United States of America v. YEVGENIY ALEKSANDROVICH NIKULIN, AKA Chinabig01, AKA dex.007, AKA itBlackHat, AKA…

NOT FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES OF AMERICA,
Plaintiff-Appellee,
v.
YEVGENIY ALEKSANDROVICH
NIKULIN, AKA Chinabig01, AKA
dex.007, AKA itBlackHat, AKA
valeriy.krutov3,
Defendant-Appellant.
No. 20-10322
D.C. Nos.
3:16-cr-00440-WHA-1
3:16-cr-00440-WHA
MEMORANDUM*
Appeal from the United States District Court
for the Northern District of California
William Alsup, District Judge, Presiding
Argued and Submitted December 10, 2021
San Francisco, California
Before: MURGUIA, Chief Judge, and IKUTA and VANDYKE, Circuit Judges.
Defendant Yevgeniy Nikulin appeals a $1,734,000 restitution order and an
88-month sentence imposed following his convictions for various offenses based
FILED
DEC 22 2021
MOLLY C. DWYER, CLERK
U.S. COURT OF APPEALS
* This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.

-- 1 of 4 --

on computer intrusions affecting the companies LinkedIn, Formspring, and
Dropbox. We have jurisdiction under 28 U.S.C. § 1291.
Even assuming plain error review applies, the district court plainly erred in
awarding $1,734,000 in restitution based on the victims’ non-itemized, conclusory
summaries of their loss in unsworn letters. See United States v. Waknine, 543 F.3d
546, 556–57 (9th Cir. 2008); United States v. Tsosie, 639 F.3d 1213, 1221–23 (9th
Cir. 2011). Although trial testimony and logs submitted at trial showed the extent
of the victims’ responses to the computer intrusions, that evidence did not provide
a basis for determining the costs incurred by the victims in mounting those
responses. Because neither the victims’ letters nor other evidence submitted by the
government satisfied the requirement that the government provide “a complete
accounting of the losses to each victim” to “the extent practicable,” 18 U.S.C.
§ 3664(a), or provide “evidence or proof that all costs incurred were directly
related to” Nikulin’s offenses, Waknine, 543 F.3d at 556, the evidence was
insufficient to support a restitution award, id.
The district court’s conservative estimate that the victims’ losses exceeded
$550,000 based on evidence regarding the size of the victim companies, the nature
of their responses to the computer intrusions, and their statements of costs
associated with their responses, was a “reasonable estimate of loss, given the
2

-- 2 of 4 --

available information.” United States v. Tadios, 822 F.3d 501, 503 (9th Cir. 2016)
(citation omitted). Therefore, the district court did not err in applying a 14-level
sentencing enhancement under § 2B1.1 of the Guidelines. U.S.S.G. § 2B1.1.
Because the district court’s conservative estimate was supported by clear and
convincing evidence, any error in the district court’s standard of review was
harmless. See United States v. Wijegoonaratna, 922 F.3d 983, 990–91 (9th Cir.
2019).
Finally, the district court did not err in admitting evidence that the owner of
the chinabig01@gmail.com email address committed a fourth, uncharged computer
intrusion against the company Automattic. The evidence was admissible under
Rule 404(b) of the Federal Rules of Evidence to show identity, both because it
tended to prove that the hacker in the charged offenses was the person who
controlled chinabig01@gmail.com, and because it tended to establish Nikulin’s
distinctive modus operandi. See United States v. Romero, 282 F.3d 683, 688 (9th
Cir. 2002). Because the district court addressed any prejudice from this evidence
by giving a limiting jury instruction, the district court did not err in determining
3

-- 3 of 4 --

that the evidence’s probative value outweighed any potential prejudice. See Fed.
R. Evid. 403; Hayes v. Ayers, 632 F.3d 500, 514 (9th Cir. 2011).1
AFFIRMED in part; REVERSED in part.2
1 The government filed a motion to supplement the record with (1) a letter
providing notice of the government’s intent to admit evidence of the Automattic
intrusion under Rule 404(b) and (2) a message and attachment from defense
counsel proposing a jury instruction to address that evidence (Dkt. 24). This
motion is granted.
2 Each party will bear its own costs on appeal.
4

-- 4 of 4 --