This Post Continues A Series That Will Comprise The Entirety Of The Matthew Keys Sentencing Documents Filed By The Defense – Part 6
- THE PSR LOSS CALCULATION IS CONTRARY TO SENTENCING LAW AND POLICY AND SHOULD BE REDUCED
The loss enhancements under USSG §2B1.1 were initially designed to address traditional theft, fraud, and embezzlement offenses. These offenses traditionally result not just in a loss for the victim, but also a gain for the perpetrator. While certain offenses under the Computer Fraud and Abuse Act or CFAA may involve an analogous transfer of funds, or an intentional destruction of valuable property, the statute’s broad nature covers many offenses which do not. See 18 U.S.C. § 1030. Here, the offenses charged are far more similar to vandalism or trespassing than theft or fraud, and are not warranted as a matter of policy. They will also have an extremely disproportionate effect on the sentencing range. With what is essentially “digital vandalism,” it is arguable no loss was intended, and certainly a loss in the amount claimed here was neither intended nor reasonably foreseeable. It is also incredibly difficult to establish, and has not been established here, whether the alleged loss included only the reasonable costs to a victim. Applying these enhancement levels for speculative, unintended, and unforeseeable costs and losses creates a perverse sentencing structure that unduly punishes otherwise de minimis CFAA offenses.
- The Loss Calculations Fail to Meet Any Appropriate Burden of Proof
At trial, prosecution witnesses claimed the offenses caused over $900,000 in loss to the victim companies. For sentencing purposes, the 9th Circuit generally accepts a preponderance of the evidence standard as the burden at sentencing, however “a heightened burden may sometimes be required … to satisfy due process concerns.” … where a sentencing factor would have an extremely disproportionate effect on the sentence.” United States v. Staten, 466 F.3d 708, 717 (9th Cir. 2006); See United States v. Kilby, 443 F.3d 1135, 1140 n. 1 (9th Cir.2006). For factors which have an extremely disproportionate effect on sentencing, the 9th Circuit applies a clear and convincing evidence standard. United States v. Staten, 466 F.3d 708, 717 (9th Cir. 2006). Where a sentencing enhancement creates a greater-than-four-level increase and more than doubles the potential sentence, that enhancement likely has a disproportionate effect on sentencing. See United States v. Staten, 466 F.3d 708, 717-18 (9th Cir. 2006) (finding disproportionate effect for a greater-than-four level enhancement that more than doubled the sentence); see also United States v. Dare, 425 F.3d 634, 642 (9th Cir. 2005) (laying out a 7-factor totality of the circumstances test for disproportionate effect). Here, the clear and convincing evidence standard is appropriate, as the loss enhancement has just such a disproportionate effect. It represents a 10-level increase and nearly triples the recommended sentence, moving the guidelines range from level 19 (30-37 months) to 29 (87-108 months). (See PSR, p. 9, ¶ 24.) The evidence offered to support these loss claims fails to meet either standard.
The prosecution’s evidence to support their loss claim fails to satisfy either standard. It includes no billing records or other business records beyond an unattributed, undated spreadsheet and a handful of emails. There is no way to tell whether these time entries were directly related to the response, or how much of a given entry was directly related. The jury was never asked to endorse any specific amount beyond the $5,000 minimum for a felony conviction, so the verdict does not endorse any specific number for loss. The claimed losses are simply not established by the evidence, and certainly fail to establish a loss amount by clear and convincing evidence.
- Unrelated Costs Should be Excluded from the Loss Calculation
Additionally, under USSG §2B1.1, the loss amount must be reasonable, and should exclude, for example, frivolous or unnecessary costs or those not reasonably necessary for incident response or investigation. The Court should look to the fair market value of any “property unlawfully taken … or destroyed” or, for proprietary information, the “cost of developing that information or the reduction in value … that resulted from the offense.” See U.S.S.G. § 2B 1.1 cmt. n.3 (C)(i), (ii); United States v. Nosal, No. CR-08-0237 EMC, 2014 WL 121519, at *3 (N.D. Cal. Jan. 13, 2014). Additionally, for CFAA related loss, the Court should consider “only those costs that were ‘reasonably necessary,’ and only those costs that would ‘resecure’ the computer to avoid ‘further damage.’” United States v. Middleton, 231 F.3d 1207, 1213 (9th Cir. 2000). Where the prosecution has not established that certain costs meet one or the other of these criteria, those costs should be excluded from the loss calculation.
The PSR rightly disregards the companies’ most nebulous loss claims, such as a decline in morning television news ratings and a vague “database loss in iPad contest.” (See PSR, p. 7, ¶ 15.) However, it incorrectly includes several loss claims that either fail to meet the appropriate burden of proof or are beyond the scope of loss under USSG §2B1.1.
The PSR incorrectly includes the costs associated with “rebuild[ing] the database.” Id. Nowhere does it say which database. The undated spreadsheet does not specify this either. In fact, nowhere else in the record seems to clarify what database this cost may refer to. Nowhere does the record establish that any database was “deleted” or needed to be rebuilt. The record contains few mentions of databases at all, and none are alleged as deleted or lost. One database mentioned at trial was the Green Links email address database, and Brendan Mercer admits he was unaware of any deletion of that database or any of its entries. (TR, p. 149; p. 177.) Another witness, Mr. Comings of Tribune Publishing Co., later described the CMS as sharing “a common database.” (TR, p. 248). At one point, a witness describes the email list database being “compromised” but in context it is clear they mean the database’s information was accessed, not that the database or any information within was deleted. (TR, p. 707). At most, the record supports that the CMS database, “Green Links” email address database, or both may have been accessed, but nowhere does the record suggest any database was deleted.
The Final PSR Response letter itself notes that the “$200,000 figure to ‘locate vendor and rebuild new database.’” is uncorroborated by any documents from the victim. These documents have not been provided, nor does the record reflect any database deletion. (See U.S. Probation Office Response to Objections, Dec. 30, 2015 (ECF # 127-3), at p. 2.) Where there is no proof of deletion, and no deletion is described in the record, it would be improper to include this figure in Matthew loss or restitution amounts.
The PSR also mistakenly includes the time-value of “telephone calls, meetings, and emails,” which are not contemplated by USSG §2B1.1. These are outside the realm of “reasonable costs to any victim” under the guideline section for 18 USC § 1030 offenses, which includes costs directly related to incident response, but not peripheral or administrative activities. See USSG §2B1.1, Application Note 3(A)(v)(III). Including these peripheral activities in the loss calculation would encourage unscrupulous victims to increase their restitution through unrelated or unnecessary meetings and correspondence.
Sentencing policy and the balance of justice weigh against applying these enhancements in a minor CFAA offense such as this. However, if the enhancements for loss are to be strictly applied according to the guidelines, they should be similarly limited by those guidelines and the relevant burden of proof. These loss entries, for an unspecified and unsupported database “deletion” and for administrative tasks at most peripheral to incident response, should not be included in the final loss number. To include them would be unjust, unsupported by the evidence, and against both the spirit and letter of the Sentencing Guidelines.
With these items excluded, assuming the other loss items can be established by clear and convincing evidence, the correct loss amount would be at most $19,591.00, resulting in a 4-point enhancement. See USSG §2B1.1(b)(1). This number best reflects a strict adherence to the Sentencing Guidelines, exclusive of unsupported or out-of-scope loss claims.
 Although United States v. Jenkins suggests this standard is not applied for conspiracy offenses, that case did not feature a loss calculation which had an extremely disproportionate effect on sentencing, and is thus distinguishable from Mr. Keys’s matter. See 633 F.3d 788, 808 (9th Cir. 2011)