United States v. Lindsley ( 2001 )

IN THE UNITED STATES COURT OF APPEALS
FOR THE FIFTH CIRCUIT
_____________________
No. 99-11164
_____________________
UNITED STATES OF AMERICA
Plaintiff - Appellee
v.
COREY LINDSLEY, also known as Tabbas
Defendant - Appellant
_________________________________________________________________
Appeal from the United States District Court
for the Northern District of Texas
_________________________________________________________________
May 3, 2001
Before KING, Chief Judge, and ALDISERT* and BENAVIDES, Circuit
Judges.
PER CURIAM:**
Defendant-Appellant Corey Lindsley pleaded guilty to one
count of trafficking in unauthorized computer access devices and
one count of computer fraud and was sentenced to a forty-one
month term of imprisonment. Lindsley appeals the district
*
Circuit Judge of the Third Circuit, sitting by
designation.
**
Pursuant to 5TH CIR. R. 47.5, the court has determined
that this opinion should not be published and is not precedent
except under the limited circumstances set forth in 5TH CIR. R.
47.5.4.
court’s imposition of a twelve-point sentencing enhancement as a
result of a loss finding exceeding $1,500,000. For the following
reasons, we AFFIRM the sentence.
I. FACTUAL AND PROCEDURAL HISTORY
A. The Charge
On May 3, 1999, Corey Lindsley1 pleaded guilty to one count
of trafficking in unauthorized computer access devices in
violation of 18 U.S.C. § 1029(a)(3), (c)(1), and (c)(2), and one
count of computer fraud in violation of 18 U.S.C. § 1030(a)(4),
(c)(2), and (c)(3)(A). According to the Factual Resume filed
with the district court on May 3, 1999, Lindsley stipulated that,
from October 1994 through approximately February 22, 1995, he and
his co-defendants Jonathan Bosanac and Calvin Cantrell used their
personal computers to illegally access Sprint Corporation’s
(“Sprint”) computer system for the purpose of obtaining something
of value. Lindsley specifically stipulated to two particular
incidents. In one, Lindsley downloaded, possessed, and stole
more than fifteen unauthorized access devices, which were in this
case, Sprint calling card numbers. In the second incident,
Lindsley admitted to calling Cantrell from Lindsley’s parents’
1
In the Appellant’s brief, Appellant’s last name is
spelled “Lindsly.” He is also known by the nickname “Tabbas.”
For the purposes of this opinion, we will refer to him as
“Lindsley.”
2
home in Colorado and asking Cantrell to send him calling card
numbers. Cantrell then illegally entered Sprint’s computer
system and downloaded2 858 Sprint calling card numbers that he
subsequently uploaded3 to Lindsley’s computer.
A sentencing hearing was held on September 16, 1999.
B. The Presentence Report
According to the information contained in the Presentence
Report (“PSR”), the two occasions to which Lindsley stipulated
were but a part of a larger operation that occurred between
August 1994 and February 1995. The PSR provided further detail
about Lindsley’s and his co-defendants’ activities in connection
with this operation. For example, according to the PSR, Lindsley
admitted to gaining illegal access to the computer systems of
Southwestern Bell (“Bell”), General Telephone Company (“GTE”),
Pacific Bell, Bell Atlantic, Southwestern Bell Mobility, Sprint,
and US West. Further, Lindsley revealed that he had probably set
up over fifty conference calls that were billed to innocent third
parties. The PSR stated that the calculable loss to the
companies, specifically Sprint, GTE, and Bell, was $1,851,780.4
2
The term “download” refers to the process of
transferring data files from a remote computer to a local
computer.
3
The term “upload” refers to the process of transferring
data files from a local computer to a remote computer.
4
The PSR does not discuss the losses of the other four
companies.
3
This figure included a Bell loss of $684,780, a GTE loss of
$214,000, and a Sprint loss of $953,000.
The PSR set Lindsley’s base offense level at III and
recommended a twelve-point enhancement based on a proposed
finding that the loss attributable to Lindsley was $1,851,780.
This gave Lindsley a total offense level of nineteen, which
results in an imprisonment range of thirty-seven to forty-six
months.
Lindsley objected to the PSR arguing that the loss
calculation was excessive, in part because it took into account
consequential damages. In response, the probation officer stated
that the loss amount was obtained from the government and the
case agent and verified by the companies.
C. The Sentencing Hearing
The sentencing hearing focused primarily on whether it was
foreseeable that Lindsley’s co-defendants would sell the stolen
Sprint calling card numbers and on the amount of loss caused by
both Lindsley’s conduct and the foreseeable conduct of his co-
defendants. At the sentencing hearing, the government called
several witnesses. The case agent, FBI Special Agent Michael
Morris, testified that, based on the evidence, he considered
Lindsley to have the most knowledge on the telecommunications
side, to have the most knowledge of the number of conspirators
and their identity, and to have been aware that other members of
the group were selling calling card numbers. Morris also
4
testified as to the $214,000 loss sustained by GTE, stating that
according to a memorandum from GTE, the company had incurred a
loss of $23,500.65 from conference calls made by the defendants
as well as additional losses.5
Regarding Sprint’s claimed losses of $953,000, the
government introduced a letter from Sprint and the testimony of
its director of security Cloyce Fleming. Fleming testified that
Sprint had calculated the loss at $955,965.356 by adding up the
reported unauthorized use for which Sprint had credited
cardholders’ accounts. Sprint included only the reported
unauthorized use from those accounts that the FBI identified as
being downloaded or uploaded from Cantrell’s line.7
Additionally, Fleming testified regarding a second document,
which revealed a large increase in reported fraudulent use during
the time of the defendants’ activities.
5
At trial, however, a memo from GTE stated its total
losses were $97,430.65, including $23,530.65 for eleven
fraudulently billed conference calls and $73,900 in investigation
expenses. This does not reach the total of $214,000 claimed in
the PSR.
6
Nothing in the record explains the difference between
the $953,000 figure and the $955,965.35.
7
During his testimony, Morris explained that a court-
ordered wiretap was placed on Cantrell’s phone lines that
captured, inter alia, the data transmissions and the downloading
of information from the telecommunication service providers’
databases. From the wiretap, the FBI compiled a database of 6679
readable credit card numbers that were downloaded or uploaded
while the wiretap was in progress. Sprint identified 2129
accounts on which account holders had reported unauthorized use
and for which Sprint had credited their accounts.
5
Finally, Ronald Youngclaus testified at sentencing regarding
Bell’s claimed $684,240 in losses. According to a letter
submitted by Bell, this figure included $27,370 for the cost of
labor to investigate the damage done to the company’s systems,
$8,464 in labor to restore the systems to their original
integrity, and $10,392 to replace the damaged BIGBIRD system.
Furthermore, the letter identified a cost of $628,014 to obtain
12,775 “smart cards” for the systems that had been compromised by
the defendants. Youngclaus testified that these smart cards were
the only way to protect the system from the “sniffers”8 that the
defendants had planted in the system. During cross-examination,
however, Youngclaus admitted that the cards served to make sure
the intrusion did not happen again.
Crediting the testimony of the government witnesses and the
calculations contained in the PSR, the district court found that
the loss figure was $1,851,857. Accordingly, the court concluded
that the loss attributable to Lindsley exceeded $1.5 million,
resulting, pursuant to the United States Sentencing Guidelines
(“U.S.S.G.”), in a twelve-point enhancement. The district court
sentenced Lindsley to forty-one months imprisonment (in the
middle of the thirty-seven to forty-six month guideline range)
8
“Sniffer” refers to “sniffer programs,” which are placed
in a computer system and capture individual’s log-on names and
passwords. If the individual changes his or her log-on name and
password, the “sniffer” will capture those changes and place the
new information in a file for the computer hacker.
6
because Lindsley had not committed any other crimes since the
offense. In its Statement of Reasons, the district court adopted
the factual findings and guideline application of the PSR.
Lindsley timely appeals.
II. COST OF SMART CARDS
Lindsley argues that the district court misapplied U.S.S.G.
§ 2F1.1 by including in the amount of loss the cost of the smart
cards purchased by Bell. Lindsley contends that the smart cards
did not simply restore the security of the Bell computer systems,
but rather increased the security of the system beyond the level
that existed at the time of the offense. As such, their cost is
a consequential damage and consequential damages should not be
included in the loss valuation in this circumstance. The
government asserts that the security smart cards were properly
included in the loss calculation because they were the only means
available to prevent continued intrusion into Bell’s computer
systems caused by the defendants’ activities. For this reason,
the smart cards merely repaired the system by restoring the
systems to their prior condition.
We review the district court’s interpretation and
application of the sentencing guidelines de novo and its factual
findings in connection with sentencing for clear error. See
United States v. Morrow, 177 F.3d 272, 300 (5th Cir. 1999);
7
United States v. Parker, 133 F.3d 322, 329 (5th Cir. 1998). A
factual finding is not clearly erroneous, and therefore not
subject to reversal, as long as it is plausible in light of the
record as a whole. See United States v. Morris, 46 F.3d 410, 419
(5th Cir. 1995).
The commentary to the guideline concerning U.S.S.G. § 2F1.1
defines “loss” as “the value of the money, property, or services
unlawfully taken.” U.S. SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 7
(1994)9; see also United States v. Izydore, 167 F.3d 213, 223
(5th Cir. 1999). Typically, the calculation of loss does not
include the victim’s consequential or incidental losses. See
Izydore, 167 F.3d at 223. Section 2F1.1 incorporates the
valuation of loss definition of U.S.S.G. § 2B1.1, see U.S.
SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 7 (1994), which provides:
“When property is damaged, the loss is the cost of repairs, not
to exceed the loss had the property been destroyed.” U.S.
SENTENCING GUIDELINES MANUAL § 2B1.1, cmt. 2 (1994). Accordingly,
whether the cost of the smart cards was properly included in the
loss valuation depends on whether the cards were necessary to
repair the damage to the system caused by the defendants.
9
We will apply the U.S.S.G. in effect at the time of
the offense. A sentencing court must apply the version of the
guidelines in effect at the time of sentencing unless such
application would violate the Ex Post Facto Clause. See United
States v. Greer, 158 F.3d 228, 234 n.4 (5th Cir. 1998). If
applying the guidelines in effect at the time of sentencing would
violate the Ex Post Facto Clause, the court should apply the
guidelines in effect at the time of the offense. See id.
8
In 1997, the U.S.S.G. were amended to include specific
guidance as to the measurement of loss in certain computer
offenses. Although not controlling, subsequent versions of the
U.S.S.G. may be considered in interpreting prior versions. See
United States v. Armstead, 114 F.3d 504, 508 n.1 (5th Cir. 1997)
(“According to U.S.S.G. § 1B1.11(b)(2), we are to consider
subsequent clarifying amendments to the Guidelines.”). The 1997
U.S.S.G. provide:
In an offense involving unlawfully accessing, or
exceeding authorized access to, a “protected computer”
as defined in 18 U.S.C. § 1030(e)(2)(A) or (B), “loss”
includes the reasonable cost to the victim of
conducting a damage assessment, restoring the system
and data to their condition prior to the offense, and
any lost revenue due to interruption of service.
U.S. SENTENCING GUIDELINES MANUAL § 2B1.1, cmt. 7 (1997).
If the cost of the smart cards was the “reasonable cost to
[Bell] of . . . restoring the system and data to their condition
prior to the offense,” id., it was properly included, as the cost
of repairing the damaged system, in the loss valuation. Lindsley
argues that the cards constituted an improvement to the system
and did more than return it to its condition prior to the offense
because the system was vulnerable to the sniffers prior to the
defendants’ activities. However, Youngclaus testified that the
defendants penetrated deeply into the Bell computer system, that
Bell located many of the sniffers but could not be sure it found
all of them, and that “[t]here was no other way [to return this
system to its original integrity before the day it was hacked by
9
this group] other than putting smart card technology in place
because of the proliferation of sniffers in [Bell’s] network.”
Based on the record as a whole, we do not find the district
court’s factual finding regarding the cost of repairing the Bell
computer system to be clear error.
III. SPECIFIC FINDING OF LOSS
Lindsley argues that although the district court concluded
that the total loss caused by the defendants was $1,851,780, it
only found him responsible for some amount over $1.5 million.
Lindsley contends that the district court’s failure to make a
finding of the specific amount of loss attributable to Lindsley
violates Federal Rule of Criminal Procedure 32(c)(1)10 and
Lindsley’s due process right to notice of the grounds on which
the district court based its guideline determination. The
government contends that the judge found Lindsley responsible for
the entire amount of loss, as it was the result of foreseeable
conduct of all the defendants, and properly used the $1.5 million
figure because it was the threshold figure for the offense level
enhancement.
10
Federal Rule of Criminal Procedure 32(c)(1) requires:
“For each matter controverted, the court must make either a
finding on the allegation or a determination that no finding is
necessary because the controverted matter will not be taken into
account in, or will not affect, sentencing.” FED. R. CRIM. P.
32(c)(1).
10
“We review de novo whether a district court complied with a
Federal Rule of Criminal Procedure.” United States v. Myers, 150
F.3d 459, 461 (5th Cir. 1998). Although Rule 32 requires the
court to make findings regarding any controverted facts in the
PSR, this circuit has “rejected the proposition that a court must
make a ‘catechismic regurgitation of each fact determined,’”
United States v. Carreon, 11 F.3d 1225, 1231 (5th Cir. 1994)
(quoting United States v. Sherbak, 950 F.2d 1095, 1099 (5th Cir.
1992)), and “we have allowed the district court to make implicit
findings by adopting the PSR.” Id. Furthermore, “[t]his
adoption will operate to satisfy the mandates of Rule 32 when the
findings in the PSR are so clear that the reviewing court is not
left to ‘second-guess’ the basis for the sentencing decision.”
Id. (quoting United States v. Hooten, 942 F.2d 878, 881 (5th Cir.
1991)).
The district court found:
However, the presentence report in Mr. Cantrell’s
case, like the presentence report in Mr. Lindsley’s
case, specifically finds, and I find that the probation
officer reached the correct conclusion that the total
amount of loss for all of the defendants involved in
this is $1,851,787. Indeed, that’s reflected in the
restitution calculations where it shows a 1.8 million
dollar figure. Although that wasn’t ordered as
restitution for Mr. Cantrell and won’t be either for
Mr. Lindsley, I simply note that the evidence does
sustain a substantial loss figure. I think it sustains
a loss figure of at least 1.85 million dollars.
The government takes the position today that the
court should at least find that the loss figure
exceeded 1.5 million and I do on the credible evidence
that was presented to me.
11
We find no error. The district court expressly adopted the
findings of the PSR and found Lindsley responsible for a loss
valued at $1,851,787. This finding satisfies the mandate of Rule
32. The $1.5 million dollar figure was used simply to identify
the loss category in which the $1,851,787 loss placed Lindsley’s
offense.11
IV. EVIDENCE TO SUPPORT LOSS VALUATION
Lindsley argues that the losses claimed by GTE and Sprint
are based on conclusory statements and unaccompanied by any
documentation.12 To rely on such speculative and undocumented
evidence, he continues, would violate the standard of proof
11
In support of his argument, Lindsley cites United States
v. Aubrey, 878 F.2d 825 (5th Cir. 1989). We do not agree that
Aubrey controls. In Aubrey, the PSR estimated the loss
attributable to the defendant at over $3 million. See id. at
828. The defendant challenged the $3 million figure, and the
district court found it to be inflated. See id. “However, the
judge made no specific finding regarding the loss; rather, he
mused that the figure ‘had to be well over a million dollars.’”
Id. In holding that the finding did not comport with Rule 32,
this court noted that “[g]iven the disparity between the
government’s figure and appellant’s, it was not sufficient for
the court simply to guess at a figure somewhere between the two
and then characterize that as a ‘finding’ as to the matter
controverted.” Id. Unlike the district court in Aubrey, the
district court here did not find the $1,851,787 figure to be
inflated. The district court in this case simply found that the
loss figure was correct at $1,851,787, which placed the loss
within the special offense characteristic category of a loss
exceeding $1.5 million.
12
Lindsley did not object to any of the claimed losses by
Bell, other than the cost of the smart cards discussed supra in
Part III.
12
required for such a substantial sentence enhancement. The
government argues that the evidence was not insufficient or
speculative and that actual losses were likely much higher.
The government has the burden of proving by a preponderance
of the evidence the facts necessary to support an increase in
sentence level. See United States v. Sanders, 942 F.2d 894, 897
(5th Cir. 1991).13 “The sentencing court ‘need not determine the
loss with precision,’ as long as its estimate is ‘reasonable
. . . given the available information.’” United States v.
Humphrey, 104 F.3d 65, 71 (5th Cir. 1997) (quoting U.S. SENTENCING
GUIDELINES MANUAL § 2F1.1, Application Note 8); see also U.S.
SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 8 (1994). “In resolving
any reasonable dispute concerning a factor important to the
sentencing determination, the court may consider relevant
information without regard to its admissibility under the rules
of evidence applicable at trial, provided that the information
13
Lindsley argues that, because the twelve-point
enhancement turned a four-to-ten month sentence into a thirty-
seven-to-forty-six month sentence, a clear and convincing
standard may be more appropriate, or even constitutionally
required. However, the correct standard in this circuit remains
a preponderance of the evidence standard. In United States v.
Mergerson, 4 F.3d 337 (5th Cir. 1993), this court acknowledged
that in certain cases “where a sentencing fact is a ‘tail that
wags the dog of the substantive offense,’” a finding of beyond a
reasonable doubt might be required. See id. at 344. However, in
United States v. Carreon, 11 F.3d 1225 (5th Cir. 1994), this
court found the difference between a sentence of six years and
one of twenty years “d[id] not constitute such a dramatic effect
that it would justify considering, much less imposing, the higher
burden of proof.” Id. at 1240. It is similarly unjustified in
this situation.
13
has sufficient indicia of reliability to support its probable
accuracy.” U.S. SENTENCING GUIDELINES MANUAL § 6A1.3(a) (1994).
“Facts contained in a PSR are considered reliable and may be
adopted without further inquiry if the defendant fails to present
competent rebuttal evidence.” United States v. Parker, 133 F.3d
322, 329 (5th Cir. 1998); see also United States v. Sidhu, 130
F.3d 644, 651 (5th Cir. 1997). “If information is presented to
the sentencing judge with which the defendant would take issue,
the defendant bears the burden of demonstrating that the
information cannot be relied upon because it is materially
untrue, inaccurate, or unreliable.” United States v. Angulo, 927
F.2d 202, 205 (5th Cir. 1991). “Mere objections do not suffice
as competent rebuttal evidence.” Parker, 133 F.3d at 329.
Lindsley alleges that the Sprint losses of $953,000 are
conclusory and not supported by any documentation. In addition
to that amount of loss being stated in the PSR, Fleming, a Sprint
employee, testified as to Sprint’s losses. Further, a letter
provided by Sprint indicated that the amount of phone card fraud
suffered by Sprint was $955,965.35. The letter and Fleming’s
testimony indicate that the loss was calculated by tabulating the
amount of fraud that had been reported on the account numbers
provided to Sprint by the FBI. See supra note 3. Lindsley
provided no evidence to rebut the amount of loss alleged by
Sprint. We find that Lindsley has failed to demonstrate that the
14
evidence relied upon to establish the amount of the Sprint loss
is materially untrue, inaccurate, or unreliable.
Lindsley also challenges the evidence supporting the losses
claimed by GTE. According to the PSR adopted by the district
court, GTE attributed $214,000 of losses to the Lindsley.
Lindsley claims that only $23,530.65 of those losses was
supported by evidence at the sentencing hearing. We need not
address the sufficiency of the evidence to support the claimed
GTE losses. Even disallowing all of GTE’s losses over the cost
of the conference calls, to which Lindsley does not object, the
district court’s sentence withstands our clear error review.
Because the district court judge adopted the total PSR finding of
$1,851,787, subtracting the additional $190,469.35 would not
reduce the loss finding below the $1.5 million required for the
twelve-point increase.
We find that the evidence was sufficient to support the
district court’s loss finding.
V. DISTRICT COURT’S COMMENTS
Lindsley makes a final argument regarding allegedly improper
comments made by the district court. The full text of the
remarks to which Lindsley objects are as follows:
MS. AINSLIE: . . . . [The hackers] were --
considered themselves to be above other hacking groups
because they were not in it for the money. They were
not trying to -- this was a group that did it for the
15
fun of it, I hate to say. You know, it’s a very
perverted sense of idea of fun, but they were there to
show off to each other -- for the mental stimulation,
for the challenge of it.
THE COURT: Mr. Rupp, the public defender, is a
very good lawyer. He pled his client to a substantial
loss. It wasn’t like it was fun and games.
MS. AINSLIE: I’m sorry?
THE COURT: I said it wasn’t like it was fun and
games. He didn’t make that argument. I’m talking
about the co-defendant who pled guilty.
MS. AINSLIE: I understand.
THE COURT: He’s a very fine lawyer.
MS. AINSLIE: Oh, absolutely, Your Honor, and I’ve
talked to him.
THE COURT: He negotiated a loss figure that was
substantially higher than what you’re arguing.
Lindsley argues that these comments by the district court
were improper and indicated that the district court relied on
matters outside the record, namely Cantrell’s stipulated loss
amount and the reputation of his counsel, in making its finding
of loss. Specifically, Lindsley asserts that trial counsel did
not have a reasonable opportunity to respond to that evidence and
that those facts should not have been considered in Lindsley’s
sentencing. The government contends that the comments made by
the district court were made in response to allegations that the
computer hacking was for fun, and therefore, the district court’s
response that the co-defendant had admitted to a profit motive
was not improper. Furthermore, the government argues that even
16
if some of the remarks were improper, the remarks alone are
insufficient to require reversal on plain error.
“A federal district judge may comment on the evidence,
question witnesses, [and] bring out facts not yet adduced. . . .
‘Improper’ comments by a trial judge do not entitle the defendant
to a new trial unless the comments are error that is substantial
and prejudicial to the defendant’s case.” United States v.
Wallace, 32 F.3d 921, 928 (5th Cir. 1994) (citations omitted).
Furthermore, a sentencing court may rely on any evidence that has
“sufficient indicia of reliability,” United States v. Huskey, 137
F.3d 283, 291 (5th Cir. 1998), and testimony from the trial of a
third party is not barred as a matter of law. See United States
v. Ramirez, 963 F.2d 693, 708 (5th Cir. 1992). As Lindsley’s
trial counsel did not object to these comments, we review
Lindsley’s claim under the plain error doctrine. See United
States v. Carpenter, 776 F.2d 1291, 1295 (5th Cir. 1985).
We have reviewed the record, and we do not find the comments
of the trial judge to be improper. Lindsley’s counsel was
suggesting that the defendants were not committing these acts for
profit, and the judge’s comments merely reflected that at least
one of his co-defendant’s viewed the matter differently. We find
that the district court’s comments do not amount to error that is
substantial and prejudicial to the defendant’s case, and
therefore, any error does not rise to the level of plain error.
17
VI. CONCLUSION
For the foregoing reasons, we AFFIRM the sentence given by
the district court.
18