U.S. Attorney Justin Herdman announced today that the Northern District of Ohio office collected $28,603,085.75 in civil and criminal actions in the fiscal year 2020 (FY 2020). Of this amount, $21,612,213.13 was collected in civil actions, and $6,990,872.62 was collected in criminal actions. 

Additionally, the U.S. Attorney’s Office for the Northern District of Ohio, working with partner agencies and divisions, collected $11,469,460.00 in asset forfeiture actions in FY 2020. Forfeited assets deposited into the Department of Justice Assets Forfeiture Fund are used to restore funds to crime victims and for various law enforcement purposes.            

Accordingly, a combined $40,072,545 was collected by the U.S. Attorney’s Office for the Northern District of Ohio in FY 2020.

“This year, when many of our processes and procedures were forced to change due to the pandemic, the Northern District was nonetheless able to recover a substantial number of funds from numerous civil and criminal judgments,” said U.S. Attorney Justin Herdman. “When we represent the United States of America and secure a collection judgment, we will seek to recover every dollar possible.” 

The Justice Department collected more than $15.9 billion in civil and criminal actions in FY 2020, ending Sept. 30, 2020. The $15,988,516,670 in collections in FY 2020 represents more than five times the approximately $3.2 billion appropriated budget for the 94 U.S. Attorneys’ offices and the main litigating divisions of the Justice Department combined in that same period. The total includes all monies collected as a result of Justice Department-led enforcement actions and negotiated civil settlements. It includes more than $13.5 billion in payments made directly to the Justice Department and more than $2.4 billion in indirect payments made to other federal agencies, states and other designated recipients. 

Notable collections in fiscal year 2020 include:

The Cannon Corporation, aka Cannon Design, $9,000,000 

In 2016, Cannon Design agreed to pay a $12 million dollar penalty, implement a series of corporate reforms and divest itself from a large project to resolve the company’s criminal liability for the conduct of more than a dozen employees, including paying bribes and kickbacks to obtain confidential information related to Department of Veterans Affairs construction projects.

Mu Sigma, Inc, $1,600,000

This settlement resulted in a recovery of $1.6 million after a joint criminal investigation into an international analytics service company alleged to be illegally using B-1 visitor for business visas to circumvent the H1-B nonimmigrant worker visa cap. This was a joint investigation by the U.S. Attorney’s Office in the Northern District of Ohio, Northern District of Texas, Department of Homeland Security and the Department of State.

Alex Spirikaitis, $671,366.90

Spirikaitis was ordered to pay $15,000,000 in restitution in December of 2014 after entering a guilty plea to leading a conspiracy that defrauded a credit union out of $15 million. 

Donald R. Peyatt, $250,000 

Peyatt was ordered to pay $250,000 in restitution in August of 2019 after entering a guilty plea to making material false statements to the IRS regarding income from a scrap steel business he owned with another person. 

Ryan Driscoll, $208,693

Driscoll was ordered to pay $208,693.00 in restitution in July of 2020 after entering a guilty plea to running an illegal sports gambling business with others, laundering the proceeds and filing a false income tax return.

The U.S. Attorneys’ Offices, along with the department’s litigating divisions, are responsible for enforcing and collecting civil and criminal debts owed to the U.S. and criminal debts owed to federal crime victims. The law requires defendants to pay restitution to victims of certain federal crimes who have suffered a physical injury or financial loss. 

While restitution is paid to the victim, criminal fines and felony assessments are paid to the department’s Crime Victims Fund, which distributes the funds collected to federal and state victim compensation and victim assistance programs.

Forfeited assets deposited into the Department of Justice Assets Forfeiture Fund are used to restore funds to crime victims and for a variety of law enforcement purposes.

Four people were sentenced to prison for taking federal money earmarked for job training and instead using the money to pay for personal expenses, including vacations, investments, real estate purchases and salaries for people who did not work at the company.

James D. Moody, 58, of Toledo, was sentenced today to 66 months in prison. Victoria Hawkins, 31, of Grand Rapids, Michigan, was sentenced last week to 54 months in prison. Angela Bowser, 46, of Toledo, was sentenced last week to 36 months in prison.

All three were convicted by a jury late last year for their activities related to Toledo-based Business Rehabilitation Informed Decisions Guiding Employment Strategies, Inc. d/b/a B.R.I.D.G.E.S., Inc..

Company founder and general manager Daniel E. Morris, 68, of Maumee, previously pleaded guilty to his crimes and was sentenced to 46 months in prison.

 “These defendants stole millions of dollars targeted to help the least among us learn job skills, and instead used the money to fund lavish lifestyles and pay for no-show jobs,” said U.S. Attorney Justin E. Herdman said. “They ripped off taxpayers and betrayed the trust placed in them.”

“This was a transparent scheme to defraud the taxpayers of Northwest Ohio,” said IRS Special Agent in Charge Ryan Korner. “Today’s guilty verdicts brings justice to thieves who enriched themselves on the backs of those struggling to survive.” 

According to court documents and trial testimony:

BRIDGES operated at 242 Reynolds Road and 310 Reynolds Road. The company was in the business of providing work placement and work training services to public assistance recipients, and nearly all of its revenue came from public funds. 

Morris was the co-founder and general manager of BRIDGES. Moody was co-founder and sole-shareholder. Hawkins was an employee from 2008 through 2012, while Bowser was an employee from 2008 through 2014.

BRIDGES was funded through the Temporary Assistance for Needy Families (TANF) program.  TANF was a welfare program that provided cash assistance to qualifying households with minor children or pregnant women. TANF provided federal block grants to states each year to cover benefits, administrative expenses and services targeted to needy families.

One of TANF’s goals was reducing the dependency of needy parents by promoting job preparation, work and marriage. TANF recipients must work as soon as they are job ready and no later than two years after commencing assistance.  BRIDGES placed public assistance recipients at “job sites,” where the recipients would work for free to obtain job training and as a condition of receiving public assistance benefits like cash assistance or SNAP benefits (formerly food stamps).

BRIDGES received more than $15.7 million in funding from several entities between 2004 and 2015, including the Ohio Department of Job and Family Services, the Lucas County Department of Job and Family Services, Ohio Works First and others. This funding was based in part on BRIDGES’ grant proposals. The majority of BRIDGES’ stated administrative costs were payroll and transportation.

BRIDGES provided job training and work placement services but at substantially lower costs than those stated in its budgets and invoices. The defendants fraudulently inflated BRIDGES payroll costs, transportation and mileage.

Morris, BRIDGES and others maintained false personnel files, timesheets, mileage records and reimbursement forms for nonexistent employees. They included fake, former or nonexistent employees on the payroll. For example, BRIDGES paid Moody a salary even though he did not work there, and later continued to pay him by issuing payroll checks to Moody’s wife.

During trial, Moody testified that he placed the salary in his wife’s name in order to distance himself from BRIDGES while running for mayor in 2009 and so that she could receive Social Security benefits despite not otherwise being eligible. Moody also received non-payroll checks, which he used to purchase and rehabilitate an investment property in Toledo, purchase an interest in his real estate company, Flex Realty, and pay for legal fees. 

BRIDGES, Morris, Moody, Hawkins and Bowser used TANF funds to pay for personal living expenses including groceries, dental care, medical care, resort vacations, pharmaceuticals, clothing, toys, designer bags, furniture, video streaming services, credit card bills, legal fees unrelated to BRIDGES’ business, tattoos, cosmetic surgery, real estate, vehicles, investments and jewelry, according to court documents and trial testimony.

For example, between February 2013 and October 2014, Hawkins accessed a BRIDGES business account to make approximately $18,200 in cash withdrawals.  Hawkins also had access to a debit card through which she accessed and spent approximately $750,000 in a two-year timeframe.  Hawkins and co-defendant Morris also purchased two houses, including a $400,000 house in the Point Place neighborhood of Toledo. 

Bowser, a program manager at BRIDGES, received numerous non-payroll checks from the company, some of which were used to purchase a house in Toledo.  Bowser continued to receive bi-weekly payments from the company after she stopped working there in 2014.  

Each defendant that went to trial was convicted of conspiracy to commit federal program theft, conspiracy to commit money laundering offenses, substantive federal program theft counts, and substantive money laundering counts.

Morris pleaded guilty to conspiracy to commit federal program theft and mail fraud, aggravated identity theft, conspiracy to commit money laundering, and willful failure to pay over withheld payroll tax.

The case is being prosecuted by Assistant U.S. Attorneys Noah P. Hood and Gene Crawford following an investigation by the Internal Revenue Service-Criminal Investigations with the assistance of the Ohio Auditor of State’s Office, Public Integrity Assurance Team.

A two-count criminal information was filed today charging a Solon accountant with conspiracy to defraud the Internal Revenue Service and attempting to interfere with the administration of Internal Revenue laws, said U.S. Attorney Justin E. Herdman and IRS Special Agent in Charge Ryan L. Korner. 

Patrick DiPietro, 51, conspired with two other people and a company owned by the other people between 2007 and 2012 to impede the lawful function of the IRS in the assessment and collection of revenue, while enriching themselves with the tax savings.

The scheme involved checks being written from the company’s bank account payable to another entity controlled by DiPietro, purportedly as payments for rent and other business expenses.  DiPietro deposited the checks into an account he controlled and then wrote checks back to the two individuals for approximately 90 percent of the amounts received, with DiPietro keeping approximately 10 percent as his “fee” for conducting the transactions, according to the information. 

DiPietro also prepared federal income tax returns for the individuals and their business for 2007 through 2011 which falsely understated taxable income and overstated business deductions, according to the information.

During the IRS criminal investigation, DiPietro provided various fraudulent documents to the investigating agents in an attempt to legitimize or explain the checks written to his business entity from the other individuals’ business, including a commercial lease, a stock option agreements, a promissory note.  None of the documents were, in fact, legitimate or had ever been executed by the parties, according to the information.

“This defendant enriched himself by taking money that should have been going into the U.S. Treasury,” Herdman said.

“Conspiring to impede the IRS by creating business checks for expenses not actually incurred and receiving a ‘kickback’ from those fraudulent business checks is not tax savings, but rather a recipe for criminal prosecution,” said Ryan L. Korner, Special Agent in Charge, IRS Criminal Investigation, Cincinnati Field Office. 

The case is being prosecuted by Assistant U.S. Attorney Robert W. Kern following an investigation by the Internal Revenue Service – Criminal Investigation.

If convicted, the defendant’s sentence will be determined by the Court after review of factors unique to this case, including the defendant’s prior criminal record, if any, the defendant’s role in the offense and the characteristics of the violations.  In all cases, the sentence will not exceed the statutory maximum and, in most cases, it will be less than the maximum.

An information is only a charge and is not evidence of guilt. A defendant is entitled to a fair trial in which it will be the government's burden to prove guilt beyond a reasonable doubt.

U.S. Attorney Justin Herdman announced today that the Jordan Community Resource Center in Cleveland Heights has been awarded $497,661 from the Department of Justice’s Office of Justice Programs and its component, the Office for Victims of Crime, to provide safe, stable housing and appropriate services to victims of human trafficking in Northern Ohio. 

“Human trafficking is a barbaric criminal enterprise that subjects its victims to unspeakable cruelty and deprives them of the most basic of human needs, none more essential than a safe place to live,” said Attorney General William P. Barr. “Throughout this Administration, the Department of Justice has fought aggressively to bring human traffickers to justice and to deliver critical aid to trafficking survivors. These new resources, announced today, expand on our efforts to offer those who have suffered the shelter and support they need to begin a new and better life.”

“In addition to combating the threat and harm posed by human trafficking, the Justice Department is committed to providing much-needed resources and assistance to victims,” said U.S. Attorney Justin Herdman. “These funds announced today will help our partners provide victims with necessities such as housing and utilities assistance, occupational training and counseling."

The grant, awarded to the Jordan Community Resource Center, will provide six to 24 months of transitional or short-term housing assistance for trafficking victims, including rental, utilities or related expenses, such as security deposits and relocation costs. The grant will also provide funding for support needed to help victims locate permanent housing, secure employment, as well as occupational training and counseling. The Jordan Community Resource Center is one of 73 organizations receiving more than $35 million in OVC grants to support housing services for human trafficking survivors.

“Human traffickers dangle the threat of homelessness over those they have entrapped, playing a ruthless game of psychological manipulation that victims are never in a position to win,” said OJP Principal Deputy Assistant Attorney General Katharine T. Sullivan. “These grants will empower survivors on their path to independence and a life of self-sufficiency and hope.”

Human trafficking offenses are among the most difficult crimes to identify, and the scope of human trafficking victimization may be much greater than the limited data reflect. A new report issued by the National Institute of Justice, another component of the Office of Justice Programs, found that the number of human trafficking cases captured in police reports may represent only a fraction of all such cases. Expanding housing and other services to trafficking victims remains a top Justice Department priority.

The Office for Victims of Crime, for example, hosted listening sessions and roundtable discussions with stakeholders in the field in 2018 and launched the Human Trafficking Capacity Building Center. From July 2018 through June 2019, 118 OVC human trafficking grantees reported serving 8,375 total clients including, confirmed trafficking victims and individuals showing strong indicators of trafficking victimization.

For a complete list of individual award amounts and jurisdictions that will receive funding, visit: https://www.ojp.gov/sites/g/files/xyckuh241/files/media/document/htvictimsfactheet.pdf

The Office of Justice Programs, directed by Principal Deputy Assistant Attorney General Katharine T. Sullivan, provides federal leadership, grants, training, technical assistance and other resources to improve the nation’s capacity to prevent and reduce crime, assist victims and enhance the rule of law by strengthening the criminal and juvenile justice systems. More information about OJP and its components can be found at www.ojp.gov.

The year 2020 marks the 150th anniversary of the Department of Justice. Learn more about the history of our agency at www.Justice.gov/Celebrating150Years.

CLEVELAND – Vall Iliev, 69, of Stow, Ohio, has been charged in a three-count information with smuggling foreign-made body armor and then selling it to law enforcement agencies and others, as legitimate, domestically-made certified products. From around 2017 to October 2023, the defendant allegedly imported body armor from the People’s Republic of China (PRC) and sold it under claims of being made in the United States and bearing a falsified trademarked label. Body armor is commonly used by those in law enforcement and other agencies for protection from ballistic threats to the torso area.According to court documents, in May 2023, U.S. Customs and Border Protection agents at the Blaine, Washington port of entry (POE) intercepted a Canadian-registered truck found to be carrying more than 200 ballistic body armor plates in boxes marked with the PRC as the origin. Cargo inspectors were unable to determine the manufacturer’s name. The plates were concealed in pre-packaged boxes within a larger shipping container which is a technique known as “Master Carton Smuggling” and typically used in attempts to evade detection by POE officials. The hidden boxes of the unmanifested cargo were pre-labeled and addressed to a business in Stow, Vallmar Studios, which Iliev owned and operated. Investigators found that Vallmar’s business location was used as a warehouse to process the PRC-manufactured body armor before selling to the public through a second business, ShotStop Ballistics, which Iliev also owned and operated in Stow.ShotStop Ballistics conducted business through its website and sold body armor to the public and law enforcement agencies across the country. The company marketed their Level III and Level IV body armor as “Made in Stow, Ohio” and “NIJ Certified.” The National Institute of Justice, or NIJ, is the research, development, and evaluation arm of the U.S. Department of Justice (DOJ), which has published performance standards for ballistic-resistant police body armor for more than 50 years. It utilizes a standard process by which rounds of ammunition are fired at a distance to certify body armor along a range of established threat levels. Manufacturers and distributors are permitted to use the NIJ trademarked symbol that indicates that the product meets its established standards for protection.However, inspectors who examined the intercepted body armor originating from the PRC, found that none of the items were shipped with related documentation that stated that the product met standards for NIJ certification. The seized ballistic plates were sent to Oregon Ballistic Laboratories for testing, which is one of five approved NIJ certified facilities in the United States. The final test results report from the laboratory showed that the panels failed to meet NIJ standards for Level III certification. Test failure for Level III indicates that the same plates would not have passed the more rigorous testing required for Level IV.Throughout the course of the years-long conspiracy, Iliev worked with a PRC broker company to find inexpensive manufacturers to make Level III and Level IV body armor. Once orders were placed, manufacturers were directed to ship the items to the defendant’s Vallmar business. When the PRC shipments arrived at the Summit County business, the defendant instructed employees to affix labels to the body armor plates stating “NIJ Certified” and “Made in Stow, Ohio” before going on sale to the public, to law enforcement departments, and to other agencies that rely on ballistic-resistant body armor for protection.Investigators found thousands of Chinese-produced body armor plates at Vallmar and ShotStop, which served as warehouses to receive, but had no means of producing, Level III or Level IV body armor. The ShotStop location housed a laser printer which was used to print the fake DOJ certification labels that Iliev’s employees were instructed to place on the sub-standard body armor before selling and shipping to customers.Investigators also found marketing videos produced by Iliev which he used to advertise the body armor products he sold with claims of being manufactured in Ohio and certified by the NIJ. The NIJ certification labels included fictitious “patent pending” on some products such as “Level III+” and “Level IV+HD” certified, which are non-existent designations.Although Iliev’s companies initially obtained and held valid NIJ certifications, he never sought to confirm through NIJ-certified testing that the body armor quality he imported through co-conspiring Chinese business associates met NIJ performance standards for ballistic resistance. These standards are crucial for buyers to make informed purchases about a product’s safety levels.These charges are merely allegations, and the defendant is presumed innocent and entitled to a fair trial. It will be the government’s burden to prove guilt beyond a reasonable doubt. If convicted, the defendant’s sentence will be determined by the Court after review of factors unique to the case, including the defendant’s prior criminal record, if any, their role in the offense, and the characteristics of the violation. In all cases, the sentence will not exceed the statutory maximum, and, in most cases, it will be less than the maximum.This case is being investigated by U.S. Immigration and Customs Enforcement’s Homeland Security Investigations (HSI) Cleveland Office alongside the Ohio Attorney General’s Bureau of Criminal Investigation with assistance from U.S. Customs and Border Protection. The case is being prosecuted by Assistant U.S. Attorney Duncan T. Brown for the Northern District of Ohio.If you have purchased ShotStop Ballistics body armor from 2018 onward, for product safety reasons, HSI recommends discontinuing use. For those who purchased items in question from ShotStop Ballistics, please email a copy of your invoice to faultyarmor@hsi.dhs.gov with “ShotStop Invoice” in the subject line no later than Monday, April 7, 2025.

A jury convicted three people of taking federal money earmarked for job training and instead using the money to pay for personal expenses, including vacations, investments, real estate purchases and salaries for people who did not work at the company, said U.S. Attorney Justin E. Herdman and IRS Special Agent in Charge Ryan Korner.

James D. Moody, 57, of Toledo, Victoria Hawkins, 30, of Grand Rapids, Michigan, and Angela Bowser, 46, of Toledo, were convicted on all counts for their activities related to Toledo-based Business Rehabilitation Informed Decisions Guiding Employment Strategies, Inc. d/b/a B.R.I.D.G.E.S., Inc..

They are scheduled to be sentenced April 10, 2018.           

Company founder and general manager Daniel E. Morris, 68, of Maumee, pleaded guilty last month to his crimes and is scheduled to be sentenced February 22, 2018.

“These defendants stole millions of dollars targeted to help the least among us learn job skills, and instead used the money to fund lavish lifestyles and pay for no-show jobs,” Herdman said. “They ripped off taxpayers and betrayed the trust placed in them.”

“This was a transparent scheme to defraud the taxpayers of Northwest Ohio,” Korner said. “Today’s guilty verdicts brings justice to thieves who enriched themselves on the backs of those struggling to survive.” 

According to court documents and trial testimony:

BRIDGES operated at 242 Reynolds Road and 310 Reynolds Road. The company was in the business of providing work placement and work training services to public assistance recipients, and nearly all of its revenue came from public funds. 

Morris was the co-founder and general manager of BRIDGES. Moody was co-founder and sole-shareholder. Hawkins was an employee from 2008 through 2012, while Bowser was an employee from 2008 through 2014.

BRIDGES was funded through the Temporary Assistance for Needy Families (TANF) program.  TANF was a welfare program that provided cash assistance to qualifying households with minor children or pregnant women. TANF provided federal block grants to states each year to cover benefits, administrative expenses and services targeted to needy families.

One of TANF’s goals was reducing the dependency of needy parents by promoting job preparation, work and marriage. TANF recipients must work as soon as they are job ready and no later than two years after commencing assistance.  BRIDGES placed public assistance recipients at “job sites,” where the recipients would work for free to obtain job training and as a condition of receiving public assistance benefits like cash assistance or SNAP benefits (formerly food stamps).

BRIDGES received more than $15.7 million in funding from several entities between 2004 and 2015, including the Ohio Department of Job and Family Services, the Lucas County Department of Job and Family Services, Ohio Works First and others. This funding was based in part on BRIDGES’ grant proposals. The majority of BRIDGES’ stated administrative costs were payroll and transportation.

BRIDGES provided job training and work placement services but at substantially lower costs than those stated in its budgets and invoices. The defendants fraudulently inflated BRIDGES payroll costs, transportation and mileage.

Morris, BRIDGES and others maintained false personnel files, timesheets, mileage records and reimbursement forms for nonexistent employees. They included fake, former or nonexistent employees on the payroll. For example, BRIDGES paid Moody a salary even though he did not work there, and later continued to pay him by issuing payroll checks to Moody’s wife.

During trial, Moody testified that he placed the salary in his wife’s name in order to distance himself from BRIDGES while running for mayor in 2009 and so that she could receive Social Security benefits despite not otherwise being eligible. Moody also received non-payroll checks, which he used to purchase and rehabilitate an investment property in Toledo, purchase an interest in his real estate company, Flex Realty, and pay for legal fees. 

BRIDGES, Morris, Moody, Hawkins and Bowser used TANF funds to pay for personal living expenses including groceries, dental care, medical care, resort vacations, pharmaceuticals, clothing, toys, designer bags, furniture, video streaming services, credit card bills, legal fees unrelated to BRIDGES’ business, tattoos, cosmetic surgery, real estate, vehicles, investments and jewelry, according to court documents and trial testimony.

For example, between February 2013 and October 2014, Hawkins accessed a BRIDGES business account to make approximately $18,200 in cash withdrawals.  Hawkins also had access to a debit card through which she accessed and spent approximately $750,000 in a two-year timeframe.  Hawkins and co-defendant Morris also purchased two houses, including a $400,000 house in the Point Place neighborhood of Toledo. 

Bowser, a program manager at BRIDGES, received numerous non-payroll checks from the company, some of which were used to purchase a house in Toledo.  Bowser continued to receive bi-weekly payments from the company after she stopped working there in 2014.  

Each defendant was convicted of conspiracy to commit federal program theft, conspiracy to commit money laundering offenses, substantive federal program theft counts, and substantive money laundering counts.

Morris pleaded guilty to conspiracy to commit federal program theft and mail fraud, aggravated identity theft, conspiracy to commit money laundering, and willful failure to pay over withheld payroll tax.

The case is being prosecuted by Assistant U.S. Attorneys Noah P. Hood and Gene Crawford following an investigation by the Internal Revenue Service-Criminal Investigations with the assistance of the Ohio Auditor of State’s Office, Public Integrity Assurance Team.

Matthew J. Turnipseede, 49, of Las Vegas, Nevada, was charged today in a 13-count indictment with defrauding approximately 72 investors in the Northern District of Ohio and elsewhere out of more than $8.5 million through a Ponzi scheme that promised investors double-digit profits achieved through various sports wagering businesses.

The defendant was officially charged with 12 counts of wire fraud and one count of mail fraud.

According to the indictment, from March 2015 to May 2021, the defendant induced victims to invest money in companies that he owned, namely Edgewize LLC, Moneyline Analytics, Moneyline Analytics Dublin Branch, and another company incorporated by Turnipseede, by falsely claiming that investor funds would be used to make sophisticated sports wagers according to an algorithm that generated double-digit returns. 

According to the indictment, none of these companies ever generated the promised profits, and instead the defendant used investor money to maintain the business, seek new sources of funds, pay off earlier investors and fund personal expenses. 

The indictment alleges that the defendant provided victim investors with operating agreements in which he claimed that all money invested would be used exclusively to place bets on sporting events and that the defendant would not be paid any compensation for placing the wagers but would retain a percentage of the winning profits.

To perpetuate the scheme, the defendant is accused of periodically emailing fraudulent financial statements to victims purporting to show substantial gains on their investments and employing an accounting firm to generate IRS forms based on fraudulent figures provided to the firm by the defendant.  The indictment alleges that the defendant’s sports wagers never generated the promised profits for investors and that the information provided to the accounting firm was fraudulent.  It is alleged that if a victim sought to withdraw some or all of their investments, the defendant used money from other victims’ contributions to cover the withdrawal.

In addition, it is also alleged that the defendant used investor funds to finance his personal expenses, including family vacations to Disneyland and Hawaii, spa treatments, lease payments on multiple vehicles and country club membership dues.

An indictment is only a charge and is not evidence of guilt.  The defendant is entitled to a fair trial in which it will be the government’s burden to prove guilt beyond a reasonable doubt.

If convicted, the defendant’s sentence will be determined by the court after a review of factors unique to this case, including the defendant’s prior criminal record, if any, the defendant’s role in the offenses and the characteristics of the violation.  In all cases, the sentence will not exceed the statutory maximum; in most cases, it will be less than the maximum.

This case was investigated by the Cleveland FBI.  This case is being prosecuted by Assistant U.S. Attorneys Erica D. Barnhill and Brian McDonough.

A federal jury today convicted two Romanian nationals of 21 counts related to their scheme to infect victim computers with malware in order to steal credit card and other information to sell on dark market websites, mine cryptocurrency and engage in online auction fraud.

Bogdan Nicolescu, 36, and Radu Miclaus, 37, were convicted after a 12-day trial of conspiracy to commit wire fraud, conspiracy to traffic in counterfeit service marks, aggravated identity theft, conspiracy to commit money laundering and 12 counts each of wire fraud. 

The verdict was announced by Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney Justin E. Herdman of the Northern District of Ohio, and FBI Special Agent in Charge Eric B. Smith.

“The evidence at presented at trial set out an international criminal enterprise with victims around the world, including people here in Northern Ohio,” Justin Herdman said. “While they stole millions of dollars, what they thought was a veil of anonymity was no protection against law enforcement, who worked diligently to track them down and bring them to justice in an American courthouse.”

"This conviction reveals the dynamic landscape in which international criminals utilize sophisticated cyber methods to take advantage of and defraud, unsuspecting victims,” Smith said. “Despite the complexity and global character of this type of investigation, this judgment demonstrates the commitment by the FBI and our partners to aggressively pursue the individuals responsible, anywhere in the world, and bring them to justice.”

According to testimony at trial and court documents, Nicolescu, Miclaus, and a co-conspirator who pleaded guilty, collectively operated a criminal conspiracy from Bucharest, Romania.  It began in 2007 with the development of proprietary malware, which they disseminated through malicious emails purporting to be legitimate from such entities as Western Union, Norton AntiVirus and the IRS. When recipients clicked on an attached file, the malware was surreptitiously installed onto their computer.

This malware harvested email addresses from the infected computer, such as from contact lists or email accounts, and then sent malicious emails to these harvested email addresses.  The defendants infected and controlled more than 400,000 individual computers, primarily in the United States.

Controlling these computers allowed the defendants to harvest personal information, such as credit card information, user names and passwords.  They disabled victims’ malware protection and blocked the victims’ access to websites associated with law enforcement.

Controlling the computers also allowed the defendants to use the processing power of the computer to solve complex algorithms for the financial benefit of the group, a process known as cryptocurrency mining.

The defendants used stolen email credentials to copy a victim’s email contacts.  They also activated files that forced infected computers to register email accounts with AOL.  The defendants registered more than 100,000 email accounts using this method.  They then sent malicious emails from these addresses to the compromised contact lists.  Through this method, they sent tens of millions of malicious emails.

When victims with infected computers visited websites such as Facebook, PayPal, eBay or others, the defendants would intercept the request and redirect the computer to a nearly identical website they had created.  The defendants would then steal account credentials.  They used the stolen credit card information to fund their criminal infrastructure, including renting server space, registering domain names using fictitious identities and paying for Virtual Private Networks (VPNs) which further concealed their identities.

The defendants were also able to inject fake pages into legitimate websites, such as eBay, to make victims believe they were receiving and following instructions from legitimate websites, when they were actually following the instructions of the defendants.

They placed more than 1,000 fraudulent listings for automobiles, motorcycles and other high-priced goods on eBay and similar auction sites.  Photos of the items were infected with malware, which redirected computers that clicked on the image to fictitious webpages designed by the defendants to resemble legitimate eBay pages.

These fictitious webpages prompted users to pay for their goods through a nonexistent “eBay Escrow Agent” who was simply a person hired by the defendants.  Users paid for the goods to the fraudulent escrow agents, who in turn wired the money to others in Eastern Europe, who in turn gave it to the defendants.  The payers/victims never received the items and never got their money back.

This resulted in a loss of millions of dollars.

The Bayrob group laundered this money by hiring “money transfer agents” and created fictitious companies with fraudulent websites designed to give the impression they were actual businesses engaged in legitimate financial transactions.  Money stolen from victims was wired to these fraudulent companies and then in turn wired to Western Union or Money Gram offices in Romania.  European “money mules” used fake identity documents to collect the money and deliver it to the defendants. 

The FBI investigated the case, with assistance from the Romanian National Police. The case was prosecuted by Assistant U.S. Attorneys Duncan T. Brown and Brian McDonough and Senior Counsel Brian Levine of the Criminal Division’s Computer Crime and Intellectual Property Section. The Office of International Affairs also provided assistance in this case.