This Post Continues A Series That Will Comprise The Entirety Of The Matthew Keys Sentencing Documents Filed By The Defense – Part 4
Mr. Keys requests custodial release for the following reasons:
- The guidelines range calculations apply inappropriate conduct-based enhancements,
- Keys did not employ “sophisticated means” in these offenses,
- Keys did not exercise managerial or supervisory authority over any conspiracy,
- The loss calculations in the PSR are contrary to sentencing law and policy,
- Numerous factors under 18 U.S.C. § 3553(a) merit a downward departure from the guidelines range,
- The Defendant’s personal and professional history merit downward departures from the guidelines range,
- A sentence under the guidelines range would not satisfy the traditional goals of a criminal sentence, and
- A downward departure is necessary to prevent a disparity in sentences for similar or more serious offenses.
BASELINE GUIDELINES SENTENCE LEVEL
When imposing a sentence, a court should start by calculating the applicable Sentencing Guidelines range. Gall v. United States, 128 S. Ct. 586, 596 (2007). The base offense level for a conspiracy (18 U.S.C. § 371) to damage a protected computer (18 U.S.C. § 1030(a)(5)(A)) is 6. U.S.S.G. § 2B1.1(a)(2); see also id. § 2X1.1(a) (base offense level for conspiracy identical to base offense level for substantive offense). The loss, estimated in the PSR at $249,956 adds 10 levels. Id. § 2B1.1(b)(1)(F). The Guidelines add 2 levels each for obtaining/disseminating personal information and for use of special skills. Id. §§ 2B1.1(b)(16), 3B1.3. Mr. Keys alleged role in the conspiracy, a supervisor or manager of a conspiracy involving five or more participants, adds 3 levels. USSG § 3B1.1(b). There is no victim related enhancements, obstruction of justice, or acceptance of responsibility enhancements added to recommended sentence. (PSR at 8). The applicable offense level, therefore, totals 29. (PSR at 3). The offense level of 27, absent any prior criminal history, is accompanied by 70-87 months of imprisonment, 1-3 years of supervised release, and 1-5 years of probation. The probation office recommended penalties, however, that are on the lower end of the guidelines. The PSR only recommends 70 months of imprisonment, 2 years of supervised release, and no probation. (PSR at 3).
- SOPHISTICATED MEANS
The PSR enhances Keys’ sentencing on the basis that he “intentionally engaged in or caused the conduct constituting sophisticated means” under U.S.S.G. § 2B.1(b)(1). According to the PSR, the “sophisticated means” consisted of only these uses: 1) “fake email addresses;” 2) use of a proxy service; and 3) “enlist[ing] the services of highly skilled hackers.” However, none of these is a sophisticated means within the meaning of the Sentencing Guidelines. In fact, the USSC amended the definition of “sophisticated means” to “narrow” (its own words) its scope to avoid precisely this kind of application. The PSR’s conclusion is wrong because: 1) the USSC declined to include proxy servers in its definition of definition of “sophisticated means;” 2) the USSC narrowed the definition of sophisticated means to cases where the defendant “intentionally engaged” in the sophisticated means, so as to enhance based on the defendant’s own culpability rather than the device used; 3) proxy servers are commonplace and widely used for predominantly legal and ethical purposes; and 4) the use of an alias in an email address is also a common practice and does not make it a “fake email address.”
- The USSC Decided Not to Include Use of Proxy Servers in its Definition of “Sophisticated Means”
To conclusively define Keys’ use of a proxy server for his personal use as a “sophisticated means” is inconsistent with the USSC’s intent, as they previously considered adding proxy servers to the definition, and declined to do so.
On March 17 and 18, 2009, the USSC held public hearings on proposed amendments to the Sentencing Guidelines, including a proposal to include use of a proxy service in connection with the charged offenses. Specifically, the proposed language would read: “In a scheme involving computers, using any technology or software to conceal the identity or geographic location of the perpetrator ordinarily indicates sophisticated means.” Thus, had that language been introduced, the burden would have shifted away from the government merely because the defendant had used some kind of proxy service.
The USSC heard numerous speakers on the issue, including representatives from the Department of Justice, Identity Theft Resource Center, Federal Public and Commffakeunity Defenders, and the Electronic Frontier Foundation. After considering the arguments, including those of its proponents, the USSC declined to add use of proxy server to the definition. The definition of “sophisticated means” has since been amended to narrow its scope (see below), but without this addition.
The reasons why the USSC decided not to include this addition are evident from the testimony before the USSC. Most people who use proxy servers do so for legitimate and ethical purposes. Many use them without knowing at all how they work, or even that they are using them at all. These services are installed, often by others, and many forget that they are even using one. As the Federal Defender testified, penalizing the use of a proxy “will absolutely sweep in conduct that is not especially complex or especially intricate,” adding that the DOJ “would have us believe that any technology or software to hide identity or location meets that test, and it is simply not true.” Even the DOJ, when pressed, acknowledged that use of proxies is not in of itself illegal, agreeing with the EFF that any use of a proxy service must be analyzed on a “case-by-case” basis.
But the PSR concludes, without explanation, that the use of the proxy service alone requires an enhanced sentence, merely because the server itself was located in Switzerland. (PSR at 8). This is the overbroad conclusion that the USSC was asked to avoid, because it “would create a wholesale presumption in conflict with actual evidence” and “relieve the government of proving the purportedly aggravating fact in any given case and shift the burden to the defendant to prove that the enhancement should not be followed.” The conclusion ignores the fact that proxies are used for a wide variety of activity, much of which is not criminal, and generally do require any kind of technical sophistication.
For instance, Matthew used a VPN proxy server in his capacity as an employee at Fox40, with the knowledge and approval of Fox40’s IT Manager, to follow international news feeds which might otherwise have been unavailable due to geographic blocking. Fox40 installed the software on Matthew’s computer. Other employees used a VPN as well, because it is a valuable investigative and journalistic tool.
There is no evidence that Keys employed any sophistication with his use of a VPN. The VPN is merely a tool that had been installed on his computer, for investigative and privacy purposes. The presumption that its general use categorically requires enhanced sentencing was rejected by the USSC. Thus, the government’s reliance on the proxy server as a sentencing factor is unsupported.
- Neither the PSR Nor the Government has Established that Keys “Intentionally Engaged” in the Sophisticated Means, as Required by the U.S.S.G.
The USSC declined to amend the Sentencing Guidelines so broadly as to include proxy servers, and in fact amended the definition of sophisticated means to narrow its scope. Under the amendment, the guidelines clarify that the “defendant intentionally engaged in or caused the conduct constituting the sophisticated means.” U.S.S.G. § 2B.1(b)(10)(C). The USSC stated the amendment was intended to “narrow” the offense characteristic because “prior to the amendment . . . court had applied this enhancement on the basis of the sophistication of the overall scheme without a determination of whether the defendants’ own conduct was ‘sophisticated’.” Thus, the clarified enhancement “better reflects the defendant’s culpability and will appropriately minimize application of this enhancement to less culpable offenders.”
Here, there is no evidence that Matthew intentionally engaged in use of a proxy server in order to conceal himself to the objects of the charged conspiracy.
An assessment of Matthew’s intent is crucial here, because, as discussed above, he had been using proxy servers long before the charged acts, when one was installed on his computer by an IT Manager at Fox40. Moreover, his initial stated intent was to watch foreign news on his computer, a valid and common purpose for a VPN. There is no showing, not even circumstantially, of his intent. There has been no showing that he created the code for the proxy server, or that he installed it, or that the means of installing it or using it were complex.
- There was no Showing of Keys’ Specific Intent that he Engaged in or Caused the Sophisticated Means
It is for this same reason that Matthew’s sentence cannot be enhanced based on his “enlist[ing] the services of highly skilled hackers to carry out his ploy.” (PSR at 8). The precise intent element added to the guidelines requires that the defendant himself must have engaged in or caused the sophisticated means. The PSR makes no mention of what sophisticated means the “hackers” used as part of the scheme, nor does it explain how any of that behavior would be attributable to Matthew. Without showing this specific intent, others’ use of sophisticated means cannot form the basis of a sophisticated means enhancement for him.
- Use of Proxy Servers are Common and Ordinary
The use of a proxy server is not categorically a sophisticated means, because it is so common and ordinary that an enhancement on this basis is unjustified. Moreover, VPN proxy servers are typically used in the course of business, for legitimate and legal purposes.
A “proxy server” is merely a mechanism where one computer communicates with another, the “proxy” and that proxy computer acts on behalf of the original user and sends the results to the user. It has the effect of creating another layer of identification, or protection, for the original user, but does not make detection impossible. Moreover, this layer of identity protection is not the only reason that these services are used. For instance, many companies use VPNs for security and convenience, such as allowing employees remote access to the company’s servers when they travel. Of course, these employees are using laptops which may also be used for personal purposes. VPN programs often run transparently, as a background process on the computer. Thus, many users of proxy servers are hardly aware that they are using them. Employees at FOX40, the victim in the charged offenses, used the same kind of proxy devices, which were installed by FOX40’s IT Manager for investigative and journalistic uses.
A proxy server requires no technical sophistication on the part of the user, no more than for any of the technologies we all use on a regular basis. We all use sophisticated technology. The computers we use are sophisticated, and so are our smartphones. The cars we used to get here are sophisticated, as are the many computerized features in the car. There are sophisticated security features enabled on each of these devices, to prevent theft, identify fraud, and other abuses of our privacy. We even use sophisticated technology to keep our homes safe, and while this technology is becoming increasingly more advanced, is also becoming more commonplace and easy to use. To argue that each of these uses is a “sophisticated means” would mean that ordinary everyday behavior, otherwise protected and even encouraged, is appropriate to enhance a criminal sentence.
The “sophisticated means” enhancement could not possibly have been intended to encompass such commonplace use of a device that requires no sophistication on the users’ part. The amendments to the Sentencing Guidelines reflect that this enhancement was meant to be narrow, so as to exclude from its scope this type simple behavior that is not ordinarily discouraged. Thus, it is an error to enhance Keys’s sentence based on his use of a proxy server.
- Fake Email Addresses
Lastly, the PSR reflects that Keys’s use of “fake email addresses” as a factor in determining that he used sophisticated means in connection with the charged offense. If, by “fake email address,” the PSR means the use of aliases like “cancerman4099” and “foxmulder4099” in his email addresses, there is nothing “fake” or sophisticated about using a clever alias for an email address. For instance, in the email list of FOX40 viewers introduced as Government Exhibit 108, the email addresses include email@example.com and firstname.lastname@example.org. This type of alias is common in email addresses, especially on publicly available email services such as Yahoo! mail or Gmail. There has been no evidence to show that there is anything out of the ordinary, let alone sophisticated or “fake”, in using these kinds of email addresses. Even council uses fake email addresses to send spam messages to such that they do not clog up his inbox.
 United States Sentencing Commission, Public Hearing, March 17 and 18, 2009, available at <http://www.ussc.gov/sites/default/files/pdf/amendment-process/public-hearings-and-meetings/20090317/Transcript.pdf>.
 United States Sentencing Commission, Proposed 2009 amendment to Application Note for Sophisticated Means Enhancement under Subsection (b)(9), January 27, 2009, available at http://www.ussc.gov/sites/default/files/pdf/amendment-process/reader-friendly-amendments/20090127_RFP_Amendments.pdf.
 United States Sentencing Commission, Public Hearing, pg. 36
 Id. at 50.
 Id. at 37.
 United States Sentencing Commission, 2015 amendment to §2B1.1(b)(10)(C), April 30, 2015, pg. 29 available at <http://www.ussc.gov/sites/default/files/pdf/amendment-process/official-text-amendments/20150430_Amendments.pdf>.
 Id. at 30.
 All of Matthew’s lawyers uses VPN.