Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 1 of 24 Page ID #:1
`
`MARC E. MAYER (SBN 190969)
`mem@msk.com
`KARIN G. PAGNANELLI (SBN 174763)
`kgp@msk.com
`MITCHELL SILBERBERG & KNUPP LLP
`2049 Century Park East, 18th Floor
`Los Angeles, CA 90067-3120
`Telephone: (310) 312-2000
`Facsimile:
`(310) 312-3100
`Attorneys for Plaintiff
`
`UNITED STATES DISTRICT COURT
`CENTRAL DISTRICT OF CALIFORNIA
`
`CASE NO.
`COMPLAINT FOR:
`(1) VIOLATION OF THE
`COMPUTER FRAUD AND ABUSE
`ACT, 18 U.S.C. §§ 1030 ET SEQ.;
`(2) VIOLATION OF CALIFORNIA
`PENAL CODE § 502;
`(3) TRESPASS TO CHATTEL;
`(4) INTENTIONAL
`INTERFERENCE WITH
`CONTRACTUAL RELATIONS;
`(5) UNFAIR COMPETITION
`
`DEMAND FOR JURY TRIAL
`
`UBISOFT, INC., a corporation existing
`under the laws of California,
`Plaintiff,
`
`v.
`DENNIS KRUK, a/k/a
`DENNIS_KRUK, _D.K_3,
`DENNIS10KRUKD,
`DENNIS10KRUK, BYDK_3,
`FOREVERDK_3, and DERDK, an
`individual; MAXIMILIAN KUEHL,
`a/k/a GIVEMEYOURELLO,
`MAXIMILIANKUEHL0, VERSIX,
`DANIELDUSENANDR,
`SIXSIEGEGAMING, and VERSIX_,
`an individual; KELVIN (KEVIN)
`UTTIH, a/k/a KUTTIHS, KUTTIH,
`and KEUTTIH, an individual; B.R. a/
`k/a TEST123TEST123,
`BENJAMINSTRIKE,
`BENJAMINSTRIKES,
`XBLAZZEROPSERVICES, and
`LIGHTNING_MAN420, an individual;
`SNG.ONE LTD, an entity of unknown
`form; DOE 1 a/k/a
`SHORTNAMEGAME,
`@SHORTNAMEGAME, and
`APPLE.ID12343@GMAIL.COM; and
`DOES 2 through 10, inclusive,
`Defendants.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 2 of 24 Page ID #:2
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`PRELIMINARY STATEMENT
`Ubisoft, Inc. (“Ubisoft”) is one of the world’s most prominent
`1.
`publishers of high-quality video games and interactive entertainment products.
`Ubisoft’s products include some of the most popular video games ever created,
`such as games in the Assassin’s Creed, Far Cry, and Tom Clancy game franchises.
`Ubisoft’s Tom Clancy games encompass more than a dozen military action games,
`including the bestselling competitive multiplayer game Tom Clancy’s Rainbow
`Six: Siege (“R6S”). In order to maintain Ubisoft’s strong community of dedicated
`R6S players, Ubisoft has invested considerable time, money, and effort into
`ensuring that all of its players have a positive, fun, and rewarding experience each
`time they play R6S. By this lawsuit, Ubisoft seeks to stop an unscrupulous
`commercial group of hackers and profiteers dedicated to harming Ubisoft’s games
`and destroying the R6S player experience for their own personal financial benefit.
`2.
`Defendants are members of a business enterprise that provides its
`customers with subscription-based access to software and other online services
`designed to enable their customers to perpetrate targeted denial-of-service (“DoS”)
`and distributed denial-of-service (“DDoS”) attacks (the “DDoS Attacks”) on the
`computer servers that enable R6S players to play and compete in the game
`(collectively, the “DDoS Services”). Defendants have offered the DDoS Services
`through various domain names, websites, and anonymous online aliases, including
`the websites sng.one and r6s.support. The DDoS Attacks that Defendants enable
`and facilitate are designed to disrupt and impede the functioning of the R6S
`servers, often disconnecting all of the players playing R6S on the targeted server.
`And even when the DDoS Attacks do not completely destroy existing matches,
`they can, and regularly do, impede the normal operation of the game, including by
`causing severe degradation of the game experience for legitimate players.
`3.
`The DDoS Services represent an enormous threat to R6S and Ubisoft.
`The DDoS Services have caused, and are continuing to cause, serious and
`2
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 3 of 24 Page ID #:3
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`irreparable harm to Ubisoft, its valuable player community, and its business
`interests. Defendants’ provision of the DDoS Services and repeated DDoS Attacks
`on Ubisoft’s computer systems, network, and servers disrupts, interferes with, and
`prevents R6S from operating properly. Moreover, in the case of a server or
`network crash, the Defendants’ DDoS Attacks deny R6S’s legitimate and
`authorized users access to Ubisoft’s servers, and more importantly, the game itself.
`This repeated service interruption and denial alienates and frustrates legitimate
`players. Defendants’ provision of the DDoS Services, especially in the United
`States, has caused severe harm to Ubisoft, including irreparable damage to its
`customers’ goodwill and trust.
`Defendants are well aware of the harm that the DDoS Services and
`4.
`DDoS Attacks cause to Ubisoft. Indeed, knowing that this lawsuit was imminent,
`Defendants have hastily sought to conceal evidence concerning their involvement,
`even going so far as to create and publish a fictional seizure notice on one of the
`websites used by Defendants falsely claiming that the domain had been seized by
`“Microsoft Inc. and Ubisoft Entertainment” pursuant to a fictional “Operation
`(D)DoS OFF.”
`As set forth herein, Defendants have engaged in numerous unlawful
`5.
`acts under United States law. Defendants have knowingly and intentionally
`impaired the integrity and availability of Ubisoft’s computer servers, disrupting
`and preventing authorized users from actively engaging with and accessing the
`R6S computer servers, in violation of, inter alia, the Computer Fraud and Abuse
`Act (“CFAA”), 18 U.S.C. §§ 1030 et seq., and California Penal Code § 502.
`Defendants further have intentionally and without permission disrupted, interfered
`with, and impaired the condition, quality, and value of Ubisoft’s computer systems,
`servers, and networks in violation of California common law. Moreover,
`Defendants have knowingly, intentionally, and maliciously induced Ubisoft
`customers in the United States to breach their contracts with Ubisoft, including
`
`3
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 4 of 24 Page ID #:4
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`contracts that explicitly prohibit them from engaging in the precise type of hacking
`that Defendants enable by use of their DDoS Services. Defendants not only know
`that their conduct is unlawful, but they engage in that conduct with the deliberate
`intent to harm Ubisoft, R6S, and its community. Ubisoft is entitled to monetary
`damages, injunctive and other equitable relief, and punitive damages against
`Defendants.
`
`
`JURISDICTION AND VENUE
`This is a civil action seeking damages, injunctive relief, and other
`6.
`equitable relief under the CFAA, 18 U.S.C. § 1030 et seq., and the laws of the
`State of California.
`This Court has subject matter jurisdiction over Ubisoft’s claims for
`7.
`violation of the CFAA pursuant to 28 U.S.C. §§ 1331 and 1338(a). Pursuant to 28
`U.S.C. § 1367, this Court has supplemental jurisdiction over Ubisoft’s state law
`claims for violation of the California Penal Code § 502, trespass to chattel,
`intentional interference with contractual relations, and unfair competition, which
`are so related to Ubisoft’s claims under the CFAA as to be part of the same case or
`controversy. Additionally, this Court has subject matter jurisdiction pursuant to 28
`U.S.C. § 1332 because the amount in controversy exceeds the sum or value of
`$75,000, and the action is between a California corporation and citizens of a
`foreign jurisdiction.
`This Court has personal jurisdiction over Defendants because they
`8.
`have purposefully directed their activities at the United States, and at California.
`Ubisoft is informed and believes, and on that basis alleges, that, without limitation:
`
`(a) Defendants conduct extensive and ongoing business with users
`in the United States and the State of California;
`
`(b) Defendants provide the DDoS Services in the United States and
`the State of California, advertise and market the DDoS Services in the United
`
`4
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 5 of 24 Page ID #:5
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`States and the State of California, and communicate directly with users in the
`United States and in the State of California, including for the purposes of soliciting
`subscriptions of the DDoS Services by such users and providing customer and
`technical support for the DDoS Services;
`
`(c) Defendants have directed their unlawful activities at Ubisoft,
`knowing and intending that Ubisoft would be harmed by their conduct in the
`United States and primarily in California, where Ubisoft has a significant business
`presence and where its U.S. office is based;
`
`(d) Defendants have entered into, and continue to enter into,
`contracts with individuals in the United States and in the State of California,
`including contracts pursuant to which such individuals’ license from Defendants
`the right to use the DDoS Services. In return for such licenses, Defendants receive
`ongoing and recurring daily, weekly, or monthly payments from individuals in the
`United States; and
`
`(e) Defendants contract with entities located in the United States
`and the State of California in connection with their business. This includes, for
`example, credit card processors and merchant banks.
`Venue is proper in this District pursuant to 28 U.S.C. § 1391(b)
`9.
`because this is a judicial district in which a substantial part of the events giving rise
`to the claims occurred, and/or in which Ubisoft’s injury was suffered.
`
`
`THE PARTIES
`10. Ubisoft is a corporation duly organized and existing under the laws of
`California. Ubisoft is the United States publisher of, and owner of certain
`exclusive rights in, the immensely popular online game Rainbow Six: Siege
`(“R6S”).
`11. Ubisoft is informed and believes, and on that basis alleges that
`Defendant Dennis Kruk, a/k/a dennis_kruk, _d.k_3, dennis10krukd, dennis10kruk,
`
`5
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 6 of 24 Page ID #:6
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`byDK_3, foreverdk_3, and derDK (“Kruk”), is an individual residing in Munich,
`Germany. Ubisoft is informed and believes that Kruk, in concert with the other
`Defendants, is responsible for the operation and promotion of the DDoS Services.
`12. Ubisoft is informed and believes, and on that basis alleges that
`Defendant Maximilian Kuehl, a/k/a GiveMeYourElLo, Maximiliankuehl0,
`VeRSiX, DanielDusenAandr, sixsiegegaming, and versix_ (“Kuehl”), is an
`individual residing in Werningshausen, Germany. Ubisoft is informed and
`believes that Kuehl, in concert with the other Defendants, is responsible for the
`operation and promotion of the DDoS Services.
`13. Ubisoft is informed and believes, and on that basis alleges that
`Defendant Kelvin (Kevin) Uttih, a/k/a kuttihs, kuttih, and keuttih (“Uttih”), is an
`individual residing in Lagos, Nigeria. Ubisoft is informed and believes that Uttih
`is the person responsible for developing, updating, maintaining and supporting the
`DDoS Services. Ubisoft is informed and believes Uttih is responsible for
`collecting, processing, and transmitting to one or more of the other Defendants
`payments made by SNG.ONE’s customers for use of and access to the DDoS
`Services.
`14. Ubisoft is informed and believes, and on that basis alleges that
`Defendant B.R, a/k/a test123test123, benjaminstrike, benjaminstrikes,
`xblazzeropservices, and Lightning_Man420, is a minor individual residing in
`Hoogwoud, Netherlands. Ubisoft is informed and believes that B.R. is the person
`responsible for operating, updating, maintaining and supporting the r6ddos.com
`website by which Defendants provide their DDoS Services. Ubisoft is informed
`and believes, and on that basis alleges that Defendant B.R also is a “reseller” of the
`DDoS Services, meaning that he collects and processes payments for the DDoS
`Services.
`15. Ubisoft is informed and believes, and on that basis alleges, that
`defendant SNG.ONE is an entity whose form currently is unknown to Ubisoft.
`
`6
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 7 of 24 Page ID #:7
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Ubisoft is informed and believes, and on that basis alleges, that SNG.ONE is the
`alter ego of Uttih, B.R., Kuehl, Kruk, and/or Defendant Doe shortnamegame and
`that Uttih, B.R., Kuehl, Kruk, shortnamegame and SNG.ONE have a unity of
`interest and ownership such that the separate personalities of the entity and the
`person cease to exist, and that SNG.ONE was created for the express purpose of
`shielding Uttih, B.R., Kuehl, Kruk, and shortnamegame from the legal
`consequences resulting from their operation, development, and provision of the
`DDoS Services and DDoS Attacks.
`16. Ubisoft is informed and believes, and on that basis alleges, that
`Defendant Doe 1, a/k/a shortnamegame and apple.id12343@gmail.com, assists in
`operation and sale of the DDoS Services. The true names and capacities, whether
`individual, corporate, associate, or otherwise, of shortnamegame are unknown to
`Ubisoft, which has therefore sued said defendants by such fictitious names.
`17. The true names and capacities, whether individual, corporate,
`associate, or otherwise, of Does 2 through 10 are unknown to Ubisoft, which has
`therefore sued said defendants by such fictitious names. These defendants include
`individuals whose real identities are not yet known to Ubisoft, but who are acting
`in concert with one another, often under the guise of Internet aliases, in committing
`the unlawful acts alleged herein. Ubisoft will seek leave to amend this complaint
`to state their true names and capacities once said defendants’ identities and
`capacities are ascertained. Ubisoft is informed and believes, and on that basis
`avers, that all defendants sued herein are liable to Ubisoft as a result of their
`participation in all or some of the acts set forth in this complaint. (All of the
`aforementioned defendants collectively are referred to herein as “Defendants.”)
`18. Ubisoft is informed and believes, and on that basis alleges, that at all
`times mentioned in this complaint, each of the Defendants was the agent of each of
`the other Defendants and, in doing the things averred in this complaint, was acting
`within the course and scope of such agency.
`
`7
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 8 of 24 Page ID #:8
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`FACTS APPLICABLE TO ALL CLAIMS
`Ubisoft And R6S
`19. Ubisoft is a video game publisher, engaged in the business of
`publishing high-quality software game products (the “Ubisoft Games”) in the
`United States. Among Ubisoft’s most popular games is Tom Clancy’s Rainbow
`Six: Siege (“R6S”). Ubisoft is the owner of certain exclusive rights in R6S and all
`of its expansions and add-ons. Ubisoft also is responsible for operating and
`maintaining R6S and, in connection with its partners, the R6S online servers.
`20. R6S, initially released on December 1, 2015, is a team-based, online
`multiplayer, military-themed “first person shooter” (“FPS”) game. In R6S, players
`assume the role of an elite special forces operative. The player must work with
`other team members, and against a competing team, to complete objectives such as
`rescuing hostages, diffusing bombs, or securing a biohazard container. To
`accomplish these objectives, players must cooperate and communicate with their
`team members, each of which brings a particular skill set to the overall team. R6S
`players may play the game either “casually” or in competitive “ranked” matches
`where their success or failure affects their overall standing in the community.
`21. R6S is a highly competitive, skill-based online game with a fixed set
`of rules that have been carefully designed to ensure that all players stand on equal
`footing and have a fair chance to defeat their opponents and progress in the game.
`Maintaining proper game balance is absolutely critical to the game’s success.
`Thousands of hours have been spent by Ubisoft to ensure that the game is fair and
`fun to play. If that balance is artificially upset, or if there is a perception that some
`players are cheating or have an unfair advantage, then players will grow frustrated
`with the game and stop playing. That, in turn, could disrupt the entire R6S
`community and cause the game to wither and die.
`22. R6S is made available to the public exclusively through, and hosted
`on, dedicated servers maintained by Ubisoft and its partners (the “R6S Server” or
`
`8
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 9 of 24 Page ID #:9
`
`
`“R6S Servers”) The R6S Servers enable the game to be played online, connect
`players of R6S to each other, and generate the online virtual world in which the
`game takes place. Proper functioning of the R6S Servers is critical to the
`functioning of R6S. Any disruption, slowdown, or interference with the R6S
`Servers can cause the game to become unplayable.
`23. Ubisoft protects the R6S game and the R6S Servers through a variety
`of methods, including through contracts between Ubisoft and R6S players.
`Specifically, in order to access the R6S Servers and play the game, users must
`create and register an account with Ubisoft. In doing so, players must expressly
`manifest their assent to the “Ubisoft Terms of Use” and End-User License
`Agreement (the “TOU”), and the “Rainbow Six: Siege Code of Conduct” (the
`“Code of Conduct”). The entire text of the TOU is displayed to users at the time
`they are asked to assent to its terms and also is made available to members of the
`public at https://legal.ubi.com/termsofuse/en-US. The Code of Conduct is
`incorporated by reference in the TOU and made available to members of the public
`at https://rainbow6.ubisoft.com/siege/en-us/news/152-326395-16/rainbow-six-
`siege-code-of-conduct.
`24. The TOU includes a conditional, limited license agreement between
`Ubisoft and its users. Under the TOU, Ubisoft licenses the right to download,
`copy, install, and play the Ubisoft Games (including by accessing the R6S
`Servers), subject to certain terms, restrictions, and conditions. Among other
`provisions, the Ubisoft End User License Agreement expressly states that, as a
`condition to the limited license: “You undertake not to directly or indirectly…
`modify, distort, block, abnormally burden, disrupt, slow down and/or hinder the
`normal functioning of all or part of the Services, or their accessibility to other
`Users, or the functioning of the partner networks of the Services, or attempt to do
`any of the above….”
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`9
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 10 of 24 Page ID #:10
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`25. The Code of Conduct also expressly forbids “[a]ny conduct which
`interrupts the general flow of Gameplay in the Game client, forum, or any other
`Ubisoft medium,” “[a]ny attempt to edit, corrupt or change Game or server code,”
`and “use of third-party hacking, cheating or botting clients.”
`It is not possible for a user to lawfully obtain access to or play R6S
`26.
`without expressly consenting to the TOU and Code of Conduct. Accordingly,
`every R6S player does so pursuant to the TOU and Code of Conduct.
`
`
`DoS and DDoS Attacks
`27. One way that video game hackers and cheaters seek to disrupt the
`game experience for others is through DoS and DDoS attacks on multiplayer game
`servers. DoS and DDoS attacks make a targeted device, computer system,
`network, or server (collectively, the “targeted device”) unavailable to its legitimate,
`intended users through the temporary or indefinite disruption of service. This
`disruption of service is accomplished by overburdening the targeted device and
`flooding it with an abundance of illegitimate requests (or traffic), forcing it to
`expend the bulk of its resources responding to the illegitimate requests. A DoS or
`DDoS attack thus prevents the targeted device from responding to legitimate
`requests, and, if sufficiently overburdened, may cause the targeted device to crash. 1
`In contrast to a DoS attack, a DDoS attack typically utilizes multiple
`28.
`machines operating together to attack a single target, which in “allow[ing] for
`exponentially more requests to be sent to the target . . . increas[es] [its] attack
`power . . .[and] increases the difficulty of attribution, as the true source of the
`attack is harder to identify.”2
`
`
`1 See Understanding Denial-of-Service Attacks, U.S. Comp. Emergency Readiness
`Team, https://www.us-cert.gov/ncas/tips/ST04-015.
`2 Id.
`
`
`
`10
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 11 of 24 Page ID #:11
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`29. DDoS Attacks are a highly disruptive weapon used by unscrupulous
`players of multiplayer games such as R6S to cheat in the game, harass others, or
`simply poison the online environment. In some cases, players wishing to gain an
`unfair advantage in R6S will engage in DDoS Attacks on the R6S Servers in order
`to create server “lag” – that is, a slowdown in communication between the player’s
`personal computer and the multiplayer server. A player experiencing a DDoS
`Attack on his or her R6S game will experience a variety of negative consequences
`such as his or her character not responding timely to player input or controls, his or
`her character moving erratically, and a flawed perception of where other players
`are located on the map. In many instances, the DDoS Attack also will cause the
`R6S Server to crash or reboot, abruptly ending matches in progress. By engaging
`in a DDoS Attack, the player who launched the attack may intend to gain an unfair
`advantage in the game by making the game unplayable for the opposing team.
`Alternatively, the player may intend to cause the match to terminate, either to
`annoy other players or avoid losing the match. In all cases, the victims of the
`attack are frustrated and angry, and may lose interest in playing R6S.
`30. Because R6S is such a popular game, and players are highly
`competitive, a market has arisen for software or services that enable players to
`cheat or harass other players, including for services that allow players to engage in
`DDoS Attacks against the R6S Servers. Defendants are among the latest to take
`advantage of this market.
`
`
`Defendants And Their Unlawful Conduct
`31. Defendants are members of a coordinated business enterprise that
`provides its customers with subscription-based access to the DDoS Services
`through a series of websites, including, but not limited to: sng.one, r6.support,
`r6s.support, stressed-stresser-stressing-stressers.com, and r6ddos.com (the “DDoS
`Websites”). Operating through anonymous online aliases, Defendants have
`
`11
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 12 of 24 Page ID #:12
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`perpetrated a malicious campaign of facilitating, encouraging, enabling,
`participating in, and conspiring to engage in recurring attacks on the R6S Servers.
`32. Ubisoft is informed and believes, and on that basis alleges, that via the
`DDoS Websites – and, particularly, the website www.sng.one (the “SNG.ONE
`Website”), Defendants sell licenses to members of the public for access to the
`DDoS Services. Defendants offer three (3) tiered subscription plans for the DDoS
`Services: (i) Starter, (ii) Advanced, and (iii) Full Time B00ter. For the Starter
`plan, which offers use of a normal network and up to one concurrent attack, a
`license costs between 10 Euros (approximately $ 11.11) for 30 days and 90 Euros
`(approximately $ 99.95) for “lifetime” access. For the Advanced plan, which
`offers use of a VIP network and up to two concurrent attacks, a license costs
`between 20 Euros (approximately $ 22.21) for 30 days and 180 Euros
`(approximately $ 199.90) for “lifetime” access. For the Full Time B00ter plan,
`which offers use of a VIP network and up to three concurrent attacks, a license
`costs between 30 Euros (approximately $ 33.32) for 30 days and 270 Euros
`(approximately $ 299.85) for “lifetime” access. Ubisoft is informed and believes,
`and on that basis alleges, that users may purchase licenses directly from the
`SNG.ONE Website by making payment to or through PayPal, Bitcoin, Paysafe,
`Skrill, and Amazon.
`In order to use the DDoS Services, members of the public must create
`33.
`and register an account with the SNG.ONE Website and purchase one of the
`subscription packages. The operators of the DDoS Websites then will provide the
`customer with access to their web-based software tools, along with instructions as
`to how to access the web-interface and launch DDoS Attacks on the R6S Servers.
`Optionally, purchasers also may pay to have members of the SNG.ONE “team”
`(i.e., Defendants or one of their agents or employees) “set up” their computer (such
`as by configuring the customer’s computer with the proper IP addresses and
`settings), so that they may immediately use the DDoS Service to attack the R6S
`
`12
`
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 13 of 24 Page ID #:13
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`Servers. Once the customer’s computer is properly configured, the purchaser may
`launch a DDoS Attack on the R6S Server at-will, subject only to the limitations of
`the license that the purchaser has paid for.
`34. Depicted below is a screenshot of the Defendants’ r6s.support
`website, wherein subscribers may utilize Defendants’ DDoS Services to target
`specific game servers for the DDoS Attacks. Among the game servers listed are
`the R6S Servers: “Rsix Lobby Crash Time 60 Sec 0.01 EUR” and “Rsix Lobby
`Freeze 180 Sec 0.01 EUR.” Also listed as potential targets are the game servers
`for other popular online multiplayer games such as Fortnite, FIFA 20, and MW4
`(Call of Duty: Modern Warfare 4).
`
`35. When executed, the DDoS Attacks flood the R6S Servers, overload its
`network, slow down the servers, and often cause a complete server crash,
`disconnecting all players engaged in an R6S match on the targeted server (and
`thereby ending their game prematurely). Even when the DDoS Attacks do not
`result in a server crash, however, they nonetheless disrupt and interfere with access
`to the R6S Servers. Defendants have weaponized these DDoS Attacks, providing
`
`13
`
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 14 of 24 Page ID #:14
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`some R6S players looking for an unfair advantage with the ability to cheat. By
`utilizing the DDoS Services to burden the R6S Servers – but not so much that the
`server crashes – Defendants’ DDoS Services can be used to create lag (or a slow
`response time from the R6S Servers) in the middle of a match. In addition to
`disrupting and interfering with regular gameplay, this can, and regularly does,
`frustrate legitimate players into quitting the match, while rewarding any remaining
`player with ranked points.
`36. Depicted below is a screenshot of an executed DDoS Attack sent
`through Defendants’ DDoS Services and the SNG.ONE Website, which Ubisoft
`tracked to an IP address associated with SNG.ONE.
`
`37. By offering, marketing, and providing their DDoS Services to active
`R6S players, Defendants have induced countless players to breach the Ubisoft
`TOU and Code of Conduct. Ubisoft also is informed and believes that Defendants
`have received substantial revenue from their distribution of, and sale of licenses to,
`the DDoS Services.
`In addition to providing the DDoS Services, Defendants provide
`38.
`extensive and ongoing customer support and technical assistance. On the
`SNG.ONE Website, Defendants advertise that “[w]e have multiple moderators
`
`14
`
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 15 of 24 Page ID #:15
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`with very good knowledge to help you out.” Defendants, including Doe
`Defendants operate and communicate via online chats maintained on the
`SNG.ONE Website or on the online “chat room” system known as “Discord.”
`Using anonymous online aliases, Defendants regularly communicate with
`customers of the DDoS Services on a variety of topics related to the DDoS
`Services.
`39. Defendants’ provision of the DDoS Services and repeated DDoS
`Attacks on Ubisoft’s computer systems, network, and servers disrupts, interferes
`with, and prevents R6S from operating properly. Moreover, in the case of a server
`or network crash, Defendants’ DDoS Attacks deny R6S’s legitimate and
`authorized users access to the R6S Servers, and more importantly, the game.
`Defendants’ provision of the DDoS Services, especially in the United States, has
`caused severe harm to Ubisoft, including irreparable damage to its customers’
`goodwill and trust.
`40. Defendants are well aware of the harm that the DDoS Services and
`DDoS Attacks cause to Ubisoft. Indeed, Defendants have gone out of their way to
`taunt and attempt to embarrass Ubisoft for the damage its services have caused to
`R6S. For example, a Twitter account operated by one or more of Defendants has
`repeatedly mocked Ubisoft’s security efforts, including Ubisoft’s efforts to ban
`individuals utilizing Defendants’ DDoS Services. 3 A screen capture of one
`instance of Defendants’ taunts is provided below:
`
`
`3 See Twitter, SNG.ONE, what else?,
`https://twitter.com/shortnamegame/status/1174436108911939584 (last accessed
`December 16, 2019).
`
`
`
`15
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 16 of 24 Page ID #:16
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Mitchell
`Silberberg &
`Knupp LLP
`
`
`
`41. Additionally, knowing that this lawsuit was likely imminent,
`Defendants have hastily sought to conceal evidence concerning their involvement,
`even going so far as to create and publish a fictional seizure notice on one of the
`websites used by Defendants (the “r6s.support website”). A screen capture of this
`fictional seizure notice, which, inter alia, falsely claimed that the domain had been
`seized by “Microsoft Inc. and Ubisoft Entertainment” pursuant to “Operation
`(D)DoS OFF[,]” is depicted below:
`
`Defendants have admitted that they created this fictional seizure notice “in order to
`get Ubisoft to admit that they have a problem.”
`
`16
`
`
`

`

`Case 2:20-cv-00478-DDP-AS Document 1 Filed 01/16/20 Page 17 of 24 Page ID #:17
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`42. Defendants and those working in concert with them have sought to
`unlawfully and unfairly enrich themselves by creating, selling, distributing,
`supporting, updating, and providing access to the DDoS Services, at the expense of
`Ubisoft, its legitimate customers, R6S, and the R6S community. Defendants’
`DDoS Attacks represent a