Case 1:24-cv-02323-MSN-WEF Document 4-31 Filed 12/19/24 Page 1 of 5 PageID# 313

'J

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF VIRGINIA
ALEXANDRIA DIVISION
■'.T \ r-
i /: -.1 1

Microsoft Corporation,

Plaintiff,
Case No.
V.

FILED UNDER SEAL

Does 1-10 Operating an Azure Abuse Network,

Defendants.

[PROPOSED] EX PARTE TEMPORARY RESTRAINING ORDER

Plaintiff Microsoft Corporation (“Microsoft” or “Plaintiff’) has filed a complaint for

injunctive and other relief pursuant to: the Computer Fraud and Abuse Act (“CFAA”) (18

U.S.C. § 1030); the Digital Millenium Copyright Act (“DMCA”) (17 U.S.C. § 1201), the
Lanham Act (15 U.S.C. §§ 1114, 116, & 1125); the Racketeer Influenced and Corrupt

Organizations (“RICO”) Act (18 U.S.C. § 1962(c)); the common law, and the All Writs Act (28

U.S.C. § 1651). Plaintiff has moved ex parte for an emergency temporary restraining order
pursuant to Rule 65(b) of the Federal Rules of Civil Procedure, 15 U.S.C. § 1116(a) (the Lanham

Act), and 28 U.S.C. § 1651(a) (the All Writs Act).

FINDINGS OF FACT AND CONCLUSIONS OF LAW

Having reviewed the papers, declarations, exhibits, and memorandum filed in support of

Plaintiffs’ Application for an Emergency Ex Parte Temporary Restraining Order, the Court
hereby makes the following findings of fact and conclusions of law:
1. This Court has jurisdiction over the subject matter of this case and there is good
cause to believe that it will have jurisdiction over all parties hereto; the Complaint states a claim

upon which relief may be granted against Defendants John Does 1-8 (“Defendants”) under the
CFAA (18 U.S.C. § 1030), the DMCA (17 U.S.C. § 1201), the Lanham Act (15 U.S.C. §§ 1114,
1116, 1125), the RICO Act (18 U.S.C. § 1962(c)), and the common law of trespass to chattels
and tortious interference.
Case 1:24-cv-02323-MSN-WEF Document 4-31 Filed 12/19/24 Page 2 of 5 PageID# 314

2. There is good cause to believe that Defendants have engaged in and are likely to

engage in acts or practices that violate the CFAA (18 U.S.C. § 1030), the DMCA (17 U.S.C. §

1201),theLanham Act(15U.S.C. §§ 1114, 1116, 1125), the RICO Act (18 U.S.C. § 1962(c)),
and constitute trespass to chattels and tortious interference, and that Microsoft is, therefore,

likely to prevail on the merits of this action;

3. Microsoft has registered trademarks representing the quality of its products and

services and its brand, including the Microsoft® and Azure® marks.
4. There is good cause to believe that, unless Defendants are restrained and enjoined

by Order of this Court, immediate and irreparable harm will result from the Defendants’
ongoing violations.
5. There is good cause to believe that immediate and irreparable damage to this
Court’s ability to grant effective final relief will result from the destruction or concealment of
other discoverable evidence of Defendants’ misconduct if Defendants receive advance notice of

this action. Based on the evidence cited in Microsoft’s TRO Application and accompanying

declarations and exhibits. Plaintiff is likely to be able to prove that:

a. Defendants are engaged in activities that directly violate United States law
and harm Plaintiff and the public, including Plaintiff’s customers;
b. Defendants have continued their unlawful conduct despite the clear injury to

the foregoing interests; and

c. Defendants are likely to delete or to relocate evidence and/or to warn their

associates engaged in such activities if informed of Plaintiff s action.

6. Plaintiffs request for this emergency ex parte relief is not the result of any lack of
diligence on Plaintiffs part, but instead based upon the nature of Defendants’ unlawful conduct.
Therefore, in accordance with Fed. R. Civ. P. 65(b), 15 U.S.C. § 1116(a) and 28 U.S.C. §

1651(a), good cause and the interest of justice require that this Order be Granted without prior
notice to Defendants, and accordingly, Plaintiff is relieved of the duty to provide Defendants

with prior notice of Microsoft’s motion;

-2-
Case 1:24-cv-02323-MSN-WEF Document 4-31 Filed 12/19/24 Page 3 of 5 PageID# 315

7. There is good cause to believe that Defendants have specifically directed their

activities to computers located in the Eastern District of Virginia.

8. There is good cause to believe that Defendants will use the domain “aitism.net”
and its subdomains to direct malicious communications to Microsoft’s computers to further

perpetrate their fraud on Plaintiff and its customers.

9. There is good cause to believe that Defendants have engaged in illegal activity by

using the aitism.net domain as described in Microsoft’s TRO papers.

10. There is good cause to believe that to immediately halt the injury caused by

Defendants, Defendants must be prohibited from sending malicious communications to

Microsoft’s computers and networks.
11. There is good cause to believe that to immediately halt the injury caused by
Defendants, the execution of this Order should be carried out in a prompt and coordinated

manner by Plaintiff and by the domain registry for “aitism.net” within a reasonable time after

the registry receives notice of this order.

12. There is good cause to permit notice of the instant Order, notice of the

Preliminary Injunction hearing and service of the Complaint by fonnal and alternative means,
given the exigency of the circumstances and the need for prompt relief The following means of

service are authorized by law, satisfy Due Process, satisfy Fed. R. Civ. P. 4(f)(3), and are

reasonably calculated to notify Defendants of the instant order, the Preliminary Injunction
hearing and of this action: (1) by personal delivery upon Defendants who provided accurate

contact infonnation in the U.S., if any, (2) transmission by email, facsimile, mail and/or

personal delivery to the contact infonnation provided by Defendants to their domain registrars
and hosting companies and as agreed to by Defendants in their domain registration and/or

hosting agreements, and (3) publishing notice on a publicly available Internet websites where

Defendants are believed to operate.

TEMPORARY RESTRAINING ORDER AND ORDER TO SHOW CAUSE

IT IS THEREFORE ORDERED that. Defendants, their representatives, and persons

who are in active concert or participation with them are temporarily restrained and enjoined

-3 -
Case 1:24-cv-02323-MSN-WEF Document 4-31 Filed 12/19/24 Page 4 of 5 PageID# 316

from: (1) accessing without authorization the computers or software comprising Microsoft’s
Azure OpenAI Service, (2) sending malicious code to configure, deploy or operate the Azure

Abuse Enteiprise, (3) generating and sending hamiful images bearing false indicia of
sponsorship or approval by Microsoft; and (4) stealing infomiation, money, or property from
Plaintiff or Plaintiffs customers

IT IS FURTHER ORDERED that, with respect to any currently registered Internet

domains used by Defendants to conduct the Azure Abuse Enterprise, the domain registries

located in the United States shall take the following actions:

A. Maintain unchanged the WHOIS or similar contact and identifying information as

of the time of receipt of this Order and maintain the domains with the current registrar;
B. The domains shall remain active and continue to resolve in the manner set forth in

this Order;

C. Prevent transfer or modification of the domains by Defendants or third parties at

the registrar;
D. The domains shall be redirected to secure servers by changing the authoritative

name servers to NS9.microsoftinternetsafety.net, NS10.microsofti ntemetsafety.net, or such other

name servers identified by Microsoft as may be necessary, and taking other reasonable steps to
work with Microsoft to ensure the redirection of the domains and to ensure that Defendants

cannot use them;

E. Take all steps required to propagate the foregoing changes through the DNS,
including domain registrars;
F. Preserve all evidence that may be used to identify the Defendants using the

domains; and

G. Refrain from providing any notice or warning to, or communicating in any way

with Defendants or Defendants’ representatives and refrain from publicizing this Order until this

Order is executed in full, except as necessary to communicate with domain registrars and

registries to execute this order.

IT IS FURTHER ORDERED that copies of this Order, notice of the Preliminary

-4-
Case 1:24-cv-02323-MSN-WEF Document 4-31 Filed 12/19/24 Page 5 of 5 PageID# 317

Injunction hearing, and service of the Complaint may be served by any means authorized by law,

including (1) by personal delivery upon Defendants who provided accurate contact infonnation

in the U.S., if any; (2) transmission by email, facsimile, mail and/or personal delivery to the

contact infonnation provided by Defendants to their domain registrars and/or hosting companies

and as agreed to by Defendants in their domain registration and/or hosting agreements, and (3)

publishing notice on a publicly available Internet website where Defendants are believed to

operate.

IT IS FURTHER ORDERED, pursuant to Federal Rule of Civil Procedure 65{b)

that the Defendants shall appear before this Court on January 10, 2024, at 10 a.m. to show

cause, if there is any, why this Court should not enter a Preliminary Injunction, pending final

ruling on the Complaint against the Defendants, enjoining them from the conduct

temporarily restrained by the preceding provisions of this Order.

IT IS FURTHER ORDERED, that Microsoft shall post a bond in the amount of

$25,000 pursuant to Federal Rule of Civil Procedure 65(c).

IT IS FURTHER ORDERED that the Defendants shall file with the Court and

serve on Plaintiffs counsel any answering affidavits, pleadings, motions, expert reports or

declarations, and/or legal memoranda no later than two (2) days prior to the hearing on

Microsoft’s request for a preliminary injunction. Plaintiff may file responsive or

supplemental pleadings, materials, affidavits, or memoranda with the Court and serve the

same on counsel for the Defendants no later than one (1) day prior to the preliminary

injunction hearing in this matter. Provided that service shall be performed by personal or

overnight delivery, facsimile or electronic mail, and documents shall be delivered so that

they shall be received by the other parties no later than 4:00 p.m. (Eastern Standard Time) on

the appropriate dates listed in this paragraph.

IT IS SO ORDERED

Entered this day of December, 2024.

^United States District Judge

- 5 -