Cl The Honorable Ivan D 0

AO 93 (Rev 1209) Search and Seizure Warrant

UNITED STATES DISTRICT COURT for the

Eastern District of Virginia

In the Matter of the Search of ) (Briefly describe the property to be searched ) or identifY the person by name and address) Case No 110SW 320)

IN THE MATTER OF THE SEARCH OF INFORMATION )ASSOCIATED WITH MEGAUPLOADCOM THAT IS )

STORED AT THE PREMISES CONTROLLED BY )CARPATHIA HOSTING

SEARCH AND SEIZURE WARRANT

To Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the __ Eastem__ District of (identifY the person or describe the property to be searched and give its location)

See Attachment A

The person or property to be searched described above is believed to conceal (identifY the person or describe the

property to be seized)

See Attachment B

I find that the affidavit(s) or any recorded testimony establish probable cause to search and seize the person or property

YOU ARE COMMANDED to execute this warrant on or before July 8 2010 (not to exceed 14 days)

Ii in the daytime 600 am to 10 pm o at any time in the day or night as I find reasonable cause has been established

Unless delayed notice is authorized below you must give a copy of the warrant and a receipt for the property taken to the person from whom or from whose premises the property was taken or leave the copy and receipt at the place where the property was taken

The officer executing this warrant or an officer present during the execution of the warrant must prepare an inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge

The Honorable Ivan D Davis

o I find that immediate notification may have an adverse result listed in 18 USC sect 2705 (except for delay oftrial) and authorize the officer executing this warrant to delay notice to the person who or whose property will be searched or seized (check the appropriate box) Ofor days (not to exceed 30)

Duntil the facts justifying the later specific date of

Date and time issued 6242010 - foYl Jw-gt

City and state Alexandria Virginia

Attachment A PREMISES TO BE SEARCHED

Computer servers owned by Carpathia Hosting headquartered at 43480 Yukon Drive Suite 200 Ashburn Virginia 20147 leased to its customer MegaUpload including but not limited to computers assigned the following IP addresses

6959250 17414012969 17414012851 209222128153 209222128246 209222128172 17414015736 17414015681 17414012827 661174341 17414012947 6611 743 118 6959358 17414012967 17414012840 6959223 6959254 6959329 6959251 6959334 17414012857 17414015715 6959241 17414015758 6611743117 209222128204 209222128135 17414015670 17414015672 6959357 17414012828 17414015656 661174363 17414012941 17414015678 1741401289 17414012945 6959239 209222128162

Attachment B ITEMS TO BE SEIZED

Items evidencing violations of Title 18 United States Code Section 2319 and Title 17 United States Code Section 506 (Criminal copyright infringement) Title 18 United States Code Section 2 (Aiding and Abetting the foregoing offenses) and Title 18 United States Code Section 371 (Conspiracy) including but not limited to the following

I ITEMS TO BE SEIZED

1 All records including the content associated with each filename logs of uploads downloads page views displays streams and distributions for each filename stored on Carpathia computers identified in the table attached in Section III below

2 All information that might identify the subscribers related to the accounts or identifiers including names addresses telephone numbers and other identifiers e-mail addresses business information the length of service (including start date) types of services utilized means and source of payment for services (including any credit card or bank account number) of the individual or individuals who uploaded the content associated with each filename stored on Carpathia computers identified in the table attached in Section III below

3 All records stored on Carpathia computers relating to MegaUpload accounts associated with the email accounts and MegaUpload customer IDs

a deadlnegmailcom

b hana_besharayahoocom

c pharaninjavideonet

d joshevyahoocom

e tikninjavideonet

f MegaUpload premium account iD numbers 5057215313 10462109706 3895607225 6142888968 5057214848 and business silver membership number 5605491629

II Information to be seized by the government

All information described above in Section I that constitutes fruits evidence and instrumentalities of violations ofTitle 18 United States Code Section 2319 and Title 17 United States Code Section 506 (Criminal copyright infringement) Title 18 United States Code Section 2 (Aiding and Abetting the foregoing offenses) and Title 18 United States Code Section 371 (Conspiracy) relating to the reproduction display or distribution of the files identified in Attachment A including

1 Content associated with each filename and logs of uploads downloads page views displays streams and distributions for each filename stored on Carpathia computers identified in the table attached in Section III below

2 Files databases and database records for each filename stored on Carpathia computers identified in the table attached in Section III below

3 Information identifying the subscribers related to the accounts or identifiers including names addresses telephone numbers and other identifiers e-mail addresses business information the length of service (including start date) types of services utilized means and source of payment for services (including any credit card or bank account number) for each filename stored on Carpathia computers identified in the table attached in Section III

4 All records stored on Carpathia computers relating to MegaUpload accounts associated with the email accounts and MegaUpload customer IDs

a dead1negmailcom

b hana _ besharayahoocom

c pharaninjavideonet

d joshevyahoocom

e tikninjavideonet

f MegaUpload premium account ID numbers 5057215313 10462109706 3895607225 6142888968 5057214848 and business silver membership number 5605491629

III Table

6959250

17414012969

17414012851

209222128153

209222128246

209222128172

17414015736

17414015681

17414012827

661174341

17414012947

6611743118

6959358

17414012967

17414012840

6959223

6959254

6959329

6959251

6959334

17414012857

17414015715

6959241

17414015758

6611743117

209222128204

A vatar+28200929+Proper+ TSX viD+SR T +28Part+ 1 29 divx

A vatar+28200929+Proper+ TSXviD+SRT+28Part+229divx

Daybreakers+28200929+ TS+ XviD+middot+Rx+Releasedivx

The+Hangover+28200929+DVDRip+XviD+-+DoNE+Releasedivx

Fantastic+Mr+F ox+28200929+DVDSCR +-+DONED EAL +Releasedivx

It27s+Complicated+28200929+DVDSCR+x ViD+-+xSCR+Release+28Part+ 1 29divx

It27s+Complicated+28200929+DVDSCR +xViD+-+xSCR +Release+o028Part+ 229divx

Sherlock+Holmes+28200929++DVDSCR+Mention+Release+28Part+ 1 29divx

Sherlock+Holmes+28200929+DVDSCR+Mention+Release+28Part+229divx

The+Princess+and+the+Frog+28200929+DVDRSCREENER+XviD+-+MENTiON+Releasedivx

20 12+28200929+BDRip+ XviD+-+iMBT+Release+28Part+ I 29divx

2012+28200929+BDRip+XviD+-+iMBT+Release+28Part+229divx

The+Lovely+Bones+28200929+LIMITED+DVDSCR+ XviD+-+FOXNEWS+Release+28Part+ 1 29divx

The+Lovely+Bones+28200929+ LIMITED+DVDSCR + X viD+-+FOXNEWS+Release+28Part+ 229 dtvx

The+Men+ Who+Stare+at+Goats+28200929+R5+ Line+ X viD+-+Prism+Release+28Part+ 1 29 divx

The+Men+ Who+Stare+at+Goats+o028200929+R5+ Line+ X viD+-+Prism+ Release+28Part+ 229 divx

Legion+2820 1 029+CAM+ XVID+-+GM +Releasedivx

The+Book+of+Eli+ TELESYNC+ XviD+-+MENTiON+Releasedivx

The+ Wolfman+ TELESYNC+ X viD+-+MO ViERUSH + Releasedivx

Valentines+ Day+ TELESYNC+ X viD+-+MENTiON+ Releasedivx

Green+Zone+2820 1029+ TS+ XViD+E28093+IMAGiNE+Release+28Part+ 1 29 divx

Green+ Zone+2820 1 029+ TS+ XViD+E28093 +IMAGiNE+Release+28Part+ 229 divx

How+ To+ Train+ Your+Dragon+2820 1 029+ TS+ XViD+-+IMAGiNE+Releasedivx

Shes+Out+Of+My+League+ TS+ XViD+-+IMAGiNE+Release+28Part+ 1 29divx

Shes+Out+Of+My+League+ TS+ XViD+-+ IMAGiNE + ReIease+28Part+ 229divx

The+Back-Up+Plan+ DVDSCR + XViD+-+BACKMEUP+Releasedivx

httpwwwninjavideonetlvideo52811 bull

httpwwwninjavideonetlvideo52812

httpwwwninjavideonetivideo54844

httpwwwninjavideonetlvideol27282

httpwwwninjavideonetlvideo52518

httpwwwninjavideonetlvideo5463 5

httpwwwninjavideonetlvideo54636

httpwwwninJavideonetlvideo54039

httpwwwninjavideonetlvideoI54040

httpwwwninjavideonetlvideo52411

httpwwwninjavideonetlvideo48061

httpwwwninjavideonetlvideo48062

httpwwwninjavideonetlvideo54146

httpwwwninjavideonetlvideo5414 7

httpwwwninjavideonetlvideo52010

httpwwwninjavideonetlvideo52012

httpwwwninjavideonetlvideo55902

httpwwwninjavideonetlvideo55773

httpwwwninjavideonetlvideo58267

httpwwwninjavideonetlvideo58204

httpwwwninjavideonetlvideo60164

httpwwwninjavideonetlvideo60758

httpwwwninjavideonetlvideo6 1 892

httpwwwninjavideonetlvideo60873

httpwwwninjavideonetlvideo60874

httpwwwninjavideonetlvideo64459

209222128135

17414015670

17414015672

6959357

17414012828

17414015656

661174363

17414012941

17414015678

1741401289

17414012945

6959239

209222128162

Iron+Man+2+28201029+CAM+XViD+-+TDV+Releasedivx

A+Nightmare+On+Elm+Street+2820 1029+CAM+XVID+-+TA+Releasedivx

Shrek+Forever+After+28201029+CAM+XviD+-+PrisM+Release+divx

Get+Him+ To+ The+Greek+2820 1 029+CAM+ X viD+-+ IMAG iNE+Releasedivx

Prince+of+Persia+ The+Sands+of+ Time+ TS+ XViD+-+FLA WL3SS+Release++28Part 1 29 divx

Prince+of+Persia+ The+Sands+of+Time+ TS+ XViD+-+FLA WL3SS+Release+28Part229divx

Letters+ To+ Juliet+2820 1 029+CAM+ XViD+-+DUBBY +Releasedivx

Robin+Hood+2820 1029+CAM+ XViD+-+IMAGiNE+Release+28Part+229divx

Hot+ Tub+ Time+Machine+2820 1 029+Unrated+DVDRip+ XviD+-+DiAMOND+Releasedivx

Sex+and+the+City+2+CAM+ XViD+-+IMAGiNE+Release+28Part+ 1 29divx

Sex+and+the+City+2+CAM+XViD+-+IMAGiNE+Release+28Part+2O029divx

Splice+2820 1 029+CAM+XviD+-+ZeT+Releasedivx

The+A+Team+28201029+TS+V2+XViD+-+IMAGiNE+Release+28Part+I29divx

httpwwwninjavideonetvideo65 843

httpwwwninjavideonetvideo65 850

httpwwwninjavideonetvideo67778

httpwwwninjavideonetvideo69081

httpwwwninjavideonetvideo68002

httpwwwninjavideonetvideo68004

httpwwwninjavideonetvideo6826 8

httpwwwninjavideonetvideo67040

httpwwwninjavideonetvideo69869

httpwwwninjavideonetvideo69329

httpwwwninjavideonetvideo69493

httpwwwninjavideonetvideo69532

httpwwwninjavideonetvideo69403

AO 106 (Rev 0609) Application for a Search Warrant

UNOE R sect~~rATEr~eISTR1CT COURF-~middot_ -=i=-~ Ifni Eastern District of Virginia rI lIN 2 4 20I~ ib

In the Matter of the Search of) I cC I~ u~ r~--- i1 (Briefly describe the property to be searched) ~ - or identify the person by name and address) ) Case No1 1 OSW ~ _shy

IN THE MATTER OF THE SEARCH OF INFORMATION ) ASSOCIATED WITH MEGAUPLOADCOM THAT IS )

STORED AT THE PREMISES CONTROLLED BY ) CARPATHIA HOSTING

APPLICATION FOR A SEARCH WARRANT

I a federal law enforcement officer or an attorney for the government request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location)

See Attachment A

located in the Eastern District of Virginia there is now concealed (identify the ~==~~--- ---------~-~~-----

person or describe the property to be seized)

See Attachment B 2 L(JC l703(c) (O[A) ltit

The basis for the search underFed R Crim P 41(c) is (check one or more)

11 evidence of a crime

11 contraband fruits of crime or other items illegally possessed

fif property designed for use intended for use or used in committing a crime

o a person to be arrested or a person who is unlawfully restrained

The search is related to a violation of

Code Section Offense Description 18 USC sect 2319371 and Criminal copyright Infringement 17 USC sect 506

The application is based on these facts

rri Continued on the attached sheet

[j Delayed notice of ____ days (give exact ending date if more than 30 days ________ ) is requested under 18 USC sect 31 03 a the basis of which is set forth on the attached sheet

Applicants signature

William Engel ICE Special Agent Printed name and title

Sworn to before me and signed in my presence

Date 06242010 ~= CO cfJ___ Judges signature

City and state A__ex_a_n_d_ri_a___--_____________ I vltt P DltcJl _ y J rn d ~gt~~ Jlir~ Printed name an title

IN THE UNITED STATES DISTRICT COURT FOR T~-rmiddot f~ f~ r~1 EASTERN DISTRICT OF VIRGINIA UL JlJN 2~OI~ [lj)

Alexandria Division I C_~Lmiddoti~~ rlt- middotmiddot~~sn ----__----shy

IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH MEGAUPLOADCOM THAT IS STORED AT THE PREMISES CONTROLLED BY CARPATHIA HOSTING

) ) ) ) )

Crim No 1 1O

UNDER SEAL

SW 320

APPLICATION AND AFFIDAVIT FOR A SEARCH WARRANT

I William Engel being duly sworn hereby depose and state as follows

I INTRODUCTION

1 I make this affidavit in support of an application for a search warrant for

information associated with certain accounts that is stored at premises owned maintained

controlled or operated by Carpathia Hosting (Carpathia) a web hosting company headquartered

at 43480 Yukon Drive Suite 200 Ashburn Virginia 20147 The information to be searched is

described in the following paragraphs and in Attachment A This affidavit is made in support of

an application for a search warrant under 18 USC sectsect 2703(a) 2703(b)(1)(A) and 2703(c)(1)(A)

to require Carpathia to disclose to the government records including content and other

information in its possession pertaining to the computer files identified in Attachment A

2 I am a Special Agent (SA) with United States Immigration and Customs

Enforcement (ICE) within the Department of Homeland Security formerly the United States

Customs Service I am currently assigned to the National Intellectual Property Rights

Coordination Center in Arlington Virginia where my duties include the investigation of crimes

involving the infringement of intellectual property including violations of Title 18 United States

Code Section 2319 and Title 17 United States Code Section 506 I have been employed as a

Special Agent by ICE for seven years since the establishment of ICE on March 1 2003 I was

previously employed as a Special Agent with the United States Customs Service for

approximately one year prior to the inception ofICE I attended and graduated from the

Criminal Investigator Training Program and Customs Basic Enforcement Program at the Federal

Law Enforcement Training Center in Glynco Georgia Prior to my present employment I was

an Inspector for the Bureau ofAlcohol Tobacco and Firearms (ATF) in Milwaukee Wisconsin

Previous to my employment with the ATF I was an Investigator Specialist for the City of

Chicago Inspector Generals Office for three years I have directed and been involved in

numerous investigations involving the use of computers and the Internet to commit violations of

fraud intrusion and intellectual property laws and have received training in this area as welL I

have received training and gained experience in interviewing and interrogation techniques arrest

procedures search warrant applications the execution of searches and seizures intellectual

property crimes computer-based crimes computer evidence identification seizure and

processing and various other criminal laws and procedures I have personally participated in the

execution of search warrants involving the search and seizure of computer equipment and

Internet-based email accounts

3 I make this affidavit in connection with an investigation into the activities of

Matthew Smith (SMITH) Justin DeDemko (DEDEMKO) Hana Beshara (BESHARA) Joshua

Evans (EVANS) and others who are believed to operate a web site known as

wwwNinjavideonet (the Ninja Video site) which is being used to reproduce and distribute

infringing copies of copyrighted television programs software and movies some of which are

still in theaters As provided below there is probable cause to believe that SMITH DEDEMKO

BESHARA and EVANS conspired together and with others in violation of Title 18 United

States Code Section 371 to reproduce and distribute copyrighted audiovisual works in violation

Special Agent by ICE for seven years since the establishment of ICE on March 1 2003 I was

previously employed as a Special Agent with the United States Customs Service for

approximately one year prior to the inception ofICE I attended and graduated from the

Criminal Investigator Training Program and Customs Basic Enforcement Program at the Federal

Law Enforcement Training Center in Glynco Georgia Prior to my present employment I was

an Inspector for the Bureau ofAlcohol Tobacco and Firearms (ATF) in Milwaukee Wisconsin

Previous to my employment with the ATF I was an Investigator Specialist for the City of

Chicago Inspector Generals Office for three years I have directed and been involved in

numerous investigations involving the use of computers and the Internet to commit violations of

fraud intrusion and intellectual property laws and have received training in this area as welL I

have received training and gained experience in interviewing and interrogation techniques arrest

procedures search warrant applications the execution of searches and seizures intellectual

property crimes computer-based crimes computer evidence identification seizure and

processing and various other criminal laws and procedures I have personally participated in the

execution of search warrants involving the search and seizure of computer equipment and

Internet-based email accounts

3 I make this affidavit in connection with an investigation into the activities of

Matthew Smith (SMITH) Justin DeDemko (DEDEMKO) Hana Beshara (BESHARA) Joshua

Evans (EVANS) and others who are believed to operate a web site known as

wwwNinjavideonet (the Ninja Video site) which is being used to reproduce and distribute

infringing copies of copyrighted television programs software and movies some of which are

still in theaters As provided below there is probable cause to believe that SMITH DEDEMKO

BESHARA and EVANS conspired together and with others in violation of Title 18 United

States Code Section 371 to reproduce and distribute copyrighted audiovisual works in violation

of federal criminal copyright laws namely Title 18 United States Code Section 2319 and Title

17 United States Code Section 506 (Criminal copyright infringement) and that they aided and

abetted criminal copyright infringement in violation ofTitle 18 United States Code Section 2

The facts in this affidavit come from my personal observations my training and experience and

infonnation obtained from other agents and witnesses

4 This affidavit is intended to show merely that there is sufficient probable cause for

the requested warrant and does not set forth all of my knowledge about this matter

II EXPLANATION OF TECHNICAL TERMS USED BELOW

5 Through the course of the ICE investigation your affiant has learned that

Carpathia operates an Internet hosting business which leases computer servers data storage and

Internet connectivity to paying customers One of its service offerings is that of self-managed

dedicated servers by which the customer remotely controls and administers servers located in

Carpathias data center facilities A dedicated server is a computer server that is used only by a

single customer Based upon my training and experience I am familiar with the following tenns

a The Internet The Internet is a collection of computers and computer

networks which are connected to one another via high-speed data links and telephone lines for

the purpose of sharing infonnation A network is a series of devices including computers and

telecommunication devices connected by communication channels

b Internet Protocol Address An Internet Protocol address (IP address) is a

unique numeric address used by computers on the Internet An IP Address is a series of four

numbers each in the range 0-255 separated by periods ~ 1215697178) Every computer

attached to the Internet must be assigned an IP address so that Internet traffic sent from and

directed to that computer may be directed properly from its source to its destination An IP

address acts much like a home or business street address -- it enables computers connected to the

Internet to properly route traffic to each other The assignment of IP addresses to computers

connected to the Internet is controlled by ISPs

c Internet Service Provider (ISP) An Internet Service Provider (ISP) is

a service that provides Internet connectivity to its subscribers In addition to providing access to

the Internet via telephone or other telecommunication lines ISPs may also provide Internet email

accounts and other services unique to each particular ISP such as data and file storage video

streaming and web site hosting ISPs maintain records pertaining to the individuals or

companies that have subscriber accounts with it Those records may include identifying and

billing information account access information in the form of log files electronic mail (eshy

mail) transaction information account application information customer service information

and other information both in electronic format and in written record format

d Internet Hosting Service An Internet Hosting Service is an ISP that

houses or operates computer servers that are connected to the Internet allowing organizations

and individuals to serve content on the Internet or store data at the hosting service There are

various levels and various kinds of services offered The most generic and powerful kind of

Internet hosting provides a server where the client can run anything it wants including web

servers and other servers and an Internet connection with good upstream bandwidth Fullshy

featured hosting services include dedicated hosting service where the hosting service owns and

manages the machine virtual private server which appears as a dedicated server to the outside

world but only uses a single physical server operated by the host and collocation facilities

which provide just the Internet connection and climate control but let the client do his own

system administration

e URL address A Uniform Resource Locator (URL) address is a series of

characters (~ letters numbers or other characters) that correspond with a particular IP address

and a specific page of information located at that address For example the URL for the main

page at CNNs website is wwwcnncom and that URL - along with URLs for different web

pages at the same website (~ wwwcnncomstory1 wwwcnncomstory2) - correspond with

specific IP addresses

III RELEVANT STATUTES

Criminal Copyright Infringement

6 Title 17 United States Code Sections 506(a) (b) provides in pertinent part

(a) Criminal Infringement-(1) In general-Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18 if the infringement was committedshy

(A) for purposes of commercial advantage or private financial gain

(B) by the reproduction or distribution including by electronic means during any 180-day period of 1 or more copies or phonorecords of 1 or more copyrighted works which have a total retail value of more than $1000 or

(C) by the distribution of a work being prepared for commercial distribution by making it available on a computer network accessible to members of the public if such person knew or should have known that the work was intended for commercial distribution

(b) Forfeiture and Destruction - When any person is convicted of any violation of subsection (a) the court in its judgment of conviction shall in addition to the penalty therein prescribed order the forfeiture and destruction or other disposition of all infringing copies or phonorecords and all implements devices or equipment used in the manufacture of such infringing copies or phonorecords

Penalties For Criminal Copyright Infringement

7 The penalties for violations of Title 17 United States Code Sections 506 are set

forth in Title 18 United States Code Sections 2319(b ) (c) (d) which provide in pertinent part

(b) Any person who commits an offense under section 506(a)(1)(A) of title 17

(1) shall be imprisoned not more than 5 years or fined in the amount set forth in this title or both if the offense consists of the reproduction or distribution including by electronic means during any 180-day period of at least 10

Internet to properly route traffic to each other The assignment of IP addresses to computers

connected to the Internet is controlled by ISPs

c Internet Service Provider (ISP) An Internet Service Provider (ISP) is

a service that provides Internet connectivity to its subscribers In addition to providing access to

the Internet via telephone or other telecommunication lines ISPs may also provide Internet email

accounts and other services unique to each particular ISP such as data and file storage video

streaming and web site hosting ISPs maintain records pertaining to the individuals or

companies that have subscriber accounts with it Those records may include identifying and

billing information account access information in the form of log files electronic mail (eshy

mail) transaction information account application information customer service information

and other information both in electronic format and in written record format

d Internet Hosting Service An Internet Hosting Service is an ISP that

houses or operates computer servers that are connected to the Internet allowing organizations

and individuals to serve content on the Internet or store data at the hosting service There are

various levels and various kinds of services offered The most generic and powerful kind of

Internet hosting provides a server where the client can run anything it wants including web

servers and other servers and an Internet connection with good upstream bandwidth Fullshy

featured hosting services include dedicated hosting service where the hosting service owns and

manages the machine virtual private server which appears as a dedicated server to the outside

world but only uses a single physical server operated by the host and collocation facilities

which provide just the Internet connection and climate control but let the client do his own

system administration

e URL address A Uniform Resource Locator (URL) address is a series of

characters (~ letters numbers or other characters) that correspond with a particular IP address

and a specific page of information located at that address For example the URL for the main

page at CNNs website is wwwcnncom and that URL - along with URLs for different web

pages at the same website (~ wwwcnncomstory1 wwwcnncomstory2) - correspond with

specific IP addresses

III RELEVANT STATUTES

Criminal Copyright Infringement

6 Title 17 United States Code Sections 506(a) (b) provides in pertinent part

(a) Criminal Infringement-(1) In general-Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18 if the infringement was committedshy

(A) for purposes of commercial advantage or private financial gain

(B) by the reproduction or distribution including by electronic means during any 180-day period of 1 or more copies or phonorecords of 1 or more copyrighted works which have a total retail value of more than $1000 or

(C) by the distribution of a work being prepared for commercial distribution by making it available on a computer network accessible to members of the public if such person knew or should have known that the work was intended for commercial distribution

(b) Forfeiture and Destruction - When any person is convicted of any violation of subsection (a) the court in its judgment of conviction shall in addition to the penalty therein prescribed order the forfeiture and destruction or other disposition of all infringing copies or phonorecords and all implements devices or equipment used in the manufacture of such infringing copies or phonorecords

Penalties For Criminal Copyright Infringement

7 The penalties for violations of Title 17 United States Code Sections 506 are set

forth in Title 18 United States Code Sections 2319(b ) (c) (d) which provide in pertinent part

(b) Any person who commits an offense under section 506(a)(1)(A) of title 17

(1) shall be imprisoned not more than 5 years or fined in the amount set forth in this title or both if the offense consists of the reproduction or distribution including by electronic means during any 180-day period of at least 10

and a specific page of information located at that address For example the URL for the main

page at CNNs website is wwwcnncom and that URL - along with URLs for different web

pages at the same website (~ wwwcnncomstory1 wwwcnncomstory2) - correspond with

specific IP addresses

III RELEVANT STATUTES

Criminal Copyright Infringement

6 Title 17 United States Code Sections 506(a) (b) provides in pertinent part

(a) Criminal Infringement-(1) In general-Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18 if the infringement was committedshy

(A) for purposes of commercial advantage or private financial gain

(B) by the reproduction or distribution including by electronic means during any 180-day period of 1 or more copies or phonorecords of 1 or more copyrighted works which have a total retail value of more than $1000 or

(C) by the distribution of a work being prepared for commercial distribution by making it available on a computer network accessible to members of the public if such person knew or should have known that the work was intended for commercial distribution

(b) Forfeiture and Destruction - When any person is convicted of any violation of subsection (a) the court in its judgment of conviction shall in addition to the penalty therein prescribed order the forfeiture and destruction or other disposition of all infringing copies or phonorecords and all implements devices or equipment used in the manufacture of such infringing copies or phonorecords

Penalties For Criminal Copyright Infringement

7 The penalties for violations of Title 17 United States Code Sections 506 are set

forth in Title 18 United States Code Sections 2319(b ) (c) (d) which provide in pertinent part

(b) Any person who commits an offense under section 506(a)(1)(A) of title 17

(1) shall be imprisoned not more than 5 years or fined in the amount set forth in this title or both if the offense consists of the reproduction or distribution including by electronic means during any 180-day period of at least 10

copies or phonorecords of 1 or more copyrighted works which have a total retail value of more than $2500

(c) Any person who commits an offense under section 506(a)(l)(B) of title 17 United States Code

(1) shall be imprisoned not more than 3 years or fined in the amount set forth in this title or both if the offense consists of the reproduction or distribution of 10 or more copies or phonorecords of 1 or more copyrighted works which have a total retail value of $2500 or more

(3) shall be imprisoned not more than 1 year or fined in the amount set forth in this title or both if the offense consists of the reproduction or distribution of 1 or more copies or phonorecords of 1 or more copyrighted works which have a total retail value of more than $1000

(d) Any person who commits an offense under section 506(a)(l)(C) of title 17 United States Codeshy

(1) shall be imprisoned not more than 3 years fined under this title or both

(2) shall be imprisoned not more than 5 years fined under this title or both if the offense was committed for purposes of commercial advantage or private financial gain

IV SUMMARY OF INVESTIGATION AND PROBABLE CAUSE

8 In the summer of 2009 your affiant acting on a referral from the Motion Picture

Association ofAmerica (MPAA) initiated an investigation of the NinjaVideo site which was

believed to be reproducing and distributing over the Internet unauthorized copies ofMPAA

member motion picture studios copyrighted works MPAA representatives advised that none of

its member studios authorizes its movies for distribution through the Ninja Video site

THE NINJAVIDEO SITE

9 Initial investigation of the NinjaVideo site revealed a publicly accessible web site

that allowed visitors to watch and download popular television shows and movies many of

which were recognized as still playing in cinemas Throughout the ICE investigation your

affiant has observed links to more than 200 different movies and more than 300 different

television programs on the Ninja Video site These links are typically updated as new movies are

released in cinemas and as new television programs are broadcast In addition to distributing

copyrighted content the NinjaVideo site displays commercial advertisements which sometimes

fill the entire browser window on various portions of the web site

10 Many of the movies listed on the Ninja Video site bear the indicia of the Internet

copyright piracy scene known as the warez scene For example some movies contain the

term CAM in the file name which indicates that the movie was recorded with a video camera

while it was playing in a theater Other movies contain the term SCR in the file name which

is a term commonly used in the warez scene to identify screener copies of movies that are

typically delivered by the studio to movie critics for review In addition most movies contain

the name of the organized Internet piracy group that was responsible for obtaining the

unauthorized copy and releasing it onto the Internet For example a link to the movie Iron Man

2 on NinjaVideo was listed as Iron Man 2 (2010) CAM XViD - TDV Release (DivX

Mirror)avi This file name indicates that a group known as TDV was responsible for initially

distributing onto the Internet a cammed copy of the movie Iron Man 2 in XViD format

11 Using an undercover computer to visit the NinjaVideo site ICE agents have

observed and engaged in the process of viewing and downloading content distributed by the site

Your affiant has also watched and downloaded several movies that were still playing in cinemas

Many of the movies and television shows are in a format known as DivX To play the DivX

formatted content a user first needs to install the free publicly available DivX software and web

browser plug-in The user only needs to install this plug-in once on the web browser being used

The visitor then must open a small computer program called an applet on the NinjaVideo site

known as the NinjaVideo Helper Once the applet is opened and running in the visitors

browser window the visitor may click on any movie or television title The purpose of the applet

appears to be to prevent other web sites from adopting and playing content hosted by the

NinjaVideo sites members and operators (a process known as leeching) which could potentially

take advertising revenue away from the NinjaVideo site Other movies are in Xvid format and

may be downloaded directly by users without being watched in the browser window

12 Once a visitor to the NinjaVideo site opens the NinjaVideo Helper applet heshe

is able to watch movies and television shows within the web browser When the user clicks on

the movie title an advertisement is typically displayed after which the movie begins playing in

the browser At the end of a movie the user can save the entire movie to a computer storage

device This is a process that ICE agents have performed on multiple occasions including those

set forth below

121162009 Ninja Assassin 111252009 0311612010 httpwwwninjavideonetvideo49303 AVI

121172009 Astro Boy 10232009 03162010 httpwwwninjavideonetvideo46128 AVI

121182009 Transfonners 2 Revenge 06242009 111302009 httpwwwninjavideonetvideo28806 AVI of the Fallen

121812009 Four Christmases 1112612008 111242009 httpwwwninjavideonetvideo46153 AVI

121302009 Alvin and the 12232009 03302010 httpwwwninjavideonetvideo54062 AVI Chipmunks 2

12302009 Invictus (Pt 1) 1211112009 051182010 httpwwwninjavideonetvideo53751 AVI

121302009 Invictus (Pt 2) 1211112009 05182010 httpwwwninjavideonetvideo53753 AVI

121302009 Sherlock Holmes 12252009 03302010 httpwwwninjavideonetvideo54040 AVI

011042010 Avatar (Pt 1) 12182009 04222010 httpwwwninjavideonetvideo52811 DivX

011042010 Avatar (Pt 2) 12182009 04222010 httpwwwninjavideonetvideo52812 DivX

01062010 Up In The Air 111132009 031092010 httpwwwninjavideonetvideo54192 AVI

011122010 Youth In Revolt 011082010 061152010 httpwwwninjavideonetvideo54785 AVI

011122010 Daybreakers 0110812010 051112010 httpwwwninjavideonetvideo54844 DivX

011122010 The Hangover 06052009 12152009 httpwwwninjavideonetvideo27282 DivX

011132010 Couples Retreat (Pt 1) 10092009 02092010 httpwwwninjavideonetvideo53 822 AVI

011132010 Couples Retreat (Pt 2) 101092009 02092010 httpwwwninjavideonetvideo53823 AVI

011142010 Fantastic Mr Fox 1111312009 031232010 httpwwwninjavideonetvideo52518 DivX

011142010 Brothers 12042009 03232010 httpwwwninjavideonetvideo54066 AVI

011142010 The Stepfather 10162009 02092010 httpwwwninjavideonetvideo49062 AVI

011142010 Its Complicated (Pt 1) 121232009 04272010 httpwwwninjavideonetvideo54635 DivX

011142010 Its Complicated (Pt 2) 12232009 04272010 httpwwwninjavideonetvideo54636 DivX

television programs on the Ninja Video site These links are typically updated as new movies are

released in cinemas and as new television programs are broadcast In addition to distributing

copyrighted content the NinjaVideo site displays commercial advertisements which sometimes

fill the entire browser window on various portions of the web site

10 Many of the movies listed on the Ninja Video site bear the indicia of the Internet

copyright piracy scene known as the warez scene For example some movies contain the

term CAM in the file name which indicates that the movie was recorded with a video camera

while it was playing in a theater Other movies contain the term SCR in the file name which

is a term commonly used in the warez scene to identify screener copies of movies that are

typically delivered by the studio to movie critics for review In addition most movies contain

the name of the organized Internet piracy group that was responsible for obtaining the

unauthorized copy and releasing it onto the Internet For example a link to the movie Iron Man

2 on NinjaVideo was listed as Iron Man 2 (2010) CAM XViD - TDV Release (DivX

Mirror)avi This file name indicates that a group known as TDV was responsible for initially

distributing onto the Internet a cammed copy of the movie Iron Man 2 in XViD format

11 Using an undercover computer to visit the NinjaVideo site ICE agents have

observed and engaged in the process of viewing and downloading content distributed by the site

Your affiant has also watched and downloaded several movies that were still playing in cinemas

Many of the movies and television shows are in a format known as DivX To play the DivX

formatted content a user first needs to install the free publicly available DivX software and web

browser plug-in The user only needs to install this plug-in once on the web browser being used

The visitor then must open a small computer program called an applet on the NinjaVideo site

known as the NinjaVideo Helper Once the applet is opened and running in the visitors

browser window the visitor may click on any movie or television title The purpose of the applet

appears to be to prevent other web sites from adopting and playing content hosted by the

NinjaVideo sites members and operators (a process known as leeching) which could potentially

take advertising revenue away from the NinjaVideo site Other movies are in Xvid format and

may be downloaded directly by users without being watched in the browser window

12 Once a visitor to the NinjaVideo site opens the NinjaVideo Helper applet heshe

is able to watch movies and television shows within the web browser When the user clicks on

the movie title an advertisement is typically displayed after which the movie begins playing in

the browser At the end of a movie the user can save the entire movie to a computer storage

device This is a process that ICE agents have performed on multiple occasions including those

set forth below

121162009 Ninja Assassin 111252009 0311612010 httpwwwninjavideonetvideo49303 AVI

121172009 Astro Boy 10232009 03162010 httpwwwninjavideonetvideo46128 AVI

121182009 Transfonners 2 Revenge 06242009 111302009 httpwwwninjavideonetvideo28806 AVI of the Fallen

121812009 Four Christmases 1112612008 111242009 httpwwwninjavideonetvideo46153 AVI

121302009 Alvin and the 12232009 03302010 httpwwwninjavideonetvideo54062 AVI Chipmunks 2

12302009 Invictus (Pt 1) 1211112009 051182010 httpwwwninjavideonetvideo53751 AVI

121302009 Invictus (Pt 2) 1211112009 05182010 httpwwwninjavideonetvideo53753 AVI

121302009 Sherlock Holmes 12252009 03302010 httpwwwninjavideonetvideo54040 AVI

011042010 Avatar (Pt 1) 12182009 04222010 httpwwwninjavideonetvideo52811 DivX

011042010 Avatar (Pt 2) 12182009 04222010 httpwwwninjavideonetvideo52812 DivX

01062010 Up In The Air 111132009 031092010 httpwwwninjavideonetvideo54192 AVI

011122010 Youth In Revolt 011082010 061152010 httpwwwninjavideonetvideo54785 AVI

011122010 Daybreakers 0110812010 051112010 httpwwwninjavideonetvideo54844 DivX

011122010 The Hangover 06052009 12152009 httpwwwninjavideonetvideo27282 DivX

011132010 Couples Retreat (Pt 1) 10092009 02092010 httpwwwninjavideonetvideo53 822 AVI

011132010 Couples Retreat (Pt 2) 101092009 02092010 httpwwwninjavideonetvideo53823 AVI

011142010 Fantastic Mr Fox 1111312009 031232010 httpwwwninjavideonetvideo52518 DivX

011142010 Brothers 12042009 03232010 httpwwwninjavideonetvideo54066 AVI

011142010 The Stepfather 10162009 02092010 httpwwwninjavideonetvideo49062 AVI

011142010 Its Complicated (Pt 1) 121232009 04272010 httpwwwninjavideonetvideo54635 DivX

011142010 Its Complicated (Pt 2) 12232009 04272010 httpwwwninjavideonetvideo54636 DivX

appears to be to prevent other web sites from adopting and playing content hosted by the

NinjaVideo sites members and operators (a process known as leeching) which could potentially

take advertising revenue away from the NinjaVideo site Other movies are in Xvid format and

may be downloaded directly by users without being watched in the browser window

12 Once a visitor to the NinjaVideo site opens the NinjaVideo Helper applet heshe

is able to watch movies and television shows within the web browser When the user clicks on

the movie title an advertisement is typically displayed after which the movie begins playing in

the browser At the end of a movie the user can save the entire movie to a computer storage

device This is a process that ICE agents have performed on multiple occasions including those

set forth below

121162009 Ninja Assassin 111252009 0311612010 httpwwwninjavideonetvideo49303 AVI

121172009 Astro Boy 10232009 03162010 httpwwwninjavideonetvideo46128 AVI

121182009 Transfonners 2 Revenge 06242009 111302009 httpwwwninjavideonetvideo28806 AVI of the Fallen

121812009 Four Christmases 1112612008 111242009 httpwwwninjavideonetvideo46153 AVI

121302009 Alvin and the 12232009 03302010 httpwwwninjavideonetvideo54062 AVI Chipmunks 2

12302009 Invictus (Pt 1) 1211112009 051182010 httpwwwninjavideonetvideo53751 AVI

121302009 Invictus (Pt 2) 1211112009 05182010 httpwwwninjavideonetvideo53753 AVI

121302009 Sherlock Holmes 12252009 03302010 httpwwwninjavideonetvideo54040 AVI

011042010 Avatar (Pt 1) 12182009 04222010 httpwwwninjavideonetvideo52811 DivX

011042010 Avatar (Pt 2) 12182009 04222010 httpwwwninjavideonetvideo52812 DivX

01062010 Up In The Air 111132009 031092010 httpwwwninjavideonetvideo54192 AVI

011122010 Youth In Revolt 011082010 061152010 httpwwwninjavideonetvideo54785 AVI

011122010 Daybreakers 0110812010 051112010 httpwwwninjavideonetvideo54844 DivX

011122010 The Hangover 06052009 12152009 httpwwwninjavideonetvideo27282 DivX

011132010 Couples Retreat (Pt 1) 10092009 02092010 httpwwwninjavideonetvideo53 822 AVI

011132010 Couples Retreat (Pt 2) 101092009 02092010 httpwwwninjavideonetvideo53823 AVI

011142010 Fantastic Mr Fox 1111312009 031232010 httpwwwninjavideonetvideo52518 DivX

011142010 Brothers 12042009 03232010 httpwwwninjavideonetvideo54066 AVI

011142010 The Stepfather 10162009 02092010 httpwwwninjavideonetvideo49062 AVI

011142010 Its Complicated (Pt 1) 121232009 04272010 httpwwwninjavideonetvideo54635 DivX

011142010 Its Complicated (Pt 2) 12232009 04272010 httpwwwninjavideonetvideo54636 DivX

012012010 The Princess and the 121112009 031162010 httpwwwninjavideonetvideo52411 DivX Frog

011202010 Sherlock Holmes (Pt 1) 12252009 03302010 httpwwwninjavideonetvideo54039 DivX

0112012010 Sherlock Holmes (Pt 2) 12252009 03302010 httpwwwninjavideonetvideo54040 DivX

0112112010 The Lovely Bones (Pt 1) 121112009 02092010 httpwwwninjavideonetvideo54146 DivX

012112010 The Lovely Bones (Pt 2) 121112009 02092010 httpwwwninjavideonetvideo54147 DivX

0112112010 2012 (Pt I) 111132009 03022010 httpwwwninjavideonetvideo48061 DivX

0112112010 2012 (Pt 2) 11132009 03022010 httpwwwninjavideonetvideo48062 DivX

01222010 The Men Who Stare at 11062009 03232010 httpwwwninjavideonetvideo55014 AVI Goats CPt 1)

01222010 The Men Who Stare at 11062009 03232010 httpwwwninjavideonetvideo55015 AVI Goats (Pt 2)

011272010 Legion 01222010 05111120 I 0 httpwwwninjavideonetvideo55903 AVI

011272010 The Book of Eli 011152010 06152010 httpwwwninjavideonetvideo55773 DivX

02262010 Shutter Island 02192010 060820 I 0 httpwwwninjavideonetvideo58564 AVI

02262010 Valentines Day 02]212010 05182010 httpwwwninjavideonetvideo58206 AVI

02262010 Valentines Day 0211212010 05182010 httpwwwninjavideonetvideo58204 DivX

02262010 The Wolfinan 021122010 06012010 httpwwwninjavideonetvideo58268 AVI

02262010 The Wolfinan 021122010 06012010 httpwwwninjavideonetvideo58267 DivX

03082010 Alice in Wonderland 03052010 060112010 httpwwwninjavideonetvideo59615 AVI (Pt 1)

03082010 Alice in Wonderland 03052010 060112010 httpwwwninjavideonetvideo59616 AVI (Pt2)

03312010 How to Train Your 03262010 Future httpwwwninjavideonetvideo61893 AVI Dragon

033112010 How to Train Your 03262010 Future httpwwwninjavideonetvideo61892 DivX Dragon

03312010 The Bounty Hunter 031912010 Future httpwwwninjavideonetvideo61094 AVI

03312010 The Bounty Hunter 03192010 Future httpwwwninjavideonetvideo61095 AVI

033112010 Green Zone 0311212010 Future httpwwwninjavideonetvideo60165 AVI

031312010 Green Zone (Pt 1) 031212010 Future httpwwwninjavideonetvideo60 164 DivX

033112010 Green Zone (Pt 2) 031122010 Future httpwwwninjavideonetlvideo60758 DivX

033112010 Shes Out of My League 031122010 Future httpwwwninjavideonetvideo60873 DivX (Pt 1)

033112010 Shes Out of My League 03122010 Future httpwwwninjavideonetvideo60874 DivX (Pt2)

033112010 Repo Men 03192010 Future httpwwwninjavideonetvideo61 091 DivX

033112010 RepoMen 031192010 Future httpwwwninjavideonetvideo61093 DivX

04302010 The Back-Up Plan 0412312010 Future httpwwwninjavideonetvideo64459 DivX

043012010 The Back-Up Plan 0412312010 Future httpwwwninjavideonetvideo64460 AVI

05042010 Iron Man 2 05072010 Future httpwwwninjavideonetvideo65843 DivX

051042010 Iron Man 2 050712010 Future httpwwwninjavideonetvideo65844 AVI

050712010 A Nightmare on Elm 04302010 Future httpwwwninjavideonetvideo65850 DivX

Street

051072010 A Nightmare on Elm 04302010 Future httpwwwninjavideonetlvideo65851 AVI Street

0611112010 Shrek Forever After 052112010 Future httpwwwninjavideonetlvideo67813 AVI

061I 1I2010 Shrek Forever After 052112010 Future httpwwwninjavideonetlvideo67778 DivX

0611112010 Get Him to the Greek 06042010 Future httpwwwninjavideonetlvideo69081 DivX

061I 112010 Prince of Persia The 051282010 Future httpwwwninjavideonetlvideo68003 AVI Sands of Time

061I I12010 Prince of Persia The 05282010 Future httpwwwninjavideonetlvideo68005 AVI Sands ofTime

061112010 Prince of Persia The 05282010 Future httpwwwninjavideonetlvideo68002 DivX Sands of Time

06112010 Prince of Persia The 05282010 Future httpwwwninjavideonetlvideo68004 DivX Sands of Time

061I 112010 Letters to Juliet 051142010 Future httpwwwninjavideonetlvideo68269 AVI

061112010 Letters to Juliet 051142010 Future httpwwwninjavideonetlvideo68268 DivX

0611112010 Robin Hood 0511412010 Future httpwwwninjavideonetlvideo67038 DivX

0611112010 Robin Hood 05142010 Future httpwwwninjavideonetlvideo67040 DivX

0611612010 Hot Tub Time Machine 032612010 Future httpwwwninjavideonetlvideo69870 AVI

061162010 Hot Tub Time Machine 0312612010 Future httpwwwninjavideonetlvideo69869 DivX

061162010 The Karate Kid 061 II120 10 Future httpwwwninjavideonetlvideo6983 7 AVI

06162010 The Karate Kid 0611112010 Future httpwwwninjavideonetlvideo69839 AVI

061162010 The Karate Kid 0611112010 Future httpwwwninjavideonetlvideo69836 DivX

06162010 The Karate Kid 0611112010 Future httpwwwninjavideonetlvideo69838 DivX

0611612010 Sex and the City 2 05272010 Future httplIwwwninjavideonetivideo69329 DivX

061162010 Sex and the City 2 052712010 Future httpwwwninjavideonetlvideo69493 DivX

0611612010 Splice 060412010 Future httpwwwninjavideonetlvideo69533 AVI

0611612010 Splice 06042010 Future httpwwwninjavideonetlvideo69532 DivX

0611612010 TheA-Team 0611112010 Future httpwwwninjavideonetlvideo69404 AVI

061162010 TheA-Team 0611112010 Future httpwwwninjavideonetivideo69406 AVI

06162010 TheA-Team 0611112010 Future httpwwwninjavideonetivideo69403 DivX

06162010 TheA-Team 0611112010 Future httpwwwninjavideonetlvideo69405 DivX

LOCATION OF INFORMATION ON CARPATHIA COMPUTERS

13 Using publicly available software that can detect the Internet Protocol addresses

of data incoming to the undercover computer your affiant was able to determine that the movies

listed on the table above were being downloaded from computers assigned IP addresses held by

three commercial Internet hosting services Carpathia Hosting headquartered in Ashburn

Virginia which is located in the Eastern District of Virginia WZ Communications Inc which is

linked to the Netherlands-based host Webazilla which also operates a datacenter in Dallas

Texas and NoZone Inc in Chicago Illinois Each of these Internet hosting service companies

leases high-speed computer server space and Internet connectivity to the public

14 Information provided by Carpathia revealed that the unauthorized copies of

movies downloaded from Carpathias facilities are stored on dedicated computer servers that

Carpathia leases to a file and media storage service company known as MegaUpload Ltd which

operates the MegaUploadcom site and business MegaUpload Ltd which is headquartered in

Hong Kong allows account holders to upload and store files of various sizes depending on

whether the user has a free or fee-based premium account MegaUploadcom has become a

popular service for the storage of infringing copies of copyrighted movies and television shows

15 Several other movies available to view on-line (but not download) on the site are

in Adobe Flash format The Flash formatted movies do not appear to be hosted by Ninja Video

but are instead hosted by a web site known as Megavideocom which is affiliated with

MegaUploadcom and also operated by MegaUpload Ltd The Megavideocom hosted movies

are framed in a users browser by the Ninja Video site so that they appear to be playing on the

Ninja Video site

THE NINJAVIDEO SITE OPERATORS

16 A search of publicly available domain name registration records revealed that the

Ninjavideonet domain was registered on or about January 22 2008 The registrant of

Ninjavideonet concealed his name addresses and contact information from publicly available

WHOIS databases through the use of a domain registration privacy service called WhoisGuard

which is operated by NameCheap Pursuant to legal process NameCheap provided business

records associated with Ninjavideonet which identified SMITH as the registrant and account

holder NameCheaps records identify deadlnegmailcom as the email address associated with

SMITHs Ninjavideonet domain name account

17 A search of publicly available WHOIS records revealed that the Ninja Video web

site is hosted on a computer assigned the IP address 9317493198 which is owned by a

Netherlands-based company known as Ecatel Ltd Ecatel is known as a web hosting company

and its web site contains the statement High quality Dedicated servers amp Co-location services in

Amsterdam Alphen aid Rijn The Hague and Stockholm A review of Pay Pals account records

for subject SMITH reveal regular payments to Ecatel from January 19 2008 to May 15 2010

18 Observation of the NinjaVideo site by your affiant revealed that the site uses a

service offered by Google called Google Analytics According to Googles product literature

the Google Analytics service provides web site operators with data on the usage of their web

sites including web site traffic how visitors to the site navigate within or away from it and the

success of advertisements on the site Google Analytics customer records for the NinjaVideo site

revealed that a Google Analytics account was created for the Ninja Video site on or about March

22008 The records further revealed three users and their email addresses associated with the

Google Analytics account Matthew Smith using the email addressdeadlnegmailcom

Justin Dedemko using the email accountjustindedemkogmailcom and Hana Beshara

using the email accountpharaOhessgmailcom

19 In addition to the unauthorized copies of movies and television shows available

through the NinjaVideo site the site has a section known as the forum board which contains

messages from the Ninja Video site operators and provides a forum for Ninja Video users to

exchange messages with the sites operators and with other users A post in the forum board

dated December 30 2009 by an Administrator named Phara described the roles of different

members of the NinjaVideo staff That post identifies the following user aliases as

Administrators - Staff PHARA DEADINE AFRIKA TIK WADSWERTH HTRDFRKshy

Security Admin STEVEH - Mainsite Admin RICKYGOI - Mainsite Admin and CREE8

Mainsite Admin The post also identifies staff members who are Moderators Staff Gods of

the Game - Staff Legends Staff and Gods of the Up Staff The terms Up and

Uploader refer to the uploading of pirated content onto computer servers that can then be

accessed by sites such as the Ninja Video site

20 Evidence collected from a variety of sources during the course of the ICE

investigation has revealed that BESHARA uses the aliases PHARA and PHARAOHESS

SMITH uses the alias DEADlNE DEDEMKO uses the alias AFRIKA and EVANS uses

the alias WADSWERTH For example

a As described above and below SMITH frequently uses alias deadlne on

various services including the NameCheap account for the NinjaVideonet domain the Google

Analytics account for the Ninja Video site his PayPal account used for the site and his Gmail

account

b PayPal records for accounts for DEDEMKO show his use of email addresses

justindedemkogmailcom afr1 kaymailcom and jstndedemk03gmailcom

c PayPal records for EVANS identify his primary email address as

joshevyahoocom Subscriber records provided by Yahoo for that email account identify

wadswerthgmailcom as a separate email account used by EVANS

d PayPal records for BESHARA identify her primary email address as

pharaninjavideonet In addition Googles Google Analytics PayPal records for the NinjaVideo

site identify BESHARAs Gmail account as pharaOhessgmailcom

21 On or about February 22 2010 a United States Magistrate Judge in the Eastern

District of Virginia issued a search warrant for information including message content

associated with the deadlnegmailcom email account registered to SMITH Within SMITHs

email account was an email from SMITH to what appears to be a tax preparer detailing income

and deductions from the operation of the NinjaVideo site from January 12009 to March 31

2009 Among other expenses SMITH listed payments of $2073434 to BESHARA and

$937500 to DEDEMKO during that three month period He also listed income ltgtf$3343952

from AdBrite $1770657 from Widget and $705588 from PayPal donations AdBrite and

Mpire Corporation (which operated Widget) are advertising networks

22 Also contained within SMITHs deadlnegmailcom email account were emails

between subjects SMITH BESHARA and DEDEMKO regarding the operation of the

NinjaVideo site For example on or about May 24 2008 BESHARA sent an email entitled

final from the email address hana besharayahoocom to DEDEMKO at the email address

iustindedemkogmailcom and SMITH at dead 1 negmai1com Attached to the email was a

Microsoft Word document entitled StageNinjareformat-l which contained a draft business plan

for an Internet video web site

23 SMITHs email account also contained notices from copyright owners and others

that content on the Ninja Video site infringed copyrights On May 1 0 2008 he received a notice

from the NinjaVideos domain name registrar that it had received a Digital Millennium

Copyright Act (DMCA) notice of infringing material on the site SMITHs email account also

contained a copy of a December 42008 letter from Starz Media LLC to Ninja Videos domain

name registrar demanding that the Ninja Video site cease and desist from continuing to facilitate

the download of the movie title Righteous Kill

24 Googles records for SMITHs deadlnegmailcom account revealed that

SMITH created a Google Apps account for the Ninja Videonet domain name on or about

September 19 2008 Google Apps is a Google service that among other things allows

subscribers to use a domain name that they own in conjunction with Googles Gmail web-based

email service For example if a person named John owned the domain name

Loremipsumcom he could subscribe to the Google Apps service and use Googles Gmail

service to send and receive email from and to the email account johnloremipsumcom

Googles records showed that as ofApril 12 2010 22 of the available sub-Google Apps

accounts for Ninja Videonet had been created Included among these 22 sub-accounts were

email accounts corresponding to names of persons identified as Staff in the December 2009

forum post by Phara AFRlKANINJAVIDEONET DEADINENINJAVIDEONET

PHARANINJAVIDEONET and WADSWERTHNINJAVIDEONET

25 The aforementioned facts provide evidence ofprobable cause to believe that the

information associated with MegaUploadcom that is stored on computers controlled by

Carpathia Hosting contain contraband andor evidence andor instrumentalities andor fruits

related to violations of violations ofTitle 18 United States Code Sections 2319 Title 17 United

States Code Section 506 and Title 18 United States Code Section 371

V INFORMATION TO BE SEARCH AND THINGS TO BE SEIZED

26 I anticipate executing this warrant under the Electronic Communications Privacy

Act in particular 18 USc sectsect 2703(a) 2703(b)(l)(A) and 2703(c)(I)(A) by using the warrant

to require Carpathia to disclose to the government copies of the records and other information

(including the content of communications) particularly described in Section I ofAttachment B

Upon receipt of the information described in Section I ofAttachment B government-authorized

persons will review that information to locate the items described in Section II ofAttachment B

VI COMPUTER DATA

27 Based on my training and experience and the facts as set forth in this affidavit

there is probable cause to believe that on the computer systems in the control of Carpathia

associated with its customer MegaUpload there exists evidence of a crime namely conspiracy

to commit criminal copyright infringement and the aiding and abetting of criminal copyright

infringement Accordingly a search warrant is requested

28 This Court has jurisdiction to issue the requested warrant because it is a court

with jurisdiction over the offense under investigation 18 USC sect 2703(a)

29 Pursuant to 18 USC sect 2703(g) the presence ofa law enforcement officer is not

required for the service or execution of this warrant

30 Carpathia has indicated that in the event it is not able to locate the content

identified on Attachment A that is stored on its servers on its own it will work with its customer

MegaUpload to access the content to provide in response to the search warrant

31 The aforementioned facts provide evidence of probable cause to believe that the

items described in Attachment B will be found at the PREMISES TO BE SEARCHED described

in Attachment A The records described in Attachment B constitute not only evidence

contraband fruits and instrumentalities of these offenses but also constitute implements

devices or equipment used in the distribution of infringing copies of copyrighted works and

are thereby subject to criminal forfeiture and destruction or other disposition pursuant to section

17 USC sect 506(b)

IX REQUEST FOR SEALINGmiddot

32 Since the investigation is continuing the Affiant requests that this search warrant

affidavit be sealed until such time as the Court directs otherwise Disclosure of the search

warrant affidavit at this time would seriously jeopardize the ongoing investigation as such

disclosure may provide an opportunity to destroy evidence change patterns of behavior notify

confederates or allow confederates to flee or continue flight from prosecution Notwithstanding

the above the government requests that Carpathia and its customer MegaUpload be permitted to

view the warrant and Attachments A and B to the warrant to assist them in executing the warrant

The investigation in this matter is continuing and it is anticipated that additional search warrants

may be executed at other locations in the near future

LYZ J----___ Special Agent lin)iieshyUS Immigration amp Customs Enforcement

Subscribed and sworn to before me this J yJ~ay ofJune 2010

HONORABLE XlJtU 0 O4UIS UNITED STATES MAGISTRATE JUDGE

Attachment A PREMISES TO BE SEARCHED

Computer servers oVl1ed by Carpathia Hosting headquartered at 43480 Yukon Drive Suite 200 Ashburn Virginia 20147 leased to its customer MegaUpload including but not limited to computers assigned the following IP addresses

6959250 17414012969 17414012851 209222128153 209222128246 209222128172 17414015736 174J4015681 17414012827 661174341 17414012947 6611743118 6959358 17414012967 17414012840 6959223 6959254 6959329 6959251 6959334 17414012857 17414015715 6959241 17414015758 6611743117 209222128204 209222128135 17414015670 17414015672 6959357 17414012828 17414015656 661174363 17414012941 17414015678 1741401289 17414012945 6959239 209222128162

view the warrant and Attachments A and B to the warrant to assist them in executing the warrant

The investigation in this matter is continuing and it is anticipated that additional search warrants

may be executed at other locations in the near future

LYZ J----___ Special Agent lin)iieshyUS Immigration amp Customs Enforcement

Subscribed and sworn to before me this J yJ~ay ofJune 2010

HONORABLE XlJtU 0 O4UIS UNITED STATES MAGISTRATE JUDGE

Attachment A PREMISES TO BE SEARCHED

Computer servers oVl1ed by Carpathia Hosting headquartered at 43480 Yukon Drive Suite 200 Ashburn Virginia 20147 leased to its customer MegaUpload including but not limited to computers assigned the following IP addresses

6959250 17414012969 17414012851 209222128153 209222128246 209222128172 17414015736 174J4015681 17414012827 661174341 17414012947 6611743118 6959358 17414012967 17414012840 6959223 6959254 6959329 6959251 6959334 17414012857 17414015715 6959241 17414015758 6611743117 209222128204 209222128135 17414015670 17414015672 6959357 17414012828 17414015656 661174363 17414012941 17414015678 1741401289 17414012945 6959239 209222128162

Attachment A PREMISES TO BE SEARCHED

Computer servers oVl1ed by Carpathia Hosting headquartered at 43480 Yukon Drive Suite 200 Ashburn Virginia 20147 leased to its customer MegaUpload including but not limited to computers assigned the following IP addresses

6959250 17414012969 17414012851 209222128153 209222128246 209222128172 17414015736 174J4015681 17414012827 661174341 17414012947 6611743118 6959358 17414012967 17414012840 6959223 6959254 6959329 6959251 6959334 17414012857 17414015715 6959241 17414015758 6611743117 209222128204 209222128135 17414015670 17414015672 6959357 17414012828 17414015656 661174363 17414012941 17414015678 1741401289 17414012945 6959239 209222128162

Attachment B ITEMS TO BE SEIZED

Items evidencing violations of Title 18 United States Code Section 2319 and Title 17 United States Code Section 506 (Criminal copyright infringement) Title 18 United States Code Section 2 (Aiding and Abetting the foregoing offenses) and Title 18 United States Code Section 371 (Conspiracy) including but not limited to the following

I ITEMS TO BE SEIZED

1 All records including the content associated with each filename logs of uploads downloads page views displays streams and distributions for each filename stored on Carpathia computers identified in the table attached in Section III below

2 All information that might identify the subscribers related to the accounts or identifiers including names addresses telephone numbers and other identifiers e-mail addresses business information the length of service (including start date) types of services utilized means and source of payment for services (including any credit card or bank account number) of the individual or individuals who uploaded the content associated with each filename stored on Carpathia computers identified in the table attached in Section III below

3 All records stored on Carpathia computers relating to MegaUpload accounts associated with the email accounts and MegaUpload customer IDs

a dead 1 negmailcom

b hana _ besharayahoocom

c pharaninjavideonet

d joshevyahoocom

e tikninjavideonet

f MegaUpload premium account ID numbers 5057215313 10462109706 3895607225 6142888968 5057214848 and business silver membership number 5605491629

II Information to be seized by the government

All information described above in Section I that constitutes fruits evidence and instrumentalities of violations of Title 18 United States Code Section 2319 and Title 17 United States Code Section 506 (Criminal copyright infringement) Title 18 United States Code Section 2 (Aiding and Abetting the foregoing offenses) and Title 18 United States Code Section 371 (Conspiracy) relating to the reproduction display or distribution ofthe files identified in Attachment A including

1 Content associated with each filename and logs of uploads downloads page views displays streams and distributions for each filename stored on Carpathia computers identified in the table attached in Section III below

2 Files databases and database records for each filename stored on Carpathia computers identified in the table attached in Section III below

3 Information identifying the subscribers related to the accounts or identifiers including names addresses telephone numbers and other identifiers e-mail addresses business information the length of service (including start date) types of services utilized means and source ofpayment for services (including any credit card or bank account number) for each filename stored on Carpathia computers identified in the table attached in Section III

4 All records stored on Carpathia computers relating to MegaUpload accounts associated with the email accounts and MegaUpload customer IDs

a deadlnegmailcom

b hana_besharayahoocom

c pharaninjavideonet

d joshevyahoocom

e tikninjavideonet

f MegaUpload premium account ID numbers 5057215313 10462109706 3895607225 6142888968 5057214848 and business silver membership number 5605491629

III Table

6959250

17414012969

17414012851

209222128153

209222128246

209222128172

17414015736

17414015681

17414012827

661174341

17414012947

6611743118

6959358

17414012967

17414012840

6959223

6959254

6959329

6959251

6959334

17414012857

17414015715

6959241

17414015758

6611743117

209222128204

Avatar+28200929+Proper+TSXviD+SRT+28Part+1 29divx

Avatar+28200929+Proper+TSXviD+SRT+28Part+229divx

Daybreakers+28200929+TS+XviD+-+Rx+Releasedivx

The+Hangover+28200929+DVDRip+ X viD+-+DoNE +Releasedivx

Fantastic+Mr+Fox+28200929+DVDSCR+-+DONEDEAL+Releasedivx

It27s+Complicated+28200929+DVDSCR+xViD+-+xSCR+Release+28Part+ 1 29divx

It27s+Complicated+28200929+DVDSCR+xViD+-+xSCR+Release+O028Part+ 229divx

Sherlock+Holmes+28200929++DVDSCR+Mention+Release+28Part+ I 29divx

Sherlock+Holmes+28200929+DVDSCR +Mention+Release+28Part+ 229 divx

The+Princess+and+the+Frog+28200929+DVDRSCREENER+XviD+-+MENTiON+Releasedivx

20 12+28200929+BDRip+ X viD+-+iMB T +Release+28Part+ 1 29 divx

20 12+28200929+BDRip+ X viD+-+iMBT +Release+28Part+ 229 divx

The+Lovely+Bones+28200929+LIMITED+DVDSCR+ X viD+-+FOXNEWS+Release+28Part+ 1 29divx

The+Lovely+Bones+28200929+LIMITED+DVDSCR+XviD+-+FOXNEWS+Release+o028Part+229divx

The+Men+Who+Stare+at+Goats+28200929+R5+Line+ X viD+-+Prism+Release+28Part+ I 29 divx

The+Men+ Who+Stare+at+Goats+28200929+R5+Line+ X viD+-+Prism+ Release+28Part+229 divx

Legion+2820 I 029+CAM+ XVID+-+GM+Releasedivx

The+Book+of+Eli+ TELESYNC+ X viD+-+MENTiON+Releasedivx

The+ Wolfinan+ TELESYNC+ X viD+-+MOViERUSH+Releasedivx

Valentines+Day+ TELESYNC+ XviD+-+MENTiON+Releasedivx

Green+Zone+2820 I 029+ TS+ XViD+E28093+IMAGiNE+Release+28Part+ 1 29 divx

Green+ Zone+2820 1029+ TS+ XViD+E28093+IMAGiNE +Release+28Part+ 229divx

How+To+Train+Your+Dragon+282 0 1 029+TS+XViD+-+lMAGiNE+Re leasedivx

Shes+Out+Of+My+League+ TS+ XViD+-+IMAGiNE+Release+28Part+ 1 29divx

Shes+Out+Of+My+League+ TS+ XViD+-+IMAGiNE+Release+28Part+ 229divx

The+Back-Up+Plan+DVDSCR + XViD+-+BACKMEUP+Releasedivx

httpwwwninjavideonetvideo52811

httpwwwninjavideonetvideo52812

httpwwwninjavideonetvideo54844

httpwwwninjavideonetvideo27282

httpwwwninjavideonetvideo52518

httpwwwninjavideonetvideo5463 5

httpwwwninjavideonetvideo54636

httpwwwninjavideonetvideo54039

httpwwwninjavideonetvideo54040

httpwwwninjavideonetvideo52411

httpwwwninjavideonetvideo48061

httpwwwninjavideonetvideo48062

httpwwwninjavideonetvideo54146

httpwwwninjavideonetvideo5414 7

httpwwwninjavideonetvideo520 10

httpwwwninjavideonetvideo52012

httpwwwninjavideonetvideo5 5902

httpwwwninjavideonetvideo55773

httpwwwninjavideonetvideo58267

httpwwwninjavideonetvideo58204

httpwwwninjavideonetvideo60164

httpwwwninjavideonetvideo607 5 8

httpwwwninjavideonetvideo61892

httpwwwninjavideonetvideo60873

httpwwwninjavideonetvideo60874

httpwwwninjavideonetvideo64459

209222128135

17414015670

17414015672

6959357

17414012828

17414015656

661174363

17414012941

17414015678

1741401289

17414012945

6959239

209222128162

Iron+Man+2+2820 1 029+CAM+XViD+-+ TDV+Releasedivx

A +Nightmare+On+Elm+Street+2820 1 029+CAM+ XVID+-+ T A+Releasedivx

Shrek+Forever+After+28201 029+CAM+ XviD+-+PrisM+Release+divx

Get+Him+ To+ The+Greek+28201029+CAM+ X viD+-+lMAGiNE+Releasedivx

Prince+of+Persia+ The+Sands+of+ Time+ TS+ XViD+-+FLA WL3SS+Release++28Partl 29divx

Prince+of+Persia+ The+Sands+of+ Time+ TS+ XViD+-+FLA WL3SS+Release+o028Part229divx

Letters+To+Juliet+2820 I 029+CAM+ XViD+-+DUBBY +Releasedivx

Robin+Hood+28201029+CAM+XViD+-+IMAGiNE+Release+28Part+229divx

Hot+ Tub+ Time+Machine+2820 I 029+Unrated+DVDRip+ XviD+-+DiAMOND+Releasedivx

Sex+and+the+City+2+CAM+XViD+-+IMAGiNE+Release+28Part+I29divx

Sex+and+the+City+2+CAM+XViD+-+IMAGiNE+Release+28Part+229divx

Splice+28201 029+CAM+XviD+-+ZeT+Releasedivx

The+A+ Team+2820 1 029+ TS+ V2+ XViD+-+IMAGiNE +Release+28Part+ 1 29divx

httpwwwninjavideonetlvideo65843

httpwwwninjavideonetlvideo65850

httpwwwninjavideonctlvideo67778

httpwwwninjavideonetlvideo69081

httpwwwninjavideonetlvideo68002

httpwwwninjavideonetlvideo68004

httpwwwninjavideonetlvideo68268

httpwwwninjavideonetlvideo67040

httpwwwninjavideonetlvideo6 9 869

httpwwwninjavideonetlvideo69329

httpwwwninjavideonetlvideo69493

httpwwwninjavideonetlvideo6953 2

httpwwwninjavideonetlvideo69403

IN THE UNITED STATES DISTRlCTCOURTFOR THE ~~~4 2~ I~ EASTERN DISTRICT OF VIRGINIA

Alexandria Division

IN THE MATTER OF THE SEARCH OF ) Case No1 10SW 3020 INFORMATION ASSOCIATED WITH ) MEGAUPLOADCOM THAT IS STORED ) UNDER SEAL AT THE PREMISES CONTROLLED BY ) CARPATHIA HOSTING )

GOVERNMENTS MOTION TO SEAL SEARCH WARRANT PURSUANT TO LOCAL RULE 49(B)

The United States by and through undersigned counsel pursuant to Local Rule 49(B) of

the Local Criminal Rules for the United States District Court for the Eastern District of Virginia

asks for an Order to Seal the search warrant the attachments the application for the search

warrant and the affidavit in support of the search warrant together with this Motion to Seal and

proposed Order until the United States makes a motion to unseal these documents

I REASONS FOR SEALING

1 United States Immigration and Customs Enforcement is investigating an alleged

conspiracy to commit criminal copyright infringement through the operation of an advertisement-

supported web site that is being used to distribute infringing copies of motion pictures software

and television programs The United States has applied for a warrant to search the contents of

the email account used in furtherance of the conspiracy by one of the subjects of the

investigation

2 Premature disclosure of the search would jeopardize an ongoing criminal

investigation including the ability of the United States to locate and arrest additional persons and

may lead to the destruction ofevidence

3 The United States has considered alternatives less drastic than sealing and has

found none that would suffice to protect this investigation

II GOVERNING CASE LAW

4 This Court has the inherent power to seal documents in support of search warrants

to protect an ongoing investigation See United States v Wuagneux 683 F2d 1343 1351 (11 th

Cir 1982) State of Arizona v Maypenny 672 F2d 761 765 (9th Cir 1982) Times Mirror

Company v United States 873 F2d 1210 (9th Cir 1989) see also Shea v Gabriel 520 F2d 879

(1 st Cir 1975) United States v Hubbard 650 F2d 293 (DC Cir 1980) In re Braughton 520

F2d 765 766 (9th Cir 1975) The trial court has supervisory power over its own records and

may in its discretion seal documents if the publics right of access is outweighed by competing

interests In re Knight Pub Co 743 F2d 231235 (4th Cir 1984) Sealing search warrants

and accompanying affidavits and applications is appropriate where there is a substantial

probability that release of the sealed documents would compromise the governments on-going

investigation severely See ~ In re Search Warrant for Secretarial Area Outside Office of

Gunn 855 F2d 569 574 (8th Cir 1988) Matter of Eye Care Physicians of America 100 F3d

514518 (7th Cir 1996) Matter of Flower Aviation of Kansas Inc 789 FSupp 366 (D Kan

1992)

III PERIOD OF TIME GOVERNMENT SEEKS TO HAVE MATTER REMAIN UNDER SEAL

5 Pursuant to Local Rule 49(B)(3) the search warrant and associated documents

will remain sealed until the United States moves to unseal

6 Notwithstanding this Motion to Seal the United States requests authorization to

2

provide a copy of the search warrant with attachments to Carpathia Hosting who will retrieve the

data sought in the search warrant In addition because Carpathia may need the assistance of its

customer MegaUpload Limited to obtain the content from the computer servers leased to

MegaUpload and located within Carpathias facilities the United States requests that Carpathia

Hosting be permitted to provided a copy of the warrant with attachments and sealing order to

MegaUpload

WHEREFORE the United States respectfully requests that the search warrant the

attachments to the search warrant the application for search warrant the affidavit in support of

the search warrant and this Motion to Seal and proposed Order be sealed until the United States

moves to unseal

Respectfully submitted

Neil H MacBride United States Attorney

BY~middot J Prabhu Attorney for United States US Attorneys Office Justin W Williams US Attorneys Building 2100 Jamieson A venue Alexandria Virginia 22314 703-299-3700 Fax 703-299-3981 jayprabhuusdojgov

3

3 The United States has considered alternatives less drastic than sealing and has

found none that would suffice to protect this investigation

II GOVERNING CASE LAW

4 This Court has the inherent power to seal documents in support of search warrants

to protect an ongoing investigation See United States v Wuagneux 683 F2d 1343 1351 (11 th

Cir 1982) State of Arizona v Maypenny 672 F2d 761 765 (9th Cir 1982) Times Mirror

Company v United States 873 F2d 1210 (9th Cir 1989) see also Shea v Gabriel 520 F2d 879

(1 st Cir 1975) United States v Hubbard 650 F2d 293 (DC Cir 1980) In re Braughton 520

F2d 765 766 (9th Cir 1975) The trial court has supervisory power over its own records and

may in its discretion seal documents if the publics right of access is outweighed by competing

interests In re Knight Pub Co 743 F2d 231235 (4th Cir 1984) Sealing search warrants

and accompanying affidavits and applications is appropriate where there is a substantial

probability that release of the sealed documents would compromise the governments on-going

investigation severely See ~ In re Search Warrant for Secretarial Area Outside Office of

Gunn 855 F2d 569 574 (8th Cir 1988) Matter of Eye Care Physicians of America 100 F3d

514518 (7th Cir 1996) Matter of Flower Aviation of Kansas Inc 789 FSupp 366 (D Kan

1992)

III PERIOD OF TIME GOVERNMENT SEEKS TO HAVE MATTER REMAIN UNDER SEAL

5 Pursuant to Local Rule 49(B)(3) the search warrant and associated documents

will remain sealed until the United States moves to unseal

6 Notwithstanding this Motion to Seal the United States requests authorization to

2

provide a copy of the search warrant with attachments to Carpathia Hosting who will retrieve the

data sought in the search warrant In addition because Carpathia may need the assistance of its

customer MegaUpload Limited to obtain the content from the computer servers leased to

MegaUpload and located within Carpathias facilities the United States requests that Carpathia

Hosting be permitted to provided a copy of the warrant with attachments and sealing order to

MegaUpload

WHEREFORE the United States respectfully requests that the search warrant the

attachments to the search warrant the application for search warrant the affidavit in support of

the search warrant and this Motion to Seal and proposed Order be sealed until the United States

moves to unseal

Respectfully submitted

Neil H MacBride United States Attorney

BY~middot J Prabhu Attorney for United States US Attorneys Office Justin W Williams US Attorneys Building 2100 Jamieson A venue Alexandria Virginia 22314 703-299-3700 Fax 703-299-3981 jayprabhuusdojgov

3

provide a copy of the search warrant with attachments to Carpathia Hosting who will retrieve the

data sought in the search warrant In addition because Carpathia may need the assistance of its

customer MegaUpload Limited to obtain the content from the computer servers leased to

MegaUpload and located within Carpathias facilities the United States requests that Carpathia

Hosting be permitted to provided a copy of the warrant with attachments and sealing order to

MegaUpload

WHEREFORE the United States respectfully requests that the search warrant the

attachments to the search warrant the application for search warrant the affidavit in support of

the search warrant and this Motion to Seal and proposed Order be sealed until the United States

moves to unseal

Respectfully submitted

Neil H MacBride United States Attorney

BY~middot J Prabhu Attorney for United States US Attorneys Office Justin W Williams US Attorneys Building 2100 Jamieson A venue Alexandria Virginia 22314 703-299-3700 Fax 703-299-3981 jayprabhuusdojgov

3

[ - f( ~

IN THE UNITED STATES DISTRICT COURT FOR TH ii Ii-~2~4 20~ I~ EASTERN DISTRICT OF VIRGINIA

Alexandria Division cCr( us rltT-- gtUR1 _ _ c _ ~

bull -j-~~- - bullbullbull bull bull ~ ~

IN THE MATTER OF THE SEARCH OF ) Case No I 10 5tu 3 ~O INFORMA TION ASSOCIATED WITH ) MEGAUPLOADCOM THAT IS STORED ) UNDER SEAL AT THE PREMISES CONTROLLED BY ) CARP A THIA HOSTING )

ORDER TO SEAL

The UNITED STATES pursuant to Local Rule 49(B) of the Local Criminal Rules for the

United States District Court for the Eastern District of Virginia having moved to seal the search

warrant the attachments to the search warrant the application for search warrant the affidavit in

support of the search warrant the Motion to Seal and proposed Order in this matter and

The COURT having found that revealing the material sought to be sealed would

jeopardize an ongoing criminal investigation having considered the available alternatives that

are less drastic than sealing and finding none would suffice to protect the governments

legitimate interest in concluding the investigation and finding that this legitimate government

interest outweighs at this time any interest in the disclosure of the material it is hereby

ORDERED ADJUDGED and DECREED that the search warrant the attachments to

the search warrant the application for search warrant the affidavit in support of the search

warrant the Motion to Seal and this Order be sealed until the United States moves to unseal

The United States is authorized to provide a copy of the search warrant with attachments to

Carpathia Hosting In addition because Carpathia may need the assistance of its customer

MegaUpload Limited to obtain the content from the computer servers leased to MegaUpload and

located within Carpathias facilities Carpathia Hosting may provide a copy of the warrant with

attachments and this sealing order to MegaUpload

HONORABLEIVAN b DAVIS Date 91( J1 n 10 UNITED STATES MAGISTRATE JUDGE

Alexandria Virginia

5