FILED
United States Court of Appeals UNITED STATES COURT OF APPEALS Tenth Circuit
FOR THE TENTH CIRCUIT November 6, 2019
_________________________________
Elisabeth A. Shumaker
Clerk of Court
UNITED STATES OF AMERICA,
Plaintiff - Appellee,
v. No. 18-6222 (D.C. No. 5:17-CR-00179-HE-1)
DAVID CHESLEY GOODYEAR, a/k/a (W.D. Okla.)
JamesSober, a/k/a Wolfman_4_Ever, a/k/a HawaiiAPUser,
Defendant - Appellant.
_________________________________
ORDER AND JUDGMENT*
_________________________________
Before CARSON, BALDOCK, and EBEL, Circuit Judges.**
_________________________________
Defendant-Appellant David Goodyear appeals from his conviction for causing intentional damage to a protected computer that resulted in at least $5,000 of aggregate loss to the victim within one year in violation of 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i). The facts underlying this conviction are as follows.
***
*
This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. It may be cited, however, for its persuasive value consistent with Fed. R. App. P. 32.1 and 10th Cir. R. 32.1.
**
After examining the briefs and appellate record, this panel has determined unanimously that oral argument would not materially assist in the determination of this appeal. See Fed. R. App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore ordered submitted without oral argument.
Defendant was a customer of Astronomics and a registered user of CloudyNights.com (“CloudyNights”). Astronomics is an Oklahoma-based company that sells telescopes and other astronomy equipment, primarily online at Astronomics.com. CloudyNights is a free internet forum for amateur astronomy enthusiasts. CloudyNights is paid for and operated by Astronomics, and the same family owns both entities. Between July 2011 and August 2016, Defendant used eleven different usernames on CloudyNights, with each username banned for violating the website’s terms of service. In August 2016, CloudyNights banned Defendant’s latest username, JamesSober.
Thereafter, Defendant registered the username HawaiiAPUser with CloudyNights. On August 13, 2016, Defendant created several posts on CloudyNights threatening to bring the Astronomics and CloudyNights websites down with “denial of service attacks.” A denial-of-service attack is an interruption of a website by the malicious actions of a third party. At the same time, Defendant posted on a “hack forum” asking other users to “take down” CloudyNights.1 Later that same day, CloudyNights became unresponsive and Astronomics began experiencing outages. IT professionals explained the sites were experiencing denial-of-service attacks. Specifically, the websites were being flooded with “tens of millions of bogus requests,” which caused the websites to crash. Because the requests
1 Defendant stated he could not remember if the address for the “hack forum” website was hackforums.com or hackforums.net. We will refer to the site as HackForums.
3
were coming from thousands of sources, as opposed to a single source, IT struggled to identify and block the requests.
Thereafter, law enforcement interviewed Defendant regarding his activity on CloudyNights. Defendant admitted to posting the threats on CloudyNights.com and soliciting an attack on CloudyNights on HackForums. Following Defendant’s admissions, the Government charged him with violating 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i) for causing intentional damage to a protected computer that resulted in at least $5,000 of aggregate loss to the victim within one year.
On February 14, 2018, Defendant proceeded to trial. The Government presented testimony from Michael Bieler (the owner of Astronomics), IT specialists, and FBI agents involved in the case. Following the Government’s case in chief, Defendant moved for a judgment of acquittal pursuant to Rule 29 of the Federal Rules of Criminal Procedure. The district court denied the motion finding the Government presented sufficient evidence from which a rational jury could return a guilty verdict. Subsequently, Defendant called one witness, a forensic computer analyst, and rested.
Thereafter, the case was submitted to the jury, and the jury returned a guilty verdict. At sentencing, the district court ordered restitution in the amount of $27,352.51. Defendant timely appealed. On appeal, Defendant argues: (1) the district court erred in admitting the testimony of Mr. Bieler concerning the alleged amount of damages; (2) the Government presented insufficient evidence to obtain a conviction; and (3) the district court erred in awarding restitution in the amount of $27,352.51. We discuss each issue in turn. Exercising jurisdiction under 28 U.S.C. § 1291, we affirm.
4
***
First, although not briefed as a separate issue, Defendant contends the district court erred in admitting the testimony of Michael Bieler, owner of Astronomics, regarding the alleged amount of damages. Defendant argues the testimony was irrelevant and unduly prejudiced the jury against him. We review the district court’s evidentiary rulings for an abuse of discretion and will not disturb a ruling unless it was based on a clearly erroneous conclusion of law or manifests a clear error in judgment. United States v. Williams, 934 F.3d 1122, 1131 (10th Cir. 2019).
Rule 402 of the Federal Rules of Evidence permits the introduction of relevant evidence and requires the exclusion of irrelevant evidence. Fed. R. Evid. 402. Evidence is relevant if: (1) “it has any tendency to make a fact more or less probable than it would be without the evidence”; and (2) “the fact is of consequence in determining the action.” Fed. R. Evid. 401. The district court may exclude relevant evidence if “its probative value is substantially outweighed by a danger of . . . unfair prejudice.” Fed. R. Evid. 403.
In this case, Defendant complains the district court admitted irrelevant and unduly prejudicial testimony when it permitted Mr. Bieler to testify regarding the amount of damages sustained from the cyber-attack. Specifically, Defendant argues Mr. Bieler should not have been permitted to testify about the cost of IT services retained to protect Astronomics and CloudyNights from continuing and future cyber- attacks. Defendant urges these expenses have “no causal nexus” to Defendant’s
5
conduct and inflate the damages estimation, which in turn inflames the jury. We are not persuaded.
First, to prove the offense of conviction, the Government was required to show the cyber-attack resulted in a loss of at least $5,000. Mr. Bieler’s testimony is directly relevant to this element because the additional IT expenses resulted from the attack on Astronomics and CloudyNights. Mr. Bieler testified that Astronomics.com and CloudyNights.com have operated since 1994, but never needed the additional IT protection until the instant cyber-attack. Furthermore, the testimony is not unduly prejudicial or particularly likely to inflame the jury’s passions. Mr. Bieler testified the IT services at issue cost $400 a month. This is not an astronomical amount by any measure, and certainly not in comparison to Mr. Bieler’s lost profits, which he estimated at $18,000. Accordingly, given the high probative value and low prejudicial value of the testimony, we hold the district court did not abuse its discretion in admitting the testimony.
***
Next, Defendant argues the Government presented insufficient evidence to obtain a conviction. We review the sufficiency of the evidence de novo to determine whether a rational jury could find the defendant guilty beyond a reasonable doubt. United States v. Marquez, 898 F.3d 1036, 1040 (10th Cir. 2018). We consider all the evidence, along with reasonable inferences taken therefrom, in the light most favorable to the government. United States v. Winder, 557 F.3d 1129, 1137 (10th Cir. 2009). On appeal, we do not “assess the credibility of witnesses or weigh conflicting evidence,
6
as these tasks are exclusively for the jury.” Id. (citing United States v. Bowen, 527 F.3d 1065, 1076 (10th Cir. 2008)). Rather, we “merely determine whether a rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Winder, 557 F.3d at 1137 (citing Bowen, 527 F.3d at 1076).2 To obtain a conviction for causing intentional damage to a protected computer that resulted in at least $5,000 of aggregate loss to the victim within one year in violation of 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i), the Government must have proven: (1) Defendant knowingly caused the transmission of a program, information, code, or command to a protected computer; and (2) Defendant, as a result of such conduct, intentionally caused damage to a protected computer without authorization. 18 U.S.C. §.1030(a)(5)(A). The jury was also entitled to convict Defendant under an aiding and abetting theory if the Government proved: (1) Defendant “willfully associated himself with a criminal venture”; and (2) “sought to make the venture succeed through some action of his own.” United States v. Ibarra-Diaz, 805 F.3d 908, 932 (10th Cir. 2015).
2 We note Defendant failed to renew his motion for a judgment of acquittal at the close of all evidence as required by Rule 29 of the Federal Rules of Criminal Procedure. Typically, when a defendant fails to renew his motion after introducing evidence in his own defense, he waives the right to appellate review on the sufficiency of the evidence. See United States v. Rufai, 732 F.3d 1175, 1189 (10th Cir. 2013). Nevertheless, the Government does not raise Defendant’s waiver in its response brief and therefore, waives the waiver. See United States v. Contreras-Ramos, 457 F.3d 1144, 1145 (10th Cir. 2006) (“waiver is waived when the government utterly neglects to invoke the waiver in this court”).
7
In either event, the Government must have also established Defendant’s conduct caused a loss of at least $5,000 during any one-year period. 18 U.S.C. §.1030(c)(4)(B)(i). Loss is defined as: (1) “any reasonable cost to any victim, including the cost of responding to an offense”; and (2) “any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11).
Upon review, we find ample evidence to support the jury’s verdict. First, FBI Agent Josh Sadowsky testified regarding an interview he conducted with Defendant. A recording of that interview was played for the jury and admitted into evidence. In the interview, Defendant admitted to creating several posts on CloudyNights in which he threatened to take down Astronomics.com and CloudyNights.com with a denial-of- service attack. Defendant also admitted to posting on HackForums asking users to “take down” the site.3 Defendant indicated he did not have to pay anyone because he need only “put a request that they take down the site” and then HackForums “see[s] if they can take down [the] site[] because they’re glory guys.”
Although Defendant stated he never posted on HackForums prior to that time, he admitted he was searching for a way to “take them out.”4 Thereafter, he found
3 Defendant does not indicate whether he was referring to CloudyNights.com or Astronomics.com when he asked HackForums users to take down the site. Defendant stated he posted, “Hey, can you take down this site?” 4 Again, Defendant does not indicate if he is talking about CloudyNights.com or Astronomics.com when he says, “take them out,” but from the surrounding context, it is clear he is referring to one or both of the sites.
8
HackForums on a google search and made the request. Defendant admitted to logging on to HackForums approximately one week later to “see if something had been done” with his request. When asked if he could stop the cyber-attack Defendant stated, “I don’t know these guys well enough . . . I’m hoping it’s been stopped because I put that request up, like, four days ago, maybe last week, seven days ago.” Although Defendant stated he was not sure how far the request would go, he “knew it was wrong.”
While the jury might have concluded Defendant caused the cyber-attack based on these admissions alone, the Government presented additional incriminating evidence through the testimony of Mr. Bieler, the web administrator for CloudyNights, and IT experts. Specifically, Mr. Bieler and the CloudyNights web administrator testified Astronomics.com and CloudyNights.com began experiencing outages on August 13, 2016—the same day Defendant solicited the cyber-attack. IT experts Matt Riffle and Jacob Sinkey testified the outages were caused by, or at least consistent with, a distributed denial of service attack—precisely the type of attack Defendant threatened. While Defendant presented contradictory testimony from his own IT expert, it is the province of the jury to assess the credibility of witnesses and weigh conflicting evidence. See Winder, 557 F.3d at 1137.
Finally, the Government presented sufficient evidence that the resulting loss was at least $5,000. Specifically, Mr. Bieler testified he paid $720 to restore Astronomics.com and CloudyNights.com following the cyber-attack. In addition, Mr. Bieler testified he had to install CloudFlare, an IT protection service, to stop the cyber- attack from continuing. Mr. Bieler testified CloudFlare cost $400 a month, for a total
9
of $4,800 in one year. With these costs alone, the Government established losses of $5,520—a loss that exceeds the statutory requirement of at least $5,000—and this amount does not include Mr. Bieler’s testimony that his business suffered lost profits in the amount of $18,000.
Based on all this evidence, a reasonable jury could infer: (1) Defendant knowingly caused the cyber-attack; and (2) intentionally caused the associated damage. At the very least, a reasonable jury could convict under the aiding and abetting theory. Specifically, a rational jury could have found: (1) Defendant willfully associated himself with a criminal venture when he sought out HackForums for the purpose of attacking Astronomics and CloudyNights; and (2) furthered that criminal venture by posting his request to take down the site. Under either theory, the Government presented sufficient evidence that the resulting losses were at least $5,000. Accordingly, Defendant’s conviction must stand.
***
Finally, Defendant argues the district court erred in awarding restitution in the amount of $27,352.51. Specifically, Defendant argues the Government’s proof of loss was insufficient to support the award. “We review the legality of a restitution order de novo, which involves reviewing the underlying factual findings for clear error and the amount of restitution imposed for an abuse of discretion.” United States v. Howard, 887 F.3d 1072, 1077 (10th Cir. 2018). Defendant does not contest the legality of the restitution award, but rather the amount awarded. Therefore, we review the district
10
court’s factual findings for clear error and the amount awarded for an abuse of discretion.
Awarding restitution in excess of the victim’s actual loss constitutes an abuse of discretion. Id. However, “in determining the amount of loss, a sentencing court may resolve uncertainties with a view toward achieving fairness to the victim, so long as it still makes a reasonable determination of appropriate restitution rooted in a calculation of actual loss.” Id. at 1076 (quoting United States v. James, 564 F.3d 1237, 1246 (10th Cir. 2009)). While the district court need not calculate a victim’s loss with “exact precision,” there must be some precision, and “speculation and rough justice are not permitted.” United States v. Ferdman, 779 F.3d 1129, 1133 (10th Cir. 2015). The Government has the burden to establish the amount of loss by a preponderance of the evidence. Id. at 1132.
In this case, the district court adopted the presentence report’s findings with respect to restitution. In the presentence report, the United States Probation Office separated Astronomics’ and CloudyNights’ losses into three categories: (1) the cost to restore Astronomics.com and CloudyNights.com following the cyber-attack; (2) the cost of IT protection to stop continued attacks; and (3) the lost profit resulting from the cyber-attack.
Turning first to the cost to restore the websites, Mr. Bieler testified he paid IT support $720 to diagnose the cyber-attack and restore the websites. An invoice from the IT company corroborated Mr. Bieler’s testimony. Next, with respect to IT protection, Mr. Bieler testified he enlisted CloudFlare to stop the continued attacks at
11
the cost of $400 per month—a total of $4,800 per year. Finally, the district court estimated lost profits by comparing Mr. Bieler’s sales in 2012, 2013, and 2015 (after excluding 2014 and 2017 as outliers) to his sales in 2016. Using this method, the district court calculated his sales for 2016 were $109,162.53 less than the average of those in 2012, 2013, and 2015. With a 20% profit margin, the district court concluded Mr. Bieler’s net profit loss was $21,832.51. This calculation of lost profits is within Mr. Bieler’s estimate of a loss between $18,000 and $28,000. After adding up these three categories of losses, the district court determined Mr. Bieler’s total loss was $27,352.51.
All three of these calculations by the United States Probation Office, which were subsequently adopted by the district court, are reasonable and based on the testimony and evidence at trial. We do not find any clear error with respect to the factual findings underlying the restitution award. Therefore, the district court did not abuse its discretion in awarding restitution in the amount of $27,352.51.
***
Accordingly, for the reasons provided herein, Defendant’s conviction and sentence are AFFIRMED.
Entered for the Court
Bobby R. Baldock
Circuit Judge