Timofey V v. United States

majority opinion

PRECEDENTIAL

UNITED STATES COURT OF APPEALS

FOR THE THIRD CIRCUIT

No. 25-2487

TIMOFEY V; ANO DIALOG,

Appellants

UNITED STATES OF AMERICA

On Appeal from the United States District Court

for the Eastern District of Pennsylvania

(D.C. Civil No. 2:24-cv-06862)

District Judge: Honorable Wendy Beetlestone

Argued June 9, 2026

Before: HARDIMAN, BOVE and FISHER, Circuit Judges.

(Filed: August 25, 2026)

Dennis E. Boyle ARGUED

Suite 500

1050 Connecticut Avenue NW

Washington, DC 20036

Counsel for Appellant

Kyle J. Finnegan ARGUED

John A. Eisenberg, Assistant Attorney General

United States Department of Justice

Appellate Section, Suite 1600

950 Pennsylvania Avenue NW

Washington, DC 20530

David Metcalf, United States Attorney

Michelle Rotella

Robert A. Zauzmer

Office of United States Attorney

615 Chestnut Street, Suite 1250

Philadelphia, PA 19106

Counsel for Appellee

OPINION OF THE COURT

FISHER, Circuit Judge.

The Government seized the domain name

waronfakes.com, along with others, purportedly because the domain names were purchased in violation of the international money laundering statute and with the intent to violate the International Emergency Economic Powers Act (IEEPA). Now, two years later, and without any indictment or other public investigative steps related to the domains, the Government still insists it cannot transfer waronfakes.com back to the appellants or, in fact, to anyone else. But because the appellants did not demonstrate to the District Court that

they are lawfully entitled to possess the domain, we will affirm the denial of their motion for return of the property.

An Internet Protocol (IP) address is a string of numbers that identifies a computer or server connected to the internet. A domain name is essentially a nickname for an IP address. When someone wants to visit the website for the United States Court of Appeals for the Third Circuit, for example, he can simply type “ca3.uscourts.gov” into his browser rather than a harder-to-remember IP address that might stretch ten digits or more. If “[a]n IP address acts much like a home or business street address” by “enabl[ing] computers connected to the Internet to properly route traffic to each other,” App. 50-51, then a domain name is like a building or venue name—a visitor to Philadelphia might successfully direct her taxi driver to take her to Independence Hall without knowing that Independence Hall is located at 520 Chestnut Street. So too might a curious member of the public successfully access the many helpful materials hosted on our Court’s website without knowing the server’s IP address.

A domain name is generally composed of a top-level domain (TLD) and a second-level domain (SLD). The TLD is the last part of a domain name such as “.com” or “.gov.” The SLD is the part of a domain name to the left of the TLD such as “Justice” in Justice.gov or “ESPN” in ESPN.com. The Domain Name System (DNS) tracks which domain names are associated with which IP addresses—essentially “a phonebook for the Internet.” App. 51. Several entities or individuals interact within the DNS: registrars, registries, and registrants.

A domain name registry is an organization that manages TLDs. Registries set usage rules (for example, only

government organizations can use the “.gov” TLD) and work with registrars to sell domain names to the public. The registry for “.com” and “.net” TLDs is VeriSign, Inc., which is headquartered in Reston, Virginia. A domain name registrar is a retail company that sells and registers domain names on behalf of a registry. A registrar sells the right to use a domain name to a registrant. Registrants may be persons or entities and may manage their domain names in various ways, including by associating a particular IP address with a particular domain name. After a registrant associates a domain name with an IP address, internet users who type in the domain name will be directed to the associated website—or, more accurately, to the IP address of a computer or server where the registrant’s website is hosted.

In March 2022, a registrant—an individual known as Timofey V—registered the domain name waronfakes.com through Reg.Ru, a Russia-based registrar. Reg.Ru obtained the domain name from Verisign. Timofey V is an employee of a so-called “autonomous nonprofit organization” (ANO) in Russia called Dialog. ANO Dialog and its employees produced content “focused primarily on political issues in Russia” and published the content on waronfakes.com. App. 356. The director of ANO Dialog is Vladimir Tabak.

IEEPA authorizes the President to impose economic sanctions in response to an unusual and extraordinary threat to the national security, foreign policy, or economy of the United States. See 50 U.S.C. § 1701–02. The President may declare a national emergency through an Executive Order to deal with that threat. Id. § 1701(a). He may exercise his statutory authority through instructions, licenses, prohibitions, investigations, and regulations. Id. §§ 1702(a)(1), 1704. It is a

crime to willfully violate orders, licenses, regulations, or prohibitions promulgated under IEEPA—or to cause them to be violated or attempt or conspire to do so. Id. § 1705(a), (c).

IEEPA includes some exceptions to the President’s otherwise broad authority. One of those exceptions is that

[t]he authority granted to the President . . . does

not include the authority to regulate or prohibit,

directly or indirectly . . . the importation from

any country, or the exportation to any country,

whether commercial or otherwise, regardless of

format or medium of transmission, of any

information or informational materials,

including but not limited to, publications, films,

posters, phonograph records, photographs,

microfilms, microfiche, tapes, compact disks,

CD ROMs, artworks, and news wire feeds.

Id. § 1702(b)(3).

Separately, as part of efforts to prevent international money laundering, Congress has prohibited the transportation, transmission, or transfer of funds or monetary instruments “to a place in the United States from or through a place outside the United States . . . with the intent to promote the carrying on of specified unlawful activity.” 18 U.S.C. § 1956(a)(2)(A). “Specified unlawful activity” includes violations of IEEPA. Id. § 1956(c)(7)(D). And anyone “who conspires to commit any offense defined in” the § 1956 money laundering statute is also subject to criminal prosecution. Id. § 1956(h).

In 2014, the President declared a national emergency with respect to Russia’s occupation of the Crimean region of Ukraine. Exec. Order No. 13660, 79 Fed. Reg. 13493 (March 6, 2014). The executive order “blocked”—that is, prohibited transferring, paying, or dealing in—all property in the United

States belonging to certain people deemed to have threatened the peace and territorial integrity of Ukraine, including by playing a role in the occupation of Crimea. Id. The order also prohibited “the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any person whose property” was blocked and prohibited “the receipt of any contribution or provision of funds, goods, or services from any such person.” Id. at 13494. Subject to a list of criteria, the President delegated to the Secretary of the Treasury and the Secretary of State the power to compile a list of blocked people. Id. at 13493. The President expanded on this order with subsequent Ukraine-related executive orders. See, e.g., Exec. Order No. 13661, 79 Fed. Reg. 15535 (March 16, 2014); Exec. Order No. 13662, 79 Fed. Reg. 16169 (March 20, 2014); Exec. Order No. 13685, 79 Fed. Reg. 77357 (Dec. 19, 2014).

Pursuant to the Ukraine-related executive orders, the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) promulgated regulations and published a Specially Designated Nationals and Blocked Persons list. See 31 C.F.R. § 589.201; Office of Foreign Assets Control, Sanctions List Search. 1 In March 2021, OFAC added to the blocked persons list several Russian government officials, including Sergei Kiriyenko, First Deputy Chief of Staff of the Presidential Executive Office. See U.S. Dep’t of Treas., Treasury Sanctions Russian Officials in Response to the Novichok Poisoning of Aleksey Navalny, March 2, 2021. 2

In April 2021, the President issued Executive Order 14024, which declared a national emergency with respect to

Available at https://perma.cc/RK2J-XLR7 (last

visited Aug. 5, 2026).

Available at https://perma.cc/EW4S-HQYK (last

visited Aug. 5, 2026).

the Russian Government’s “efforts to undermine the conduct of free and fair democratic elections and democratic institutions in the United States and its allies and partners.” 86 Fed. Reg. 20249 (April 15, 2021). Like the Ukraine-related executive orders, E.O. 14024 blocked the property of persons determined by the Secretary of the Treasury or the Secretary of State to meet enumerated criteria and prohibited, among other things, the “provision of funds, goods, or services by, to, or for the benefit of” a designated person without first obtaining a license from OFAC. Id. at 20249–51; 31 C.F.R. § 587.202(a), (c). Pursuant to this executive order, OFAC announced additional sanctions against Kiriyenko. OFAC noted that Kiriyenko was already on the blocked persons list but nonetheless redesignated him as a blocked person. U.S. Dep’t of Treas., U.S. Treasury Imposes Immediate Economic Costs in Response to Actions in the Donetsk and Luhansk Regions, February 22, 2022. 3

In 2024, OFAC issued General License No. 25G. Office of Foreign Assets Control, 31 C.F.R. § 587 General License No. 25G, Authorizing Transactions Related to Telecommunications and Certain Internet-Based Communications. 4 The license authorizes “all transactions ordinarily incident and necessary to the receipt or transmission of telecommunications involving the Russian Federation that” are otherwise prohibited under Executive Order 14024. However, General License No. 25G explicitly requires separate authorization for transactions involving certain sanctioned entities including ANO Dialog. See General

Available at https://perma.cc/X9J2-6VVU (last

visited Aug. 5, 2026).

Available at https://perma.cc/EWQ8-RDVP (last

visited Aug. 5, 2026).

License No. 25G(d)(4)(viii).

In August 2024, the Government obtained a warrant and seized the domain waronfakes.com, along with other domains, purportedly because the domain names were purchased in violation of the international money laundering statute and with the intent of violating IEEPA. The Government asserted that waronfakes.com “was part of a network of domains that promoted Russian disinformation efforts on behalf of at least one sanctioned entity.” Appellee’s Br. 6; see also App. 47–48. According to the Government, Kiriyenko directed ANO Dialog and others to use the domains to disseminate Russian government propaganda and influence voters in the U.S. and elsewhere by posing as citizens of those countries and impersonating legitimate news outlets. The Government theorized that Russia-based registrar Reg.Ru purchased from U.S.-based registry Verisign the waronfakes.com domain name with the intent to violate IEEPA because the payment was made for the benefit of Kiriyenko, a person on the blocked persons list. And to acquire the domain name from the U.S.-based registry, funds had to be transferred from outside the U.S. to within the U.S. According to the Government’s theory, this constituted international money laundering.

The Seizure Warrant ordered Verisign “to redirect the [domain] to substitute servers at the direction of the FBI.” App. 120. Thereafter, visitors to the domain saw a notice that the domain had been seized. Five days after the seizure, OFAC added ANO Dialog and its director, Tabak, to the blocked persons list pursuant to E.O. 14024. See U.S. Dep’t of Treas., Treasury Takes Action as Part of a U.S. Government Response

to Russia’s Foreign Malign Influence Operations, September 4, 2024. 5

Timofey V and ANO Dialog moved in the District

Court for the return of the domain pursuant to Federal Rule of Criminal Procedure 41(g). The Government opposed the motion and requested that the District Court dismiss it. The District Court denied the motion for return of the property and granted the Government’s motion to dismiss. Because ANO Dialog and its director, Tabak, are on the blocked persons list, the District Court reasoned that they were legally prohibited from gaining control over the domain without a license from OFAC, which they had not obtained. And because Timofey V and ANO Dialog did not establish lawful entitlement to the domain, the District Court determined that there was no need for an evidentiary hearing and denied the petition.

Timofey V and ANO Dialog appeal.

II.

The District Court had jurisdiction over the federal question presented here pursuant to 28 U.S.C. § 1331, because a motion under Federal Rule of Criminal Procedure 41(g) is “treated as a civil proceeding for equitable relief.” Peloro v. United States, 488 F.3d 163, 172 (3d Cir. 2007) (quoting United States v. Bein, 214 F.3d 408, 411 (3d Cir. 2000)). We have jurisdiction over the District Court’s final order pursuant to 28 U.S.C. § 1291.

We review de novo legal questions related to whether a party has standing to bring a claim. Edmonson v. Lincoln Nat’l

Available at https://perma.cc/M6PB-YXQU (last

visited Aug. 5, 2026).

Life Ins. Co., 725 F.3d 406, 414 (3d Cir. 2013). We review the District Court’s decision to deny a Rule 41(g) motion, and to do so without an evidentiary hearing, for abuse of discretion. United States v. Chambers, 192 F.3d 374, 376 (3d Cir. 1999); United States v. Albinson, 356 F.3d 278, 281 & n.5 (3d Cir. 2004).

III.

A. Standing

To establish Article III standing, the party invoking federal jurisdiction must show (1) that he has suffered an “injury in fact,” (2) that there is “a causal connection between the injury and the conduct complained of,” and (3) that it is likely “that the injury will be ‘redressed by a favorable decision.’” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (citation modified). To show injury in fact in a Rule 41(g) proceeding, the movant must claim an “ownership, possessory or security interest in at least a portion of the . . . property.” United States v. Rodriguez-Aguirre, 264 F.3d 1195, 1204 (10th Cir. 2001) (quoting United States v. $515,060.42 in U.S. Currency, 152 F.3d 491, 497 (6th Cir. 1998)); see also United States v. $8,221,877.16 in U.S. Currency, 330 F.3d 141, 150 n.9 (3d Cir. 2003) (holding that in an action to contest a forfeiture, “standing requires the claimant to show an interest in the property sufficient to create a ‘case or controversy’”) (quoting United States v. Contents of Accts. Nos. 3034504504 and 144–07143, 971 F.2d 974, 984 (3d Cir. 1992)).

The Government argues that the appellants do not have standing to bring this Rule 41(g) motion because they do not have any interest in the waronfakes.com domain and that, regardless of any interest, their claim is not redressable. Both arguments are unavailing.

1. Interest in the Domain

The Government argues that the appellants “do not have a cognizable ownership or possessory interest in the” domain. Appellee’s Br. 15. According to the Government, the appellants’ registration of the domain gave them something like a leasehold interest over the domain during the period of their registration. And the appellants’ registration, the Government says, extended from March 2022 to only March 2023. The domain was seized outside that period, in August 2024. With no active registration, the appellants would have no possessory interest and, according to the Government, suffer no injury by the Government’s continued possession. However, the appellants claim—and indeed submitted evidence showing—that Timofey V was the domain’s

registrant at the time it was seized.

First, the affidavit presented by the Government in support of the seizure warrant quotes an investigative report that says Timofey V updated his domain registration a year after he first registered it. Second, in response to this same argument in the District Court, the appellants produced a document from the Russian registrar, Reg.Ru, that purports to confirm Timofey V was the registrant of the waronfakes.com domain as late as March 20, 2025. The Government argues— as it did in the District Court—that there is reason to doubt the appellants’ claims and documentation related to registration beyond the first year. But it is not true that “the record only indicates that Timofey V registered the Subject Domain for a one-year period in March 2022,” id. (emphasis added), and the District Court did not make any factual findings on this issue.

2. Redressability

The Government also argues that, even if there is a valid possessory interest, the appellants’ claim is not redressable

because ANO Dialog is now on the blocked persons list pursuant to E.O. 14024, and any transfer of property in which a blocked person has an interest is “null and void.” Appellee’s Br. 25 (quoting 31 C.F.R. § 587.202(a)). Because the domain is property that cannot be transferred without a license from OFAC, the courts are powerless to provide redress, according to the Government, and standing is therefore lacking.

This argument cuts right to the heart of the merits of the claim: a Rule 41(g) motion may be denied if the movants are “not entitled to lawful possession of the seized property, the property is contraband or subject to forfeiture or the government’s need for the property as evidence continues.” Chambers, 192 F.3d at 377 (quoting United States v. Van Cauwenberghe, 934 F.2d 1048, 1061 (9th Cir. 1991)). Entitlement to lawful possession is part of what the movants need to prove at the merits stage and the merits are separate from Article III standing. City of Philadelphia v. Sec’y U.S. Dep’t of Interior, 179 F.4th 169, 179 (3d Cir. 2026).

B. Entitlement to Lawful Possession

Generally, a Rule 41(g) motion is denied if the movants are “not entitled to lawful possession of the seized property” or if “the property is contraband or subject to forfeiture.” Chambers, 192 F.3d at 377 (quoting Van Cauwenberghe, 934 F.2d at 1061). Right now, the appellants cannot lawfully receive the waronfakes.com domain, so they cannot establish that they are lawfully entitled to the property under Rule 41(g).

1. Transferability and the Blocked Persons List

When OFAC adds people or entities to the blocked

persons list, “all their assets in the United States or under the control of any person who is in the United States are blocked, or effectively frozen.” Zevallos v. Obama, 793 F.3d 106, 110 (D.C. Cir. 2015) (citation modified). The block is total. Absent

a license or some other sort of relief, the property may not be “dealt in” in any fashion. 31 C.F.R. § 544.201(a). Nor may anyone on the blocked persons list benefit from any funds, goods, or services provided by anyone in the United States unless OFAC licenses the transaction. Id. § 544.201(b), (c).

ANO Dialog is now on the blocked persons list, and Timofey V is an employee of ANO Dialog. The appellants contend that we must evaluate their right to the property based on the circumstances at the time of the seizure and note that ANO Dialog was not on the blocked persons list until five days after the seizure. But ANO Dialog’s designation as a blocked person (or not) had nothing to do with the original seizure. Rather, the seizure was based on Kiriyenko’s designation as a blocked person. Recall the Government’s international money laundering theory: Russia-based registrar Reg.Ru transferred money into the U.S.—to Verisign—for the benefit of Kiriyenko. That, according to the Government, was international money laundering.

The appellants cite Al Haramain Islamic Foundation v. Department of the Treasury, 686 F.3d 965, 980 (9th Cir. 2012), for the proposition that “actions preceding designation cannot be retroactively justified by subsequent designation.” Appellants’ Br. 17. But they do not mention that the property in that case was not seized pursuant to a warrant. Al Haramain, 686 F.3d at 973. The property there was blocked by OFAC “pending an investigation,” and seven months later, the owner was designated a blocked person. Id. Moreover, Al Haramain concerned due process rather than Rule 41(g). The District Court here did not need to address the appellants’ arguments about the validity of the seizure in order to resolve the Rule 41(g) motion. For purposes of the motion, the relevant timeframe was the time of filing rather than the earlier seizure of the domain. And when the motion was filed, the appellants

were not in a position lawfully to possess the domain. To do so, they would have had to conspire with, or aid and abet, a transfer of the blocked property. That type of transfer would violate OFAC’s sanctions and, potentially, IEEPA and the money laundering statutes. The District Court was not at liberty to authorize or order criminal conduct pursuant to Rule 41(g).

Transfer of the waronfakes.com domain is “blocked and effectively frozen,” Zevallos, 793 F.3d at 110, so it cannot be transferred to the appellants. Nor have they obtained a license. At oral argument, counsel confirmed the appellants have not applied for a license, and ANO Dialog has not applied for delisting from the blocked-persons list. Oral Argument Recording at 7:17–7:44. 6

Because the District Court determined the appellants were not entitled to lawful possession, it did not conduct a hearing. The appellants argue it should have done so. The rule provides that “[t]he court must receive evidence on any factual issue necessary to decide the motion.” Fed. R. Crim. P. 41(g). We interpret that language according to its plain meaning: “A hearing is required only if needed to determine a ‘disputed issue of fact necessary to the resolution of the motion.’” Peloro, 488 F.3d at 177 (quoting United States v. Albinson, 356 F.3d 278, 282 (3d Cir. 2004)). It was apparent to the District Court that the appellants were not lawfully entitled to receive a transfer of the property at present because, undisputedly, ANO Dialog is on the blocked-persons list, Timofey V is ANO Dialog’s employee, and neither has a license from OFAC. So, it did not abuse its discretion by declining to hold an evidentiary hearing. Id.; see also United States v. Felici, 208

Available at https://perma.cc/5MGR-QL4K (last

visited Aug. 5, 2026).

F.3d 667, 670 (8th Cir. 2000) (concluding that “[w]hen it is apparent that the person seeking a return of the property is not lawfully entitled to own or possess the property, the district court need not hold an evidentiary hearing”).

Without the ability to lawfully receive the domain, the appellants did not establish in the District Court that they were lawfully entitled to the property as required by Rule 41(g). See Chambers, 192 F.3d at 377.

2. Statutory and Regulatory Exceptions

The appellants also argue that the OFAC sanctions do not block the transfer of the domain to them because the domain falls under IEEPA’s statutory exception for “information or informational materials.” 50 U.S.C. § 1702(b)(3). They assert that IEEPA gives “the Executive substantial authority to confront national emergencies,” but that the statute also explicitly limits the President’s authority to “regulate certain types of information and informational materials.” Appellants’ Br. at 12. According to the appellants, because restricting information is not a power the President has under IEEPA, and because the information provided on waronfakes.com is the applicable type of information, the Government did not have the power to seize the domain in the first place. Id. at 14–15. Alternatively, the appellants argue that the transfer of the domain is authorized by OFAC General License No. 25, which permits ordinary telecommunications transactions. The appellants characterize these arguments together as “free speech” arguments, though the arguments are based on the statutory and regulatory text—not the Constitution. Id. at 11.

The Government contends that the appellants forfeited these arguments because they did not raise them in the District Court. In reply, the appellants point to their brief in opposition

to the Government’s motion to dismiss. There, the appellants argued that the “shutdown” of waronfakes.com was an unconstitutional prior restraint in violation of the First Amendment and violated the website’s readers’ First Amendment rights to receive information. App. 720. But those are different arguments than the ones they make here about IEEPA’s text and OFAC’s General License No. 25.

“It is well established that arguments not raised before the District Court are forfeited on appeal.” In re Niaspan Antitrust Litig., 67 F.4th 118, 135 (3d Cir. 2023) (citation modified). We “may ‘resurrect’ forfeited arguments in ‘extraordinary circumstances.’” United States v. Dowdell, 70 F.4th 134, 140 (3d Cir. 2023) (quoting Wood v. Milyard, 566 U.S. 463, 471 & n.5 (2012)). Arguments are the same if they “depend on the same legal rule or standard” and “the same facts.” United States v. Joseph, 730 F.3d 336, 342 (3d Cir. 2013). The appellants did not mention IEEPA’s “information or informational materials” exception or anything about any OFAC general license in the District Court. The legal rules undergirding these arguments are different from the legal rules governing First Amendment rights. Therefore, the arguments based on IEEPA and General License 25 are forfeited. And there are no “extraordinary circumstances” here that warrant resurrecting them. See Dowdell, 70 F.4th at 140.

C. Reasonableness

This result should not be read as an endorsement of the Government’s indefinite retention of the domain name. “To show an abuse of discretion . . . , appellants must show that the trial court’s action was arbitrary, fanciful or clearly unreasonable.” Stich v. United States, 730 F.2d 115, 118 (3d Cir. 1984) (citation modified). In the context of a Rule 41(g) motion where there has not yet been an indictment or a motion

by the Government for forfeiture, we have said courts should consider the “reasonableness” of the Government’s actions. United States v. 608 Taylor Ave., 584 F.2d 1297, 1304 (3d Cir. 1978). “If the government’s retention is unreasonable considering all circumstances, the district court as a matter of its supervisory powers should order the return of the seized property.” Id.

Here, the Government asserts an “interest in retaining the domain, pending an indictment or forfeiture, to prevent Appellants and their coconspirators from using it again to promote transactions for the benefit of Kiriyenko in violation of U.S. sanctions.” Appellee’s Br. 34. But at oral argument, we learned that the appellants had not heard anything from the Government about their property in the then-twenty months since the seizure. Oral Argument Recording at 4:07–4:37. And the Government did not know when or if any indictment might be forthcoming or if it would formally move for forfeiture of the property. Id. at 16:40-17:20.

The Government contends that its criminal

investigation remains active, and that it is “factually complex, especially compared to some of the cases involving currency seizures, which themselves had longer—but reasonable— delays.” Appellee’s Br. 36. Indeed, the Supreme Court has held in one case that a delay of eighteen months between seizure and the initiation of forfeiture proceedings was not unreasonable. See United States v. $8,850 in U.S. Currency, 461 U.S. 555, 567–69 (1983). But no indictment and no communication with the property owner for more than twenty months would seem to be approaching the limits of reasonableness. See Lindell v. United States, 82 F.4th 614, 621–22 (8th Cir. 2023). The timing and substance of the Treasury Department’s handling of any relevant applications for licenses or de-listing in the future would also be relevant to

the reasonableness inquiry in a Rule 41(g) motion. However, because no such applications have been filed up to this point, and the appellants were not lawfully entitled to the property when they filed the motion, see Chambers, 192 F.3d at 377, the District Court’s decision was not “arbitrary, fanciful or clearly unreasonable,” Stich, 730 F.2d at 118 (citation modified).

IV.

The appellants claim a possessory interest sufficient for standing, but because they did not establish that they were lawfully entitled to the property, we will affirm.

Timofey V v. United States

Authorities cited

Opinion · public domain