ARIN Taking a Hard Line on Fraud Pays Off In Precedent-Setting Criminal Trial and Conviction

By Michael Abejuela – General Counsel, ARIN
and Stephen M. Ryan – Former ARIN General Counsel
and Sam C. Neel – Partner, McDermott Will & Emery LLP

This is a follow up to the prior blog post Taking a Hard Line on Fraud from May 2019.

Defendants’ Amir Golestan and His Company, Micfo, LLC, Pled Guilty in U.S. District Court to 20 Counts of Wire Fraud for Defrauding ARIN

As we noted in back in May 2019, federal prosecutors from the United States Attorney’s Office for the District of South Carolina announced their indictment of Amir Golestan and his company, Micfo, LLC, for defrauding ARIN. Although COVID-19 delayed the trial for years, it began on Monday, November 15, 2021, and ended on the second day when Mr. Golestan and Micfo pled guilty to all of the 20 counts charged. This was not a “plea agreement,” and Mr. Golestan and Micfo will be criminally sentenced, likely within the next couple of months.

John Sweeting, ARIN’s Chief Customer Officer, was the first witness in the trial. His testimony lasted almost an entire day, as he described ARIN, Internet protocol (“IP”) number resources, and the elaborate criminal scheme of bogus companies and false documents utilized by Mr. Golestan to defraud ARIN.

ARIN greatly appreciates the federal prosecutors and investigative agents of the FBI cracking down against Mr. Golestan and Micfo, whose elaborate scheme involved the use of sham “Channel Partner” companies to defraud not only ARIN, but also the entire Internet community. According to the prosecutors, “Golestan and Micfo fabricated the true nature of the Channel Partners, including creating false officers and deceptive websites for the businesses, which were in turn used to deceive ARIN and to fraudulently obtain IP address rights from ARIN.” The prosecutors charged that “through this scheme, Golestan and Micfo obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00.”

This federal indictment and criminal conviction—coming as it did after the conclusion of ARIN’s successful litigation and arbitration proceeding against Mr. Golestan and his sham corporations—sends an important message of deterrence to other parties contemplating fraudulent schemes to obtain or transfer Internet number resources: those who seek to defraud ARIN (or other Regional Internet Registries - RIRs) are subject to ruinous civil litigation, criminal charges, and ultimately, incarceration.

IPv4 address scarcity before and after “runout” led to increased attempts to fraudulently obtain IP addresses from ARIN (and other RIRs) and to the hijacking of addresses issued to other parties. In late 2018, ARIN uncovered Mr. Golestan’s elaborate scheme to defraud the Internet community of over 730,000 IPv4 addresses, and ARIN responded in accordance with community-developed policies and through legal means pursuant to those policies.

Detecting, Stopping, and Reporting International Criminal Activity Directed Against ARIN and Other Regional Internet Registries Is Ongoing

Most organizations obtain their address space from ARIN in good faith in accordance with the policies set out by the community, but occasionally organizations provide ARIN with fraudulent or inaccurate information in an attempt to obtain resources. ARIN has sound due diligence processes to review and reject resource requests, transfer requests, and changes of Points of Contact (POCs) that do not comply with community-developed policy. In cases where fraud is suspected and discovered, as in this case, ARIN will investigate and revoke resources if necessary, and, when appropriate, report suspected criminal behavior to the appropriate law enforcement agencies.

Apart from the Micfo case, ARIN has recently made an important criminal referral to authorities in its service region (and law enforcement agencies out-of-region) regarding an individual and his corporate entities that improperly sought addresses from ARIN. That matter involves the alleged improper obtaining of Internet number resources from other RIRs, but a careful review has also indicated that those resources are being utilized for illegal child pornography (Child Sexual Abuse Material - CSAM) and illegal gambling in ARIN’s service area (and elsewhere).

The Back Story: Mr. Golestan and Micfo Brought Aggressive Litigation Against ARIN In An Attempt To Stop ARIN and the US Government From Exposing the Fraud

Prior to the Government’s May 2019 indictment of Mr. Golestan and Micfo, Mr. Golestan adopted a baseless but aggressive legal posture against ARIN. After ARIN requested that the “Channel Partners” produce certain documents and explain their conduct—as required by ARIN policy—Mr. Golestan filed a lawsuit and an arbitration claim against ARIN. In retrospect, this legal attack on ARIN appears to reflect a strategy to make ARIN incur such significant legal costs and business disruptions in an attempt to dissuade the non–profit registry from enforcement.

First, Mr. Golestan—on behalf of his sham companies—filed a motion for a Temporary Restraining Order and Preliminary Injunction against ARIN in U.S. District Court, and demanded a hearing the following morning (the Friday just before Christmas in 2018). Despite the complexity of the issues presented, the presiding federal judge in the Eastern District of Virginia ruled on the spot for ARIN based on facts and information in letters ARIN had sent the defrauding parties. Second, Mr. Golestan’s sham companies also filed an Arbitration claim against ARIN pursuant to ARIN’s Registration Services Agreement (“RSA”), the first ever invocation of ARIN’s dispute resolution mechanism in two decades. In both the federal court and arbitration, without the help of law enforcement agencies, ARIN exposed an intricate multi-year scheme to fraudulently obtain resources from ARIN. Mr. Golestan obtained and utilized previously created shelf companies spread out across the nation and used aliases to conceal his identity, including providing ARIN with falsely notarized affidavits of officers who did not exist to induce ARIN to issue over 730,000 IPv4 addresses to 11 companies and to approve transfers and reassignments of these addresses. On the eve of having to answer under oath in a deposition ordered by the arbitrator, Mr. Golestan’s aggressive litigation position collapsed when he notified the arbitrator that he would invoke his 5th Amendment right not to testify during any deposition. On May 1, 2019, ARIN obtained a final and very favorable arbitration award, which allowed ARIN to revoke the IP resources held by the invented sham companies¹, and it required Mr. Golestan and his companies to pay ARIN $350,000 for some of ARIN’s out of pocket legal fees and costs associated with the matter.

The arbitration result and now criminal conviction set an important precedent to deter defrauding parties from similar schemes to improperly obtain or transfer IP resources and run up the cost of litigation to wear out ARIN.

¹Some of the resources sought and fraudulently obtained by Mr. Golestan had been transferred to bona-fide purchasers outside of the ARIN region before the fraud was discovered. ARIN chose not to interfere with or claw back the resources provided in those completed transactions.

ARIN Has Now Terminated Micfo’s RSA and Revoked Its Numbers Resources For Breach of the RSA.

As mentioned above, ARIN had already clawed back 532,000 of the fraudulently obtained addresses from Mr. Golestan’s sham “Channel Partners” in May 2019 prior to the Government’s indictment of Mr. Golestan and Micfo. The Government is now seeking forfeiture of IP address resource rights held by Micfo.

Further, subsequent to the completion of the criminal trial—and pursuant to the terms of the Micfo RSA with ARIN—ARIN terminated Micfo’s RSA on Tuesday, November 23, 2021, and thereby revoked all remaining address rights held by that now-convicted company. Those IP addresses will be held pending the Government’s forfeiture proceedings.

ARIN’s Due Diligence Will Continue Based on This Experience

ARIN’s Registration Services Department (“RSD”) staff reviews all requests for resources and address transfers, and every analyst on the team takes very seriously the responsibility of protecting our community’s number resources. In fact, RSD’s review of transfer requests by Micfo and one of Mr. Golestan’s sham companies (likely a mistake by Mr. Golestan) led to further analysis that unraveled the scheme. It was ARIN personnel who alerted the ARIN legal team to the problem, and ARIN’s lawyers were then able to move the investigation to a successful litigation conclusion. Ultimately, it was ARIN’s business practice of requiring notarized documents for allocation and transfer that provided an easy factual device to demonstrate fraud and intent to all three legal tribunals. False notarizations violate state civil and criminal laws, and using the Internet to send those falsely notarized documents likely violates federal laws as well.

What to Do If You Suspect Fraud

ARIN works to protect the registration rights of its IP address holders and to prevent the fraudulent transfer of IP address space. Our staff actively investigates suspected cases of fraud. If you have reason to believe a certain block of Internet number resources may have been inappropriately obtained from ARIN or improperly transferred, please submit a fraud report to us, and we will investigate it.

Recent blogs categorized under: Data Accuracy

• Micfo’s Amir Golestan Sentenced to 5 Years in Federal Prison for Defrauding ARIN
• ARIN’s Whois: What Data is Public Information and How Can it be Accessed?
• Why is ARIN Contacting Me about My Info in Whois?
• Working Together to Prevent Number Resource Fraud