UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
UNITED STATES OF AMERICA v. Crim. No. 18-0359 (JDB)
THOMAS KENNEDY MCCORMICK,
Defendant.
MEMORANDUM OPINION
Before the Court are three pretrial motions filed by defendant Thomas Kennedy McCormick: (1) a motion to dismiss for preindictment delay; (2) a motion to suppress certain of his statements; and (3) a motion to dismiss counts 3–7 of the indictment. For the reasons that follow, the Court will deny each of the three motions. 1 Background
Darkode was an invitation-only online forum that operated from approximately 2008 to December 2013. Tr. at 34; Indict. [ECF No. 8] ¶¶ 1, 29. 2 Darkode’s primary purpose was to facilitate the creation, exchange, and sale of computer malware and exploit kits. Tr. at 34. Darkode members used the forum to post and discuss completed malware, solicit advice and recommendations as to unfinished malware, and coordinate sales of malware to non-members. Id. McCormick, under the online moniker “Fubar,” began using Darkode in, at the latest, 2009, while he was a high-school student in Cambridge, MA. Id. at 65–66, 84, 89. Sometime in 2013, McCormick became an “administrator” of Darkode. Id. at 190–94; Indict. ¶ 84.
1 McCormick has also filed a motion to compel discovery. See Mot. to Compel Discovery [ECF No. 34].
The Court will continue to monitor discovery proceedings but does not think it necessary to rule on the motion at this time. The parties are directed to submit a joint status update as to any remaining discovery issues by not later than December 6, 2019.
2 All citations to “Tr.” refer to the official transcript from the evidentiary hearing held on October 25, 2019.
See Transcript of Proceedings [ECF No. 86].
2
The Federal Bureau of Investigation launched a criminal investigation into Darkode in 2008. Tr. at 35. As part of that investigation, in early 2010, an undercover FBI agent used Darkode to purchase malware named “Zeus” from Fubar. Id. at 38, 40. The Zeus malware was a “banking trojan” designed to steal banking credentials from unsuspecting victims. Id. at 75. At the time of the undercover purchase, the FBI did not know that Fubar was defendant McCormick. Id. at 38. Soon after the purchase, FBI agents began investigating the real-world identity of Fubar. Id. They eventually identified Fubar as McCormick in January 2011, and continued to look into his activities thereafter to develop a “fuller picture of the activities that [he was] engaged in.” Id. at 38–41, 55.
On December 5, 2013, at about 6:15 a.m., FBI agents executed a search warrant on McCormick’s dorm room at the University of Massachusetts, Amherst, where he was then a student. Id. at 52, 90. The agents were not authorized to arrest McCormick. Id. at 61. The warrant authorized seizure of “any digital electronic device, to include memory storage and physical computers, and potentially financial documentation associated with proceeds of the crime.” Id. at 52. According to the government, several digital devices were found in McCormick’s room, including a USB drive containing over 30,000 credit and debit card numbers associated with over 1,600 separate financial institutions. Indict. ¶ 85. Subsequent investigation of the compromised accounts revealed that the financial institutions had reported at least $678,993 in fraudulent activity relating to those accounts. Id. ¶ 35.
Agents executing the search warrant also sought to interview McCormick. After giving McCormick a chance to compose himself and get dressed following the agents’ entry into his dorm room, Special Agent David Hitchcock asked him if he would be “interested” in speaking with the agents in their unmarked FBI car parked outside the dorm. Tr. at 61. Hitchcock stressed that
3
McCormick “wasn’t under arrest,” that the interview was “completely voluntary,” and that “he could leave at any point in time.” Id. at 61–62. McCormick agreed to speak to Hitchcock and the other agents. Id. On the way to the FBI car, McCormick was allowed to use the restroom under the supervision of one of the agents. Id. at 63, 92–93. Once they arrived at the car, Hitchcock sat in the driver’s seat, McCormick sat in the passenger seat, and another agent sat behind McCormick in the rear right seat. Id. at 63. The car was a traditional civilian sedan, with no identifying law- enforcement marks or plastic barrier between the front and rear seats. Id. at 63–64. When McCormick and the agents were situated in the car, the interview commenced. Id. at 64–65. The agents did not read McCormick any Miranda warnings. Id. at 61.
During the interview, McCormick explained his involvement with Darkode, going into some detail about his own activity as well as that of other Darkode members. Id. at 65, 73. McCormick also told the agents that he “wanted to cooperate” and “help out,” but was concerned about “screw[ing] himself.” Id. at 71, 73–74. At one point, McCormick asked the agents if he should get an attorney. Id. at 77. Hitchcock responded that McCormick needed to make that decision for himself, emphasizing then and again several other times throughout the interview that McCormick was “free to stop talking” and could leave at any time. Id. at 71, 77, 99. McCormick acknowledged that he understood but remained in the car and continued talking to the agents. Id. at 77. The interview concluded after approximately three hours, when McCormick stated that he would “really like to get back to preparing for [his] exams.” Id. at 80. At no point in the interview did the agents handcuff McCormick or restrict his movement, and when he said that he wanted to leave, he was allowed to do so. Id. at 78, 80–81.
Several months later, with the assistance of an attorney, McCormick began participating in a series of voluntary debriefings with law enforcement that extended from 2013 to 2018. Id. at
4
175. Though a plea agreement was discussed at these meetings, a plea was never successfully negotiated. Id. at 197. On December 4, 2018—following the collapse of the plea negotiations— the government indicted McCormick and charged him with seven counts: one count of conspiracy to participate in a racketeering influenced corrupt organization in violation of 18 U.S.C. § 1962(d), one count of conspiracy to commit bank fraud and wire fraud in violation of 18 U.S.C. § 1349, and five counts of aggravated identity theft in violation of 18 U.S.C. § 1028A. See Indict. Three others were indicted along with McCormick, id., but to date are not in this country.
These three pre-trial motions followed. The Court held a hearing on the motions on October 25, 2019.
Analysis
I. Motion to Dismiss for Preindictment Delay McCormick first moves to dismiss for preindictment delay. He argues that the government should have prosecuted him more quickly, and that its failure to do so prejudiced him by (1) depriving him of the protections of the Juvenile Delinquency Act (“JDA”), 18 U.S.C. § 5031, and (2) making it difficult for him to retrieve evidence as to the events of 2009 through 2013. Mot. to Dismiss for Preindict. Delay [ECF No. 36] at 6–8. McCormick also argues that any delay in prosecution was an intentional attempt to gain a tactical advantage. Id. at 8.
Generally, the applicable “statute of limitations is the primary measuring stick to gauge whether a criminal charge is unduly stale.” United States v. Bridgeman, 523 F.2d 1099, 1112 (D.C. Cir. 1975). The Supreme Court has recognized, however, “that if preindictment delay is so substantial as to prejudice a defendant’s right to a fair trial, the Due Process Clause of the Fifth Amendment may necessitate dismissal.” United States v. Mahoney, 698 F. Supp. 344, 346 (D.D.C. 1988) (citing United States v. Marion, 404 U.S. 307, 324 (1971)). To prevail on such a claim, a
5
defendant must satisfy both parts of a two-part test. First, the delay must have “caused substantial prejudice to [the defendant’s] rights to a fair trial.” Marion, 404 U.S. at 324. Second, the delay must have been “an intentional device to gain tactical advantage over the accused.” Id.
Neither of McCormick’s arguments as to prejudice are sufficient to satisfy the prejudice prong of this test. His first argument is that the government knew about some of his illegal conduct when he was under twenty-one, and that by waiting to indict him until after he was twenty-one, the government deprived him of the protections of the JDA. Mot. to Dismiss for Preindict. Delay at 5–6. Under the JDA, a juvenile court generally has jurisdiction over a defendant for acts of juvenile delinquency (that is, criminal conduct occurring before a defendant turns eighteen) until that defendant turns twenty-one. See 18 U.S.C. §§ 5031, 5032. McCormick turned eighteen on October 15, 2010, and twenty-one on October 15, 2013. Tr. at 121, 135–36. Thus, he would be entitled to the protections of the JDA only for prosecutions relating to offense conduct that occurred before October 15, 2010, and only then until he turned twenty-one in 2013.
The only conduct charged in the original indictment that occurred before McCormick turned eighteen is his sale of Zeus malware to an undercover FBI agent. See Indict. ¶¶ 80–82. But the indictment alleges that this sale was merely an early act in what was a lengthy conspiracy that continued long after McCormick turned eighteen. Courts have unanimously concluded that prosecutors can charge a defendant with an adult conspiracy where he or she entered into the conspiracy as a juvenile but committed further overt acts as an adult. See, e.g., United States v. Delatorre, 157 F.3d 1205, 1209 (10th Cir. 1998) (“No circuit has applied the JDA to an adult conspiracy or racketeering prosecution simply because defendant’s participation in the crimes began prior to his eighteenth birthday.”). Courts have simply required that there be “some demonstration of post-eighteen participation in such crimes.” Id. Here, for each count of the
6
indictment, the government has alleged overt acts after McCormick turned eighteen on October 15, 2010, including at least one act for each subsequent year of the charged 2008–2013 bank fraud and RICO conspiracies. See, e.g., Indict. ¶ 78 (alleging that McCormick “advertised for sale on the Darkode Forum malware known as ngrBot” between February 13, 2011, and July 11, 2011); id. ¶ 83 (alleging that McCormick “intruded into a website called ziddu.com and discovered vulnerabilities which allowed [him] to steal 4.8 million user email addresses and passwords” in August 2012); id. ¶ 85 (alleging that McCormick possessed devices with stolen banking credentials on December 5, 2013). Therefore, because none of the counts of this indictment charge McCormick solely with pre-eighteen conduct, the JDA is inapplicable. 3 Moreover, the government has already agreed to strike the sale of the Zeus malware from the indictment. See Order of September 9, 2019 [ECF No. 71] at 1. As a result, the indictment, as it currently stands, does not even charge McCormick for his pre-eighteen involvement in the conspiracies, making it still clearer that he is not and was not entitled to the protections of the JDA.
McCormick’s second argument is that the delay in prosecution resulted in unfair prejudice because his memories of the events in question have faded and he was not able to “secure and preserve” certain chat logs from the Darkode forum that may have been exculpatory. Mot. to Dismiss for Preindict. Delay at 7. The problem with this argument is that both the D.C. Circuit and the Supreme Court have unambiguously rejected allegations of prejudice resulting from “a general dimming of memories and loss of evidence.” Bridgeman, 523 F.2d at 1112; see Marion, 404 U.S. at 325–26 (noting that the possibility that “memories will dim, witnesses [will] become
3 Nor does United States v. Hoo, 825 F.2d 667 (2d Cir. 1987), a case that McCormick repeatedly cites, help him. The Hoo court explicitly stated that it “believe[s] that the due process clause does not require that decisions to prosecute be subjected to pre-indictment judicial inquiry simply because the timing of the decision affects the availability of juvenile procedures.” Id. at 671. The court also stated that “a rule . . . requiring in essence that prosecutors bring charges against twenty-year-olds as soon as they are able to do so [] would ‘pressure prosecutors into resolving doubtful cases in favor of early—and possibly unwarranted—prosecutions.’” Id. (quoting United States v. Lovasco, 431 U.S. 783, 793 (1977)).
7
inaccessible, and evidence [will] be lost” is not in itself “enough to demonstrate that [defendant] cannot receive a fair trial”). The “primary guarantee against . . . overly stale charges” is the applicable statute of limitations, not the Fifth Amendment, and McCormick concedes that the charges here were properly brought within the limitations period. See Mot. to Dismiss for Preindict. Delay at 2. Ultimately, McCormick offers nothing more than an argument that the delay “has unnecessarily increased the difficulty of mounting a defense in this case.” Mahoney, 698 F. Supp. at 346. Bridgeman and Marion preclude that argument.
Because both of McCormick’s contentions of prejudice fail to satisfy the first Marion prong, the Court has no need to address whether any delay here was an “intentional device to gain tactical advantage” under the second Marion prong. Marion, 404 U.S. at 324. The Court therefore will deny McCormick’s motion to dismiss for preindictment delay.
II. Motion to Suppress McCormick next moves to suppress all the statements he made during his interview with FBI agents on December 5, 2013. Mot. to Suppress [ECF No. 35] at 1. In his view, this interview was a custodial interrogation, and because he was never given Miranda warnings, any statements he made are inadmissible under the Fifth Amendment. Id. at 2–3.
In order to use statements obtained during a “custodial interrogation” of a defendant, the government must first give the defendant Miranda warnings. See United States v. Burden, 934 F.3d 675, 693 (D.C. Cir. 2019). It is undisputed that McCormick was not given Miranda warnings before the statements at issue here were made. Tr. at 61. Accordingly, the question before the Court is whether McCormick’s statements were given during a custodial interrogation.
A defendant is “in custody” for purposes of Miranda when a reasonable person in the defendant’s position would have “felt he or she was not at liberty to terminate the interrogation
8
and leave.” Thompson v. Keohane, 516 U.S. 99, 112 (1995). The inquiry as to whether a defendant was in custody is an objective one that must take into account all of the circumstances of the interrogation. See Burden, 934 F.3d at 694. “Relevant factors include the location of the questioning, its duration, statements made during the interview, the presence or absence of physical restraints during the questioning, and the release of the interviewee at the end of the questioning.” Howes v. Fields, 565 U.S. 499, 509 (2012) (internal citations omitted).
Here, a reasonable person in McCormick’s position would have understood that he was not subject to “a formal arrest or restraint on freedom of movement of the degree associated with a formal arrest,” Stansbury v. California, 511 U.S. 318, 322 (1994) (internal quotation marks omitted), and would have felt free to terminate the interview and leave. A number of facts support this conclusion. First, when FBI agents began talking to McCormick on the morning of December 5, 2013, they informed him that they were there to execute a search warrant, that they did not have an arrest warrant, that an interview was not part of the search warrant, that speaking to the agents was voluntary, and that he was free to leave at any time. Tr. at 61–62. McCormick stated that he understood. Id. Over the course of the interview, the agents repeatedly reminded McCormick that the interview was voluntary and that he was free to leave. Id. at 71, 79. Each time, McCormick indicated that he understood that he was not under arrest, and that he wanted to cooperate with the agents, so long as he didn’t “screw” himself. Id. at 71, 74, 79. McCormick thus had several opportunities, from the very beginning of his encounter with the FBI agents, to simply decline to be interviewed. Cf. United States v. Robinson, 256 F. Supp. 3d 15, 25 (D.D.C. 2017) (finding no “custodial interrogation” based, in part, on the fact that the defendant could have declined to be interviewed).
9
Second, McCormick was not handcuffed or restrained at any point in the interview, nor was he deprived of food or water or of the ability to use the restroom. Tr. at 63, 72, 78, 81.
Third, while the interview did take place in an unmarked FBI car, the car was parked in a familiar location (McCormick’s campus), and given the cold weather in Massachusetts in December, it is not surprising that the interview was conducted in the heated car rather than outside. Id. at 61, 90, 94; cf. United States v. Ford, 401 F. App’x 852, 855–56 (4th Cir. 2010) (concluding that interview in police vehicle had not been “custodial interrogation” because, in part, conditions outside of the vehicle were not ideal for conducting interview). McCormick cites two cases in an attempt to demonstrate that interviews in police cars are per se custodial interrogations. See Figg v. Shroeder, 312 F.3d 625, 632 (4th Cir. 2002); United States v. Richardson, 949 F.2d 851, 856 (6th Cir. 1991). But even setting aside the fact that those cases addressed whether a defendant has been seized under the Fourth Amendment, rather than whether he or she has been subjected to a custodial interrogation (as is the relevant question here), in those cases officers told the defendants that they were not free to leave; here, the agents repeatedly told McCormick that he was free to leave. Cf. United States v. Dates, 752 F. App’x 570, 577–78 (10th Cir. 2018) (concluding that a reasonable person, “after having entered a [police] vehicle of his own free will to talk to federal agents, would understand that he was similarly free to terminate the conversation and go about his day”).
Fourth, during the interview, McCormick informed the agents that he had an exam that afternoon that he needed to prepare for. Tr. at 80. The agents kept McCormick apprised of the time throughout the interview, and when McCormick stated that he needed to leave to study, the agents allowed him to leave. Id. McCormick thus did in fact feel free to “terminate the interrogation and leave,” Thompson, 516 U.S. at 112, since he did just that.
10
For these reasons, the interview on December 5, 2013, was not a “custodial interrogation.”
Hence, the government’s failure to give McCormick Miranda warnings is not a basis to suppress his statements. The Court will deny his motion to suppress.
III. Motion to Dismiss Counts 3–7 Finally, McCormick moves to dismiss counts 3–7 of the indictment, which are five separate counts of aggravated identity theft under 18 U.S.C. § 1028A. These counts are based on McCormick’s December 5, 2013 possession of expired credit-card numbers and associated identification information of five District of Columbia residents. Indict. ¶¶ 93–94. McCormick asserts that the relevant statutory scheme includes a requirement that credit-card numbers be “usable,” and that because the cards here were expired, the government cannot satisfy this requirement. Mot. to Dismiss Counts 3–7 [ECF No. 69] at 3.
The aggravated identity theft statute provides that “[w]hoever, during and in relation to any felony violation enumerated in subsection (c),[4] knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years.” 18 U.S.C. § 1028A(a)(1). A “means of identification” is defined, as relevant here, as “any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any . . . (D) telecommunication identifying information or access device.” Id. § 1028(d)(7). And an “access device” is defined as
any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money,
4 McCormick does not dispute that the RICO and bank fraud conspiracies charged in counts 1 and 2 of his indictment fall under subsection (c).
11
goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument).
Id. § 1029(e)(1). Also relevant is the statute’s definition of a limited subset of access devices,
“unauthorized access devices,” which includes “any access device that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud.” Id. § 1029(e)(3).
The government argues that the credit-card numbers forming the basis of McCormick’s five counts of aggravated identity theft are “access devices.” Gov’t’s Opp. to Def.’s Mot. to Dismiss Counts 3–7 at 4. In response, McCormick homes in on the statutory language that an access device is something “that can be used . . . to obtain money, goods, services, or any other thing of value.” Id. § 1029(e)(1) (emphasis added). He contends that, because the credit-card numbers all expired between 2008 and 2012, they could not be “used” as of December 5, 2013, when the FBI discovered the numbers in McCormick’s possession. Mot. to Dismiss Counts 3–7 at 2–3.
Four circuits have addressed the question whether access devices must be usable. The Ninth Circuit, in United States v. Onyesoh, 674 F.3d 1157 (9th Cir. 2012), held that access devices, and the smaller subset of unauthorized access devices, “must be usable,” id. at 1159. In accordance with this ruling, the court determined that in the context of expired credit cards, the government must “prove the usability of the expired credit card numbers by a preponderance of the evidence,” for instance by presenting “expert testimony to establish usability” or evidence that a defendant “was prepared to use the numbers in combination with another device.” Id. at 1159–60. The Onyesoh court concluded that the government had not adequately presented such evidence and remanded to the district court to allow it “to hear evidence of usability.” Id. at 1160. Upon remand, the government presented evidence that expired credit cards are usable, and the district court found
12
that this evidence established by a preponderance that the numbers were in fact “usable.” 5 United States v. Onyesoh, 549 F. App’x 700, 701 (9th Cir. 2013). The Ninth Circuit affirmed this finding. Id. at 702.
Three other circuits, however, have rejected Onyesoh’s conclusion that access devices must be usable. In United States v. Carver, 916 F.3d 398 (4th Cir. 2019), the Fourth Circuit “decline[d] to adopt Onyesoh’s usability standard,” id. at 402. The court based its conclusion on the fact that unauthorized access devices, which include “expired, revoked, [or] canceled” cards, are a subset of access devices, and so are also subject to the usability standard. Id. at 402–03. But the court thought it obvious that such cards “cannot be used to obtain money,” and therefore the Onyesoh usability standard was inconsistent with the full statutory scheme. See id. In the Fourth Circuit’s view, a better reading was that the “general words ‘can be used’ signify a [congressional] intent to expand the reach of the definition.” Id. at 403. As support for this “perfectly natural” reading, the court used the following analogy:
A salesperson describing the features of a universal remote control might say, “This can be used on any model of television we sell.” No one would think the salesperson is representing that the remote control would be currently functional—
it might need batteries, reprogramming, or various other adjustments before it would work. The promise is that it is the kind of thing that, under plausible circumstances, could change channels, adjust volume, and so forth on televisions.
The same is true of a fraudulently altered card. Even if it could not complete a transaction now, it is the type of thing that could do so, and was altered for precisely that purpose.
5 The government’s evidence consisted of expert testimony that:
• Credit card account numbers do not change when they expire; rather, a new card is issued with the same account number and a new expiration date.
• An expired credit card account number, in conjunction with the true account holder’s name, address, and other personal identifiers, allows a person to obtain a duplicate card to make Internet purchases, enter ATM transactions, and obtain cash advances.
• Identity thieves typically collect identity theft victim profiles, stolen mail, checks, SIM cards, and credit reports for use in applying for new credit cards, all of which were found during a search of defendant’s home.
Id. at 701.
13
Id. As a result, the court determined that prosecutors need not prove “an extra element of current functionality,” but instead must show “only that [each device] was in principle the sort of thing that people use to obtain money (like a credit card or bank number).” Id. The Sixth and Seventh Circuits have adopted similar readings of the “can be used” language. See United States v. Popovski, 872 F.3d 552, 553 (7th Cir. 2017) (concluding that § 1029(e)(1) “defines an ‘access device’ according to its nature—the sort of thing that could in principle be used to get goods or funds, whether or not it would work in practice”); United States v. Moon, 808 F.3d 1085, 1091 (6th Cir. 2015) (“We . . . reject [defendant’s] argument for a ‘usability’ requirement.”).
This Court concludes that the Fourth, Sixth, and Seventh Circuits have the better of the argument. The Ninth Circuit’s usability requirement cannot be squared with the fact that “lost, stolen, expired, revoked, [or] canceled” cards are also access devices, yet are unlikely to be able to be “used” to obtain money. Hence, this Court concludes that there is no usability requirement as described in Onyesoh. Instead, as the Fourth Circuit concluded, the government must show “only that [each access device] was in principle the sort of thing that people use to obtain money.” Carver, 916 F.3d at 403.
The basis for McCormick’s motion to dismiss counts 3–7, in essence, is that usability is an element of the statute that the government, as a matter of law, could not satisfy at trial with respect to expired credit credits. See Mot. to Dismiss Counts 3–7 at 1–2. Because the Court rejects that view of the statute, the motion will be denied. 6
6 The Court notes that even if it had adopted Onyesoh’s view of the statute, the pretrial dismissal of counts 3–7, as McCormick requests, would still be inappropriate. Onyesoh merely requires the government to present, at trial, evidence of usability. See Onyesoh, 674 F.3d at 1159–60.
14
Conclusion
For the foregoing reasons, the Court will (1) deny McCormick’s motion to dismiss for preindictment delay; (2) deny McCormick’s motion to suppress; and (3) deny McCormick’s motion to dismiss counts 3–7. A separate order has been issued on this date.
/s/
JOHN D. BATES
United States District Judge Dated: November 25, 2019