IN THE UNITED STATES COURT OF APPEALS FOR THE FIFTH CIRCUIT
_____________________
No. 99-11164
_____________________
UNITED STATES OF AMERICA
Plaintiff - Appellee
v.
COREY LINDSLEY, also known as Tabbas Defendant - Appellant
_________________________________________________________________
Appeal from the United States District Court for the Northern District of Texas
_________________________________________________________________
May 3, 2001
Before KING, Chief Judge, and ALDISERT* and BENAVIDES, Circuit Judges.
PER CURIAM:** Defendant-Appellant Corey Lindsley pleaded guilty to one count of trafficking in unauthorized computer access devices and one count of computer fraud and was sentenced to a forty-one month term of imprisonment. Lindsley appeals the district
*
Circuit Judge of the Third Circuit, sitting by designation.
**
Pursuant to 5TH CIR. R. 47.5, the court has determined that this opinion should not be published and is not precedent except under the limited circumstances set forth in 5TH CIR. R. 47.5.4.
court’s imposition of a twelve-point sentencing enhancement as a result of a loss finding exceeding $1,500,000. For the following reasons, we AFFIRM the sentence.
I. FACTUAL AND PROCEDURAL HISTORY A. The Charge
On May 3, 1999, Corey Lindsley1 pleaded guilty to one count of trafficking in unauthorized computer access devices in violation of 18 U.S.C. § 1029(a)(3), (c)(1), and (c)(2), and one count of computer fraud in violation of 18 U.S.C. § 1030(a)(4), (c)(2), and (c)(3)(A). According to the Factual Resume filed with the district court on May 3, 1999, Lindsley stipulated that, from October 1994 through approximately February 22, 1995, he and his co-defendants Jonathan Bosanac and Calvin Cantrell used their personal computers to illegally access Sprint Corporation’s (“Sprint”) computer system for the purpose of obtaining something of value. Lindsley specifically stipulated to two particular incidents. In one, Lindsley downloaded, possessed, and stole more than fifteen unauthorized access devices, which were in this case, Sprint calling card numbers. In the second incident, Lindsley admitted to calling Cantrell from Lindsley’s parents’
1 In the Appellant’s brief, Appellant’s last name is spelled “Lindsly.” He is also known by the nickname “Tabbas.” For the purposes of this opinion, we will refer to him as “Lindsley.”
3
home in Colorado and asking Cantrell to send him calling card numbers. Cantrell then illegally entered Sprint’s computer system and downloaded2 858 Sprint calling card numbers that he subsequently uploaded3 to Lindsley’s computer.
A sentencing hearing was held on September 16, 1999.
B. The Presentence Report According to the information contained in the Presentence Report (“PSR”), the two occasions to which Lindsley stipulated were but a part of a larger operation that occurred between August 1994 and February 1995. The PSR provided further detail about Lindsley’s and his co-defendants’ activities in connection with this operation. For example, according to the PSR, Lindsley admitted to gaining illegal access to the computer systems of Southwestern Bell (“Bell”), General Telephone Company (“GTE”), Pacific Bell, Bell Atlantic, Southwestern Bell Mobility, Sprint, and US West. Further, Lindsley revealed that he had probably set up over fifty conference calls that were billed to innocent third parties. The PSR stated that the calculable loss to the companies, specifically Sprint, GTE, and Bell, was $1,851,780.4
2 The term “download” refers to the process of transferring data files from a remote computer to a local computer.
3 The term “upload” refers to the process of transferring data files from a local computer to a remote computer.
4 The PSR does not discuss the losses of the other four companies.
4
This figure included a Bell loss of $684,780, a GTE loss of $214,000, and a Sprint loss of $953,000.
The PSR set Lindsley’s base offense level at III and recommended a twelve-point enhancement based on a proposed finding that the loss attributable to Lindsley was $1,851,780. This gave Lindsley a total offense level of nineteen, which results in an imprisonment range of thirty-seven to forty-six months.
Lindsley objected to the PSR arguing that the loss calculation was excessive, in part because it took into account consequential damages. In response, the probation officer stated that the loss amount was obtained from the government and the case agent and verified by the companies.
C. The Sentencing Hearing The sentencing hearing focused primarily on whether it was foreseeable that Lindsley’s co-defendants would sell the stolen Sprint calling card numbers and on the amount of loss caused by both Lindsley’s conduct and the foreseeable conduct of his co- defendants. At the sentencing hearing, the government called several witnesses. The case agent, FBI Special Agent Michael Morris, testified that, based on the evidence, he considered Lindsley to have the most knowledge on the telecommunications side, to have the most knowledge of the number of conspirators and their identity, and to have been aware that other members of the group were selling calling card numbers. Morris also
5
testified as to the $214,000 loss sustained by GTE, stating that according to a memorandum from GTE, the company had incurred a loss of $23,500.65 from conference calls made by the defendants as well as additional losses.5 Regarding Sprint’s claimed losses of $953,000, the government introduced a letter from Sprint and the testimony of its director of security Cloyce Fleming. Fleming testified that Sprint had calculated the loss at $955,965.356 by adding up the reported unauthorized use for which Sprint had credited cardholders’ accounts. Sprint included only the reported unauthorized use from those accounts that the FBI identified as being downloaded or uploaded from Cantrell’s line.7 Additionally, Fleming testified regarding a second document, which revealed a large increase in reported fraudulent use during the time of the defendants’ activities.
5 At trial, however, a memo from GTE stated its total losses were $97,430.65, including $23,530.65 for eleven fraudulently billed conference calls and $73,900 in investigation expenses. This does not reach the total of $214,000 claimed in the PSR.
6 Nothing in the record explains the difference between the $953,000 figure and the $955,965.35.
7 During his testimony, Morris explained that a courtordered wiretap was placed on Cantrell’s phone lines that captured, inter alia, the data transmissions and the downloading of information from the telecommunication service providers’ databases. From the wiretap, the FBI compiled a database of 6679 readable credit card numbers that were downloaded or uploaded while the wiretap was in progress. Sprint identified 2129 accounts on which account holders had reported unauthorized use and for which Sprint had credited their accounts.
6
Finally, Ronald Youngclaus testified at sentencing regarding Bell’s claimed $684,240 in losses. According to a letter submitted by Bell, this figure included $27,370 for the cost of labor to investigate the damage done to the company’s systems, $8,464 in labor to restore the systems to their original integrity, and $10,392 to replace the damaged BIGBIRD system. Furthermore, the letter identified a cost of $628,014 to obtain 12,775 “smart cards” for the systems that had been compromised by the defendants. Youngclaus testified that these smart cards were the only way to protect the system from the “sniffers”8 that the defendants had planted in the system. During cross-examination, however, Youngclaus admitted that the cards served to make sure the intrusion did not happen again.
Crediting the testimony of the government witnesses and the calculations contained in the PSR, the district court found that the loss figure was $1,851,857. Accordingly, the court concluded that the loss attributable to Lindsley exceeded $1.5 million, resulting, pursuant to the United States Sentencing Guidelines (“U.S.S.G.”), in a twelve-point enhancement. The district court sentenced Lindsley to forty-one months imprisonment (in the middle of the thirty-seven to forty-six month guideline range)
8 “Sniffer” refers to “sniffer programs,” which are placed in a computer system and capture individual’s log-on names and passwords. If the individual changes his or her log-on name and password, the “sniffer” will capture those changes and place the new information in a file for the computer hacker.
7
because Lindsley had not committed any other crimes since the offense. In its Statement of Reasons, the district court adopted the factual findings and guideline application of the PSR.
Lindsley timely appeals.
II. COST OF SMART CARDS Lindsley argues that the district court misapplied U.S.S.G.
§ 2F1.1 by including in the amount of loss the cost of the smart cards purchased by Bell. Lindsley contends that the smart cards did not simply restore the security of the Bell computer systems, but rather increased the security of the system beyond the level that existed at the time of the offense. As such, their cost is a consequential damage and consequential damages should not be included in the loss valuation in this circumstance. The government asserts that the security smart cards were properly included in the loss calculation because they were the only means available to prevent continued intrusion into Bell’s computer systems caused by the defendants’ activities. For this reason, the smart cards merely repaired the system by restoring the systems to their prior condition.
We review the district court’s interpretation and application of the sentencing guidelines de novo and its factual findings in connection with sentencing for clear error. See United States v. Morrow, 177 F.3d 272, 300 (5th Cir. 1999);
8
United States v. Parker, 133 F.3d 322, 329 (5th Cir. 1998). A factual finding is not clearly erroneous, and therefore not subject to reversal, as long as it is plausible in light of the record as a whole. See United States v. Morris, 46 F.3d 410, 419 (5th Cir. 1995).
The commentary to the guideline concerning U.S.S.G. § 2F1.1 defines “loss” as “the value of the money, property, or services unlawfully taken.” U.S. SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 7 (1994)9; see also United States v. Izydore, 167 F.3d 213, 223 (5th Cir. 1999). Typically, the calculation of loss does not include the victim’s consequential or incidental losses. See Izydore, 167 F.3d at 223. Section 2F1.1 incorporates the valuation of loss definition of U.S.S.G. § 2B1.1, see U.S. SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 7 (1994), which provides: “When property is damaged, the loss is the cost of repairs, not to exceed the loss had the property been destroyed.” U.S. SENTENCING GUIDELINES MANUAL § 2B1.1, cmt. 2 (1994). Accordingly, whether the cost of the smart cards was properly included in the loss valuation depends on whether the cards were necessary to repair the damage to the system caused by the defendants.
9 We will apply the U.S.S.G. in effect at the time of the offense. A sentencing court must apply the version of the guidelines in effect at the time of sentencing unless such application would violate the Ex Post Facto Clause. See United States v. Greer, 158 F.3d 228, 234 n.4 (5th Cir. 1998). If applying the guidelines in effect at the time of sentencing would violate the Ex Post Facto Clause, the court should apply the guidelines in effect at the time of the offense. See id.
9
In 1997, the U.S.S.G. were amended to include specific guidance as to the measurement of loss in certain computer offenses. Although not controlling, subsequent versions of the U.S.S.G. may be considered in interpreting prior versions. See United States v. Armstead, 114 F.3d 504, 508 n.1 (5th Cir. 1997) (“According to U.S.S.G. § 1B1.11(b)(2), we are to consider subsequent clarifying amendments to the Guidelines.”). The 1997 U.S.S.G. provide:
In an offense involving unlawfully accessing, or exceeding authorized access to, a “protected computer”
as defined in 18 U.S.C. § 1030(e)(2)(A) or (B), “loss”
includes the reasonable cost to the victim of conducting a damage assessment, restoring the system and data to their condition prior to the offense, and any lost revenue due to interruption of service.
U.S. SENTENCING GUIDELINES MANUAL § 2B1.1, cmt. 7 (1997).
If the cost of the smart cards was the “reasonable cost to [Bell] of . . . restoring the system and data to their condition prior to the offense,” id., it was properly included, as the cost of repairing the damaged system, in the loss valuation. Lindsley argues that the cards constituted an improvement to the system and did more than return it to its condition prior to the offense because the system was vulnerable to the sniffers prior to the defendants’ activities. However, Youngclaus testified that the defendants penetrated deeply into the Bell computer system, that Bell located many of the sniffers but could not be sure it found all of them, and that “[t]here was no other way [to return this system to its original integrity before the day it was hacked by
10
this group] other than putting smart card technology in place because of the proliferation of sniffers in [Bell’s] network.”
Based on the record as a whole, we do not find the district court’s factual finding regarding the cost of repairing the Bell computer system to be clear error.
III. SPECIFIC FINDING OF LOSS Lindsley argues that although the district court concluded that the total loss caused by the defendants was $1,851,780, it only found him responsible for some amount over $1.5 million. Lindsley contends that the district court’s failure to make a finding of the specific amount of loss attributable to Lindsley violates Federal Rule of Criminal Procedure 32(c)(1)10 and Lindsley’s due process right to notice of the grounds on which the district court based its guideline determination. The government contends that the judge found Lindsley responsible for the entire amount of loss, as it was the result of foreseeable conduct of all the defendants, and properly used the $1.5 million figure because it was the threshold figure for the offense level enhancement.
10 Federal Rule of Criminal Procedure 32(c)(1) requires:
“For each matter controverted, the court must make either a finding on the allegation or a determination that no finding is necessary because the controverted matter will not be taken into account in, or will not affect, sentencing.” FED. R. CRIM. P. 32(c)(1).
11
“We review de novo whether a district court complied with a Federal Rule of Criminal Procedure.” United States v. Myers, 150 F.3d 459, 461 (5th Cir. 1998). Although Rule 32 requires the court to make findings regarding any controverted facts in the PSR, this circuit has “rejected the proposition that a court must make a ‘catechismic regurgitation of each fact determined,’” United States v. Carreon, 11 F.3d 1225, 1231 (5th Cir. 1994) (quoting United States v. Sherbak, 950 F.2d 1095, 1099 (5th Cir. 1992)), and “we have allowed the district court to make implicit findings by adopting the PSR.” Id. Furthermore, “[t]his adoption will operate to satisfy the mandates of Rule 32 when the findings in the PSR are so clear that the reviewing court is not left to ‘second-guess’ the basis for the sentencing decision.” Id. (quoting United States v. Hooten, 942 F.2d 878, 881 (5th Cir. 1991)).
The district court found:
However, the presentence report in Mr. Cantrell’s case, like the presentence report in Mr. Lindsley’s case, specifically finds, and I find that the probation officer reached the correct conclusion that the total amount of loss for all of the defendants involved in this is $1,851,787. Indeed, that’s reflected in the restitution calculations where it shows a 1.8 million dollar figure. Although that wasn’t ordered as restitution for Mr. Cantrell and won’t be either for Mr. Lindsley, I simply note that the evidence does sustain a substantial loss figure. I think it sustains a loss figure of at least 1.85 million dollars.
The government takes the position today that the court should at least find that the loss figure exceeded 1.5 million and I do on the credible evidence that was presented to me.
12
We find no error. The district court expressly adopted the findings of the PSR and found Lindsley responsible for a loss valued at $1,851,787. This finding satisfies the mandate of Rule 32. The $1.5 million dollar figure was used simply to identify the loss category in which the $1,851,787 loss placed Lindsley’s offense.11
IV. EVIDENCE TO SUPPORT LOSS VALUATION Lindsley argues that the losses claimed by GTE and Sprint are based on conclusory statements and unaccompanied by any documentation.12 To rely on such speculative and undocumented evidence, he continues, would violate the standard of proof
11 In support of his argument, Lindsley cites United States v. Aubrey, 878 F.2d 825 (5th Cir. 1989). We do not agree that Aubrey controls. In Aubrey, the PSR estimated the loss attributable to the defendant at over $3 million. See id. at 828. The defendant challenged the $3 million figure, and the district court found it to be inflated. See id. “However, the judge made no specific finding regarding the loss; rather, he mused that the figure ‘had to be well over a million dollars.’” Id. In holding that the finding did not comport with Rule 32, this court noted that “[g]iven the disparity between the government’s figure and appellant’s, it was not sufficient for the court simply to guess at a figure somewhere between the two and then characterize that as a ‘finding’ as to the matter controverted.” Id. Unlike the district court in Aubrey, the district court here did not find the $1,851,787 figure to be inflated. The district court in this case simply found that the loss figure was correct at $1,851,787, which placed the loss within the special offense characteristic category of a loss exceeding $1.5 million.
12 Lindsley did not object to any of the claimed losses by Bell, other than the cost of the smart cards discussed supra in Part III.
13
required for such a substantial sentence enhancement. The government argues that the evidence was not insufficient or speculative and that actual losses were likely much higher.
The government has the burden of proving by a preponderance of the evidence the facts necessary to support an increase in sentence level. See United States v. Sanders, 942 F.2d 894, 897 (5th Cir. 1991).13 “The sentencing court ‘need not determine the loss with precision,’ as long as its estimate is ‘reasonable . . . given the available information.’” United States v. Humphrey, 104 F.3d 65, 71 (5th Cir. 1997) (quoting U.S. SENTENCING GUIDELINES MANUAL § 2F1.1, Application Note 8); see also U.S. SENTENCING GUIDELINES MANUAL § 2F1.1, cmt. 8 (1994). “In resolving any reasonable dispute concerning a factor important to the sentencing determination, the court may consider relevant information without regard to its admissibility under the rules of evidence applicable at trial, provided that the information
13 Lindsley argues that, because the twelve-point enhancement turned a four-to-ten month sentence into a thirty- seven-to-forty-six month sentence, a clear and convincing standard may be more appropriate, or even constitutionally required. However, the correct standard in this circuit remains a preponderance of the evidence standard. In United States v. Mergerson, 4 F.3d 337 (5th Cir. 1993), this court acknowledged that in certain cases “where a sentencing fact is a ‘tail that wags the dog of the substantive offense,’” a finding of beyond a reasonable doubt might be required. See id. at 344. However, in United States v. Carreon, 11 F.3d 1225 (5th Cir. 1994), this court found the difference between a sentence of six years and one of twenty years “d[id] not constitute such a dramatic effect that it would justify considering, much less imposing, the higher burden of proof.” Id. at 1240. It is similarly unjustified in this situation.
14
has sufficient indicia of reliability to support its probable accuracy.” U.S. SENTENCING GUIDELINES MANUAL § 6A1.3(a) (1994). “Facts contained in a PSR are considered reliable and may be adopted without further inquiry if the defendant fails to present competent rebuttal evidence.” United States v. Parker, 133 F.3d 322, 329 (5th Cir. 1998); see also United States v. Sidhu, 130 F.3d 644, 651 (5th Cir. 1997). “If information is presented to the sentencing judge with which the defendant would take issue, the defendant bears the burden of demonstrating that the information cannot be relied upon because it is materially untrue, inaccurate, or unreliable.” United States v. Angulo, 927 F.2d 202, 205 (5th Cir. 1991). “Mere objections do not suffice as competent rebuttal evidence.” Parker, 133 F.3d at 329.
Lindsley alleges that the Sprint losses of $953,000 are conclusory and not supported by any documentation. In addition to that amount of loss being stated in the PSR, Fleming, a Sprint employee, testified as to Sprint’s losses. Further, a letter provided by Sprint indicated that the amount of phone card fraud suffered by Sprint was $955,965.35. The letter and Fleming’s testimony indicate that the loss was calculated by tabulating the amount of fraud that had been reported on the account numbers provided to Sprint by the FBI. See supra note 3. Lindsley provided no evidence to rebut the amount of loss alleged by Sprint. We find that Lindsley has failed to demonstrate that the
15
evidence relied upon to establish the amount of the Sprint loss is materially untrue, inaccurate, or unreliable.
Lindsley also challenges the evidence supporting the losses claimed by GTE. According to the PSR adopted by the district court, GTE attributed $214,000 of losses to the Lindsley. Lindsley claims that only $23,530.65 of those losses was supported by evidence at the sentencing hearing. We need not address the sufficiency of the evidence to support the claimed GTE losses. Even disallowing all of GTE’s losses over the cost of the conference calls, to which Lindsley does not object, the district court’s sentence withstands our clear error review. Because the district court judge adopted the total PSR finding of $1,851,787, subtracting the additional $190,469.35 would not reduce the loss finding below the $1.5 million required for the twelve-point increase.
We find that the evidence was sufficient to support the district court’s loss finding.
V. DISTRICT COURT’S COMMENTS Lindsley makes a final argument regarding allegedly improper comments made by the district court. The full text of the remarks to which Lindsley objects are as follows:
MS. AINSLIE: . . . . [The hackers] were --
considered themselves to be above other hacking groups because they were not in it for the money. They were not trying to -- this was a group that did it for the
16
fun of it, I hate to say. You know, it’s a very perverted sense of idea of fun, but they were there to show off to each other -- for the mental stimulation, for the challenge of it.
THE COURT: Mr. Rupp, the public defender, is a very good lawyer. He pled his client to a substantial loss. It wasn’t like it was fun and games.
MS. AINSLIE: I’m sorry?
THE COURT: I said it wasn’t like it was fun and games. He didn’t make that argument. I’m talking about the co-defendant who pled guilty.
MS. AINSLIE: I understand.
THE COURT: He’s a very fine lawyer.
MS. AINSLIE: Oh, absolutely, Your Honor, and I’ve talked to him.
THE COURT: He negotiated a loss figure that was substantially higher than what you’re arguing.
Lindsley argues that these comments by the district court were improper and indicated that the district court relied on matters outside the record, namely Cantrell’s stipulated loss amount and the reputation of his counsel, in making its finding of loss. Specifically, Lindsley asserts that trial counsel did not have a reasonable opportunity to respond to that evidence and that those facts should not have been considered in Lindsley’s sentencing. The government contends that the comments made by the district court were made in response to allegations that the computer hacking was for fun, and therefore, the district court’s response that the co-defendant had admitted to a profit motive was not improper. Furthermore, the government argues that even
17
if some of the remarks were improper, the remarks alone are insufficient to require reversal on plain error.
“A federal district judge may comment on the evidence, question witnesses, [and] bring out facts not yet adduced. . . . ‘Improper’ comments by a trial judge do not entitle the defendant to a new trial unless the comments are error that is substantial and prejudicial to the defendant’s case.” United States v. Wallace, 32 F.3d 921, 928 (5th Cir. 1994) (citations omitted). Furthermore, a sentencing court may rely on any evidence that has “sufficient indicia of reliability,” United States v. Huskey, 137 F.3d 283, 291 (5th Cir. 1998), and testimony from the trial of a third party is not barred as a matter of law. See United States v. Ramirez, 963 F.2d 693, 708 (5th Cir. 1992). As Lindsley’s trial counsel did not object to these comments, we review Lindsley’s claim under the plain error doctrine. See United States v. Carpenter, 776 F.2d 1291, 1295 (5th Cir. 1985).
We have reviewed the record, and we do not find the comments of the trial judge to be improper. Lindsley’s counsel was suggesting that the defendants were not committing these acts for profit, and the judge’s comments merely reflected that at least one of his co-defendant’s viewed the matter differently. We find that the district court’s comments do not amount to error that is substantial and prejudicial to the defendant’s case, and therefore, any error does not rise to the level of plain error.
18
VI. CONCLUSION
For the foregoing reasons, we AFFIRM the sentence given by the district court.