Loss on Acct Stolen BECU No Due to Fraudulent Transactions 1 10 22 2010 $1199 59 2 10 22 2010 $650 14 3 10 22 2010 $636 86 4 10 22 2010 $317 98 5 10 22 2010 $394 60 All in violation of Title 18 United States Code Sections 1344 and 2 UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 Roman 10 206 553-7970 Case Document 5 Filed 03 16 11 Page 11 of 27 coma Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 4 I 2 On our about October 22 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACK2 aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a- program information code and command and as a result of that conduct intentionally caused and attempted to cause damage without authorization to a protected computer to wit by causing the installation of malware on a credit card processing computer belonging to and located at the Broadway Grill restaurant in Seattle WA and by such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value - All in Violation of Title 18 United States Code Sections 1030 a 5 A and and 2 Intentional Damage to a Protected Computer 7 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if set forth herein 7 2 On our about October 2 2009 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that conduct intentionally caused and attempted to cause damage without authorization to'a protected computer to wit by causingthe installation of malware on a credit card processing computer belonging to and located at the Grand UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 Roman - 11 206 553-7970 Case Document 5 Filed 03 16 11 Page 12 of 27 Central Baking Company restaurant in Seattle WA andby such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value Allin Violation of Title 18 United States Code Sections 1030 a 5 A and and 2 COUNT 8 Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 4 On our about August 28 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that Conduct intentionally caused and attempted to cause damage without authorization to a protected computer to wit by causing the installation of malware on a credit card processing computer belonging to and located at the Mad Pizza restaurant in Tukwila WA and by such-Conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value All in violation Of Title 18 United States Code Sections 1030 a 5 A and and 2 COUNT9 Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein i 2 i on our about November 2 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 981OI-1271 Roman - 12 20s 553-7970 Case Document 5 Filed 03 16 11 Page 13 of 27 aka shmak knowingly caused the transmission of a program information code and command and as a'result of that conduct intentionally caused and attempted to cause damage without authorization to a protected computer to wit by causing the installation of malware on a credit card processing computer belonging to and located at the Mad Pizza restaurant 1263 Thomas Street Seattle WA and by such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 invalue All in violation of Title 18 United StatesCode Sections 1030 a 5 A and and 2 Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 On our about October 22 2010 within the Western'District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka I RUBEN SAMVELICH akanCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that conduct intentionally caused and attempted cause damage without authorization to a protected computer to wit by causing the installation of malware on a credit card processing computer belonging to and located at the Mad Pizza restaurant 1321 Madison St Seattle WA and by such conduct caused loss toeone or more persons during a one year period aggregating at least $5 000 in value All inviolation of Title 18 United States Code Sections and and 2 STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 Roman - 13 206 553-7970 Case Document 5 Filed 03 16 11 Page 14 of 27 COUNT 11 Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of-Counts 1-5 are realleged and incorporated as if fully set forth herein A I 2 On our about August 26 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACK2 aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that conduct intentionally caused and attempted to cause damage without authorization to a protected computer to wit by causing-the installation of malware on a credit card processing Computer belonging to and located at the Mad 7 Pizza restaurant 402 E Madison St Seattle WA and by such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value 7 A11 in violation of Title 18 United States Code Sections 1030 a 5 A and and 2 COUNT 12 Intentional Damage to a Protected Computer Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 7 2 On our about September 13 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that conduct intentionally caused and attempted to cause damage without authorization to 'a protected computer to wit by causing the installation of malware on a credit card processing computer belonging toand located at UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101 1271 Roman - 14 206 553 7970 Case Document 5 Filed 03 16 11 Page 15 of 27 the Village Pizza restaurant in Anacortes WA and by such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value All in violation of Title 18 United States Code Sections 1030 a 5 A and and 2 scum Intentional Damage to a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully Set forth herein i 2 On our about August 9 2010 within the Western District of WashingtOn and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly caused the transmission of a program information code and command and as a result of that conduct intentionally caused and attempted to cause damage without authorization to a protected computer to wit by causing the installation of malware on a credit card processing computer belonging to and located at the Casa Mia Italian Pizzeria restaurant in Yelm WA and by such conduct caused loss to one or more persons during a one year period aggregating at least $5 000 in value I All in violation of Title 18 United States Code Sections 1030 a 5 A and and COUNT 14 Obtaining Information From a Protected Computer 1 7 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 7 2 Beginning on a date uncertain but on or about October 22 2010 and continuing until on or about October 27 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98l01 1271 Roman - 15 206 553-7970 10Case Document 5 Filed 03 16 11 Page 16 of 27 RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally acceSsed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card- processing computer belonging to and located at the Broadway Grill restaurant in Seattle WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as defined by Title 18 United States Code Section 20 and that they committed such offense I in furtherance of a criminal and tortious act in violation of theConstitution and laws of the United States speci cally bank fraud in violation of Title 18 United States Code Section 1344 I 2 All in violation of Title 18 United States Code Sections and I 1030 c 2 B ii and 2 census Obtaining Information From a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein I 2 Beginning on a date uncertain but on or about October 2 2009 and continuing until on or about December 1 2010 within the western District of 1 Washingtonand elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer without authorization and I thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Grand Central Baking Company restaurant in Seattle WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance of a criminal and tortious act in Violation UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 Roman - 16 206 553-7970 Case Document 5 Filed 03 16 11 Page 17 of 27 of the Constitution and laws of the United States speci cally bank fraud in violation of Title 18 United States Code Section 1344 All in violation of Title 18 United States Code Sections 1030 a 2 and 1030 c 2 B ii and 2 new Obtaining Information From a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if illy set forth herein 7 I 2 I Beginning on a date uncertain but on or about August 28 20 10 and continuing until on or about February 1 2011 Within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer'without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a-credit card processing computer belonging to and located at the Mad Pizza restaurant in Tukwila WA and obtained therefrom credit card track data that included credit card account numbersissued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance of a criminal and tortious act in violation of the Constitution and laws of the United States speci cally bank fraud in Violation of Title 18 United States Code Section 1344 All in violation of Title 18 United States Code Sections 1030 a 2 and 1030 a 2 B ii and 2 UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1 27 Roman - 17 206 553-7970 Case Document 5 Filed 03 16 11 Page 18 of 27 COUNT 17 Obtaining Information From a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully setforth herein I 2 Beginning on a date uncertain but on or about November 2 2010 and continuing until on or about February 1 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Mad Pizza restaurant 1263 Thomas St Seattle WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance ofa criminal and tortious act in violation of the Constitution and laws of the United States speci cally bank fraud in violation of Title 18 United States Code Section 1344 All in violation of Title 18 United States Code Sections 1030 a 2 and 1030 c 2 B ii and 2 COUNT 18 I Obtaining Information From aProtected Computer 1 Paragraphs 1 through 26 of Counts 1 5 are realleged and incorporated as if fully set forth herein 2 Beginning on a date uncertain but on or about October 22 2010 and continuing until 011 or about February 15 2011 within the Western District of Washington and elsewhere ROMAN aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattie Washington 98101 1271 Roman - 18 206 553-7970 Case Document 5 Filed 03 16 11 Page 19 of 27 aka Zagreb aka shmak intentionally accessed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Mad Pizza restaurant 1321 Madison St Seattle WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance of a criminal and tortious act in Violation of the Constitution and laws of the United States speci cally bank fraud in Violation of Title 18 United States Code Section 1344 All in violation of Title 18 United States Code Sections 1030 a 2 and 1030 c 2 B ii and 2 COUNT 19 Obtaining Information From a Protected Computer 7 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 Beginning on a date uncertain but on or about August 26 2010 and Continuing until on or about February 15 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Mad Pizza restaurant 4021 E Madison St Seattle WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance of a criminal and tortious act in Violation UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101-1271 Roman - 19 206 553 7970 DocumentS Filed 03 16 11 Page 20 of 27 of the Constitution and laws of the United States speci cally bank fraud in violation of Title 18 7United States Code Section 1344 Allin violation of Title 18 United States Code Sections 1030 a 2 and 1030 c 2 B ii and 2 Obtaining Information From a Protected Computer 1 - Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 Beginning on a date uncertain but on or about September 25 2010 and continuing until on or about February 8 2011 within-the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACK2 IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Village Pizza restaurant Anacortes WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing EmplOyees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense - in furtherance of a criminal and tortious act in Violation of the Constitution and laws of I the United States speci cally bank fraud in violation of Title 18 United States Code Seetion 1344 All in violation of Title 18 United States Code Sections 1030 a 2 and I 1030 c 2 B ii and 2 UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 7 Seattle Washington 98101-1271 1 - Roman 20 205 553-7970 Case Document 5 Filed 03 16 11 Page 21 of 27 COUNT 21 Obtaining Information From a Protected Computer 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 7 I 2 Beginning on a date uncertain but on or about August 9 2010 and continuing until on Or about February 23 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak intentionally accessed a computer without authorization and thereby obtained information from a protected computer to wit they intentionally accessed a credit card processing computer belonging to and located at the Casa Mia Italian Pizzeria restaurant Yelm WA and obtained therefrom credit card track data that included credit card account numbers issued by Boeing Employees Credit Union or other nancial institutions as de ned by Title 18 United States Code Section 20 and that they committed such offense in furtherance of a Criminal and tortious act in violation of the Constitution and laws of the United States speci cally bank fraud in violation of Title 18 United States Code Section 1344 7 All in violation of Title 18 United States Code Sections 1030 a 2 and 1030 c 2 B ii and 2 mum Possession of Fifteen or More Unauthorized Access Devices Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 I On or about January 20 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka - RUBEN SAMVELICH aka nCuX aka Bulb-a aka aka smaus aka Zagreb aka shmak knowingly and with intent to defraud possessed fteen or more unauthorized UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattie Washington 98101-1271 Roman - 21 206 553 7970 Roman - 22 7 Case Document 5 Filed 03 16 11 Page 22 of 27 access devices that is credit card account numbers that belonged to individuals who were customers of businesses located within the Western District of Washington which credit card account numbers ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak stole from businesses including the Broadway Grill the Grand Central Baking Company several Mad Pizza restaurants Village Pizza and Casa Mia Italian Pizzeria located in the Western District of Washington said possession affecting interstate and foreign commerce in that the unauthorized access devices were possessed in order to market and sell them to Others for the intended purpose of making fraudulent purchases in multiple states within the United States and foreign countries All in violation of Title 18 United States Code Sections 1029 a 3 and and 2 COUNT 23 Traf cking in Unauthorized Access Devices 1 Paragraphs 1 through 26 of Counts 1 5 are realleged and incorporated as if 2 fully set forth herein i 2 From on or about November 15 2010 to on or about November 16 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba - aka aka smaus aka Zagreb aka shmak knowingly and with intent to defraud traf cked in credit card track data including credit card account numbers for credit card accounts that were established through and issued by the Boeing Employees Credit Union in the Western District Of Washington and by such conduct from on or about November 15 2010 and ending on or about November 16 2010 obtained pro ts aggregating approximately $83 490 00 said traf cking affecting interstate and foreign commerce in that the credit card account numbers that were so traf cked were in turn UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98l01-127l 206 553-7970 Case Document 5 Filed 03 16 11 Page 23 of 27 used to make fraudulent purchases in multiple states within the United States and foreign countries All in violation of Title 18 United States Code Sections 1029 a 2 and and 2 COUNT 24 Traf cking in Unauthorized Access Devices 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein - 2 From on or about January 31 2011 to on or about February 1 2011 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly and with intent to defraud traf cked in credit card trackdata including credit card account numbers for-credit card accounts that Were established through and issued by the Boeing Employees Credit I Union inthe Western District of Washington and by such conduct from on or about January 31 2011 and ending on or about February 1 2011 obtained pro ts aggregating approximately $30 716 00 said traf cking affecting interstate and foreign commerce in that the credit card account numbers that were so traf cked were in turn used to make fraudulent purchases in multiple states within the United States and foreign countries All in violation of Title 18 United States Code Sections 1029 a 2 and and 2 I UNITED STATES ATTORW 00 Stewart Street Suite 5220 Seattle Washington 93101-1272 Roman - 23 206 553 7970 Case Document 5 Filed 03 16 11 Page 24 of 27 COUNT 25 Aggravated Identity Theft 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein 7 2 On or about October 22 2010 within the Western District of WashingtOn and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka zagreb aka shmak knowingly transferred possessed and used without lawful authority a means of identi cation of another person to wit the personally identi able credit card number of belonging to D K of Seattle WA 'within the Western District of Washington during and in relation to a felony listed in Title 18 United States Code Section 1028A c to wit Bank Fraud in violation of Title 18 United States Code Section 1344 I I All in Violation of Title 18 United States Code Sections 1028A a 1 and 2 COUNT 26 Aggravated Identity Theft 1 Paragraphs 1 through 26' of Counts 1-5 are realleged and incorporated as if fully set forth herein 2 On orabout October 22 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly transferred possessed and used without lawful authority a means of identi cation of another person to wit the personally identi able credit card number of belonging to NS of Seattle WA within the Western District of Washington during and in relation to a felony listedrin Title 18 United States Code UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98101 -1 271 Roman 24 206 553 7970 Case Document 5 Filed 03 16 11 Page 25 of 27 Section 1028A c to wit Bank Fraud in Violation of Title 18 United States Code Section 1344 - All in violation of Title 18 United States Code SectiOns 1028A a 1 and 2 lo UM Aggravated Identity Theft 7 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if illy set forth hereinabout October 22 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shmak knowingly transferred possessed and used without lawful authority a means of identi cation of another person to wit the personally identi able credit card number of belonging to T A of Seattle WA within the Western District of Washington during and in relation toga felony listed in Title 18 United States Code Section 1028A c to wit Bank Fraud in violation of Title 18 United States code Section 1344 7 All in Violation of Title 18 United States Code Sections 1028A a 1 and 2 I COUNT 28 Aggravated Identity Theft 1 Paragraphs 1 through 26 of Counts 1-5 are realleged and incorporated as if fully set forth herein I I 2 On or about October 22 2010 within the Western District of Washington and elsewhere ROMAN SELEZNEV aka TRACK2 aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka aka smaus aka Zagreb aka shrnak knowingly transferred possessed and used without lawful authority a means of identi cation of another person to wit the personally identi able credit card number STATES ATTORNEY 700 Stewan Street Suite 5220 Seattle Washington 981014271 Roman 25 206 553 7970 Case Document 5 Filed 03 16 11 Page 26 of 27 of belonging to H of Seattle WA within the Western District of Washington during and in relation to a felony listed in Title 18 United States Code Section 1028A c to wit Bank Fraud in Violation of Title 18 United States Code Section 1344 All in Violation of Title 18 United States Code Sections 1028A a 1 and 2 COUNT 29 Aggravated Identity Theft 7 1 Paragraphs lithrough 26 of Counts 1-5 are realleged and incorporated as if my set forth herein 2 On or about October 22 2010 within-the Westem' District of Washington and elsewhere ROMAN SELEZNEV aka TRACKZ aka ROMAN IVANOV aka RUBEN SAMVELICH aka nCuX aka Bulba aka akasrnaus aka Zagreb aka shmak knowingly transferred possessed and used without lawful authority a means 2 of identi cation of another person to wit the personally identi able credit card number belonging to L S of Seattle WA within the Western District of Washington during and in relation to a felony listed in Title 18 United States Code UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle washington 98101-1271 206 553-7970 Roman - 26 Case Document 5 Filed 03 16 11 Page 27 of 27 1 to wit Bank Fraud in violation of Title 18 United States Code 2 Section 1344 3 All in violation of Title 18 United States Code Sections 1028A a 1TRUE BILL 6 DATED 7 Signature of the Foreperson redacted pursuant 8 I to the policy of the Judicial Conference 9 FOREPERSON 1 11 leNY A DURKAN 2 nited States Attorn 13 Jive 14 Carl Blackstone i 15 Assistant ed States Attorney 16 A Wanna Assistant United States Attorney UNITED STATES ATTORNEY 700 Stewart Street Suite 5220 Seattle Washington 98l01-127l Roman 27 a 206 553 7970                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu