PX
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 1 of 10
DECLARATION OF ELIZABETH T. HAN PURSUANT TO 28 U.S.C. § 1746
I, Elizabeth T. Han, hereby state that I have personal knowledge of the facts set forth below. If
called as a witness, I could and would testify competently as follows:
1.
I am a citizen of the United States and over the age of eighteen (18) years old. lam employed as an investigator with the Federal Trade Commission (“FTC’’) in the Division of Financial Practices. My office address is 600 Pennsylvania Avenue, N.W., CC 10232, Washington, D.C., 20580.
I began working at the FTC in June 2013. My responsibilities include investigating suspected violations of consumer protection laws. In the normal course of carrying out my investigative responsibilities, I regularly use Internet search engines, electronic databases, spreadsheet software, and a variety of other software-based investigative and organizational tools. I regularly review a variety of records, including bank, domain, and telecom records, engaging in analysis for indicators of fraudulent activity. I am also a Certified Fraud Examiner (“CFE”), a certification first obtained in February 2012. To become a CFE, I had to pass an exam which tested four subject areas: (1) fraud prevention and deterrence; (2) fraudulent financial transactions; (3) fraud investigations; and (4) legal elements of fraud.
Prior to working at the FTC, I was an investigator with the U.S. Department of Commerce — Office of Inspector General (OIG) for almost three years. My responsibilities for OIG included investigating contract and procurement fraud, grant fraud, serious employee misconduct, and gross mismanagement. In the normal course of
carrying out my investigative responsibilities, I regularly used Internet search engines,
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 2 of 10
electronic databases, and spreadsheet software. I also regularly reviewed financial documents, including contract and grant documents, engaging in analysis for indicators of fraudulent activity.
4, At the FTC, I was assigned to the investigation of the defendants named in the complaint that the FTC has filed herewith. The defendants include one company: BF Labs, Inc. d/b/a Butterfly Labs (“Butterfly Labs”), and three individuals: Darla Drake a/k/a Jody Drake (“Drake”), Nasser Ghoseiri (““Ghoseiri’’), and Sonny Vleisides (“Vleisides”’) (collectively referred to as “Defendants”). Drake, Ghoseiri, and Vleisides, will be referred to separately as “Individual Defendants.”
3: During the course of this investigation, I found articles reporting that Butterfly Labs was the first company to advertise a 65nm bitcoin mining machine. True and correct copies of articles containing such statements are attached here as Attachments (“‘Att.”) A - B.
6. In December 2013, Butterfly Labs maintained a projected shipping date of “November/December” for the first round of customers who had paid up front for the Monarch. A true and correct copy the order page as captured by the Internet Archive’ on December 3, 2013, is attached here as Att. C.
7: During the course of this investigation, the FTC obtained records from BMO Harris Bank
' The Internet Archive is a non-profit organization founded in 1996 that administers an archive of over 408 billion
websites, with the goal of preserving permanent access for researchers, historians, scholars, and the general public.
The pages are captured on a sporadic schedule and not every version of Butterfly Labs’ product page was captured.
As aresult, some of the reported information we have regarding Butterfly Labs’ product offerings, such as pricing,
cannot be supported by a corresponding website capture. The Internet Archive preserved the Butterfly Labs website as it existed on particular dates in time. In the course of
this investigation, we utilized the Internet Archive by downloading copies of the Butterfly Labs home, product,
ordering, and forum pages as they were preserved on specific dates, and stored them as PDFs.
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 3 of 10
on March 21, 2014, pursuant to a CID issued by the FTC. The documents produced
included bank statements, checks, deposits, wire transfers, and account signature cards,
from September 2012 to June 2014. A true and correct copy of the entire production is
available upon request.
8. I reviewed the records from BMO Harris, and observed that members of the
management, including Mr. Ghoseiri, Innovation Officer, Mr. Vleisides, Innovation
Officer, Jeff Ownby, Vice-President of Marketing and Ecommerce, and Josh Zerlan, VP
of Product Development, received loans via wire transfer from Butterfly Labs’ corporate
operating account, ending in xxx5901. The transfers were labeled with notes such as
“loan against future earnings.” Below is a table identifying the loans made via wire
transaction.
Recipient Amount Date ee Note Nasser Ghoseiri $16,000 June 17, 2013 130617503805 | Loan Against Future Earnings Nasser Ghoseiri $16,000 June 17, 2013 130617503944 | Loan Against Future Earnings Jeffrey Ownby $50,000 July 19, 2013 130719013661 | Loan against Dividends Nasser Ghoseiri $12,000 September 9, 2013 130909504144 | Loan against Future Earnings Nasser Ghoseiri $12,000 September 9, 2013 130909504175 | Loan against Future Earnings Sonny Vleisides $20,160 September 18, 2013 | 130918503539 | Loan against future earnings Sonny Vleisides $20,160 September 26, 2013 | 130926502060 | Loan against Future Earnings Jeffrey Ownby $50,000 July 19, 2013 130719013661 | Loan against Dividends Jeffrey Ownby $50,000 July 23, 2013 130723005004 | Advance against dividends Jeffrey Ownby _| $10,000 October 3, 2013 131003008585 ee : es Jeffrey Ownby _| $5,000 March 14, 2014 1403140g05ag)) omnes Nowe tonJeliney
Ownby, against future earnings
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 4 of 10
10.
ele
True and correct excerpts of the bank records reflecting such wire transactions are attached here as Att. D.
During the course of this investigation, I observed many consumers posting on internet forums about their difficulty in obtaining a refund from Butterfly Labs after waiting lengthy periods for their orders. The consumers who successfully obtained a refund utilized internet forums to post their strategies in an effort to aid other consumers. Strategies included contacting PayPal’s fraud department and engaging in the credit card chargeback process. True and correct copies of these internet postings are attached here as Att. E-F.
During the course of this investigation, I observed many consumers posting on internet forums that they believed Butterfly Labs was retaining the mining machines for their own use, and only shipping the mining machines after they had exhausted the machine’s capabilities. Butterfly Labs repeatedly stated they were not mining with equipment built for consumers. True and correct copies of these statements are attached here as Att. G -— H.
On September 22, 2014, I ran a search of complaints in the FTC’s complaint database, searching for all complaints against Butterfly Labs from March 1, 2014 to September 22, 2014. I found 40 complaints, which I reviewed. I observed that many consumers were continuing to experience difficulty getting a refund, with a complaint filed that same day by a consumer who stated they had just made a second request for their refund for an order they placed on January 5, 2014. Additionally, many consumers report they do not want the product because of how long it has been delayed; consumers state the lengthy
delay has rendered the product ineffective and useless. A true and correct copy of the
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 5 of 10
12.
13,
14.
spreadsheet of complaints I downloaded from the FTC’s complaint database is attached here as Att. I.
On September 19, 2014, I entered Defendants’ business premises at 10770 El Monte St., Suite 101, Leawood, KS 66211; 10606 Widmer Road, Lenexa, KS 66215; and 17501 West 98" St., Lenexa, KS 66219 pursuant to a court order. Upon entering each location, it was evident that the defendants operated their business primarily from 10770 El Monte, and utilized the other two locations as storage facilities. During my inspection of the 10770 El Monte location, I created a map of the premises layout. In addition, I took photos documenting each location. A true and correct copy of the map I created of 10770 El Monte is attached here as Att. J. Photographs of each location are available upon request.
During my inspection of each of the Butterfly Labs premises, computer forensic examiner Ryan Lex, employed by the temporary court-appointed receiver, was participating in a walkthrough alongside the receiver. Mr. Lex recorded his walk-through of all three Butterfly Labs premises, and provided those recordings to me for review. I was present for much of the time Mr. Lex was recording.
During my inspection of the premises located at 10770 El Monte, I observed red foam pitchforks, with the words “BFL is late!” and “Y U NO SHIP!” imprinted on them, located at various places within the offices and work stations. There were many red foam pitchforks being stored in Mr. Zerlan’s office at 10770 El Monte, as well as at the storage facility located at 17501 West 98" St. True and correct copies of photos and/or image stills from Mr. Lex’s video recordings demonstrating the locations of the items are
attached here as Atts. K —M.
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 6 of 10
ie During my inspection of the premises located at 10770 El Monte, I entered a trailer attached to the back of the building, identified as Room J on Att. A. In this trailer, there were racks of computing units powered on. The trailer also contained many fans, which were operating to keep the computing units cooled. I observed that the racks lined with computing units also contained small ASUS-brand computers running what appeared to be a bitcoin mining software. A true and correct copy of the photos of Room J are attached here as Atts. N — T.
16. During my inspection of the premises located at 10770 El Monte, I entered another room containing racks of computing units powered on, identified as Room F on Att. A. In this room, the computing units were also powered on, with ventilation provided from a connecting room running to keep the units cooled. Again, the racks lined with computing units also contained small ASUS-brand computers running what appeared to be a bitcoin mining software. A true and correct copy of the photos of Room F are attached here as Atts. U - W.
Td, During my inspection of the premises located at 10606 Widmer, John Mutrux, a Butterfly Labs employee, accompanied Mr. Lex and the receiver, explaining what each set of boxes in the facility contained. I observed many pallets of boxed parts filling both sides of the warehouse. Mr. Mutrux identified many of the parts in storage at 10606 Widmer as “obsolete” or no longer capable of being used because of design changes. Further, Mr. Mutrux identified a safe containing boxes of brand-new Nexus 7 tablets” that were purchased to operate mining software, and are currently sitting unused. True and correct excerpts of Mr. Lex’s video recordings of Mr. Mutrux’s identification of stored parts,
* http://www.google.com/nexus/7/; the Nexus 7 tablet is a mobile media product manufactured by Google, and runs their Android operating system.
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 7 of 10
18.
19.
20.
created when I was present, are available upon request.
During my inspection of the premises located at 17501 98", Mr. Mutrux again accompanied Mr. Lex and the receiver, and explained what each set of boxes in the facility contained. I observed this warehouse to be approximately two times as large as the facility at 10606 Widmer, and had pallets of boxed parts filling both sides as well as down the middle of the facility. Mr. Mutrux identified many of the parts in storage at 17501 98" as “obsolete” or no longer capable of being used because of design changes. Mr. Mutrux also identified boxes of completed, older generation mining machines manufactured by Butterfly Labs, as “obsolete.” Lastly, Mr. Mutrux identified multiple pallets of boxed parts as having been procured for future products Butterfly Labs currently has in development and hopes to put onto the market. Some of these boxed parts are for products Mr. Mutrux identified as “not anywhere near production.” True and correct excerpts of Mr. Lex’s video recordings of Mr. Mutrux’s identification of stored parts, created when I was present, are available upon request.
During my inspection of the premises located at 10770 El Monte, I located the computers of some of Butterfly Labs’ principals, including Mr. Vleisides, and Mr. Zerlan. While on- site, the FTC had forensic examiners present who created either a logical copy or a forensic image of these identified computers. Upon my return to FTC offices in Washington, D.C., I reviewed the forensic images, and was able to review the contents of each principal’s machines, reviewing items such as internal chat logs, excel spreadsheets, and audio files, that the user had saved to their machine.
In reviewing Mr. Zerlan’s machine, I reviewed an audio file entitled “2013 Refund
Policies.wav” with a last modified date of April 17, 2014, at 4:28pm. The audio file was a
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 8 of 10
pap
2d.
pe
recording stating that because orders had begun shipping, no refunds would be processed. A true and correct copy of the audio recording located on Mr. Zerlan’s computer is available upon request.
I also found text files on Mr. Zerlan’s computer representing internal chat logs between members of Butterfly Labs’ management team, including Mr. Zerlan, Mr. Vleisides, and Ms. Drake, the General Manager. One text file I found, entitled “communication group.txt” with a last modified date of September 3, 2014, contains logs of conversations that occurred between the principals during the period from June 10, 2013 — September 3, 2014. The principals discussed many topics, including Butterfly Labs’ upgrade program, shipment delays and refund policies. True and correct excerpts of the chat logs, with portions highlighted, are attached here as Att. X.
In reviewing Mr. Vleisides’ computer, I came across many spreadsheets, one of which was entitled “Receivables wallets — 04-18-14.csv” with a last modified date of April 18, 2014. The spreadsheet contained a log of transactions to bitcoin wallets addresses, which match known Butterfly Labs bitcoin wallet addresses. Many of the transactions are labeled in a manner indicating they represent funds gained from mining — for example, “Received with ... New Eclipse burnin mining account,” “Received with... Bitcoin mining — Eclipse pool,” and “Received with ... Forfeiture from Janette to company of 15 bitcoins from office mining project.” True and correct copies of the spreadsheets are available upon request.
Following my inspection of the premises, I learned of at least eleven bitcoin wallets designated for and/or containing corporate funds from the temporary court-appointed
receiver. Of the eleven wallets identified, wallet addresses were only known for six. The
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 9 of 10
receiver was going to ascertain the remaining wallet addresses, as well as the private keys to each of the wallets, in order to move any corporate funds to a secured bitcoin wallet
controlled by the court, in order to prevent asset dissipation.
Pursuant to 28 U.S.C. § 1746, I declare under penalty of perjury that the statements made in this
declaration are true and correct.
Executed in Washington, D.C. on September 26, 2014.
Case 4:14-cv-00815-BCW Document 42-1 Filed 09/27/14 Page 10 of 10