Taking a Hard Line on Fraud

By Stephen M. Ryan – Former ARIN General Counsel
and Sam C. Neel – Partner, McDermott Will & Emery LLP

***Updated on May 16, 2019***

UPDATE:  Federal Prosecutors Charge Amir Golestan and His Company, Micfo, LLC, for Defrauding ARIN

On May 15, 2019, federal prosecutors from the United States Attorney’s Office for the District of South Carolina announced their indictment of Amir Golestan and his company, Micfo, LLC, for defrauding ARIN.  ARIN greatly appreciates the U.S. Government cracking down against Mr. Golestan and Micfo, whose elaborate scheme involved the use of sham “Channel Partner” companies to defraud not only ARIN but also the entire Internet community.  According to the prosecutors, “Golestan and Micfo fabricated the true nature of the Channel Partners, including creating false officers and deceptive websites for the businesses, which were in turn used to deceive ARIN and to fraudulently obtain IP address rights from ARIN.”  The prosecutors charged that “through this scheme, Golestan and Micfo obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00.”

This federal indictment—coming just after the conclusion of ARIN’s successful litigation and arbitration against Mr. Golestan and his sham corporations—sends an important message to other parties contemplating fraudulent schemes to obtain or transfer Internet resources:  those who seek to defraud ARIN are putting themselves at risk of civil and criminal litigation.

***

An emergent IPv4 transfer market and IPv4 address scarcity have led to increased attempts to fraudulently obtain IP addresses. In late 2018, ARIN uncovered an elaborate scheme to defraud the Internet community of approximately 735,000 IPv4 addresses, and ARIN responded in accordance with community-developed policies and through legal means pursuant to those policies. ARIN is committed to protecting the resources entrusted to us.  We recently issued a press release regarding the outcome of a landmark case in which our due diligence led to the successful revocation of all misappropriated IP addresses.

Intentional Fraud By A Few Bad Apples

Most organizations obtain their address space from ARIN in good faith according to the policies set out by the community, but occasionally organizations provide ARIN with fraudulent or inaccurate information in an attempt to obtain resources. ARIN has sound due diligence processes to review and reject resource requests, transfer requests, and changes of POC’s that do not comply with community-developed policy. In cases where suspected fraud has already occurred, ARIN will investigate and revoke resources if necessary. ARIN counsel reports suspected criminal behavior to the appropriate law enforcement agencies.

Exposing This Fraud

In the case just completed, the entities that defrauded ARIN adopted an aggressive posture after ARIN requested that it produce certain documents and explain its conduct—as required by ARIN policy—as they filed a motion for a Temporary Restraining Order and Preliminary Injunction against ARIN in U.S. District Court, and demanded a hearing the following morning (the Friday just before Christmas). The U.S. District Court Judge ruled for ARIN based on facts and information in letters ARIN had sent the defrauding entities. Simultaneously, the defrauding entities also filed an Arbitration claim against ARIN pursuant to ARIN’s Registration Services Agreement (“RSA”), the first ever invocation of ARIN’s dispute resolution mechanism. In both the federal court and Arbitration, ARIN exposed an intricate multi-year scheme to fraudulently obtain resources from ARIN. The individual who controlled the entities obtained and utilized previously created shelf companies spread out across the nation and used aliases to conceal his identity, including providing ARIN with falsely notarized affidavits of officers who did not exist to induce ARIN to issue approximately 735,000 IPv4 addresses to 11 companies and approve transfers and reassignments of these addresses. On the eve of having to answer under oath in depositions ordered by the Arbitrator, their litigation position collapsed when the defrauding party notified the Arbitrator that he would rely on his right to not testify by invoking the 5th Amendment to the U.S. Constitution. On May 1, 2019, ARIN obtained a final and very favorable arbitration award, which allows ARIN to revoke all of the resources held by the defrauding entities, and it required the defrauding party to pay ARIN $350,000 for ARIN’s legal fees and costs associated with the matter. This case sets an important precedent to deter defrauding parties from similar schemes to improperly obtain or transfer IP resources.

Some of the resources sought and fraudulently obtained had been transferred to bona-fide purchasers out of the ARIN region. ARIN has not interfered with the recipients of those completed transactions. The defrauding party also used the Waiting List policy to obtain resources before issuance of IPv4 addresses under the policy was suspended.

ARIN’s Due Diligence

ARIN’s Registration Services Department (“RSD”) staff reviews all requests for resources and address transfers, and every analyst on the team takes the responsibility of protecting our community’s number resources very seriously. In fact, RSD’s review of requested transfers by the defrauding party (likely a mistake by the individual) led to further analysis that unraveled the scheme. It was ARIN personnel who alerted the ARIN legal team to the problem, and ARIN’s lawyers were then able to move the investigation to a successful litigation conclusion. As a former Federal prosecutor, I was impressed with the skillful design and tradecraft used in  the fraud. Ultimately, it was ARIN’s practice of requiring notarized documents for allocation and transfer that gave us an easy factual device to demonstrate fraud and intent to both tribunals. False notarizations violate state civil and criminal laws, and using the Internet to send those falsely notarized documents likely violate federal laws as well.

What to Do If You Suspect Fraud

ARIN works to protect the registration rights of its IP address holders and to prevent the fraudulent transfer of IP address space. Our staff actively investigates suspected cases of fraud. If you have reason to believe a certain block of Internet number resources may have been inappropriately obtained from ARIN or improperly transferred, please submit a fraud report to us, and we will investigate it.

Recent blogs categorized under: Data Accuracy

• Micfo’s Amir Golestan Sentenced to 5 Years in Federal Prison for Defrauding ARIN
• ARIN Taking a Hard Line on Fraud Pays Off In Precedent-Setting Criminal Trial and Conviction
• ARIN’s Whois: What Data is Public Information and How Can it be Accessed?
• Why is ARIN Contacting Me about My Info in Whois?