Computer data moving through a server in Downtown Crossing was enough to warrant bringing a Russian hacker boss to trial here, judge rules

Update: Klyushin's sentencing has been canceled "until further notice."

Vladislav Klyushin, a Moscow IT executive held at the Plymouth County jail since 2021, could learn at some point how much longer he sit behind bars in the US following his conviction in February on insider-trading charges related to the theft of American corporate financial statements before their official releases.

Klyushin's sentencing had been set for Monday in US District Court in Boston but was canceled "until further notice."

That entry in his court docket came not long after a federal judge rejected his bid to reverse the jury's verdict and acquit him on the grounds his alleged crime - hacking into servers used by public corporations to store financial statements before they are released to the SEC and the public, then making trades based on that information - had nothing to do with Boston and so he should never have been tried here. On Monday, he faces a potential sentence of up to 20 years on the convictions for wire and securities fraud.

In her ruling, Judge Patty Saris said that given the nature of the crimes committed by Klyushin and his underlings in Moscow, the fact that a couple of weeks worth of their hacking attempts were routed through a VPN server leased in a data center in the Macy's building at 1 Summer St. was enough of Boston connection to warrant his trial here as anywhere else.

Unlike their boss, Klyushin's underlings at his M-13 firm in Moscow did not also face trial here, because they remain in Russia - they were smart or poor enough to not go on a ski trip to Switzerland, like the one he went on, only to be arrested by Swiss police, who then turned him over to US law enforcement, who say his firm made roughly $90 million in profits in deals based on the documents they stole.

Following his conviction, Klyushin's attorneys moved to have him acquitted on the grounds that federal law requires attention to finding the proper venue for a criminal trial and that Boston really had no connection to the crimes, that neither he nor his employees likely even knew their traffic was being routed via a server room run by the Markley Group in the Macy's building at 1 Summer St.

At trial, prosecutors showed that between Oct. 22 and Nov. 6, 2018, some of hacking traffic from Moscow was routed via a series of 104 IP addresses through a server that a company called Micfo put in rented space in the Markley data center and then leased to a Dallas company called Stackpath, whose VPN services Klyushin and his alleged conspirators used to help break into the financial-data servers.

When a crime occurs in more than one place, especially when involving crimes that originate outside the US - the hackers were physically in Moscow, not the US - the law lets prosecutors file charges anywhere along the route, Saris wrote, citing a 1908 Supreme Court ruling involving a railroad caught giving kickbacks to certain meat packers shipping between the Mississippi River and New York.

In the Klyushin case, she wrote:

The earnings reports accessed through the Boston server included those of dozens of publicly traded companies. Klyushin and his co-conspirators placed their trades only after the confidential information was downloaded through the Boston server, and revised their positions following public announcements of those earnings. For example, confidential information pertaining to Tesla was downloaded to the Boston server at 5:18 a.m. on October 24, 2018. Later that morning, Klyushin bought Tesla stock. After the market closed that day and the earnings were publicly announced, the conspirators immediately sold their shares to great profit. ...

While Klyushin hit send on a computer in Russia, given the nature of the charged continuing crimes, he caused the crimes to be implemented in part in Massachusetts. Based on this evidence concerning the use of a server in Boston, a jury could reasonably find by a preponderance of the evidence that Klyushin's use of the IP addresses in Boston was essential conduct, and that Massachusetts had a meaningful connection to the crimes committed.