How Arkady Bukh, an immigrant from New York, became the world's leading defender of cybercrime
Bukh is a one-man lawyer who has spent a generation, navigating international channels, dealing with a huge number of accused hackers from the former Soviet bloc facing charges in American courts, including Vladislav Gorokhorin, a hacker and credit card merchant known as "BadB", who helped create CarderPlanet.
“100% of my cases are businessmen,” Buch says. "They either didn't know they weren't complying with American law or they advertised themselves more aggressively than they should have."
Working from offices in Manhattan and Brighton Beach, a Brooklyn neighborhood known for its close-knit community of Russians and other Eastern European immigrants, Buch became one of the world's best-known intermediaries in international cybercrime, experiencing first-hand the cat-and-mouse game between law enforcement and hackers has escalated over the past decade.
"He's like the godfather of cyber defense lawyers," says Vadim Glozman, a Chicago lawyer who has worked with Bukh on many cases. "He's done more cases like this than anyone in this country, and that kind of experience can't be taught to anyone."
Buch's office is located in midtown Manhattan on Madison Avenue, between high-end fashion stores such as Alexander McQueen, Chanel and Pomellato jewelry. Buch himself is outgoing and relaxed, two traits so rare among New York lawyers that it's almost suspicious. In fact, colleagues and former prosecutors say Buch's outgoing personality masks a shrewd legal mind. By creating an impression of aloofness, Bukh deceived his opponents into underestimating him, according to former U.S. officials who faced him in court. The most obvious example of this approach is his penchant for dressing ostentatiously, including jackets, bowler hats, bow ties and suspenders. He drives around Manhattan, Brooklyn and New Jersey in a silver Mercedes G-Class luxury SUV. It's part of a strategy to attract the attention of potential clients, Buch said, even if it has earned him the nickname "Willy Wonka" from some in the straight-laced world of American law enforcement.
This character emerged during his conversations with CyberScoop over several months in 2019 and 2020. Sometimes he ignores questions that might make his clients look bad, and then moves the conversation to broad topics such as the future of cryptocurrencies. When asked why he first decided to represent the interests of accused cybercriminals, Buch answers succinctly and with a smile: “I like technology.” For all his modesty, Buch seems to talk to any reporter who will listen, and has been quoted by NPR, CNN, NBC and a number of smaller outlets. He is particularly talkative with Sputnik, a Russian government-funded media outlet.
Bukh is from Azerbaijan, a former Soviet republic located between Russia, Iran and the Caspian Sea. His paternal grandfather was Boris Vannikov, a Soviet military general who survived Joseph Stalin's purges and rose to an administrative position in the Soviet Union's atomic weapons project. Despite his grandfather's influence and deep family ties to the former Soviet Union, Bukh left Azerbaijan after the 1990 Baku pogrom, when a nationalist mob killed an estimated 90 Armenians, injured about 700 and warned others to leave the country. After living with relatives in Israel for a time, Buch came to New York in 1992 and soon enrolled at New York Law School, building on his previous education in mathematics and technology.
It was a good time for the young lawyer to make a name for himself in New York, which was experiencing an influx of Russian-speaking immigrants a full century after immigrants from Russia and Ukraine first established communities in the city. He graduated from the university in 2002 and immediately started his own practice. At first, Buch advertised his services mostly on a Russian-language website aimed at immigrants, representing clients accused of drunk driving and minor drug offenses, he says. Soon after, Buch began representing accused cybercriminals. At the time, cybercriminals were still experimenting with many tools that would target victims for a generation. That year, industry analysts noted an increase in phishing attacks, with the number of malware strains increasing by more than 50%, to more than 100.
"Our position is to help the government, and we hope to get a favorable deal from the prosecutor," Buch said in a 2007 New York Times op-ed. Cooperating with the government is usually the best way for defendants to find time to serve their sentences and return home, Buch said. If they don't want to do it, or prosecutors aren't impressed with what the client has to offer, the plan is to take a guilty plea. A trial is a last resort, and Buch estimates it will happen in less than 1% of cases.
As Buch said, “Going to court is like sending a patient for surgery for a disease that has a 99% mortality rate.” Clients reluctant to betray their former associates are likely to change their minds after learning how much time they risk spending in an American prison, away from visitors and with a language barrier to overcome.
Buch argues that his guilty clients, rather than purposefully stealing Americans' credit information or selling malicious software, were guilty only of advertising their services too aggressively or accidentally circumventing overly broad US criminal laws.
"My argument is that this is like going after Mikhail Kalashnikov," Bukh said, referring to the inventor of the AK-47 assault rifle. "He knew that this weapon would be used in Russia and Afghanistan by al-Qaeda terrorists, but he did not fire it."
One former US prosecutor openly scoffed at the idea that accused cybercriminals from around the world wouldn't realize they had violated US law. “Of course the defense lawyer will say that,” the prosecutor said. "But under American law, ignorance of the law does not give you permission to do whatever you want." Walking a tightrope with American lawyers is difficult enough, but Buch has recently faced the additional challenge of dealing with Russian government officials in the United States. When accused cybercriminals arrive in New York under arrest, their country's consulate typically visits them in jail and monitors court proceedings in Manhattan and Brooklyn to ensure fair treatment. Often, at cybercrime hearings in the Southern District of New York or Eastern District of New York, only representatives of foreign governments sit in the gallery. Sometimes these representatives take a more active role. Foreign consular officials sometimes persuade lawyers to abandon a joint legal strategy if it means exposing other hackers from the same country, Buch said. Russian officials, in particular, are sometimes especially eager to make a name for themselves, according to former U.S. Justice Department officials. Bukh often found himself in the middle. For his part, he refuses to specify which countries' consular officers pressured him to take a different approach, and in what cases.
In 2019, Bukh & Associates was involved in no fewer than five major cybercrime cases in the US criminal justice system. Clients range from the aforementioned Rytikov to Stanislav Lisov, who pleaded guilty to creating the NeverQuest banking malware. They also include admitted advertising fraudster Sergei Ovsyannikov, convicted LinkedIn hacker Evgeniy Nikulin and Fedor Gladyr, a 34-year-old Ukrainian who pleaded guilty to collaborating with the FIN7 gang.
"I have more than a dozen former hackers helping me, some of them here in the US, some in Russia, and some are even wanted," he said.
Buch's team now has six full-time attorneys and several employees working on client cases. They often result in guilty pleas to lesser charges, and the Department of Justice wins another victory in the fight against cybercrime.
