UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
UNITED STATES OF AMERICA v. Crim. No. 18-0359 (JDB) THOMAS KENNEDY MCCORMICK,
Defendant.
MEMORANDUM OPINION
Before the Court are three pretrial motions filed by defendant Thomas Kennedy
McCormick: (1) a motion to dismiss for preindictment delay; (2) a motion to suppress certain of
his statements; and (3) a motion to dismiss counts 3–7 of the indictment. For the reasons that
follow, the Court will deny each of the three motions. 1
Background
Darkode was an invitation-only online forum that operated from approximately 2008 to
December 2013. Tr. at 34; Indict. [ECF No. 8] ¶¶ 1, 29. 2 Darkode’s primary purpose was to
facilitate the creation, exchange, and sale of computer malware and exploit kits. Tr. at 34. Darkode
members used the forum to post and discuss completed malware, solicit advice and
recommendations as to unfinished malware, and coordinate sales of malware to non-members. Id.
McCormick, under the online moniker “Fubar,” began using Darkode in, at the latest, 2009, while
he was a high-school student in Cambridge, MA. Id. at 65–66, 84, 89. Sometime in 2013,
McCormick became an “administrator” of Darkode. Id. at 190–94; Indict. ¶ 84.
1 McCormick has also filed a motion to compel discovery. See Mot. to Compel Discovery [ECF No. 34]. The Court will continue to monitor discovery proceedings but does not think it necessary to rule on the motion at this time. The parties are directed to submit a joint status update as to any remaining discovery issues by not later than December 6, 2019. 2 All citations to “Tr.” refer to the official transcript from the evidentiary hearing held on October 25, 2019. See Transcript of Proceedings [ECF No. 86].
1 The Federal Bureau of Investigation launched a criminal investigation into Darkode in
2008. Tr. at 35. As part of that investigation, in early 2010, an undercover FBI agent used Darkode
to purchase malware named “Zeus” from Fubar. Id. at 38, 40. The Zeus malware was a “banking
trojan” designed to steal banking credentials from unsuspecting victims. Id. at 75. At the time of
the undercover purchase, the FBI did not know that Fubar was defendant McCormick. Id. at 38.
Soon after the purchase, FBI agents began investigating the real-world identity of Fubar. Id. They
eventually identified Fubar as McCormick in January 2011, and continued to look into his
activities thereafter to develop a “fuller picture of the activities that [he was] engaged in.” Id. at
38–41, 55.
On December 5, 2013, at about 6:15 a.m., FBI agents executed a search warrant on
McCormick’s dorm room at the University of Massachusetts, Amherst, where he was then a
student. Id. at 52, 90. The agents were not authorized to arrest McCormick. Id. at 61. The warrant
authorized seizure of “any digital electronic device, to include memory storage and physical
computers, and potentially financial documentation associated with proceeds of the crime.” Id. at
52. According to the government, several digital devices were found in McCormick’s room,
including a USB drive containing over 30,000 credit and debit card numbers associated with over
1,600 separate financial institutions. Indict. ¶ 85. Subsequent investigation of the compromised
accounts revealed that the financial institutions had reported at least $678,993 in fraudulent activity
relating to those accounts. Id. ¶ 35.
Agents executing the search warrant also sought to interview McCormick. After giving
McCormick a chance to compose himself and get dressed following the agents’ entry into his dorm
room, Special Agent David Hitchcock asked him if he would be “interested” in speaking with the
agents in their unmarked FBI car parked outside the dorm. Tr. at 61. Hitchcock stressed that
2 McCormick “wasn’t under arrest,” that the interview was “completely voluntary,” and that “he
could leave at any point in time.” Id. at 61–62. McCormick agreed to speak to Hitchcock and the
other agents. Id. On the way to the FBI car, McCormick was allowed to use the restroom under
the supervision of one of the agents. Id. at 63, 92–93. Once they arrived at the car, Hitchcock sat
in the driver’s seat, McCormick sat in the passenger seat, and another agent sat behind McCormick
in the rear right seat. Id. at 63. The car was a traditional civilian sedan, with no identifying law-
enforcement marks or plastic barrier between the front and rear seats. Id. at 63–64. When
McCormick and the agents were situated in the car, the interview commenced. Id. at 64–65. The
agents did not read McCormick any Miranda warnings. Id. at 61.
During the interview, McCormick explained his involvement with Darkode, going into
some detail about his own activity as well as that of other Darkode members. Id. at 65, 73.
McCormick also told the agents that he “wanted to cooperate” and “help out,” but was concerned
about “screw[ing] himself.” Id. at 71, 73–74. At one point, McCormick asked the agents if he
should get an attorney. Id. at 77. Hitchcock responded that McCormick needed to make that
decision for himself, emphasizing then and again several other times throughout the interview that
McCormick was “free to stop talking” and could leave at any time. Id. at 71, 77, 99. McCormick
acknowledged that he understood but remained in the car and continued talking to the agents. Id.
at 77. The interview concluded after approximately three hours, when McCormick stated that he
would “really like to get back to preparing for [his] exams.” Id. at 80. At no point in the interview
did the agents handcuff McCormick or restrict his movement, and when he said that he wanted to
leave, he was allowed to do so. Id. at 78, 80–81.
Several months later, with the assistance of an attorney, McCormick began participating in
a series of voluntary debriefings with law enforcement that extended from 2013 to 2018. Id. at
3 175. Though a plea agreement was discussed at these meetings, a plea was never successfully
negotiated. Id. at 197. On December 4, 2018—following the collapse of the plea negotiations—
the government indicted McCormick and charged him with seven counts: one count of conspiracy
to participate in a racketeering influenced corrupt organization in violation of 18 U.S.C. § 1962(d),
one count of conspiracy to commit bank fraud and wire fraud in violation of 18 U.S.C. § 1349,
and five counts of aggravated identity theft in violation of 18 U.S.C. § 1028A. See Indict. Three
others were indicted along with McCormick, id., but to date are not in this country.
These three pre-trial motions followed. The Court held a hearing on the motions on
October 25, 2019.
Analysis
I. Motion to Dismiss for Preindictment Delay
McCormick first moves to dismiss for preindictment delay. He argues that the government
should have prosecuted him more quickly, and that its failure to do so prejudiced him by (1)
depriving him of the protections of the Juvenile Delinquency Act (“JDA”), 18 U.S.C. § 5031, and
(2) making it difficult for him to retrieve evidence as to the events of 2009 through 2013. Mot. to
Dismiss for Preindict. Delay [ECF No. 36] at 6–8. McCormick also argues that any delay in
prosecution was an intentional attempt to gain a tactical advantage. Id. at 8.
Generally, the applicable “statute of limitations is the primary measuring stick to gauge
whether a criminal charge is unduly stale.” United States v. Bridgeman, 523 F.2d 1099, 1112
(D.C. Cir. 1975). The Supreme Court has recognized, however, “that if preindictment delay is so
substantial as to prejudice a defendant’s right to a fair trial, the Due Process Clause of the Fifth
Amendment may necessitate dismissal.” United States v. Mahoney, 698 F. Supp. 344, 346 (D.D.C.
1988) (citing United States v. Marion, 404 U.S. 307, 324 (1971)). To prevail on such a claim, a
4 defendant must satisfy both parts of a two-part test. First, the delay must have “caused substantial
prejudice to [the defendant’s] rights to a fair trial.” Marion, 404 U.S. at 324. Second, the delay
must have been “an intentional device to gain tactical advantage over the accused.” Id.
Neither of McCormick’s arguments as to prejudice are sufficient to satisfy the prejudice
prong of this test. His first argument is that the government knew about some of his illegal conduct
when he was under twenty-one, and that by waiting to indict him until after he was twenty-one,
the government deprived him of the protections of the JDA. Mot. to Dismiss for Preindict. Delay
at 5–6. Under the JDA, a juvenile court generally has jurisdiction over a defendant for acts of
juvenile delinquency (that is, criminal conduct occurring before a defendant turns eighteen) until
that defendant turns twenty-one. See 18 U.S.C. §§ 5031, 5032. McCormick turned eighteen on
October 15, 2010, and twenty-one on October 15, 2013. Tr. at 121, 135–36. Thus, he would be
entitled to the protections of the JDA only for prosecutions relating to offense conduct that
occurred before October 15, 2010, and only then until he turned twenty-one in 2013.
The only conduct charged in the original indictment that occurred before McCormick
turned eighteen is his sale of Zeus malware to an undercover FBI agent. See Indict. ¶¶ 80–82. But
the indictment alleges that this sale was merely an early act in what was a lengthy conspiracy that
continued long after McCormick turned eighteen. Courts have unanimously concluded that
prosecutors can charge a defendant with an adult conspiracy where he or she entered into the
conspiracy as a juvenile but committed further overt acts as an adult. See, e.g., United States v.
Delatorre, 157 F.3d 1205, 1209 (10th Cir. 1998) (“No circuit has applied the JDA to an adult
conspiracy or racketeering prosecution simply because defendant’s participation in the crimes
began prior to his eighteenth birthday.”). Courts have simply required that there be “some
demonstration of post-eighteen participation in such crimes.” Id. Here, for each count of the
5 indictment, the government has alleged overt acts after McCormick turned eighteen on October
15, 2010, including at least one act for each subsequent year of the charged 2008–2013 bank fraud
and RICO conspiracies. See, e.g., Indict. ¶ 78 (alleging that McCormick “advertised for sale on
the Darkode Forum malware known as ngrBot” between February 13, 2011, and July 11, 2011);
id. ¶ 83 (alleging that McCormick “intruded into a website called ziddu.com and discovered
vulnerabilities which allowed [him] to steal 4.8 million user email addresses and passwords” in
August 2012); id. ¶ 85 (alleging that McCormick possessed devices with stolen banking credentials
on December 5, 2013). Therefore, because none of the counts of this indictment charge
McCormick solely with pre-eighteen conduct, the JDA is inapplicable. 3
Moreover, the government has already agreed to strike the sale of the Zeus malware from
the indictment. See Order of September 9, 2019 [ECF No. 71] at 1. As a result, the indictment,
as it currently stands, does not even charge McCormick for his pre-eighteen involvement in the
conspiracies, making it still clearer that he is not and was not entitled to the protections of the JDA.
McCormick’s second argument is that the delay in prosecution resulted in unfair prejudice
because his memories of the events in question have faded and he was not able to “secure and
preserve” certain chat logs from the Darkode forum that may have been exculpatory. Mot. to
Dismiss for Preindict. Delay at 7. The problem with this argument is that both the D.C. Circuit
and the Supreme Court have unambiguously rejected allegations of prejudice resulting from “a
general dimming of memories and loss of evidence.” Bridgeman, 523 F.2d at 1112; see Marion,
404 U.S. at 325–26 (noting that the possibility that “memories will dim, witnesses [will] become
3 Nor does United States v. Hoo, 825 F.2d 667 (2d Cir. 1987), a case that McCormick repeatedly cites, help him. The Hoo court explicitly stated that it “believe[s] that the due process clause does not require that decisions to prosecute be subjected to pre-indictment judicial inquiry simply because the timing of the decision affects the availability of juvenile procedures.” Id. at 671. The court also stated that “a rule . . . requiring in essence that prosecutors bring charges against twenty-year-olds as soon as they are able to do so [] would ‘pressure prosecutors into resolving doubtful cases in favor of early—and possibly unwarranted—prosecutions.’” Id. (quoting United States v. Lovasco, 431 U.S. 783, 793 (1977)).
6 inaccessible, and evidence [will] be lost” is not in itself “enough to demonstrate that [defendant]
cannot receive a fair trial”). The “primary guarantee against . . . overly stale charges” is the
applicable statute of limitations, not the Fifth Amendment, and McCormick concedes that the
charges here were properly brought within the limitations period. See Mot. to Dismiss for
Preindict. Delay at 2. Ultimately, McCormick offers nothing more than an argument that the
delay “has unnecessarily increased the difficulty of mounting a defense in this case.” Mahoney,
698 F. Supp. at 346. Bridgeman and Marion preclude that argument.
Because both of McCormick’s contentions of prejudice fail to satisfy the first Marion
prong, the Court has no need to address whether any delay here was an “intentional device to gain
tactical advantage” under the second Marion prong. Marion, 404 U.S. at 324. The Court therefore
will deny McCormick’s motion to dismiss for preindictment delay.
II. Motion to Suppress
McCormick next moves to suppress all the statements he made during his interview with
FBI agents on December 5, 2013. Mot. to Suppress [ECF No. 35] at 1. In his view, this interview
was a custodial interrogation, and because he was never given Miranda warnings, any statements
he made are inadmissible under the Fifth Amendment. Id. at 2–3.
In order to use statements obtained during a “custodial interrogation” of a defendant, the
government must first give the defendant Miranda warnings. See United States v. Burden, 934
F.3d 675, 693 (D.C. Cir. 2019). It is undisputed that McCormick was not given Miranda warnings
before the statements at issue here were made. Tr. at 61. Accordingly, the question before the
Court is whether McCormick’s statements were given during a custodial interrogation.
A defendant is “in custody” for purposes of Miranda when a reasonable person in the
defendant’s position would have “felt he or she was not at liberty to terminate the interrogation
7 and leave.” Thompson v. Keohane, 516 U.S. 99, 112 (1995). The inquiry as to whether a
defendant was in custody is an objective one that must take into account all of the circumstances
of the interrogation. See Burden, 934 F.3d at 694. “Relevant factors include the location of the
questioning, its duration, statements made during the interview, the presence or absence of
physical restraints during the questioning, and the release of the interviewee at the end of the
questioning.” Howes v. Fields, 565 U.S. 499, 509 (2012) (internal citations omitted).
Here, a reasonable person in McCormick’s position would have understood that he was not
subject to “a formal arrest or restraint on freedom of movement of the degree associated with a
formal arrest,” Stansbury v. California, 511 U.S. 318, 322 (1994) (internal quotation marks
omitted), and would have felt free to terminate the interview and leave. A number of facts support
this conclusion. First, when FBI agents began talking to McCormick on the morning of December
5, 2013, they informed him that they were there to execute a search warrant, that they did not have
an arrest warrant, that an interview was not part of the search warrant, that speaking to the agents
was voluntary, and that he was free to leave at any time. Tr. at 61–62. McCormick stated that he
understood. Id. Over the course of the interview, the agents repeatedly reminded McCormick that
the interview was voluntary and that he was free to leave. Id. at 71, 79. Each time, McCormick
indicated that he understood that he was not under arrest, and that he wanted to cooperate with the
agents, so long as he didn’t “screw” himself. Id. at 71, 74, 79. McCormick thus had several
opportunities, from the very beginning of his encounter with the FBI agents, to simply decline to
be interviewed. Cf. United States v. Robinson, 256 F. Supp. 3d 15, 25 (D.D.C. 2017) (finding no
“custodial interrogation” based, in part, on the fact that the defendant could have declined to be
interviewed).
8 Second, McCormick was not handcuffed or restrained at any point in the interview, nor
was he deprived of food or water or of the ability to use the restroom. Tr. at 63, 72, 78, 81.
Third, while the interview did take place in an unmarked FBI car, the car was parked in a
familiar location (McCormick’s campus), and given the cold weather in Massachusetts in
December, it is not surprising that the interview was conducted in the heated car rather than
outside. Id. at 61, 90, 94; cf. United States v. Ford, 401 F. App’x 852, 855–56 (4th Cir. 2010)
(concluding that interview in police vehicle had not been “custodial interrogation” because, in part,
conditions outside of the vehicle were not ideal for conducting interview). McCormick cites two
cases in an attempt to demonstrate that interviews in police cars are per se custodial interrogations.
See Figg v. Shroeder, 312 F.3d 625, 632 (4th Cir. 2002); United States v. Richardson, 949 F.2d
851, 856 (6th Cir. 1991). But even setting aside the fact that those cases addressed whether a
defendant has been seized under the Fourth Amendment, rather than whether he or she has been
subjected to a custodial interrogation (as is the relevant question here), in those cases officers told
the defendants that they were not free to leave; here, the agents repeatedly told McCormick that
he was free to leave. Cf. United States v. Dates, 752 F. App’x 570, 577–78 (10th Cir. 2018)
(concluding that a reasonable person, “after having entered a [police] vehicle of his own free will
to talk to federal agents, would understand that he was similarly free to terminate the conversation
and go about his day”).
Fourth, during the interview, McCormick informed the agents that he had an exam that
afternoon that he needed to prepare for. Tr. at 80. The agents kept McCormick apprised of the
time throughout the interview, and when McCormick stated that he needed to leave to study, the
agents allowed him to leave. Id. McCormick thus did in fact feel free to “terminate the
interrogation and leave,” Thompson, 516 U.S. at 112, since he did just that.
9 For these reasons, the interview on December 5, 2013, was not a “custodial interrogation.”
Hence, the government’s failure to give McCormick Miranda warnings is not a basis to suppress
his statements. The Court will deny his motion to suppress.
III. Motion to Dismiss Counts 3–7
Finally, McCormick moves to dismiss counts 3–7 of the indictment, which are five separate
counts of aggravated identity theft under 18 U.S.C. § 1028A. These counts are based on
McCormick’s December 5, 2013 possession of expired credit-card numbers and associated
identification information of five District of Columbia residents. Indict. ¶¶ 93–94. McCormick
asserts that the relevant statutory scheme includes a requirement that credit-card numbers be
“usable,” and that because the cards here were expired, the government cannot satisfy this
requirement. Mot. to Dismiss Counts 3–7 [ECF No. 69] at 3.
The aggravated identity theft statute provides that “[w]hoever, during and in relation to any
felony violation enumerated in subsection (c),[4] knowingly transfers, possesses, or uses, without
lawful authority, a means of identification of another person shall, in addition to the punishment
provided for such felony, be sentenced to a term of imprisonment of 2 years.” 18
U.S.C. § 1028A(a)(1). A “means of identification” is defined, as relevant here, as “any name or
number that may be used, alone or in conjunction with any other information, to identify a specific
individual, including any . . . (D) telecommunication identifying information or access device.”
Id. § 1028(d)(7). And an “access device” is defined as
any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money,
4 McCormick does not dispute that the RICO and bank fraud conspiracies charged in counts 1 and 2 of his indictment fall under subsection (c).
10 goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument). Id. § 1029(e)(1). Also relevant is the statute’s definition of a limited subset of access devices,
“unauthorized access devices,” which includes “any access device that is lost, stolen, expired,
revoked, canceled, or obtained with intent to defraud.” Id. § 1029(e)(3).
The government argues that the credit-card numbers forming the basis of McCormick’s
five counts of aggravated identity theft are “access devices.” Gov’t’s Opp. to Def.’s Mot. to
Dismiss Counts 3–7 at 4. In response, McCormick homes in on the statutory language that an
access device is something “that can be used . . . to obtain money, goods, services, or any other
thing of value.” Id. § 1029(e)(1) (emphasis added). He contends that, because the credit-card
numbers all expired between 2008 and 2012, they could not be “used” as of December 5, 2013,
when the FBI discovered the numbers in McCormick’s possession. Mot. to Dismiss Counts 3–7
at 2–3.
Four circuits have addressed the question whether access devices must be usable. The
Ninth Circuit, in United States v. Onyesoh, 674 F.3d 1157 (9th Cir. 2012), held that access devices,
and the smaller subset of unauthorized access devices, “must be usable,” id. at 1159. In accordance
with this ruling, the court determined that in the context of expired credit cards, the government
must “prove the usability of the expired credit card numbers by a preponderance of the evidence,”
for instance by presenting “expert testimony to establish usability” or evidence that a defendant
“was prepared to use the numbers in combination with another device.” Id. at 1159–60. The
Onyesoh court concluded that the government had not adequately presented such evidence and
remanded to the district court to allow it “to hear evidence of usability.” Id. at 1160. Upon remand,
the government presented evidence that expired credit cards are usable, and the district court found
11 that this evidence established by a preponderance that the numbers were in fact “usable.” 5 United
States v. Onyesoh, 549 F. App’x 700, 701 (9th Cir. 2013). The Ninth Circuit affirmed this finding.
Id. at 702.
Three other circuits, however, have rejected Onyesoh’s conclusion that access devices must
be usable. In United States v. Carver, 916 F.3d 398 (4th Cir. 2019), the Fourth Circuit “decline[d]
to adopt Onyesoh’s usability standard,” id. at 402. The court based its conclusion on the fact that
unauthorized access devices, which include “expired, revoked, [or] canceled” cards, are a subset
of access devices, and so are also subject to the usability standard. Id. at 402–03. But the court
thought it obvious that such cards “cannot be used to obtain money,” and therefore the Onyesoh
usability standard was inconsistent with the full statutory scheme. See id. In the Fourth Circuit’s
view, a better reading was that the “general words ‘can be used’ signify a [congressional] intent to
expand the reach of the definition.” Id. at 403. As support for this “perfectly natural” reading, the
court used the following analogy:
A salesperson describing the features of a universal remote control might say, “This can be used on any model of television we sell.” No one would think the salesperson is representing that the remote control would be currently functional— it might need batteries, reprogramming, or various other adjustments before it would work. The promise is that it is the kind of thing that, under plausible circumstances, could change channels, adjust volume, and so forth on televisions. The same is true of a fraudulently altered card. Even if it could not complete a transaction now, it is the type of thing that could do so, and was altered for precisely that purpose.
5 The government’s evidence consisted of expert testimony that: • Credit card account numbers do not change when they expire; rather, a new card is issued with the same account number and a new expiration date. • An expired credit card account number, in conjunction with the true account holder’s name, address, and other personal identifiers, allows a person to obtain a duplicate card to make Internet purchases, enter ATM transactions, and obtain cash advances. • Identity thieves typically collect identity theft victim profiles, stolen mail, checks, SIM cards, and credit reports for use in applying for new credit cards, all of which were found during a search of defendant’s home. Id. at 701.
12 Id. As a result, the court determined that prosecutors need not prove “an extra element of current
functionality,” but instead must show “only that [each device] was in principle the sort of thing
that people use to obtain money (like a credit card or bank number).” Id. The Sixth and Seventh
Circuits have adopted similar readings of the “can be used” language. See United States v.
Popovski, 872 F.3d 552, 553 (7th Cir. 2017) (concluding that § 1029(e)(1) “defines an ‘access
device’ according to its nature—the sort of thing that could in principle be used to get goods or
funds, whether or not it would work in practice”); United States v. Moon, 808 F.3d 1085, 1091
(6th Cir. 2015) (“We . . . reject [defendant’s] argument for a ‘usability’ requirement.”).
This Court concludes that the Fourth, Sixth, and Seventh Circuits have the better of the
argument. The Ninth Circuit’s usability requirement cannot be squared with the fact that “lost,
stolen, expired, revoked, [or] canceled” cards are also access devices, yet are unlikely to be able
to be “used” to obtain money. Hence, this Court concludes that there is no usability requirement
as described in Onyesoh. Instead, as the Fourth Circuit concluded, the government must show
“only that [each access device] was in principle the sort of thing that people use to obtain money.”
Carver, 916 F.3d at 403.
The basis for McCormick’s motion to dismiss counts 3–7, in essence, is that usability is an
element of the statute that the government, as a matter of law, could not satisfy at trial with respect
to expired credit credits. See Mot. to Dismiss Counts 3–7 at 1–2. Because the Court rejects that
view of the statute, the motion will be denied. 6
6 The Court notes that even if it had adopted Onyesoh’s view of the statute, the pretrial dismissal of counts 3–7, as McCormick requests, would still be inappropriate. Onyesoh merely requires the government to present, at trial, evidence of usability. See Onyesoh, 674 F.3d at 1159–60.
13 Conclusion
For the foregoing reasons, the Court will (1) deny McCormick’s motion to dismiss for
preindictment delay; (2) deny McCormick’s motion to suppress; and (3) deny McCormick’s
motion to dismiss counts 3–7. A separate order has been issued on this date.
/s/ JOHN D. BATES United States District Judge Dated: November 25, 2019