United States v. Goodyear

• Court: Court of Appeals for the Tenth Circuit
• Decided: November 6, 2019
• Docket: 18-6222
• Status: Unpublished

Opinion

FILED United States Court of Appeals UNITED STATES COURT OF APPEALS Tenth Circuit

FOR THE TENTH CIRCUIT November 6, 2019 _________________________________ Elisabeth A. Shumaker Clerk of Court UNITED STATES OF AMERICA,

Plaintiff - Appellee,

v. No. 18-6222 (D.C. No. 5:17-CR-00179-HE-1) DAVID CHESLEY GOODYEAR, a/k/a (W.D. Okla.) JamesSober, a/k/a Wolfman_4_Ever, a/k/a HawaiiAPUser,

Defendant - Appellant. _________________________________

ORDER AND JUDGMENT* _________________________________

Before CARSON, BALDOCK, and EBEL, Circuit Judges.** _________________________________

Defendant-Appellant David Goodyear appeals from his conviction for causing

intentional damage to a protected computer that resulted in at least $5,000 of aggregate

loss to the victim within one year in violation of 18 U.S.C. § 1030(a)(5)(A) and

(c)(4)(B)(i). The facts underlying this conviction are as follows.

***

* This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. It may be cited, however, for its persuasive value consistent with Fed. R. App. P. 32.1 and 10th Cir. R. 32.1. ** After examining the briefs and appellate record, this panel has determined unanimously that oral argument would not materially assist in the determination of this appeal. See Fed. R. App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore ordered submitted without oral argument. Defendant was a customer of Astronomics and a registered user of

CloudyNights.com (“CloudyNights”). Astronomics is an Oklahoma-based company

that sells telescopes and other astronomy equipment, primarily online at

Astronomics.com. CloudyNights is a free internet forum for amateur astronomy

enthusiasts. CloudyNights is paid for and operated by Astronomics, and the same

family owns both entities. Between July 2011 and August 2016, Defendant used eleven

different usernames on CloudyNights, with each username banned for violating the

website’s terms of service. In August 2016, CloudyNights banned Defendant’s latest

username, JamesSober.

Thereafter, Defendant registered the username HawaiiAPUser with

CloudyNights. On August 13, 2016, Defendant created several posts on CloudyNights

threatening to bring the Astronomics and CloudyNights websites down with “denial of

service attacks.” A denial-of-service attack is an interruption of a website by the

malicious actions of a third party. At the same time, Defendant posted on a “hack

forum” asking other users to “take down” CloudyNights.1

Later that same day, CloudyNights became unresponsive and Astronomics

began experiencing outages. IT professionals explained the sites were experiencing

denial-of-service attacks. Specifically, the websites were being flooded with “tens of

millions of bogus requests,” which caused the websites to crash. Because the requests

1 Defendant stated he could not remember if the address for the “hack forum” website was hackforums.com or hackforums.net. We will refer to the site as HackForums. 2 were coming from thousands of sources, as opposed to a single source, IT struggled to

identify and block the requests.

Thereafter, law enforcement interviewed Defendant regarding his activity on

CloudyNights. Defendant admitted to posting the threats on CloudyNights.com and

soliciting an attack on CloudyNights on HackForums. Following Defendant’s

admissions, the Government charged him with violating 18 U.S.C. § 1030(a)(5)(A) and

(c)(4)(B)(i) for causing intentional damage to a protected computer that resulted in at

least $5,000 of aggregate loss to the victim within one year.

On February 14, 2018, Defendant proceeded to trial. The Government presented

testimony from Michael Bieler (the owner of Astronomics), IT specialists, and FBI

agents involved in the case. Following the Government’s case in chief, Defendant

moved for a judgment of acquittal pursuant to Rule 29 of the Federal Rules of Criminal

Procedure. The district court denied the motion finding the Government presented

sufficient evidence from which a rational jury could return a guilty verdict.

Subsequently, Defendant called one witness, a forensic computer analyst, and rested.

Thereafter, the case was submitted to the jury, and the jury returned a guilty

verdict. At sentencing, the district court ordered restitution in the amount of

$27,352.51. Defendant timely appealed. On appeal, Defendant argues: (1) the district

court erred in admitting the testimony of Mr. Bieler concerning the alleged amount of

damages; (2) the Government presented insufficient evidence to obtain a conviction;

and (3) the district court erred in awarding restitution in the amount of $27,352.51. We

discuss each issue in turn. Exercising jurisdiction under 28 U.S.C. § 1291, we affirm.

3 ***

First, although not briefed as a separate issue, Defendant contends the district

court erred in admitting the testimony of Michael Bieler, owner of Astronomics,

regarding the alleged amount of damages. Defendant argues the testimony was

irrelevant and unduly prejudiced the jury against him. We review the district court’s

evidentiary rulings for an abuse of discretion and will not disturb a ruling unless it was

based on a clearly erroneous conclusion of law or manifests a clear error in judgment.

United States v. Williams, 934 F.3d 1122, 1131 (10th Cir. 2019).

Rule 402 of the Federal Rules of Evidence permits the introduction of relevant

evidence and requires the exclusion of irrelevant evidence. Fed. R. Evid. 402.

Evidence is relevant if: (1) “it has any tendency to make a fact more or less probable

than it would be without the evidence”; and (2) “the fact is of consequence in

determining the action.” Fed. R. Evid. 401. The district court may exclude relevant

evidence if “its probative value is substantially outweighed by a danger of . . . unfair

prejudice.” Fed. R. Evid. 403.

In this case, Defendant complains the district court admitted irrelevant and

unduly prejudicial testimony when it permitted Mr. Bieler to testify regarding the

amount of damages sustained from the cyber-attack. Specifically, Defendant argues

Mr. Bieler should not have been permitted to testify about the cost of IT services

retained to protect Astronomics and CloudyNights from continuing and future cyber-

attacks. Defendant urges these expenses have “no causal nexus” to Defendant’s

4 conduct and inflate the damages estimation, which in turn inflames the jury. We are

not persuaded.

First, to prove the offense of conviction, the Government was required to show

the cyber-attack resulted in a loss of at least $5,000. Mr. Bieler’s testimony is directly

relevant to this element because the additional IT expenses resulted from the attack on

Astronomics and CloudyNights. Mr. Bieler testified that Astronomics.com and

CloudyNights.com have operated since 1994, but never needed the additional IT

protection until the instant cyber-attack. Furthermore, the testimony is not unduly

prejudicial or particularly likely to inflame the jury’s passions. Mr. Bieler testified the

IT services at issue cost $400 a month. This is not an astronomical amount by any

measure, and certainly not in comparison to Mr. Bieler’s lost profits, which he

estimated at $18,000. Accordingly, given the high probative value and low prejudicial

value of the testimony, we hold the district court did not abuse its discretion in

admitting the testimony.

Next, Defendant argues the Government presented insufficient evidence to

obtain a conviction. We review the sufficiency of the evidence de novo to determine

whether a rational jury could find the defendant guilty beyond a reasonable doubt.

United States v. Marquez, 898 F.3d 1036, 1040 (10th Cir. 2018). We consider all the

evidence, along with reasonable inferences taken therefrom, in the light most favorable

to the government. United States v. Winder, 557 F.3d 1129, 1137 (10th Cir. 2009).

On appeal, we do not “assess the credibility of witnesses or weigh conflicting evidence,

5 as these tasks are exclusively for the jury.” Id. (citing United States v. Bowen, 527 F.3d

1065, 1076 (10th Cir. 2008)). Rather, we “merely determine whether a rational trier

of fact could have found the essential elements of the crime beyond a reasonable

doubt.” Winder, 557 F.3d at 1137 (citing Bowen, 527 F.3d at 1076).2

To obtain a conviction for causing intentional damage to a protected computer

that resulted in at least $5,000 of aggregate loss to the victim within one year in

violation of 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i), the Government must have

proven: (1) Defendant knowingly caused the transmission of a program, information,

code, or command to a protected computer; and (2) Defendant, as a result of such

conduct, intentionally caused damage to a protected computer without authorization.

18 U.S.C. §.1030(a)(5)(A). The jury was also entitled to convict Defendant under an

aiding and abetting theory if the Government proved: (1) Defendant “willfully

associated himself with a criminal venture”; and (2) “sought to make the venture

succeed through some action of his own.” United States v. Ibarra-Diaz, 805 F.3d 908,

932 (10th Cir. 2015).

2 We note Defendant failed to renew his motion for a judgment of acquittal at the close of all evidence as required by Rule 29 of the Federal Rules of Criminal Procedure. Typically, when a defendant fails to renew his motion after introducing evidence in his own defense, he waives the right to appellate review on the sufficiency of the evidence. See United States v. Rufai, 732 F.3d 1175, 1189 (10th Cir. 2013). Nevertheless, the Government does not raise Defendant’s waiver in its response brief and therefore, waives the waiver. See United States v. Contreras-Ramos, 457 F.3d 1144, 1145 (10th Cir. 2006) (“waiver is waived when the government utterly neglects to invoke the waiver in this court”). 6 In either event, the Government must have also established Defendant’s conduct

caused a loss of at least $5,000 during any one-year period. 18 U.S.C.

§.1030(c)(4)(B)(i). Loss is defined as: (1) “any reasonable cost to any victim,

including the cost of responding to an offense”; and (2) “any revenue lost, cost

incurred, or other consequential damages incurred because of interruption of service.”

18 U.S.C. § 1030(e)(11).

Upon review, we find ample evidence to support the jury’s verdict. First, FBI

Agent Josh Sadowsky testified regarding an interview he conducted with Defendant.

A recording of that interview was played for the jury and admitted into evidence. In

the interview, Defendant admitted to creating several posts on CloudyNights in which

he threatened to take down Astronomics.com and CloudyNights.com with a denial-of-

service attack. Defendant also admitted to posting on HackForums asking users to

“take down” the site.3 Defendant indicated he did not have to pay anyone because he

need only “put a request that they take down the site” and then HackForums “see[s] if

they can take down [the] site[] because they’re glory guys.”

Although Defendant stated he never posted on HackForums prior to that time,

he admitted he was searching for a way to “take them out.”4 Thereafter, he found

3 Defendant does not indicate whether he was referring to CloudyNights.com or Astronomics.com when he asked HackForums users to take down the site. Defendant stated he posted, “Hey, can you take down this site?” 4 Again, Defendant does not indicate if he is talking about CloudyNights.com or Astronomics.com when he says, “take them out,” but from the surrounding context, it is clear he is referring to one or both of the sites. 7 HackForums on a google search and made the request. Defendant admitted to logging

on to HackForums approximately one week later to “see if something had been done”

with his request. When asked if he could stop the cyber-attack Defendant stated, “I

don’t know these guys well enough . . . I’m hoping it’s been stopped because I put that

request up, like, four days ago, maybe last week, seven days ago.” Although Defendant

stated he was not sure how far the request would go, he “knew it was wrong.”

While the jury might have concluded Defendant caused the cyber-attack based

on these admissions alone, the Government presented additional incriminating

evidence through the testimony of Mr. Bieler, the web administrator for CloudyNights,

and IT experts. Specifically, Mr. Bieler and the CloudyNights web administrator

testified Astronomics.com and CloudyNights.com began experiencing outages on

August 13, 2016—the same day Defendant solicited the cyber-attack. IT experts Matt

Riffle and Jacob Sinkey testified the outages were caused by, or at least consistent

with, a distributed denial of service attack—precisely the type of attack Defendant

threatened. While Defendant presented contradictory testimony from his own IT

expert, it is the province of the jury to assess the credibility of witnesses and weigh

conflicting evidence. See Winder, 557 F.3d at 1137.

Finally, the Government presented sufficient evidence that the resulting loss was

at least $5,000. Specifically, Mr. Bieler testified he paid $720 to restore

Astronomics.com and CloudyNights.com following the cyber-attack. In addition, Mr.

Bieler testified he had to install CloudFlare, an IT protection service, to stop the cyber-

attack from continuing. Mr. Bieler testified CloudFlare cost $400 a month, for a total

8 of $4,800 in one year. With these costs alone, the Government established losses of

$5,520—a loss that exceeds the statutory requirement of at least $5,000—and this

amount does not include Mr. Bieler’s testimony that his business suffered lost profits

in the amount of $18,000.

Based on all this evidence, a reasonable jury could infer: (1) Defendant

knowingly caused the cyber-attack; and (2) intentionally caused the associated damage.

At the very least, a reasonable jury could convict under the aiding and abetting theory.

Specifically, a rational jury could have found: (1) Defendant willfully associated

himself with a criminal venture when he sought out HackForums for the purpose of

attacking Astronomics and CloudyNights; and (2) furthered that criminal venture by

posting his request to take down the site. Under either theory, the Government

presented sufficient evidence that the resulting losses were at least $5,000.

Accordingly, Defendant’s conviction must stand.

Finally, Defendant argues the district court erred in awarding restitution in the

amount of $27,352.51. Specifically, Defendant argues the Government’s proof of loss

was insufficient to support the award. “We review the legality of a restitution order de

novo, which involves reviewing the underlying factual findings for clear error and the

amount of restitution imposed for an abuse of discretion.” United States v. Howard,

887 F.3d 1072, 1077 (10th Cir. 2018). Defendant does not contest the legality of the

restitution award, but rather the amount awarded. Therefore, we review the district

9 court’s factual findings for clear error and the amount awarded for an abuse of

discretion.

Awarding restitution in excess of the victim’s actual loss constitutes an abuse of

discretion. Id. However, “in determining the amount of loss, a sentencing court may

resolve uncertainties with a view toward achieving fairness to the victim, so long as it

still makes a reasonable determination of appropriate restitution rooted in a calculation

of actual loss.” Id. at 1076 (quoting United States v. James, 564 F.3d 1237, 1246 (10th

Cir. 2009)). While the district court need not calculate a victim’s loss with “exact

precision,” there must be some precision, and “speculation and rough justice are not

permitted.” United States v. Ferdman, 779 F.3d 1129, 1133 (10th Cir. 2015). The

Government has the burden to establish the amount of loss by a preponderance of the

evidence. Id. at 1132.

In this case, the district court adopted the presentence report’s findings with

respect to restitution. In the presentence report, the United States Probation Office

separated Astronomics’ and CloudyNights’ losses into three categories: (1) the cost to

restore Astronomics.com and CloudyNights.com following the cyber-attack; (2) the

cost of IT protection to stop continued attacks; and (3) the lost profit resulting from

the cyber-attack.

Turning first to the cost to restore the websites, Mr. Bieler testified he paid IT

support $720 to diagnose the cyber-attack and restore the websites. An invoice from

the IT company corroborated Mr. Bieler’s testimony. Next, with respect to IT

protection, Mr. Bieler testified he enlisted CloudFlare to stop the continued attacks at

10 the cost of $400 per month—a total of $4,800 per year. Finally, the district court

estimated lost profits by comparing Mr. Bieler’s sales in 2012, 2013, and 2015 (after

excluding 2014 and 2017 as outliers) to his sales in 2016. Using this method, the

district court calculated his sales for 2016 were $109,162.53 less than the average of

those in 2012, 2013, and 2015. With a 20% profit margin, the district court concluded

Mr. Bieler’s net profit loss was $21,832.51. This calculation of lost profits is within

Mr. Bieler’s estimate of a loss between $18,000 and $28,000. After adding up these

three categories of losses, the district court determined Mr. Bieler’s total loss was

$27,352.51.

All three of these calculations by the United States Probation Office, which were

subsequently adopted by the district court, are reasonable and based on the testimony

and evidence at trial. We do not find any clear error with respect to the factual findings

underlying the restitution award. Therefore, the district court did not abuse its

discretion in awarding restitution in the amount of $27,352.51.

Accordingly, for the reasons provided herein, Defendant’s conviction and

sentence are AFFIRMED.

Entered for the Court

Bobby R. Baldock Circuit Judge