In Las Vegas Courtroom, First Ever Cybercrime RICO Trial Begins

Until it closed two years ago, Carder.su was an online cybercrime forum used by some 7,900 fraudsters around the world. The site was allegedly headed by a Russian named Roman Zolotarev, and it boasted a slew of high-end vendors and sophisticated moderators. But none of them are on trial. Instead, a rank-and-file credit card scammer who signed up at Carder.su when he was 16 years old on is trial for racketeering charges and faces a 20-year sentence.
Image may contain Fruit Banana Plant and Food
Left to right: Roger Grodesky, Jonathan Vergnetti, and Elias Lee Samaha are among those facing conspiracy and identity theft charges after allegedly buying fake IDs from an online storefront run by the U.S. Secret Service in Las Vegas.

LAS VEGAS – With his angular face and hooded eyes, Andrew Duncan is a federal prosecutor right out of Central Casting. But his message on the opening day of the trial of an alleged cybercriminal yesterday was anything but old fashioned.

“Television and the movies have always portrayed organized criminal enterprises in a certain way,” he says -- mafia hoodlums plotting in a smoky backroom, “Vinnie the Bull” guarding the door.

Things have changed. “Flash forward to the 21st century,” he says, raising his voice and shouting out the domain name of a website, www.Carder.su. He pauses between each of the W's so they ring like gunshots through the courtroom.

Until it closed two years ago, Carder.su was an online cybercrime forum used by some 7,900 fraudsters around the world. It was essentially a criminal eBay. Carefully screened “vendors” sold a wealth of products: counterfeiting gear, stolen identify information, skimmed or stolen credit card magstripe data, hacker tools, botnets for rent, and online banking credentials. Forum administrations and moderators kept the system purring, and ordinary members could post reviews of the products they’d bought.

The Secret Service's Nevada licenses were particularly good, since they were secretly made by the Nevada DMV.

The site was allegedly headed by a Russian named Roman Zolotarev, and it boasted a slew of high-end vendors and sophisticated moderators. None of them are in this courtroom. The sole defendant at this trial, which began yesterday, is a rank-and-file credit card scammer who signed up at Carder.su when he was 16 years old, and made the mistake of dealing with an undercover Secret Service agent a year later.

Now 22, David Ray Camez is the first cybercrime defendant in the country to go to trial on federal racketeering charges, instead of computer or credit card fraud statutes. He’s charged with conspiracy to violate RICO and with the separate charge of violating RICO, and faces a 20-year sentence.

The key question facing the jurors isn’t whether Camez was a crook -- he’s already serving a state prison term for forgery. It’s whether the website he did business on was an organized criminal enterprise comparable, as a legal matter, to the Mafia or a Los Angeles street gang.

David Ray Camez in a 2011 mugshot

Enacted in 1970 to help the FBI crack down on the mafia, the Racketeer Influenced and Corrupt Organizations Act lets the feds hold every member of a criminal organization individually responsible for the actions of the group as a whole. If it applies here, then Camez will be legally culpable for every crime committed by all 7,800 users of Carder.su, which the government estimates caused $50.5 million in consumer losses.

A conviction under that theory would give the U.S. a powerful new legal weapon as it takes on a growing number of underground criminal forums dealing in everything from weapons to drugs to more cybercrime.

Underscoring the importance of the case to the government, the Justice Department has deployed a lawyer from the Organized Crime and Gang Section in Washington to assist local prosecutors Duncan and Kimberly Frayn, and they’ve flown in one of the FBI’s top cyber cops, J. Keith Mularski, to appear as the first witness, testifying as an expert on the carder forums. Prosecutors plan to present 1,500 exhibits, and up to 43 witnesses, in a trial scheduled to last at least three weeks.

Ten other defendants have already pleaded guilty. But Camez is stubborn, says his lawyer, Chris Rasmussen. “Other racketeering cases, there’s a boss who’s telling you what to do,” Rasmussen told WIRED on the eve of trial. “Nobody can tell David what to do. He’s really adamant that he’s not into racketeering.”

The case is the first trial to come from Operation Open Market, a four-year undercover probe that saw the U.S. government selling high-quality fake IDs to more than 100 criminals around the world, while gathering evidence for four federal grand jury indictments against 55 defendants in 10 countries, facing a cumulative millennium of prison time.

WIRED reported exclusively last July on the details of the Open Market investigation. An October status report filed in the case indicates the FBI is investigating WIRED’s sources for “protected materials” revealed in that story.

The Secret Service sold this “voter identification card” to criminals as a second form of ID, for when a driver’s license alone just won’t do it.

That story began in 2007, according to internal DHS documents seen by WIRED, after the arrest of a 34-year-old credit card forger named Justin Todd Moss at a Whole Foods about 12 miles from this courtroom.

Under the name “Celtic,” Moss had a reputation as a reliable member of the carder forums. Celtic agreed to cooperate, the government acknowledged yesterday, and Secret Service agent Mike Adams took over Celtic’s online identity. He started hanging out on the U.S. crime forum CardersMarket, then migrated in October 2007 to the Russian site Carder.su.

It was there that Adams began transforming Celtic from a mere consumer of criminal goods into a top provider. Eventually he was peddling driver’s licenses from 13 states: New York, Nevada, Illinois, Virginia, Tennessee, Georgia, Maine, South Dakota, Arizona, Texas, Washington, Indiana, and California. The Nevada licenses were particularly good, encased in what the agent claimed was authentic government laminate bearing the state seal.

“This ID is absolutely flawless, awesome, highest quality, guaranteed to work ANYWHERE,” gushed one satisfied customer of the Nevada license. Another crowed that he’d successfully passed the ID at the Social Security Administration.

There was a reason the Nevada license was so good. It was real. The Secret Service enlisted the help of the state DMV to produce the licenses, according to Rasmussen. An official count isn’t available, but WIRED has tallied that the agent sold to at least 110 different customers, shipping at least 125 fake driver’s licenses, in addition to secondary forms of ID, including dozens of AT&T employee ID cards, and a handful of Carson City “voter identification” cards.

Another of Celtic's products, fraudsters could buy this fake AT&T employee ID card to fatten up their wallets.

From the Secret Service’s standpoint, selling fake IDs -- “novelties,” in the parlance of the underground -- held a number of advantages. Unlike intangible commodities like credit card numbers or passwords, fake IDs must be shipped physically, which gives the agency an address to investigate for every customer. And, being photo IDs, the customer had to provide their photos.

Behind the scenes, the Secret Service was serving hundreds of search warrants, grand jury subpoenas and so-called 2703(d) orders that compel the disclosure of a suspects’ webmail and chat accounts from the likes of Hotmail, Live.com, Gmail, Yahoo, and AOL’s ICQ service, as well as ISPs and hosting companies.

Camez first fell into the Open Market trap in May of 2009, when he allegedly paid “Celtic” $330 to make him a fake Arizona driver’s license under an alias. Several more orders followed.

In February 2010, DHS’s Customs and Border Protection intercepted a suspicious package from Pakistan and found of 26 counterfeit MasterCard gift cards on their way to Camez. Local police and federal agents served a search warrant on his Phoenix apartment that May, and found counterfeiting gear, forged U.S. currency and fake bank cards.

Undeterred by the raid, in June he allegedly ordered 30 fake credit cards from a Carder.su vendor called Kartoon. The Secret Service raided him a second time and seized more evidence. Camez was charged and convicted locally, and is now serving a seven year state prison term in Arizona. The U.S. pulled him out of state custody to put him on trial here in Las Vegas.

Sitting at the defense table in a light-blue button down and a prison buzz-cut, Camez seems a poor test subject for a bold new cybercrime prosecution method. But he’s the best the government has. Low-level crooks like Camez account for about half the defendants charged in Open Market, but comprise 22 of the 28 who’ve been identified and arrested.

The more valuable targets are the 27 Carder.su vendors charged with selling criminal goods and services alongside Celtic. But of these, eight are known only by their online nicknames, and 13 others have been identified but live in foreign jurisdictions like Ukraine, Morocco and Nigeria. Only the six unlucky enough to be based in the United States have been arrested.

Zolotarev, the ringleader, is now believed to be running a Carder.su successor forum. Reached over ICQ, the administrator of that forum declined to comment. “Forum not for journalist,” he wrote. “Don’t want be popular.”

In his opening statement, Duncan emphasizes the interdependencies of the forum, and reads from chat logs in which Camez -- who went by “Bad Man” and “Doctorsex” -- discussed the deals he struck with various vendors. He bought stolen magstripe data from one Carder.su source, paid another vendor to turn it into counterfeit credit cards, and, of course, purchased fake ID from Adams, who is now with DHS’s Homeland Security Investigations.

Additionally, Camez allegedly dealt directly with Zolotarev to use Carder.su’s escrow service, which helps keep vendors and customers honest by holding the money while a deal goes through.

Duncan shows jurors a screenshot of black-themed Carder.su login page. “This black screen and what’s behind it is the new place and the new face of organized crime,” he says. “This black screen is the Vinnie the Bull, keeping you out.”

When Duncan wraps up, Rasmussen stands to deliver his opening statement. “Carder.su is a website,” Rasmussen says simply. “There’s no membership… They talk about ‘Vinnie the Bull’ at the door? There’s nobody at the door.”

The defense’s argument is that Carder.su is more like Craigslist than the mafia; people meet and talk and, yes, make criminal deals by the boatload, but nobody is in charge. There’s no boss of all bosses getting a piece of the action. Nobody’s paying tribute. There’s no organization, and, hence, no RICO violation.

He also slams the government for its undercover tactics, comparing Operation Open Market to the ATF’s Fast and Furious operation. Just as Fast and Furious put guns in the hands of smugglers, Open Market “sent government identification made by the DMV” to criminals around the world, most of which have not been recovered.

Rasmussen suggests that the government should have taken a different course altogether when a 17-year-old Camez first approached Adams looking for a fake driver’s license.

“Did Special Agent Adams contact David’s mother say, ‘Hey, your kid’s messing around on a website he shouldn’t be’? No.”

The first day of the trial closed with the FBI’s Mularski, who, until 2008, ran an undercover cybercrime forum called Dark Market under the moniker “Master Splyntr.” He testified that the carder forums have no lawful purpose.

“On the carding forums you can obtain really anything you need to commit cybercrime,” he said. “There’s no legitimate activity that occurs on them.”