## Facts

- Online Information Bureau, Inc. (OIB), a Connecticut e-commerce company, hosted websites and processed credit-card and other financial transactions, maintaining sensitive customer and merchant account data.
- The government alleged that Aleksey Vladimirovich Ivanov, a Russian national acting from Russia, unlawfully accessed OIB’s computer network and obtained “root” passwords giving full control over OIB’s systems and data.
- OIB received emails from Ivanov stating he had acquired the root credentials.
- The indictment alleged Ivanov threatened to destroy OIB’s systems and critical databases unless OIB paid roughly $10,000 for his “assistance” in securing the system.
- Ivanov was charged in a superseding indictment with conspiracy, computer fraud and related activity, extortion, and possession of unauthorized access devices, including counts under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, and the Hobbs Act, 18 U.S.C. § 1951.

## Issues

1. Whether a federal district court has subject-matter jurisdiction to prosecute a foreign national for federal computer-intrusion and extortion offenses allegedly committed while the defendant was physically outside the United States.
2. Whether the CFAA, the Hobbs Act, and the other charged federal statutes may be applied to conduct abroad when the target and harmful effects are within the United States.

## Decision

- The court denied Ivanov’s motion to dismiss the indictment for lack of subject-matter jurisdiction.
- The court held jurisdiction was proper because the intended and actual harmful effects were in the United States, where the victim company, its computers, and its data were located.
- The court also concluded that the charged statutes were intended by Congress to reach the charged conduct even when initiated from outside the United States, given the domestic targets and effects.

## Legal Principles

- U.S. criminal jurisdiction may extend to extraterritorial conduct when the conduct is aimed at, and produces substantial harmful effects within, the United States (objective territorial/effects principle).
- Federal statutes may apply to extraterritorial conduct when congressional intent—express or implied—shows they are meant to protect U.S. computers, data, and interstate commerce from foreign-origin attacks.
- For cyber intrusions, the location of the protected systems and the locus of harm can support jurisdiction even if the defendant’s acts were performed abroad.

## Conclusion

The court permitted prosecution to proceed, holding that alleged hacking and extortion threats launched from abroad could be tried in the United States where the target systems and business operations were domestic and the charged federal statutes were construed to reach such foreign-origin conduct.


United States v. Ivanov, 175 F. Supp. 2d 367 (D. Conn. 2001)