Facebook Inc V Nguyen Et Al Candce-21-05002 0001.0

Case 3:21-cv-05002 Document 1 Filed 06/29/21 Page 1 of 35
1 HUNTON ANDREWS KURTH LLP

Ann Marie Mortimer (State Bar No. 169077)
2
amortimer@HuntonAK.com
3 Jason J. Kim (State Bar No. 221476)
4 kimj@HuntonAK.com
Jeff R. R. Nelson (State Bar No. 301546)
5 jnelson@HuntonAK.com
6 550 South Hope Street, Suite 2000
Los Angeles, California 90071-2627
7 Telephone: (213) 532-2000
8 Facsimile: (213) 532-2020
9 Attorneys for Plaintiff

10 FACEBOOK, INC.
11
UNITED STATES DISTRICT COURT

550 South Hope Street, Suite 2000
Hunton Andrews Kurth LLP
12
NORTHERN DISTRICT OF CALIFORNIA
13
OAKLAND/SAN FRANCISCO DIVISION
14
CASE NO.: 3:21-CV-05002
15 FACEBOOK, INC., a Delaware
corporation, COMPLAINT; DEMAND FOR JURY
16
TRIAL
17 Plaintiff,
18 v.
19 THÊM NGUYỄN, also known as
20 “Thêm Hữu Nguyễn;” LÊ KHANG;
NGUYỄN QUỐC BẢO; and PHAM
21 HỮU DUNG also known as “Dung
22 Ma,”
23 Defendants.
24
25
26
27
28
3:21-CV-05002
COMPLAINT; DEMAND FOR JURY TRIAL
1 Plaintiff Facebook, Inc. alleges the following:

2 INTRODUCTION
3 1. Beginning no later than October 2020 and continuing to at least June
4 2021, Defendants took control of user accounts on Facebook in order to run millions
5 of dollars of ads. Defendants misused cookies to take control of the accounts, a
6 technique known as “session or cookie theft,” and targeted employees of advertising
7 and marketing agencies, which had access to large corporate ad accounts. To execute
8 on their scheme, Defendants first misled the victims into self-compromising their user
9 accounts by causing them to install a mobile app from the Google Play Store
10 deceptively called “Ad Manager for Facebook” (the “malicious app”) that was not
11 actually affiliated with Facebook. When victims installed the malicious app, they
12 shared their Facebook account login credentials and made accessible other
13 information, which Defendants then used to access their Facebook accounts and run
14 ads without the victims’ knowledge or consent. Defendants ran at least $36 million in
15 unauthorized ads, which Facebook reimbursed to the victims once it discovered the
16 unlawful scheme.
17 2. Defendants’ scheme is known as an “account takeover attack” and
18 originated from Vietnam. Account takeovers fuel fraud because compromised
19 accounts can be used to engage in different types of illicit conduct. According to
20 online sources, these attacks have been on the rise across all industries and cost online
21 businesses and consumers in the United States billions of dollars in losses annually.
22 Approximately 50% of these attacks originate from Asia, with Vietnam as one of the
23 leading sources of attacks from the region in 2020. See
24 https://www.globenewswire.com/en/news-release/2021/02/09/2172197/0/en/New-
25 Data-from-Arkose-Labs-Shows-Increased-Fraud-Across-All-Industries-Since-Black-
26 Friday-with-Gift-Card-Fraud-and-Account-Takeover-Attacks-Surging.html;
27 http://secdev-foundation.org/wp-content/uploads/2015/07/FacebookHackingan-
28 EpidemicinVietnam.pdf; and
1 3:21-CV-05002
1 https://www.buzzfeednews.com/article/craigsilverman/facebook-ad-scams-revenue-
2 china-tiktok-vietnam.
3 3. Facebook brings this action for injunctive relief to stop Defendants’
4 conduct in violation of Facebook’s Terms of Service and U.S. law. Facebook also
5 brings this action to obtain compensatory, punitive, and exemplary damages in
6 response to Defendants’ violations of California Comprehensive Computer Data
7 Access and Fraud Act, Cal. Penal Code § 502, the Computer Fraud and Abuse Act, 18
8 U.S.C. § 1030, and breach of contract.
9 PARTIES
10 4. Plaintiff Facebook, Inc., is a Delaware corporation with its principal
11 place of business in Menlo Park, California. Facebook owns and operates several
12 products, including Instagram.

13 5. Defendant Thêm Nguyễn, also known as “Thêm Hữu Nguyễn,” is a
14 resident of Hanoi, Vietnam. As part of the scheme, Thêm Nguyễn used cookie theft to
15 obtain access to Facebook accounts and run ads for some of his own e-commerce sites
16 that sold t-shirts, mugs, and other merchandise, including dragonwtee88.com, and
17 delphine.family.
18 Figure 1: Defendant Thêm Nguyễn
19
20
21
22
23
24
25
26
27
28
2 3:21-CV-05002
1 6. Defendant Lê Khang is a resident of Hanoi, Vietnam. Lê Khang used

2 multiple online aliases, including “Lạc Lối,” “Lê Minh,” “Nụ Cười Của Nắng,” and
3 “Niken Trần.” Lê Khang maintained a public GitHub account with the username
4 “khangle0608.” As part of the scheme, Lê Khang used multiple email addresses to
5 compromise accounts and conceal his true identity, including
6 sorrylove0410@gmail.com. Lê Khang was a programmer and developer of the
7 malicious app.
8 Figure 2: Defendant Le Khang
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
3 3:21-CV-05002
1 7. Defendant Nguyễn Quốc Bảo is a resident of Hanoi, Vietnam. As part of

2 the scheme, Nguyễn Quốc Bảo changed the phone number on at least one of the
3 victim’s accounts to phone number 84945066666 in order to avoid detection and
4 maintain control of the account. Nguyễn Quốc Bảo collected access information from
5 users that self-compromised their user accounts after installing the malicious app.
6 Nguyễn Quốc Bảo also ran unauthorized ads on Facebook and Instagram.
7 Figure 3: Nguyễn Quốc Bảo
8
9
10
11
12
13
14
15
8. Defendant Pham Hữu Dung, also known as “Dung Ma,” is a resident of
16
Hanoi, Vietnam. As part of the scheme, Pham Hữu Dung ran unauthorized
17
advertisements on Facebook and Instagram. Pham Hữu Dung also used the online
18
alias “Ghost Agency” to promote the rental of compromised accounts on Facebook.
19
Figure 4: Pham Hữu Dung
20
21
22
23
24
25
26
27
28
4 3:21-CV-05002
1 JURISDICTION AND VENUE

2 9. The Court has federal question jurisdiction over the federal causes of
3 action alleged in this complaint pursuant to 28 U.S.C. § 1331.
4 10. The Court has supplemental jurisdiction under 28 U.S.C. § 1367 over the
5 state law causes of action alleged in this complaint because they arise out of the same
6 nucleus of operative fact as Facebook’s federal claims.
7 11. In addition, the Court has jurisdiction under 28 U.S.C. § 1332 over all
8 causes of action alleged in this complaint because complete diversity exists and the
9 amount in controversy exceeds $75,000.
10 12. Defendants used and controlled multiple Facebook accounts and thereby
11 agreed to Facebook’s Terms of Service and Commercial Terms. The Court has
12 personal jurisdiction over Defendants because Facebook’s Terms of Service and

13 Commercial Terms contain a forum selection clause that requires this Complaint be
14 brought in the U.S. District Court for the Northern District of California or a state
15 court located in San Mateo County, and that Defendants submit to the personal
16 jurisdiction of either of those courts for litigating this matter.
17 13. The Court also has personal jurisdiction over Defendants because they
18 knowingly directed and targeted their conduct at California and at Facebook, which
19 has its principal place of business in California. By accessing and using Facebook,
20 and running ads on Facebook and Instagram, Defendants transacted business and
21 engaged in commerce in California. In addition to Facebook, Defendants knowingly
22 used a California-based business to further their fraud scheme. Facebook’s claims
23 arise directly from and relate to Defendants’ activities described in this Complaint and
24 activities in and directed at California.
25 14. Venue is proper in this judicial district pursuant to 28 U.S.C. § 1391(b),
26 as the threatened and actual harm to Plaintiff occurred in this District. Venue is also
27 proper with respect to each Defendant pursuant to 28 U.S.C. §1391(c)(3) because
28 none of them reside in the United States.
5 3:21-CV-05002
1 15. Pursuant to Civil L.R. 3-2(c), this case may be assigned to either the San
2 Francisco or Oakland division because Facebook is located in San Mateo County.
3 FACTUAL ALLEGATIONS
4 A. Background on Facebook and Instagram
5 16. Plaintiff owns and operates Facebook, a social networking website and
6 mobile application that enables its users to create their own personal profiles and
7 connect with each other on their personal computers and mobile devices. As of March
8 2021, Facebook daily active users averaged 1.88 billion and monthly active users
9 averaged 2.85 billion.
10 17. Plaintiff also owns and operates Instagram, which is a photo and video
11 sharing app. Instagram users can upload photos and videos to Instagram and share
12 them.
13 18. Anyone with a Facebook or Instagram account can create and place ads
14 on Facebook and Instagram. An ad account and a Facebook Page are used to run ads
15 on Instagram and Facebook. A Facebook Page is a public page on Facebook designed
16 for businesses, organizations, and public figures. Only a Facebook user can create or
17 manage a Facebook Page.
18 19. Facebook Business Manager is a tool that helps Facebook users organize
19 and manage multiple Facebook ad accounts and Pages, and run and track
20 advertisements. A Business Manager account is required to use the Business Manager
21 tool. Only a Facebook user can create a Business Manager account.
22 20. Users of a Business Manager account can have different roles, including
23 “Employee” or “Admin.” A user with Employee access to the Business Manager
24 account can only work on ad accounts to which they are assigned. A user with
25 Administrator access has full control of accounts that are part of the Business
26
27
28
6 3:21-CV-05002
1 Manager account. Only Facebook users with the role of Administrator can add other
2 Facebook users to the Business Manager.
3 B. Facebook’s Terms of Service
4 21. All Facebook users must agree to Facebook’s Terms of Service
5 (“Terms”) (available at https://www.facebook.com/terms.php) and other rules that
6 govern access to, and use of, Facebook. Those Terms include the Advertising and
7 Page Policies and Commercial Terms.
8 22. Section 3.2.1 of the Terms prohibits users from “do[ing] . . . anything
9 unlawful, misleading, [ ] or fraudulent” or facilitating or supporting others in doing so.
10 23. Section 3.2.3 of the Terms prohibits users from “access[ing] or
11 collect[ing] data from [Facebook] Products using automated means (without our prior
12 permission) or attempt[ing] to access data you do not have permission to access.”

13 24. Advertising Policy 4.13 (available at
14 https://www.facebook.com/policies/ads/) prohibits “ads, landing pages, and business
15 practices” from “contain[ing] deceptive, false, or misleading content, including
16 deceptive claims, offers, or methods.”
17 25. Advertising Policy 4.32 prohibits ads that “promote products, services,
18 schemes or offers using deceptive or misleading practices.”
19 C. Defendants Agreed to Facebook’s Terms of Service
20 26. At all times relevant to this Complaint, Defendants accepted and were
21 bound by Facebook’s Terms.
22 27. Between November 24, 2007 and June 15, 2021, Defendant Thêm
23 Nguyễn used and controlled at least nine Facebook user accounts, and multiple Pages,
24 Business Manager accounts, and ad accounts.
25 28. Between February 11, 2015 and June 15, 2021, Defendant Lê Khang
26 used and controlled at least five Facebook user accounts, and multiple Pages, Business
27 Manager accounts, and ad accounts.
28
7 3:21-CV-05002
1 29. Between March 21, 2009 and June 15, 2021, Defendant Nguyễn Quốc
2 Bảo used and controlled at least six Facebook user accounts, and multiple Pages,
4 30. Between August 13, 2011 and June 15, 2021, Defendant Pham Hữu
5 Dung used and controlled at least six Facebook user accounts, and multiple Pages,
7 D. Defendants’ Scheme
8 1. Overview
9 31. Beginning no later than October 2020, Defendants engaged in an account
10 takeover attack targeting Facebook and its users. Defendants’ scheme proceeded as
11 follows:
12 a. First, Defendants developed and distributed a malicious app

13 designed to trick victims into self-compromising their Facebook accounts.
14 b. Second, Defendants promoted the malicious app on the Google
15 Play Store. When a user installed the malicious app, the user was prompted to enter
16 their Facebook user account credentials and self-compromised their account.
17 c. Third, through the malicious app, Defendants misappropriated
18 users’ Facebook cookies, which include authentication information from the victim’s
19 device, and used them to take over the victim’s Facebook account. Once Defendants
20 gained unauthorized access to a victim’s Facebook account, Defendants used the
21 account to add other unauthorized users to the victim’s Business Manager account.
22 Those unauthorized users were given Administrator level access to the Business
23 Manager account, which enabled them to run ads and use existing credit lines.
24 d. Fourth, Defendants ran thousands of ads on Facebook and
25 Instagram. Defendants ran ads that redirected Facebook and Instagram users to
26 various ecommerce sites promoting the sale of different merchandise, including print-
27 on-demand merchandise from sites controlled by Defendant Thêm Nguyễn (e.g.,
28 customizable products like mugs and t-shirts printed at the time an order is placed).
8 3:21-CV-05002
1 Defendants spent at least $36 million in unauthorized advertising, which was charged
2 to the victims’ business credit lines. Facebook reimbursed the Defendants’ victims for
3 Defendants’ unauthorized advertising activity.
4 2. Development, Distribution, and Promotion of the Malicious
5 App
6 32. On or about December 28, 2020, Defendant Lê Khang developed and
7 distributed a malicious app named “Ads Manager” on the Google Play Store. On or
8 about January 7, 2021, Defendant Lê Khang changed the name of the malicious app to
9 “Ads Manager for Facebook.” The developer of the malicious app was listed as
10 “Pages Manager For Facebook,” and it listed an email address used by Lê Khang:
11 sorrylove0410@gmail.com. Id.
12 33. Defendants tricked victims into installing the malicious app by

13 misrepresenting the malicious app on the Google Play Store, portraying it as a
14 legitimate alternative to Facebook’s real Ad Manager tool:
15 Why sacrifice your privacy or an awesome user experience when you can
16 have both? With us, the best Facebook alternative—lightweight, highly
17 customizable, and battery friendly, with a strict “no tracking” policy to
18 ensure your privacy is secured. . . . That’s why us is (sic) your answer—
19 with a robust day/night theming (sic) engine, Messages access built-in
20 (Chat Heads included), customizable widget for your notifications and
21 messages, as well as an ad blocker to filter out the noise, you’ll find lots to
22 love. Stay connected with your campaigns, no matter where you are.
23 Create, edit and get insights from ads across the entire Facebook family of
24 apps, including Facebook.
25 In fact, the malicious app was not affiliated with Facebook or Facebook’s legitimate
26 Ad Manager tool.
27 34. According to the Google Play Store, between December 2020 and May
28 2021, the malicious app was installed more than 10,000 times.
9 3:21-CV-05002
1 35. Starting on or about December 28, 2020, Defendants ran advertisements

2 on Facebook that promoted the malicious app as a solution for managing and
3 optimizing mobile ads. Exs. 1–3. The ads were directed at users in the United States,
4 Europe, Brazil, and India. For example, as shown in Figure 5, on December 31, 2020,
5 Defendants advertised the malicious app on Facebook and directed the advertisement
6 at users in India:
7 Figure 5: Defendants’ Advertised Their Malicious App
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23 36. Between December 28, 2020, and January 2, 2021, Defendants
24 advertised the malicious app and approximately 1,700 users clicked on the ad.
25 37. Defendants designed the malicious app to trick users to self-compromise
26 their Facebook account, and allow Defendants to access and take over those accounts
27 to run ads.
28
10 3:21-CV-05002
1 38. After victims installed the malicious app, they were prompted to enter
2 their Facebook user credentials and authenticate their Facebook access. The user’s
3 credentials were communicated to Facebook’s computers, which returned cookies
4 with authentication information (collectively, “access information”) for the user.
5 Defendants originally designed the malicious app to send the victim’s access
6 information to a computer (Internet Protocol address 45.76.183.4) controlled by
7 Defendants. A version of the malicious app published after January 2021 was
8 designed to return the victim’s access information to a group chat thread on Telegram
9 (BotID: 1493839902). Defendants used the access information obtained from the
10 malicious app to access and submit requests to Facebook accounts, falsely
11 representing themselves as the legitimate Facebook user to Facebook computers.
12 39. For example, on or about January 21, 2021, Defendants tricked a

13 Facebook user located in India, who had Administrator access to a Business Manager
14 account, to install the malicious app. Defendants then accessed the victim’s Facebook
15 account and Business Manager account using the access information collected through
16 the malicious app. Defendants used the stolen account information to access the
17 user’s Facebook account and Business Manger account, which was unauthorized.
18 3. Unauthorized Activity and Advertisements Using
19 Compromised Accounts
20 40. Defendants used their unauthorized access to run approximately 10,000
21 ads on Facebook and Instagram.
22 41. Defendants also offered compromised accounts for rent to other
23 Facebook users. For example, as shown in Figure 61, in a March 16, 2021 post on
24 Facebook, Defendant Dung Ma offered users in Vietnam the ability to rent access to
25 compromised accounts to promote products through live video ads.
26
27
28
1
Figure 6 was translated from Vietnamese to English.
11 3:21-CV-05002
1 Figure 6: Defendants Offer Rental Access to Compromised Accounts
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 42. The unauthorized ads promoted the sale of print-on-demand and other
21 merchandise on third-party websites, including dragonwtee88.com, delphine.family,
22 biglovetee.com, coolprintusa1.com, and lion-print.net and were directed at Facebook
23 and Instagram users around the world, including users in the United States, Europe,
24 and Vietnam. Defendant Thêm Nguyễn used and controlled the dragonwtee88.com
25 and delphine.family sites to sell print-on-demand merchandise. For example:
26 a. On or about January 22, 2021, Defendants used a compromised
27 account to publish and cause to be published the unauthorized ad shown in Figure 7
28 and directed it at users in the United States. Users that clicked on the ad were
12 3:21-CV-05002
1 redirected to the website dragonwtee88.com, which was a website controlled by

2 Defendant Thêm Nguyễn to sell t-shirts.
3 Figure 7: Defendants’ Unauthorized January 22, 2021 Ad on Facebook
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 b. On or about January 24, 2021, Defendants used a compromised
22 account to publish and cause to be published the unauthorized live video ad shown in
23 Figure 82 below on Facebook and directed it at users in Vietnam and India. Users
24 clicked on this ad 54 times.
25
26
27
28
2
Figure 8 was translated from Vietnamese to English.
13 3:21-CV-05002
1 Figure 8: Defendants’ Unauthorized January 24, 2021, Ad on Facebook
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 c. On or about January 29, 2021, Defendants used a compromised
22 account to publish and cause to be published the unauthorized ad shown in Figure 9
23 on Facebook and Instagram, and directed it at users in the United States, Canada,
24 Europe, and Australia. Users clicked on this ad over 20,000 times and were redirected
25 to the website tacuviss.com.
26
27
28
14 3:21-CV-05002
1 Figure 9: Defendants’ Unauthorized January 29, 2021, Ad on Instagram
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 d. Defendants published and caused to be published ads that
20 promoted online scams. For example, on January 24, 2021, Defendants used a
21 compromised account to publish the unauthorized ad shown in Figure 10. The ad was
22 directed at users in the United States and was clicked on over 100,000 times. Users
23 that clicked on this add were redirected to bestsellingus.store. According to user
24 complaints, users that paid for the advertised product did not receive the LED lights or
25 they received a product that did not work as advertised.
26
27
28
15 3:21-CV-05002
1 Figure 10: Defendants’ Unauthorized January 24, 2021, Ad on Facebook
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 43. The unauthorized ads were billed to various victims’ ad accounts.
21 Facebook reimbursed the victims approximately $36 million for unauthorized ads
22 published using those accounts.
23 E. Facebook’s Enforcement Efforts
24 44. On June 16, 2021, as a result of its investigative efforts, Facebook
25 identified that Defendant Nguyễn Quốc Bảo had obtained access to a Business
26 Manager account through an account takeover attack, which Defendants then accessed
27 without authorization. The Business Manager account managed over 150 ad accounts.
28 Facebook identified and disabled several user accounts that Defendants controlled and
16 3:21-CV-05002
1 that had been added to the Business Manager account and notified the victim.
2 Facebook disabled the accounts before Defendants were able to run any unauthorized
3 ads.
4 45. On June 25, 2021, Facebook took various technical enforcement
5 measures against Defendants, including disabling Facebook and Instagram accounts
6 created or controlled by Defendants. Google also removed the malicious app from the
7 Google Play Store in May 2021.
8 F. Defendants Unjustly Enriched Themselves and Their Unlawful Acts
9 Have Caused Damage and a Loss to Facebook
10 46. In 2020 and 2021, Defendants used their illicit proceeds to throw parties,
11 purchase luxury vehicles, business class travel, dinners, tattoos, and other spending.
12 Defendants then bragged about their extravagant purchases online:

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
17 3:21-CV-05002
1 Figure 11: Post of Nguyễn Quốc Bảo with Multiple Apple iPhones – October 13, 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
18 3:21-CV-05002
1 Figure 12: Post of Nguyễn Quốc Bảo on Yacht – December 30, 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Figure 13: Post of the Defendants Dining Together (Thêm Nguyễn, Nguyễn Quốc Bảo, and
17 Pham Hữu Dung) – November 27, 2020
18
19
20
21
22
23
24
25
26
27
28
19 3:21-CV-05002
1 Figure 14: Post of Nguyễn Quốc Bảo

Traveling Business Class to Hanoi - December 30, 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
20 3:21-CV-05002
1 Figure 15: Post of Defendant Thêm Nguyễn

posing with a new Mercedes-Benz – March 29, 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
21 3:21-CV-05002
1 Figure 16: Post of Nguyễn Quốc Bảo’s Mercedes-Benz E-Class – November 29, 2020
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
22 3:21-CV-05002
1 Figure 17: Post of Pham Hữu Dung

Displaying Expensive Tattoos and Watch – February 26, 2021
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 47. Defendants interfered with Facebook’s computer network and service,
19 and they have negatively impacted the Facebook experience for users and advertisers
20 whose accounts were affected by their fraud.
21 48. Defendants’ breaches of Facebook’s Terms, as well as their violations of
22 state and federal law, have injured Facebook’s reputation, public trust, and goodwill.
23 49. Facebook suffered damages and a loss attributable to Defendants,
24 including the efforts and resources it has used to prepare this Complaint, investigate,
25 mitigate, and remediate Defendants’ illegal conduct, reimburse victims for
26 unauthorized advertisements, and attempt to identify, analyze, and stop their injurious
27 activities in an amount to be determined at trial, but not less than $36 million.
28
23 3:21-CV-05002
1 50. Defendants have been unjustly enriched by their activities at the expense
2 of Facebook in an amount to be determined at trial, but not less than $36 million.
3 FIRST CAUSE OF ACTION
4 (Breach of Contact)
5 51. Facebook incorporates all other paragraphs as if fully set forth herein.
6 52. Access to and use of Facebook’s services is governed by Facebook’s
7 Terms and its related policies.
8 53. Defendants agreed to and became bound by Facebook’s Terms and
9 related policies through their use of Facebook and its services.
10 54. Facebook has performed all conditions, covenants, and promises required
11 of it in accordance with its agreement with Defendants.
12 55. Defendants knowingly breached Facebook’s Terms and Advertising and

13 Page Policies. Defendants violated Facebook’s Terms sections 3.2.1 and 3.2.3 by (a)
14 accessing and using other Facebook user’s accounts without authorization or
15 permission; (b) collecting users’ access information using the malicious app; (c)
16 publishing ads that promoted the malicious app as a legitimate alternative to
17 Facebook’s Ad Manager tool; and (d) publishing and causing the publication of
18 thousands of unauthorized ads on Facebook and Instagram.
19 56. Defendants violated Advertising Policies 4.13 and 4.32 by running
20 deceptive and misleading ads that promoted the installation of Defendants’ malicious
21 app.
22 57. Defendants’ violations of Facebook’s Terms have directly and
23 proximately caused harm and injury to Facebook.
24 58. When Defendants agreed to and became bound by Facebook’s Terms,
25 both Facebook and Defendants knew or reasonably could have foreseen that the harm
26 and injury to Facebook was likely to occur in the ordinary course of events because of
27 Defendants’ breach.
28
24 3:21-CV-05002
1 59. Defendants’ breaches of Facebook’s Terms have caused Facebook

2 damages in an amount to be determined at trial, but not less than $36,000,000.
3 SECOND CAUSE OF ACTION
4 (California Penal Code § 502)
6 61. Defendants knowingly accessed and without permission used Facebook’s
7 data, computers, computer system, and computer network in order to (A) devise or
8 execute any scheme or artifice to defraud and deceive, and (B) to wrongfully control
9 or obtain money, property, or data, in violation of California Penal Code § 502(c)(1).
10 62. Defendants knowingly and without permission used or caused to be used
11 Facebook’s computer services in violation of California Penal Code § 502(c)(3).
12 63. Defendants, using Facebook access information obtained from the

13 malicious app, knowingly and without permission accessed or caused to be accessed
14 Facebook’s computers, computer systems, and/or computer networks in violation of
15 California Penal Code § 502(c)(7).
16 64. Because Facebook suffered damages and a loss as a result of Defendants’
17 actions, Facebook is entitled to compensatory damages, attorneys’ fees, and any other
18 amount of damages to be proven at trial, and injunctive relief under California Penal
19 Code § 502(e)(1) and (2)
20 65. Because Defendants willfully violated Section 502, and there is clear and
21 convincing evidence that Defendants committed “fraud” as defined by Section 3294
22 of the Civil Code, Facebook entitled to punitive and exemplary damages under
23 California Penal Code § 502(e)(4).
24 THIRD CAUSE OF ACTION
25 (Computer Fraud and Abuse Act, 18 U.S.C. § 1030)
27 67. Facebook computers and servers are protected computers as defined by
28 18 U.S.C. § 1030(e)(2).
25 3:21-CV-05002
1 68. Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and

2 with intent to defraud, accessed Facebook’s protected computers and by means of
3 such conduct furthered the intended fraud and obtained something of value.
4 Defendants’ fraud included accessing Facebook user accounts without authorization
5 and running unauthorized advertisements using those accounts while representing to
6 Facebook that they were authorized to access and use those accounts.
7 69. Defendants violated 18 U.S.C. § 1030(b) by attempting and conspiring to
8 commit the violations alleged in the preceding paragraph.
9 70. Defendants’ conduct caused a loss to Facebook of at least $5,000 during
10 a one-year period.
11 71. Defendants’ actions caused Facebook to incur a loss and suffer damages
12 as defined by 18 U.S.C. § 1030(e)(8) and (11), including the expenditure of resources

13 to investigate and respond to Defendants’ fraudulent scheme in an amount to be
14 proven at trial.
15 REQUEST FOR RELIEF
16 WHEREFORE, Plaintiff Facebook requests judgment against Defendants as
17 follows:
18 1. That the Court enter judgment against Defendants that Defendants have:
19 a. Violated the Computer Fraud and Abuse Act, in violation of
20 18 U.S.C. 1030;
21 b. Violated the California Comprehensive Computer Data Access and
22 Fraud Act, in violation of California Penal Code § 502; and
23 c. Breached their contracts with Facebook in violation of California law.
24 2. That the Court enter a permanent injunction enjoining and restraining
25 Defendants and their agents, employees, successors, and assigns, and all other persons
26 acting in concert with or conspiracy with Defendants or affiliated with them from:
27 a. Accessing or attempting to access Facebook’s platform and computer
28 systems;
26 3:21-CV-05002
1 b. Engaging in any activity that disrupts, diminishes the quality of,

2 interferes with the performance of, or impairs the functionality of
3 Facebook’s platform and computer system, including developing
4 malware that targets Facebook;
5 c. Engaging in any activity that violates Facebook’s Terms, or facilitating
6 others to do the same;
7 d. Engaging in activity that violates the Computer Fraud and Abuse Act
8 (18 U.S.C. § 1030) or the California Comprehensive Computer Data
9 Access and Fraud Act (California Penal Code § 502).
10 3. That Facebook be awarded damages, including, but not limited to,
11 compensatory and punitive damages, as permitted by law and in such amounts to be
12 proven at trial, but not less than $36,000,000.

13 4. That Facebook be awarded its reasonable costs, including reasonable
14 attorneys’ fees.
15 5. That Facebook be awarded pre- and post-judgment interest as allowed by
16 law.
17 That the Court grant all such other and further relief as the Court may deem just
18 and proper.
19
20 Dated: June 29, 2021 HUNTON ANDREWS KURTH LLP
21
22
By: /s/ Ann Marie Mortimer
23 Ann Marie Mortimer
24 Jason J. Kim
Jeff R. R. Nelson
26 FACEBOOK, INC.
Platform Enforcement and Litigation
27 Facebook, Inc.
28 Jessica Romero
Michael Chmelar
27 3:21-CV-05002
1 DEMAND FOR JURY TRIAL

2 Plaintiff hereby demands a trial by jury on all issues triable to a jury.
3
4 Dated: June 29, 2021 HUNTON ANDREWS KURTH LLP
5
6
By: /s/ Ann Marie Mortimer
7 Ann Marie Mortimer
8 Jason J. Kim
Jeff R. R. Nelson
10 FACEBOOK, INC.
11 Platform Enforcement and Litigation

12 Facebook, Inc.
Jessica Romero
13 Michael Chmelar
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
073923.0000069 EMF_US 85677429v5

28 3:21-CV-05002
EXHIBIT 1
ase 3:21-cv-05002 Document 1 Filed 06/29/21 Page 31 of
2 January 2021 Ad that Promoted Malicious App
EXHIBIT 2
28 December 2020 Ad that Promoted Malicious App
EXHIBIT 3
31 December 2020 Ad that Promoted Malicious App

Facebook Inc V Nguyen Et Al Candce-21-05002 0001.0

Uploaded by

Copyright:

Available Formats

Facebook Inc V Nguyen Et Al Candce-21-05002 0001.0

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Facebook Inc V Nguyen Et Al Candce-21-05002 0001.0

Uploaded by

Copyright:

Available Formats

Case 3:21-cv-05002 Document 1 Filed 06/29/21 Page 1 of 35

1 HUNTON ANDREWS KURTH LLP

9 Attorneys for Plaintiff

UNITED STATES DISTRICT COURT

1 Plaintiff Facebook, Inc. alleges the following:

12 products, including Instagram.

1 6. Defendant Lê Khang is a resident of Hanoi, Vietnam. Lê Khang used

1 7. Defendant Nguyễn Quốc Bảo is a resident of Hanoi, Vietnam. As part of

1 JURISDICTION AND VENUE

12 personal jurisdiction over Defendants because Facebook’s Terms of Service and

12 permission) or attempt[ing] to access data you do not have permission to access.”

12 a. First, Defendants developed and distributed a malicious app

12 33. Defendants tricked victims into installing the malicious app by

1 35. Starting on or about December 28, 2020, Defendants ran advertisements

25 37. Defendants designed the malicious app to trick users to self-compromise

12 39. For example, on or about January 21, 2021, Defendants tricked a

1 Figure 6: Defendants Offer Rental Access to Compromised Accounts

1 redirected to the website dragonwtee88.com, which was a website controlled by

1 Figure 8: Defendants’ Unauthorized January 24, 2021, Ad on Facebook

1 Figure 9: Defendants’ Unauthorized January 29, 2021, Ad on Instagram

1 Figure 10: Defendants’ Unauthorized January 24, 2021, Ad on Facebook

12 Defendants then bragged about their extravagant purchases online:

1 Figure 14: Post of Nguyễn Quốc Bảo

1 Figure 15: Post of Defendant Thêm Nguyễn

1 Figure 17: Post of Pham Hữu Dung

12 55. Defendants knowingly breached Facebook’s Terms and Advertising and

1 59. Defendants’ breaches of Facebook’s Terms have caused Facebook

12 63. Defendants, using Facebook access information obtained from the

1 68. Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and

12 as defined by 18 U.S.C. § 1030(e)(8) and (11), including the expenditure of resources

1 b. Engaging in any activity that disrupts, diminishes the quality of,

12 proven at trial, but not less than $36,000,000.

1 DEMAND FOR JURY TRIAL

11 Platform Enforcement and Litigation

073923.0000069 EMF_US 85677429v5

You might also like