United States v. Volodymyr Kvashuk ( 2022 )


Menu:
  •                    FOR PUBLICATION
    UNITED STATES COURT OF APPEALS
    FOR THE NINTH CIRCUIT
    UNITED STATES OF AMERICA,                 No. 20-30251
    Plaintiff-Appellee,
    D.C. No.
    v.                   2:19-cr-00143-JLR-1
    VOLODYMYR KVASHUK,
    Defendant-Appellant.                OPINION
    Appeal from the United States District Court
    for the Western District of Washington
    James L. Robart, District Judge, Presiding
    Argued and Submitted October 7, 2021
    Seattle, Washington
    Filed March 28, 2022
    Before: Richard A. Paez, Milan D. Smith, Jr., and
    Jacqueline H. Nguyen, Circuit Judges.
    Opinion by Judge Nguyen
    2                 UNITED STATES V. KVASHUK
    SUMMARY *
    Criminal Law
    The panel affirmed Volodymyr Kvashuk’s conviction on
    18 fraud-related counts in a case in which Kvashuk stole $10
    million in digital gift cards from his employer, Microsoft,
    using login credentials he filched from his coworkers.
    Kvashuk challenged the denial of his motion to suppress
    evidence seized from his house on the ground that the search
    warrant lacked probable cause, arguing that the warrant
    affidavit failed to establish a nexus between the unlawful
    activities and the places to be searched. Considering the
    totality of the circumstances, the panel concluded that the
    search warrant affidavit showed a fair probability that
    evidence of Kvashuk’s crimes would be found on a
    computer at his residence, and that there was therefore an
    adequate nexus between the unlawful activities and the place
    to be searched. The panel rejected Kvashuk’s argument that
    the evidence supporting the application was stale. Rejecting
    Kvashuk’s challenge to the district court’s denial of his
    request for a hearing under Franks v. Delaware, 
    438 U.S. 154
     (1978), the panel wrote that Kvashuk identified no false
    or misleading statement in the affidavit, let alone one that the
    affiant made intentionally or recklessly.
    Kvashuk contended that his two convictions for
    aggravated identity theft, which stem from his use of
    coworkers’ accounts intended for testing the Microsoft
    Universal Store, are infirm because the test accounts do not
    *
    This summary constitutes no part of the opinion of the court. It
    has been prepared by court staff for the convenience of the reader.
    UNITED STATES V. KVASHUK                    3
    constitute a “means of identification” under 18 U.S.C.
    § 1028A(a)(1), in that the accounts do not “identify a
    specific individual.” Rejecting this contention, the panel
    wrote that the test accounts’ purpose, prerequisites, and
    functionality do not bear on whether they “identify a specific
    individual”; that the test accounts here could be and did
    identify specific employees; and that the Universal Store
    team’s limited sharing of test accounts and passwords was
    insufficient to differentiate the test accounts from any other
    business email account associated with a specific person.
    Kvashuk contended that the district court violated his
    due process rights by preventing him from presenting a
    complete defense—in particular, by excluding evidence of
    his status in the United States as an asylum applicant from
    Ukraine. He argued that his sole defense to the prosecution’s
    theory that he used crypto currency to conceal the money
    trail from his crime was that he did not intend to defraud
    Microsoft but used Bitcoin as an asylum seeker to avoid
    detection by the Ukrainian government. The panel wrote
    that while testifying about his asylum status might have
    strengthened his defense that he did not defraud Microsoft,
    Kvashuk was able to raise the defense without it. The panel
    held that the district court did not abuse its discretion in
    concluding that any additional probative value in disclosing
    Kvashuk’s immigration status would be substantially
    outweighed by the danger of unfair prejudice from the jury’s
    knowledge that he could suffer immigration consequences if
    convicted on the charges.
    Kvashuk contended that the district court should have
    dismissed a juror because the juror had experience with the
    Universal Store team. The panel wrote that merely working
    for the same large organization as the defendant is an
    insufficient basis for implied bias, and concluded that
    4               UNITED STATES V. KVASHUK
    because the juror’s personal experience on the Universal
    Store team was not similar or identical to the fact pattern at
    issue in the trial, the district court properly denied the motion
    to remove him.
    COUNSEL
    Joshua Sabert Lowther (argued), Lowther Walker LLC,
    Atlanta, Georgia, for Defendant-Appellant.
    Michael Dion (argued), Assistant United States Attorney;
    Tessa M. Gorman, Acting United States Attorney; United
    States Attorney’s Office, Seattle, Washington; for Plaintiff-
    Appellee.
    OPINION
    NGUYEN, Circuit Judge:
    Volodymyr Kvashuk stole $10 million in digital gift
    cards from his employer, Microsoft, using login credentials
    he filched from his coworkers. Microsoft uncovered
    Kvashuk’s scheme and fired him after noticing unusual gift
    card redemption activity.
    Unbeknownst to Kvashuk, Microsoft also referred the
    matter to law enforcement. Over the next 13 months, the
    Internal Revenue Service (“IRS”) investigated both the gift
    card theft and Kvashuk’s failure to report the illegal income
    on his tax returns. Government agents recovered additional
    evidence when they executed a search warrant on Kvashuk’s
    home and vehicle.
    UNITED STATES V. KVASHUK                    5
    In this appeal from his conviction for 18 fraud-related
    counts, Kvashuk contends that: the search warrant lacked
    probable cause; his coworkers’ login credentials were not a
    “means of identification,” 18 U.S.C. §1028A(a)(1); the
    exclusion of evidence that he had applied for asylum
    prevented him from presenting a complete defense; and the
    district court should have dismissed a juror who worked for
    the same team at Microsoft. None of these contentions has
    merit. Therefore, we affirm the district court’s judgment.
    I. Background
    A. Kvashuk’s Employment at Microsoft
    Kvashuk grew up in Ukraine and came to the United
    States in 2015 at age 21. In August 2016 he landed his first
    job in the tech industry as a software engineer at Microsoft’s
    Redmond, Washington campus. For roughly the first year,
    he worked as a contractor, and after a two-month hiatus, he
    returned to Microsoft as a direct employee in December
    2017.
    Kvashuk worked on various projects involving the user
    experience at the Universal Store. The Universal Store is
    Microsoft’s online portal for selling computer hardware,
    television shows, movies, games, and applications. It is
    universally available on devices running a Microsoft
    operating system, such as a Windows PC, an Xbox game
    console, or a Windows phone, but anyone with access to the
    internet and an email address can create an account and place
    an order.
    Software engineers working on the Universal Store team
    (“UST”) wrote and tested code. Most testing was performed
    “in production”—i.e., using the code version that an end user
    would experience. UST members tested the steps that a user
    6              UNITED STATES V. KVASHUK
    would go through to purchase a product at the Universal
    Store—the user’s “purchase flow”—by creating test
    accounts. Test accounts were the same as any other
    Universal Store account, with three main exceptions.
    First, the email addresses used for test accounts started
    with “mstest_” followed by an alias selected by the
    individual tester. For example, Kvashuk’s test account was
    mstest_v-vokvas@outlook.com.
    Second, Microsoft provided UST members with special
    credit cards (“test-in-production” or “TIP” cards) for use
    with the test accounts. TIP cards were not real credit cards—
    no bank would honor them—but the Universal Store
    accepted the cards as a means of payment without submitting
    the transaction to a bank for processing. Thus, TIP cards
    allowed software engineers to test the Universal Store
    purchase flow without money changing hands.
    Third, Microsoft suppressed the shipment of any
    physical goods ordered from a test account. Crucially,
    however, this safeguard did not apply to digital gift cards
    delivered via email.
    A digital gift card is a token—a 25-character code
    broken into five groups of five characters separated by
    hyphens—that can be redeemed for a specified amount of
    credit (“currency stored value” or “CSV”) at the Universal
    Store. A digital gift card purchaser need not redeem the
    token herself; anyone with a Universal Store account can
    redeem it.
    B. Microsoft’s Investigation
    In February 2018, Microsoft’s fraud investigation strike
    team (“FIST”) noticed a suspicious spike in Xbox Live
    UNITED STATES V. KVASHUK                            7
    subscriptions paid for with CSV. The FIST traced the CSV
    to tokens ordered through two test accounts:
    mstest_sfwe2eauto@outlook.com, which belonged to UST
    member Andre Chen, and mstest_avestu@outlook.com,
    which belonged to UST member Roy Morey.
    Microsoft suspended these two test accounts on March
    15, 2018, and cancelled any unredeemed tokens purchased
    through them. At the time, the FIST believed that an outside
    actor had ordered the tokens because the IP addresses
    associated with the transactions were external to Microsoft, 1
    and the FIST investigator who interviewed Chen and Morey
    did not suspect their involvement.
    On March 22, 2018, the FIST noticed another spike in
    CSV purchases traceable to a third test account:
    mstest_zabeerj2@outlook.com, which belonged to UST
    member Zabeer Jainullabudeen. These transactions were
    made from a device using the same hosting IP company as
    the transactions that originated from the sfwe2eauto and
    avestu test accounts. The next day, Microsoft suspended the
    zabeerj2 test account and cancelled the unredeemed tokens
    purchased through it. In all, $10 million worth of tokens was
    stolen through the three test accounts, and Microsoft
    cancelled only $1.8 million worth before the tokens were
    redeemed for CSV, resulting in a loss to the company of
    approximately $8.2 million.
    Microsoft came to suspect Kvashuk when the FIST
    searched for other accounts that had accessed the Universal
    Store from the IP addresses used to steal CSV. Multiple IP
    1
    An Internet Protocol (“IP”) address is a numerical label assigned
    to each device that is connected to a computer network that accesses the
    internet.
    8                 UNITED STATES V. KVASHUK
    addresses associated with the sfwe2eauto or avestu test
    accounts were also associated with Kvashuk’s v-vokvas test
    account,       his      personal       Outlook     account
    (safirion@outlook.com), and his personal Gmail account, 2
    as well as an additional account: pikimajado@tinoza.org.
    Kvashuk’s v-vokvas test account, the pikimajado
    account, and another account—xidijenizo@axsup.net—
    were also linked to the sfwe2eauto and avestu test accounts
    through the same “fuzzy device ID.” A fuzzy device ID is a
    “fairly unique” identifier generated by Microsoft—a string
    of information that identifies characteristics about the user’s
    browser, operating system, and other attributes. According
    to Microsoft, it is “theoretically possible” but “very
    unlikely” that two different devices would have the same
    fuzzy device ID.
    Microsoft discovered that in October 2017, Kvashuk’s
    v-vokvas test account ordered a single token that another
    account, linked to an email address at searchdom.io,
    redeemed for a subscription to Microsoft Office. Kvashuk
    was a registered owner of searchdom.io. Two weeks later,
    the v-vokvas test account ordered tokens worth
    approximately $10,000, of which approximately $2,500 was
    redeemed for CSV in the Universal Store by accounts linked
    to the pikimajado and xidijenizo email accounts. These two
    accounts used the CSV to purchase graphics cards and ship
    them to “Grigor Shikor” at Kvashuk’s apartment complex.
    2
    Microsoft knew Kvashuk’s personal Gmail account from his
    resume. Microsoft deduced that the safirion account belonged to
    Kvashuk because the name on the account was “volo kv” (i.e., the first
    few letters of Kvashuk’s first and last names) and one of the mailing
    addresses for the account was the apartment where Kvashuk lived until
    April 2018.
    UNITED STATES V. KVASHUK                             9
    In two interviews, Kvashuk admitted to Microsoft
    investigators that he had used his test account to generate
    tokens, which he claimed he redeemed to watch movies. He
    also admitted purchasing a graphics card on the Universal
    Store using CSV he obtained from the test account. He
    claimed that he had wanted to see whether it was possible to
    order physical items that way but that the graphics card never
    arrived. 3 When asked if he knew Grigor Shikor, Kvashuk
    first told the investigators, “It’s complicated,” and then
    denied knowing him.
    Microsoft terminated Kvashuk’s employment in June
    2018 and informed the Department of Justice about the
    stolen CSV.
    C. Kvashuk’s Criminal Prosecution
    The government learned additional details through its
    investigation. The name on Kvashuk’s phone account was
    Grigory Kvashuk. Many of the IP addresses Kvashuk used
    to access the Universal Store belonged to a company
    operating a virtual private network (“VPN”). 4
    3
    Evidence in the record suggests that the graphics card was indeed
    delivered to Kvashuk’s apartment complex even though the specific
    apartment number to which it was shipped did not exist.
    4
    When an internet user connects to a website via a VPN, it will
    appear to the website (which may be recording the user’s IP address) that
    the user is connecting via the VPN’s IP address rather than the IP address
    of the device where the user is located. Thus, a VPN is a tool that
    provides a degree of privacy. It has many legitimate uses, such as
    securing corporate data, preventing advertisers from collecting personal
    information, and avoiding suppression and censorship by foreign
    governments. A VPN can also be used by criminals to conceal their
    involvement in cybercrime, as the government argued Kvashuk did here.
    10               UNITED STATES V. KVASHUK
    Kvashuk also had sudden, unexplained wealth. His
    salary at Microsoft was $116,000, and his bank account at
    Wells Fargo had a balance of less than $20,000 until late
    November 2017. Between November 2017 and May 2018,
    Kvashuk transferred over $2.8 million from a
    cryptocurrency account he held at Coinbase.com into his
    bank account. By examining the Bitcoin blockchain (a
    public ledger of Bitcoin transactions), the government
    determined that the Bitcoin deposits in Kvashuk’s Coinbase
    account came from a mixing service, which obscures the
    Bitcoin’s source by mixing potentially identifiable Bitcoin
    with other Bitcoin. Kvashuk used the cash from his
    Coinbase account to purchase a $162,000 Tesla Model S in
    March 2018 and, three months later, a $1.675 million house
    on the shore of Lake Washington.
    Through a search warrant served on Google, the
    government obtained Kvashuk’s Gmail messages and
    internet search history and learned that Kvashuk had been
    selling the stolen tokens on a Paxful account. Paxful.com is
    a peer-to-peer Bitcoin marketplace that allows users to
    exchange Bitcoin for gift cards, among other things.
    Kvashuk’s chats on Paxful with purchasers of the gift card
    tokens revealed that he received 55 to 60 cents worth of
    Bitcoin for every dollar of CSV that he sold.
    The government subsequently executed a search warrant
    on Kvashuk’s lakefront house and car and seized additional
    evidence tying Kvashuk to the stolen CSV. Kvashuk was
    Many Microsoft employees used the same VPN as Kvashuk. The VPN
    assigned non-unique IP addresses; more than 100 users could share one
    of its IP addresses at any given time.
    UNITED STATES V. KVASHUK                           11
    indicted on 18 fraud-related counts, including two counts of
    aggravated identity theft, 18 U.S.C. § 1028A. 5
    Prior to trial, the district court denied Kvashuk’s motions
    to suppress the evidence obtained from his house and car and
    to dismiss the aggravated identity theft counts for failure to
    state an offense. Over Kvashuk’s objection, the court
    granted in part the government’s motion in limine to exclude
    evidence that Kvashuk had applied for asylum—in
    particular, a statement that he made to his tax preparer
    regarding his immigration status. At trial, when a juror
    disclosed that he had worked on the UST during the two
    years before Kvashuk began working at Microsoft, Kvashuk
    unsuccessfully moved to dismiss the juror.
    The jury convicted Kvashuk of all counts. Kvashuk
    moved for judgment of acquittal on the aggravated identity
    theft counts due to insufficient evidence. In addition, he
    moved for a new trial because the court excluded evidence
    of his asylum application and declined to dismiss the juror
    with UST experience. The district court denied both motions
    and sentenced Kvashuk to nine years in prison. We have
    jurisdiction under 
    28 U.S.C. § 1291
    .
    5
    In addition, the indictment charged Kvashuk with one count of
    access device fraud, 
    18 U.S.C. § 1029
    (a)(5), (c)(1)(A)(ii); one count of
    access to a protected computer in furtherance of fraud, 
    id.
     § 1030(a)(4),
    (c)(3)(A); one count of mail fraud, id. § 1341; five counts of wire fraud,
    id. § 1343; two counts of filing a false tax return, 
    26 U.S.C. § 7206
    (1);
    and six counts of money laundering, 
    18 U.S.C. § 1957
    .
    12                UNITED STATES V. KVASHUK
    II. Discussion
    A. Motion to Suppress Evidence Seized from Kvashuk’s
    House
    Kvashuk challenges the denial of his motion to suppress
    evidence seized from his house on the ground that the search
    warrant lacked probable cause. 6 Relatedly, he challenges the
    district court’s denial of his request for a hearing under
    Franks v. Delaware, 
    438 U.S. 154
     (1978).
    We review the district court’s denial of a motion to
    suppress de novo and any underlying factual findings for
    clear error. United States v. Kleinman, 
    880 F.3d 1020
    , 1036
    (9th Cir. 2017). The district court’s denial of a request for a
    Franks hearing is also reviewed de novo. 
    Id. at 1038
    .
    1. Nexus between the scheme and the place to be
    searched
    “A warrant must be supported by probable cause—
    meaning a ‘fair probability that contraband or evidence of a
    crime will be found in a particular place based on the totality
    of circumstances.’” United States v. King, 
    985 F.3d 702
    , 707
    (9th Cir. 2021) (quoting United States v. Diaz, 
    491 F.3d 1074
    , 1078 (9th Cir. 2007)). The magistrate’s probable
    cause determination “should be paid great deference by
    reviewing courts.” 
    Id.
     (quoting Illinois v. Gates, 
    462 U.S. 213
    , 236 (1983)). Review “is limited to ensuring that the
    6
    Kvashuk also challenges the search of his car, but the only
    evidence from the car introduced at trial was Kvashuk’s employee badge.
    Since it was undisputed that Kvashuk worked at Microsoft, and the
    evidence had no other significance, any error from the district court’s
    refusal to suppress it was harmless beyond a reasonable doubt. See
    United States v. Job, 
    871 F.3d 852
    , 865 (9th Cir. 2017).
    UNITED STATES V. KVASHUK                    13
    magistrate had a ‘substantial basis’ for concluding that
    probable cause existed.” 
    Id. at 708
     (quoting Gates, 
    462 U.S. at 238
    ).
    Kvashuk does not dispute that there was probable cause
    to suspect him of crimes in connection with the stolen CSV.
    Rather, he argues that the warrant affidavit failed to
    “establish a nexus between the unlawful activities and the
    places to be searched.”
    It is true that “[p]robable cause to believe that a suspect
    has committed a crime is not by itself adequate to secure a
    search warrant for the suspect’s home.” United States v.
    Ramos, 
    923 F.2d 1346
    , 1351 (9th Cir. 1991), overruled on
    other grounds by United States v. Ruiz, 
    257 F.3d 1030
    , 1032
    (9th Cir. 2001) (en banc). But “the nexus between the items
    to be seized and the place to be searched” can rest on
    “normal inferences as to where a criminal would be likely to
    hide” evidence of his crimes. United States v. Spearman,
    
    532 F.2d 132
    , 133 (9th Cir. 1976) (per curiam) (quoting
    United States v. Lucarz, 
    430 F.2d 1051
    , 1055 (9th Cir.
    1970)).
    While we have not directly addressed the nexus issue,
    our cases confirm that the nature of cybercrime—
    specifically, its reliance on computers and personal
    electronic devices—is relevant to probable cause for
    searching the suspect’s residence. See United States v.
    Adjani, 
    452 F.3d 1140
    , 1145 (9th Cir. 2006) (holding that
    evidence of the suspect’s “extortion scheme . . . requiring the
    use of a computer” justified a search warrant for any
    computers found at the suspect’s home); United States v.
    Gourde, 
    440 F.3d 1065
    , 1071 (9th Cir. 2006) (en banc)
    (holding that evidence the suspect maintained membership
    in a website with child pornography supported search of the
    computer at his residence); see also United States v. Green,
    14                UNITED STATES V. KVASHUK
    
    954 F.3d 1119
    , 1123 (8th Cir. 2020); United States v. Jones,
    
    942 F.3d 634
    , 639–40 (4th Cir. 2019); Peffer v. Stephens,
    
    880 F.3d 256
    , 272–73 (6th Cir. 2018); United States v.
    Joubert, 
    778 F.3d 247
    , 252–53 (1st Cir. 2015); United States
    v. Watzman, 
    486 F.3d 1004
    , 1007–08 (7th Cir. 2007).
    Here, the warrant affidavit explained in detail how
    Kvashuk committed the suspected crimes “almost entirely
    via digital devices.” Such devices “were used to access . . .
    Microsoft’s online store, set up and access email accounts,
    conduct online research in furtherance of the scheme,
    purchase and redeem CSV, communicate with one or more
    tax preparers, and conduct bitcoin transactions.” The
    affidavit also pointed out that “many people generally keep
    their cell phones and other digital devices . . . in their home”
    and provided extensive evidence that Kvashuk did so here.
    For example, the affidavit noted that (1) Kvashuk was a
    software engineer; (2) his house had internet service; (3) the
    IP address assigned to his house was used in 2018 and 2019
    to access his Coinbase and Gmail accounts, both of which
    were involved in his scheme; 7 (4) he emailed his tax preparer
    7
    To the extent Kvashuk maintains that the search of his Gmail
    account lacked probable cause because he did not use it to purchase or
    redeem tokens, we disagree. In December 2017, Kvashuk accessed the
    Universal Store from an account linked to his Gmail account at least nine
    times, and accessed his Coinbase account once, from various IP
    addresses later used by the test accounts to steal CSV. Although other
    Microsoft employees used the same IP addresses, which belonged to a
    commercial VPN, Kvashuk was specifically linked to the stolen CSV
    transactions through the fuzzy device ID used to access his v-vokvas,
    pikimajado, and xidijenizo accounts. Moreover, Coinbase records
    showed communications with Kvashuk’s Gmail account. The IRS agent
    who prepared the affidavit attested that such communications “may be
    evidence of financial transactions conducted using the proceeds of the
    fraud, and therefore be evidence of money laundering.” And there was
    UNITED STATES V. KVASHUK                     15
    in February 2019 regarding the preparation of his false 2018
    return; and (5) based on the affiant’s training and experience,
    “people often keep personal, financial, and tax records in
    their home,” including Bitcoin private keys (essentially,
    passwords necessary to control their Bitcoin). All of this
    evidence, taken together, was enough to reasonably establish
    a nexus between the digital devices to be seized and
    Kvashuk’s home.
    Kvashuk argues that “it is chronologically impossible for
    the theft at issue to be committed by way of a digital device
    inside the [lakefront] house” given that Microsoft disabled
    the test accounts before he moved there in April 2018. But
    this is irrelevant. “[P]robable cause to believe that a person
    conducts illegal activities in the place where he is to be
    searched is not necessary; the proper inquiry is whether there
    was probable cause to believe that evidence of illegal activity
    would be found in the search.” United States v. Elliott,
    
    322 F.3d 710
    , 716 (9th Cir. 2003).
    The affidavit contained evidence that the house had
    internet service and that the IP address associated with the
    house was used to access Kvashuk’s Gmail and Coinbase
    accounts. It was thus reasonable for the magistrate to infer
    that Kvashuk brought his digital devices with him—
    including those used to perpetrate the theft—when he moved
    from the apartment to the house. See United States v.
    Richardson, 
    607 F.3d 357
    , 371 (4th Cir. 2010) (rejecting
    contention that “that there must be some ‘specific’ allegation
    that [the suspect] . . . was using the same computer at the
    new residence”). Moreover, Kvashuk’s use of the test
    accounts to order digital gift cards was only the first step of
    a clear pattern of deposits into Kvashuk’s Coinbase account that
    followed redemption of the stolen CSV.
    16              UNITED STATES V. KVASHUK
    his scheme, which continued until he transferred the
    proceeds from his Coinbase account into his Wells Fargo
    bank account.    According to the affidavit, Kvashuk
    continued making these transfers through May 2018.
    Considering “the totality of [the] circumstances,” King,
    985 F.3d at 707 (quoting Diaz, 
    491 F.3d at 1078
    ), the search
    warrant affidavit shows a fair probability that evidence of
    Kvashuk’s crimes would be found on a computer at his
    residence. Therefore, there was an adequate nexus between
    the unlawful activities and the place to be searched.
    2. Staleness
    Kvashuk asserts that the information in the search
    warrant affidavit was mostly stale, and thus did not support
    probable cause, because it involved events that occurred
    more than a year before the search warrant was presented to
    the magistrate in July 2019. His staleness argument does not
    withstand scrutiny.
    To be sure, “[t]he most convincing proof that [evidence
    of a crime] was in the possession of the person or upon the
    premises at some remote time in the past will not justify a
    present invasion of privacy.” United States v. Grant,
    
    682 F.3d 827
    , 832 (9th Cir. 2012) (quoting Durham v.
    United States, 
    403 F.2d 190
    , 193 (9th Cir. 1968)). But the
    “mere passage ‘of substantial amounts of time is not
    controlling in a question of staleness.’” United States v.
    Flores, 
    802 F.3d 1028
    , 1043 (9th Cir. 2015) (quoting United
    States v. Dozier, 
    844 F.2d 701
    , 707 (9th Cir. 1988)).
    “That is particularly true with electronic evidence.” 
    Id.
    Given “the long memory of computers,” evidence of a crime
    typically remains on a computer even if the defendant
    attempts to delete it. 
    Id.
     (quoting Gourde, 
    440 F.3d at 1071
    );
    UNITED STATES V. KVASHUK                            17
    see Gourde, 
    440 F.3d at 1068
     (explaining that deleted files
    “were not actually erased but were kept in the computer’s
    ‘slack space’ until randomly overwritten, making [them]
    retrievable by computer forensic experts”). 8
    Here, as in Gourde, the affidavit supporting the search
    warrant explained that “computer files . . . can be preserved
    (and consequently also then recovered) for months or even
    years after they have been downloaded onto a storage
    medium, deleted, or accessed or viewed via the Internet,”
    and that even after deletion, files often still reside in the
    computer’s “slack space.” Although most of the evidence of
    the CSV theft was 15–20 months old at the time of the
    warrant application, a temporal gap of that magnitude is not
    extreme relative to the lifespan of a computer. See, e.g.,
    United States v. Schesso, 
    730 F.3d 1040
    , 1047 (9th Cir.
    2013) (holding that “a mere 20 months” was not too long to
    expect data to remain recoverable).
    Kvashuk was unaware of the criminal investigation into
    his theft, so he had no reason to delete or encrypt any
    incriminating files. In fact, the warrant served on Google
    just two months earlier had yielded relevant evidence from
    Kvashuk’s Gmail account and browser history. And the
    search warrant application sought not only evidence of the
    theft, but also evidence of Kvashuk’s suspected false tax
    returns. He had communicated with his tax preparer in
    February 2019—five months before the search warrant
    8
    “Of course, at some point ‘after a very long time’ the likelihood
    that certain digital information will be recoverable from a specific device
    ‘drops to a level at which probable cause to search the suspect’s home
    for the computer can no longer be established.’” United States v. Rees,
    
    957 F.3d 761
    , 770 (7th Cir. 2020) (quoting (United States v. Seiver,
    
    692 F.3d 774
    , 777 (7th Cir. 2012)). The timeframes in this case present
    no such issue.
    18              UNITED STATES V. KVASHUK
    application. The evidence supporting the application was
    not stale.
    3. Franks hearing
    “To obtain a Franks hearing, a defendant must make a
    substantial preliminary showing that: (1) ‘the affiant officer
    intentionally or recklessly made false or misleading
    statements or omissions in support of the warrant,’ and
    (2) ‘the false or misleading statement or omission was
    material, i.e., necessary to finding probable cause.’” United
    States v. Norris, 
    942 F.3d 902
    , 909–10 (9th Cir. 2019)
    (quoting United States v. Perkins, 
    850 F.3d 1109
    , 1116 (9th
    Cir. 2017)), cert. denied, 
    140 S. Ct. 2754
     (2020). Kvashuk
    identifies no false or misleading statement in the affidavit,
    let alone one that the affiant—lead IRS case agent Eric
    Hergert—made intentionally or recklessly.
    That Hergert failed to note Kvashuk’s claim to have
    changed his company’s email domain from “searchdom.io”
    to “searchdom.ai” is inconsequential. There is no evidence
    that this change occurred before October 2017, when an
    account linked to the searchdom.io domain redeemed CSV
    obtained from the vokvas test account. Even if Searchdom
    had changed domains by then, there is also no evidence to
    support Kvashuk’s theory that someone unconnected to his
    company was operating the searchdom.io email account.
    Indeed, when Microsoft investigated searchdom.io in March
    2018 or later, Kvashuk was still listed as a registered owner.
    In May 2018, when the FIST asked Kvashuk who controlled
    the Searchdom domains, Kvashuk did not disclaim
    ownership of searchdom.io; to the contrary, he indicated that
    he had access to the Searchdom site generally.
    Hergert’s statement that Kvashuk “has a Samsung
    phone” and that “[l]ocation records received . . . often place
    UNITED STATES V. KVASHUK                   19
    this phone at the [lakeside house], including during evening
    hours,” did not, as Kvashuk argues, imply that he “accessed
    the CSV codes or test account from his phone.” Rather, it
    showed that Kvashuk lived at the house as early as April
    2018, even though he did not own the house until two
    months later.
    Nor was it misleading for Hergert to omit the statement
    he had earlier included in the Google search warrant
    affidavit that the government had “only limited evidence”
    regarding how Kvashuk sold the CSV and transferred the
    funds to his bank account. By the time the agents sought to
    search Kvashuk’s house, they had obtained substantial
    evidence regarding these financial transactions—much of it
    derived from the records obtained from Google.
    B. Convictions for Aggravated Identity Theft
    Kvashuk next challenges his convictions for aggravated
    identity theft, which stem from his use of Chen’s swfe2eauto
    test account and Jainullabudeen’s zabeerj2 test account.
    Kvashuk contends that these two convictions are infirm
    because the test accounts do not constitute a “means of
    identification.” 18 U.S.C. § 1028A(a)(1). We review the
    district court’s denial of a motion for judgment of acquittal
    de novo, “viewing the evidence in the light most favorable
    to the prosecution.” United States v. Charley, 
    1 F.4th 637
    ,
    643 (9th Cir. 2021) (quoting United States v. Vazquez-
    Hernandez, 
    849 F.3d 1219
    , 1229 (9th Cir. 2017)).
    20                UNITED STATES V. KVASHUK
    Aggravated identity theft requires proof that the
    defendant, “during and in relation to” certain felonies, 9
    “knowingly transfer[red], possesse[d], or use[d], without
    lawful authority, a means of identification of another
    person.” 18 U.S.C. § 1028A(a)(1).
    [T]he term “means of identification” means
    any name or number that may be used, alone
    or in conjunction with any other information,
    to identify a specific individual, including
    any—
    (A) name, social security number, date
    of birth, official State or government
    issued      driver’s      license    or
    identification       number,      alien
    registration number, government
    passport number, employer or
    taxpayer identification number;
    (B) unique biometric data, such as
    fingerprint, voice print, retina or iris
    image, or other unique physical
    representation;
    (C) unique electronic identification
    number, address, or routing code; or
    (D) telecommunication        identifying
    information or access device . . . .
    9
    The underlying felonies here were access device fraud and access
    to a protected computer in furtherance of fraud, as charged in counts one
    and two, respectively. See 18 U.S.C. § 1028A(c)(4).
    UNITED STATES V. KVASHUK                    21
    Id. § 1028(d)(7) (emphasis added).
    Kvashuk argues that the test accounts do not “identify a
    specific individual,” id., because “they are simply tools for
    the testers to do their jobs for Microsoft.” He points out that
    the test accounts serve “Microsoft’s business purposes,” “are
    strictly controlled by Microsoft,” “are ‘programmed’ to
    make test purchases ‘in an automated fashion,’” and have
    TIP cards “associated with [them], not with the individual
    testers.”
    The test accounts’ purpose, prerequisites, and
    functionality do not bear on whether they “identify a specific
    individual.” In drafting the statute, Congress intended “to
    construct an expansive definition” of the term “means of
    identification,” United States v. Alexander, 
    725 F.3d 1117
    ,
    1121 (9th Cir. 2013) (quoting United States v. Blixt, 
    548 F.3d 882
    , 887 (9th Cir. 2008)), and “to protect businesses from
    financial loss,” United States v. Maciel-Alcala, 
    612 F.3d 1092
    , 1100 (9th Cir. 2010).
    The test accounts at issue here clearly could be used to
    identify specific Microsoft employees because the
    company’s investigators actually did identify four
    individuals—Chen, Morey, Jainullabudeen, and Kvashuk—
    as the owners of test accounts that had been used to purchase
    CSV. At oral argument, Kvashuk’s counsel acknowledged
    that “every Microsoft employee has [a Microsoft] email
    address that is individual to him or her.” That UST members
    use their Microsoft email accounts for certain business
    purposes (counsel gave the example of communicating with
    human resources) and their test email accounts for other
    business purposes makes no difference to whether the test
    email accounts identify specific testers. See United States v.
    Barrington, 
    648 F.3d 1178
    , 1192–93 (11th Cir. 2011)
    (rejecting argument that employee “passwords . . . used to
    22             UNITED STATES V. KVASHUK
    access the [university’s] computer system belonged to the
    university and do not constitute personal identity
    information of the individual university employees”).
    Kvashuk also argues that “the testers shared the login
    information of the test accounts among the team,” and the
    credentials thus “identify a member of the testing team, but
    not the particular individuals.” While rampant sharing of
    test account credentials among the testers could render the
    accounts unreliable as a means of identification, the
    evidence does not support that characterization of what
    occurred at Microsoft.
    Testers “sometimes” shared test accounts and
    passwords, but Kvashuk’s manager, Marshall Wilcox, told
    the testers that “they shouldn’t be sharing,” because it made
    the accounts “harder to trace individually.” There were
    exceptions where Wilcox authorized password sharing to
    test specific purchase flows, but none of these exceptions
    involved Kvashuk, and Wilcox never gave Kvashuk
    permission to use a test account assigned to another
    employee.
    In many organizations, individuals commonly allow
    someone else—an assistant, an IT professional, or even a
    colleague—to access their email account for specific, limited
    purposes. Because such an individual has primary control of
    the account and the account remains associated with his or
    her identity, the account still identifies the individual
    specifically and thus retains its status as “a means of
    identification.” 18 U.S.C. § 1028A(a)(1). Here, the UST
    members’ limited sharing of test accounts and passwords,
    both authorized and informal, was insufficient to
    differentiate the test accounts from any other business email
    account associated with a specific person. The district court
    properly denied Kvashuk’s motion for judgment of acquittal.
    UNITED STATES V. KVASHUK                   23
    C. Exclusion of Evidence of Kvashuk’s Asylum
    Application
    Kvashuk contends that the district court violated his due
    process rights by preventing him from presenting a complete
    defense. In particular, he argues that the court erred in
    excluding evidence of his status in the United States as an
    asylum applicant. “Generally, we review the ruling on a
    motion in limine for abuse of discretion.” United States v.
    Alvirez, 
    831 F.3d 1115
    , 1120 (9th Cir. 2016). “However, we
    review de novo whether the ruling precludes the presentation
    of a defense.” 
    Id.
    “[T]he Constitution guarantees criminal defendants a
    meaningful opportunity to present a complete defense,”
    Jones v. Davis, 
    8 F.4th 1027
    , 1035 (9th Cir. 2021) (quoting
    Crane v. Kentucky, 
    476 U.S. 683
    , 690 (1986)), which
    includes “the right to put before a jury evidence that might
    influence the determination of guilt,” 
    id.
     (quoting
    Pennsylvania v. Ritchie, 
    480 U.S. 39
    , 56 (1987)). “[A]
    defendant’s right to present a complete defense is abridged
    by any restrictions on defense evidence that are ‘arbitrary or
    disproportionate’ and that infringe on the defendant’s
    ‘weighty interest.’” Id. at 1036 (quoting Holmes v. South
    Carolina, 
    547 U.S. 319
    , 324 (2006)).
    Nonetheless, “[t]he accused does not have an unfettered
    right to offer testimony that is inadmissible under standard
    rules of evidence.” 
    Id.
     (cleaned up) (quoting Taylor v.
    Illinois, 
    484 U.S. 400
    , 410 (1988)). “A trial court therefore
    may, consistent with the Constitution, exclude defense
    evidence through the proper application of evidentiary rules
    that serve a valid purpose in a given case, including when
    proposed evidence is ‘only marginally relevant or poses an
    undue risk of harassment, prejudice, or confusion of the
    issues.’” 
    Id.
     (quoting Holmes, 
    547 U.S. at
    326–27).
    24              UNITED STATES V. KVASHUK
    In a February 2019 email, Kvashuk informed the tax
    professional who prepared his 2018 tax return, Daniel Lusk,
    that he had purchased his house with “cash that my dad gave
    me.” Lusk asked for documentation of the funding source,
    and Kvashuk sent him a tax report from his Coinbase
    account. Kvashuk explained: “[I]t’s all that I have. My dad
    would use [Bitcoin] to send me cash for security reasons, I
    have pending asylum. He purchased [Bitcoin] -> send it to
    me -> I sell it here -> get cash.”
    Prior to trial, the prosecution moved to exclude
    references to Kvashuk’s immigration status and asylum
    application, arguing it was irrelevant and unduly prejudicial
    under Federal Rules of Evidence 402 and 403. The district
    court granted this relief but allowed Kvashuk to testify “that
    he is from the Ukraine” and, with adequate foundation, that
    he “transferred or received crypto currency” because he
    needed “to conceal the transfers from the Ukrainian
    government.”
    At trial, the prosecution elicited testimony from Lusk
    about the email exchange, a redacted copy of which was
    admitted into evidence. The redacted version omitted “I
    have pending asylum,” leaving only “My dad would use
    [Bitcoin] to send me cash for security reasons.” Later, the
    prosecutor reread the redacted email.
    Kvashuk argues that the asylum ruling precluded him
    from presenting a complete defense because it “prevented
    [him] from making a full narrative regarding the legitimate
    reasons underlying his use of cryptocurrency.” He claims
    that his “sole defense” to the prosecution’s theory that he
    “used cryptocurrency to ‘conceal the money trail from his
    crime’” was to show “that he did not intend to defraud
    Microsoft.” Kvashuk wanted the jury to hear that he used
    Bitcoin “as an asylum seeker . . . to avoid detection by the
    UNITED STATES V. KVASHUK                     25
    Ukrainian government,” because “Ukraine requires
    disclosure” of the receiver’s location “for cross-border
    money remittances over a certain amount.”
    The district court’s exclusion of evidence regarding
    Kvashuk’s asylum status did not deny him a defense. The
    district court’s restrictions on such evidence were narrowly
    tailored and carefully explained, not “arbitrary or
    disproportionate.” Jones, 8 F.4th at 1036. While testifying
    about his asylum status may have strengthened his defense
    that he did not intend to defraud Microsoft, he was able to
    raise the defense without it.
    Nor did the district court abuse its discretion in excluding
    the evidence. Although Kvashuk claims the jury equated his
    statement to Lusk that he used cryptocurrency “for security
    reasons” with “so I won’t get caught by Microsoft,” the jury
    also heard Kvashuk’s statement to another tax professional
    that his father sent Bitcoin “because of his [father’s] country
    restrictions.” In addition, the district court allowed Kvashuk
    to testify “on [his] belief that he needed to conceal the
    transfer from the Ukrainian government,” though he chose
    not to do so. The district court did not abuse its discretion in
    concluding, prior to trial, that any additional probative value
    in disclosing Kvashuk’s immigration status “would be
    substantially outweighed by the danger of unfair prejudice”
    from the jury’s knowledge that “Kvashuk could suffer
    immigration consequences if convicted of the charges.” See
    Fed. R. Evid. 403.
    At trial, Kvashuk understandably chose to abandon his
    story about his father transferring millions of dollars to him
    after the prosecution introduced evidence that his father
    earned only $1,150 per month in Ukraine. Instead, Kvashuk
    admitted to the jury that the Bitcoin came from sales of the
    stolen CSV and that he lied to the tax professionals about the
    26              UNITED STATES V. KVASHUK
    Bitcoin’s source because explaining the Paxful transactions
    would be more involved than simply saying the Bitcoin was
    a gift from his father. In light of Kvashuk’s testimony, the
    district court did not abuse its discretion in ruling that the
    excluded evidence of Kvashuk’s asylum status did not
    warrant a new trial. Any marginal probative value this
    evidence retained after he changed his story was
    substantially outweighed by the risk of juror confusion and
    prejudice to the prosecution. See id.
    D. Motion to Dismiss Juror No. 12
    Kvashuk lastly contends that the district court should
    have dismissed Juror No. 12 because the juror had
    experience with the UST. Our review of the district court’s
    denial of a motion to dismiss a sitting juror depends on the
    ruling’s basis. We review an actual bias determination for
    abuse of discretion; implied bias is a mixed question of law
    and fact that we review de novo. United States v. Gonzalez,
    
    906 F.3d 784
    , 796 (9th Cir. 2018).
    During voir dire, Juror No. 12 disclosed that he “was
    primarily employed as a Microsoft contractor between 2011
    and 2018 on a variety of different projects” and that
    Microsoft was his current employer’s “primary business
    partner.” He professed having “a very wide and very
    shallow knowledge of almost any computer subject you can
    imagine.” Nonetheless, he affirmed that he could “render an
    impartial verdict.” Defense counsel asked no follow-up
    questions.
    On the second day of the trial, after Wilcox testified
    about Kvashuk’s role at the UST, Juror No. 12 sent a note to
    the court stating that he “work[ed] in close proximity” to
    “the people and teams being discussed” but did “not believe
    it to be a problem as [he] did not work directly with [them].”
    UNITED STATES V. KVASHUK                    27
    Upon further questioning, Juror No. 12 explained that he
    worked at Microsoft from April 2014 to August 2016, thus
    ending the same month Kvashuk started. According to Juror
    No. 12, the Universal Store “was just starting up when [he]
    was leaving,” although he “was one of the early QA testers.”
    However, the Universal Store had “advanced so far beyond
    what it was when [he] worked there, that it might as well be
    indistinguishable.”
    Juror No. 12 did not remember working on anything at
    Microsoft that had been discussed in the trial testimony and
    did not recognize any of the witnesses. He explained that he
    “worked on content ingestion,” which involved the “people
    who were putting things for sale up on the storefront.” It was
    “the exact opposite end” of what Kvashuk’s team did
    “working on the user experience.” Juror No. 12 reiterated
    that he could be fair and impartial.
    Defense counsel moved to dismiss Juror No. 12.
    Counsel argued that had he known of the juror’s “intimate
    knowledge of the Universal Store” during voir dire, he
    would have used one of his peremptory strikes on Juror No.
    12 rather than one of the other prospective jurors. Defense
    counsel clarified, however, that he was not challenging Juror
    No. 12 based on his ability to be fair. The district court
    denied the request to remove Juror No. 12.
    The district court, citing Sanders v. Lamarque, 
    357 F.3d 943
     (9th Cir. 2004), evidently analyzed the request to
    remove Juror No. 12 as being for implied rather than actual
    bias. See 
    id. at 948
    . Implied bias “is a legal doctrine under
    which bias will be conclusively presumed in certain
    circumstances even if the juror professes a sincere belief that
    she can be impartial.” Gonzalez, 906 F.3d at 797. Bias will
    be presumed only in the extreme situation “where the
    relationship between a prospective juror and some aspect of
    28               UNITED STATES V. KVASHUK
    the litigation is such that it is highly unlikely that the average
    person could remain impartial in his deliberations under the
    circumstances.” Id. (quoting Fields v. Brown, 
    503 F.3d 755
    ,
    770 (9th Cir. 2007) (en banc)). Such a relationship exists,
    for example, when the juror has had a “personal experience
    that is similar or identical to the fact pattern at issue in the
    trial,” 
    id.
     (quoting United States v. Gonzalez, 
    214 F.3d 1109
    ,
    1112 (9th Cir. 2000)), “‘is aware of highly prejudicial
    information about the defendant,’ which no ordinary person
    could be expected to put aside in reaching a verdict,” 
    id.
    (quoting Gonzalez, 
    214 F.3d at 1112
    ), or “lies about material
    facts during voir dire in order to secure a spot on the jury,”
    
    id.
    Kvashuk argues that Juror No. 12 “must be dismissed
    because his extrinsic personal knowledge could cause him to
    make a decision based on information outside of the
    evidence presented at trial.” But Juror No. 12 explained that
    his experiences at the UST in its early days were in no way
    similar to Kvashuk’s experiences there a year or two later
    and that the Universal Store had changed considerably
    during that time. The UST had approximately 8,000
    employees, and because Juror No. 12 and Kvashuk worked
    at different times on completely different aspects of the
    Universal Store, it is unlikely that their work overlapped.
    For example, there was no indication that Juror No. 12 had
    access to a TIP card since he did not work on the end user
    experience. Merely working for the same large organization
    as the defendant is an insufficient basis for implied bias.
    We draw an analogy from Frazier v. United States,
    
    335 U.S. 497
     (1948). In that case, the defendant challenged
    two jurors because one juror and the other’s spouse worked
    for the Treasury Department, which at the time contained the
    Bureau of Narcotics—the agency that had investigated the
    UNITED STATES V. KVASHUK                    29
    case. 
    Id. at 512
    . In rejecting this challenge, the Court noted
    that the Treasury Department had 19,645 employees in the
    District of Columbia and that the two employees at issue
    performed work unrelated to the Bureau of Narcotics. 
    Id.
    at 499 n.2, 512. The Court held that this connection was “not
    so obvious a disqualification or so inherently prejudicial as
    a matter of law, in the absence of any challenge to [the
    jurors] before trial, as to require the court of its own motion
    or on [the defendant’s] suggestion afterward to set the
    verdict aside and grant a new trial.” 
    Id. at 513
    .
    Because Juror No. 12’s “personal experience” on the
    UST was not “similar or identical to the fact pattern at issue
    in the trial,” Gonzalez, 906 F.3d at 797, the district court
    properly denied the motion to remove him.
    AFFIRMED.