United States v. George Koutsostamatis

956 F.3d 301
CourtCourt of Appeals for the Fifth Circuit
DecidedApril 15, 2020
Docket18-20594
StatusPublished
Cited by12 cases

This text of 956 F.3d 301 (United States v. George Koutsostamatis) is published on Counsel Stack Legal Research, covering Court of Appeals for the Fifth Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. George Koutsostamatis, 956 F.3d 301 (5th Cir. 2020).

Opinion

Case: 18-20594 Document: 00515383270 Page: 1 Date Filed: 04/15/2020

IN THE UNITED STATES COURT OF APPEALS FOR THE FIFTH CIRCUIT

No. 18-20594 United States Court of Appeals Fifth Circuit

FILED April 15, 2020

UNITED STATES OF AMERICA, Lyle W. Cayce Clerk Plaintiff – Appellee,

v.

GEORGE KOUTSOSTAMATIS,

Defendant – Appellant.

Appeal from the United States District Court for the Southern District of Texas

Before ELROD, WILLETT, and OLDHAM, Circuit Judges. ANDREW S. OLDHAM, Circuit Judge: George Koutsostamatis worked for BP. He posed as a hacker and threatened to release sensitive information unless BP paid him a fortune in cryptocurrency. BP contacted the FBI, and the FBI asked BP to help identify the purported hacker. BP used its own digital security team and outside contractors to do just that. With BP’s help, the FBI uncovered Koutsostamatis’s crime. He pleaded guilty to one count of wire fraud. His sentence included an order to pay restitution in the amount of $552,651 for expenses BP incurred investigating his scheme. Now, he argues those expenses aren’t covered by the Mandatory Victims Restitution Act. We agree. Case: 18-20594 Document: 00515383270 Page: 2 Date Filed: 04/15/2020

No. 18-20594

I. We begin with the law of restitution. Then we turn to Koutsostamatis’s case. A. A federal court cannot order restitution without statutory authorization. United States v. Papagno, 639 F.3d 1093, 1096 (D.C. Cir. 2011). Starting in 1925, federal courts were authorized to order restitution as a part of probation. See Cortney E. Lollar, What Is Criminal Restitution?, 100 IOWA L. REV. 93, 96 n.5 (2014). For the bulk of the twentieth century that was essentially the extent of federal restitution. Ibid. Then came the victims’ rights movement of the 1970s and 1980s. See Papagno, 639 F.3d at 1096. In 1982, Congress passed and President Reagan signed the Victim and Witness Protection Act (“VWPA”), Pub. L. No. 97-291, 96 Stat. 1248, 1253 (codified as amended at 18 U.S.C. § 3663). The VWPA authorized restitution for victims of most federal crimes. Papagno, 639 F.3d at 1096. And it allowed judges to order restitution for the value of lost property, the expenses of recovering from bodily injury, and the cost of funerals. Ibid. Congress expanded restitution again in 1994. That year, Congress passed and President Clinton signed legislation that amended the VWPA. See Pub. L. No. 103-322, § 40504, 108 Stat. 1796, 1947 (codified at 18 U.S.C. § 3663(b)(4)). With that addition, courts gained the power to order restitution to “reimburse the victim for lost income and necessary child care, transportation, and other expenses related to participation in the investigation or prosecution of the offense or attendance at proceedings related to the offense.” Ibid. The same year, restitution became mandatory under the Violence Against Women Act (“VAWA”), which required restitution in “the full amount of the victim’s losses” for victims of domestic violence and certain sex-

2 Case: 18-20594 Document: 00515383270 Page: 3 Date Filed: 04/15/2020

related crimes. See Pub. L. No. 103-322, 108 Stat. 1904 (codified as amended at 18 U.S.C. § 2248). Two years later, restitution became mandatory for a much larger set of federal crimes under the Mandatory Victims Restitution Act (“MVRA”), Pub. L. No. 104-132, § 204, 110 Stat. 1214, 1227 (1996) (codified as amended at 18 U.S.C. § 3663A). The MVRA kicks in when (1) the underlying offense is a “crime of violence,” an “offense against property . . . including any offense committed by fraud or deceit,” or one of two specific crimes concerning tampering with consumer products or theft of medical products, and (2) an identifiable victim suffers a physical or pecuniary loss. See 18 U.S.C. § 3663A(c)(1). In such cases, the MVRA requires restitution for the same kinds of expenses for which the VWPA allows restitution (i.e., the value of lost property, the expenses of recovering from bodily injury, and the cost of funerals). Compare id. § 3663A(b), with id. § 3663(b). And “in any case,” the MVRA requires the defendant to “reimburse the victim for lost income and necessary child care, transportation, and other expenses incurred during participation in the investigation or prosecution of the offense or attendance at proceedings related to the offense.” Id. § 3663A(b)(4). Koutsostamatis’s case requires us to determine the limits of the “other expenses” covered by § 3663A(b)(4). B. Koutsostamatis worked for BP in Chicago as a refining supply economist. In 2017, he broke bad: Koutsostamatis took trading information and personally identifiable information about hundreds of BP employees from BP’s network, and then sent BP an email from an anonymous, foreign email account posing as a hacker. He threatened to release the information he’d pulled from the network unless BP paid him 125 bitcoins (at that time, worth about $340,000).

3 Case: 18-20594 Document: 00515383270 Page: 4 Date Filed: 04/15/2020

Koutsostamatis’s threats continued for the next 40 days. At one point, to display the depth of his “hack,” Koutsostamatis sent BP a recording of the audio at a BP “town hall” meeting that had taken place on the Chicago trading floor. In an email, Koutsostamatis claimed to have recorded the event by hacking into a microphone. In reality, he just used his own phone. Within hours of the first extortionist email, BP contacted the FBI. The FBI, in turn, asked for BP’s help investigating the breach of BP’s network. BP’s systems are massive and complex—it has over 80,000 employees working in more than 80 countries. And Koutsostamatis’s crime impacted employees in the United States, the United Kingdom, and Germany. So, in response to the FBI’s request, 44 members of BP’s digital security team, along with outside contractors, audited its servers to determine the source of the breach. Other outside contractors conducted forensic analysis on the audio recording of the town hall. Those efforts helped identify Koutsostamatis as the “hacker.” And eventually, Koutsostamatis pleaded guilty to one count of wire fraud. During sentencing, BP’s Donna Weimer testified about the costs BP incurred in discovering the fraud. The costs fell into the following categories: • BP spent $423,267 on its own digital security team. Weimer explained that “[t]hose expenses were incurred because we had to have our digital security team help the FBI in the investigation.” Given “the size and the massive amount of emails, IMs and web browsers that we needed to take a look at,” Weimer said, the FBI “needed BP’s assistance.” • BP spent $108,389 on “forensic services” by KPMG. As to that expense, Weimer explained, “there was just a lot of IMs, emails, web activity to go through, so it was additional digital security services that they helped provide.” • BP spent $17,875 on server auditing and logging by Varonis. Weimer noted that “Varonis was a software we used to help identify the breach.” The software allowed BP to know “when someone was accessing certain files.”

4 Case: 18-20594 Document: 00515383270 Page: 5 Date Filed: 04/15/2020

• Finally, BP spent $3,120 on audio review by Diligence Forensics.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Barr v. SEC
114 F.4th 441 (Fifth Circuit, 2024)
United States v. Joseph
Fifth Circuit, 2024
United States v. Moore
71 F.4th 392 (Fifth Circuit, 2023)
United States v. Richardson
Fifth Circuit, 2023
United States v. Palomares
52 F.4th 640 (Fifth Circuit, 2022)
United States v. John Afriyie
27 F.4th 161 (Second Circuit, 2022)
United States v. Majors
Fifth Circuit, 2022
United States v. Clark
990 F.3d 404 (Fifth Circuit, 2021)

Cite This Page — Counsel Stack

Bluebook (online)
956 F.3d 301, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-george-koutsostamatis-ca5-2020.