United States v. McCormick

• Court: District Court, District of Columbia
• Decided: December 15, 2023
• Docket: Criminal No. 2018-0359
• Status: Published

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA,

v. Criminal Action No. 18-359-4 (JDB) THOMAS KENNEDY MCCORMICK, Defendant.

MEMORANDUM OPINION AND ORDER

On March 3, 2020, defendant Thomas McCormick pleaded guilty to Racketeer Influenced

Corrupt Organization (“RICO”) Conspiracy in violation of 18 U.S.C. § 1962(d) and Aggravated

Identity Theft in violation of 18 U.S.C. § 1028A. The Court sentenced McCormick on November

15, 2023 to eighteen months’ incarceration but at the parties’ request, deferred a determination of

restitution while the parties attempted to resolve certain issues. The parties could not reach a

resolution and the Court held a restitution hearing on December 12, 2023. The Court delivered an

oral ruling at that hearing and indicated that it would memorialize its reasoning in a forthcoming

opinion. For the reasons articulated at the hearing and explained further below, the Court will

order restitution to JP Morgan Chase in the amount of $105,793 and to American Express Bank in

the amount of $43,919, for a total restitution figure of $149,712. 1

Background

The following narrative is drawn from the parties’ agreed-upon facts. See Agreed

Statement of Facts in Supp. of Guilty Plea [ECF No. 101] (“SOF”); Presentence Investigation

Report [ECF No. 139] (“PSR”). Darkode was an invitation-only online forum that operated from

1 McCormick agreed to forfeit $8,051.25, which will be offset against the balance of the restitution. See Consent Order of Forfeiture [ECF No. 146-1] at 4.

1 approximately 2008 to December 2013. SOF ¶¶ 2, 5. Darkode’s primary purpose was to facilitate

the creation, exchange, and sale of software designed to infect computers and electronic devices

with malware. Id. ¶ 2. Darkode members used the forum to post and discuss completed malware,

solicit advice and recommendations as to unfinished malware, and coordinate sales of malware to

non-members. Id. ¶¶ 2, 6.

McCormick, using the moniker “Fubar,” joined Darkode in March 2009 and became an

administrator in 2013. Id. ¶¶ 23, 25. As an administrator, McCormick moderated and managed

forum threads selling and/or providing malware, services to render malware undetectable to

antivirus software, access to botnets, and access to databases of stolen personally identifiable

information (“PII”) such as social security numbers and dates of birth. PSR ¶ 39. McCormick

also conspired to buy, sell, and trade malware, botnets, and stolen PII used to fraudulently obtain

money from others. Id. ¶ 40.

On December 5, 2013, FBI agents executed a search warrant on McCormick’s dormitory

at the University of Massachusetts-Amherst. SOF ¶ 26. The agents seized three USB thumb

drives, a microSD card, a Windows 8 Pro Surface, an iPhone 4, and an Apple laptop. Id. ¶ 30.

One of the thumb drives contained malware that can be used to steal banking credentials. Id.

Another drive contained over 30,000 credit and debit card numbers associated with over 1,600

financial institutions. Id. ¶ 32. As relevant here, JP Morgan Chase (“JPMC”) reported $366,532

in fraud associated with the stolen accounts on the drive and American Express Bank (“AmEx”)

reported $312,461 in fraud associated with the stolen accounts on the drive, for a total of $678,993

in fraud losses. Id.

On March 3, 2020, McCormick pleaded guilty to one count of RICO Conspiracy in

violation of 18 U.S.C. § 1962(d) (Count I) and one count of Aggravated Identity Theft in violation

2 of 18 U.S.C. § 1028A (Count III). At sentencing, the Court ordered McCormick to serve twelve

months’ incarceration on Count I and six months’ incarceration on Count III, to run consecutively,

followed by thirty-six months’ supervised release. See Judgment [ECF No. 146] at 2–3. Upon

request of the parties, the Court postponed making a restitution determination while the parties

attempted to negotiate an amount. 2 See Nov. 15, 2023 Min. Entry. The parties filed supplemental

briefing on their respective restitution positions, see Gov’t’s Supplemental Mem. in Aid of

Sentencing Re: Restitution [ECF No. 148] (“Gov’t Mem.”); Def.’s Position on Restitution [ECF

No. 149] (“Def. Mem.”), and, upon the Court’s Order, filed addenda identifying all evidence they

intended to produce at the restitution hearing, see Gov’t’s Supplemental Mem. in Aid of

Sentencing Re: Restitution Hearing Evidence [ECF No. 152] (“Gov’t Add.”); Def.’s Addendum

to Sentencing Mem. [ECF No. 151] (“Def. Add.”).

The government seeks restitution in the amount of $678,993, the total dollar amount JPMC

and AmEx reported in fraud associated with the accounts on the drive in McCormick’s possession.

Gov’t Mem. at 2. McCormick argues that the Court should not order any restitution because (1)

the government did not identify actual loss suffered by JPMC or AmEx; and (2) McCormick did

not directly participate in the charges at issue. Def. Mem. at 6–8. Alternatively, McCormick asks

the Court to apportion liability and reduce his restitution amount to reflect his contribution to the

victims’ losses, which he argues was limited. Id. at 8–9.

Analysis

Restitution in this case is authorized by the Mandatory Victims Restitution Act (“MVRA”),

which applies, inter alia, to “an offense against property under [Title 18] . . ., including any offense

committed by fraud or deceit . . . in which an identifiable victim or victims has suffered . . .

2 18 U.S.C. § 3664(d)(5) authorizes a court to “set a date for the final determination of the victim’s losses, not to exceed 90 days after sentencing,” if the victim’s losses are not ascertainable prior to sentencing.

3 pecuniary loss.” 18 U.S.C. § 3663A(c)(1)(A)(ii), (c)(1)(B). The purpose of the MVRA is

“essentially compensatory,” not punitive: it serves “to restore a victim, to the extent money can do

so, to the position [the victim] occupied before sustaining injury.” United States v. Fair, 699 F.3d

508, 512 (D.C. Cir. 2012) (alteration in original) (quoting United States Boccagna, 450 F.3d 107,

115 (2d Cir. 2006)). Accordingly, restitution is “limited to the actual, provable loss suffered by

the victim and caused by the offense conduct.” Id.; see United States v. Bikundi, 926 F.3d 761,

791 (D.C. Cir. 2019); United States v. Smith, 297 F. Supp. 2d 69, 72 (D.D.C. 2003). The

government bears the burden of establishing the amount of loss suffered by the victim by a

preponderance of the evidence. Fair, 699 F.3d at 513; In re Sealed Case, 702 F.3d 59, 66 (D.C.

Cir. 2012).

The MVRA defines “victim” as “a person directly and proximately harmed as a result of

the commission of an offense for which restitution may be ordered.” 18 U.S.C. § 3663A(a)(2).

Where, as here, the offense involves “as an element a scheme, conspiracy, or pattern of criminal

activity,” the court must order restitution to “any person directly harmed by the defendant’s

criminal conduct in the course of the scheme, conspiracy, or pattern.” Id.

I. Amount of Loss

Because the MVRA only authorizes courts to order restitution for actual, provable losses

suffered by the victim, courts may not order restitution for losses that are unsubstantiated or

speculative. See United States v. Cienfuegos, 462 F.3d 1160, 1168–69 (9th Cir. 2006). Nor should

courts order restitution if “the number of identifiable victims is so large as to make restitution

impracticable,” 18 U.S.C. § 3663A(c)(3)(A), or if “determining complex issues of fact related to

the cause or amount of the victim’s losses would complicate or prolong the sentencing process,”

4 such that the burden on the sentencing process outweighs the need to provide restitution, id. §

3663A(c)(3)(B).

Although the government bears the burden of proving the amount of actual loss to the

victim, the government need not prove the amount of restitution “with exactitude.” In re Sealed

Case, 702 F.3d at 66. “Some degree of approximation . . . is not fatal,” and district courts are

charged with estimating “the amount of the victim’s loss,” based on the facts in the record, “with

some reasonable certainty.” Id. (cleaned up).

For much of this litigation, the government pursued $678,993 in restitution on the theory

that two victim financial institutions—JPMC and AmEx—reported losses of $366,532 and

$312,461, respectively. 3 See Gov’t Mem. at 2. But, as the government conceded at the restitution

hearing, neither institution suffered actual losses in those amounts. See Gov’t Add. at 1–2. The

government proffers, the defense agrees, and the Court now accepts, that JPMC has identified an

actual loss of $124,462.04 and AmEx has identified an actual loss $51,669, with the remaining

amounts attributable to chargebacks to various merchants. 4 See id.; Def. Mem. at 6; Def. Add. at

1. To recover the remaining $502,831.96, the government pivoted—on the night before the

restitution hearing—to include as victims of the offense the merchants underlying these

chargebacks. Gov’t Add. at 2.

The government has not met its burden of proving actual loss to the merchant victims.

Despite having had evidence of the loss amounts attributable to each merchant in its possession

for years, the government was unable to answer many of the Court’s questions as to the contents

3 The parties have represented to the Court that JPMC and AmEx provided itemized spreadsheets reflecting fraud charges totaling $366,532.74 for JPMC and $312,461.10 for AmEx. 4 The government states that “a chargeback occurs when the underlying bank suffers a fraud loss and requires that the merchant who handled the fraudulent transaction suffer the loss instead of the bank.” Gov’t Add. at 2.

5 of the spreadsheets, nor could the government identify the merchants or the specific losses

attributable to them. 5 The MVRA “limits the order of restitution to the sum of losses to identifiable

victims.” United States v. Grimes, 173 F.3d 634, 640 (7th Cir. 1999) (emphasis added). Thus,

courts have found that district judges erred where they ordered restitution to “unidentified”

victims. Id. at 639–40; see also United States v. Catoggio, 326 F.3d 323, 328 (2d Cir. 2003);

United States v. Zakhary, 357 F.3d 186, 191 (2d Cir. 2004) (“Under these circumstances [where

‘no . . . identification of victims or determination of their losses was made’], we are obliged to

vacate that part of the judgment of conviction ordering restitution.”). The government bears the

burden of establishing actual loss to identifiable victims. Its inability to do so years after obtaining

the evidence on which it now seeks to rely, at a hearing specifically held to address restitution,

prevents the Court from ordering restitution to victims other than those identified as suffering

actual losses: JPMC and AmEx.

The Court takes further issue with the government’s attempt to recover losses from charges

that predate McCormick’s entry into the conspiracy. The MVRA authorizes restitution for a

“person directly harmed” by the defendant’s criminal conduct in the course of a conspiracy. 18

U.S.C. § 3663A(a)(2). McCormick cannot be held responsible for losses that occurred prior to his

participation in the conspiracy for which he was convicted. 6 See United States v. Flaschberger,

408 F.3d 941, 943 (7th Cir. 2005) (finding error where the district court ordered restitution for

losses from years preceding the scheme alleged in indictment). Despite the government’s

agreement that McCormick’s restitution order should not include losses prior to March 2009, the

5 With respect to JPMC, the government conceded at the restitution hearing that it does not even know “whether JP Morgan has maintained” records that sufficiently identify the merchant victims.

The Court considers McCormick’s entry date into the Darkode conspiracy to be March 21, 2009, which the 6

government agrees is the earliest date on which his participation can be documented. See SOF ¶ 25.

6 reported losses reflected on the spreadsheets are based on at least some charges that predate

McCormick’s entry into Darkode. Def. Mem. at 8. Although the exact amount is unknown,

McCormick’s counsel estimates that approximately $55,000, or roughly eight percent, of the

banks’ reported losses are from charges prior to March 2009. 7

Accordingly, the government has failed to meet its burden as to the $678,993 it seeks in

restitution. The Court further concludes that it would be too difficult, and too burdensome on the

sentencing process, to allow the government more time to attempt to identify the victims and

quantify the losses at this stage. See 18 U.S.C. 3663A(c)(3).

The Court thus makes the following findings: JPMC suffered an actual loss of $124,462.04

and AmEx suffered an actual loss of $51,669. A fifteen percent decrease in these amounts is

proper to account for the estimated amount attributable to charges preceding McCormick’s

involvement. 8 These calculations result in $105,793 to JPMC and $43,919 to AmEx, which the

Court estimates with reasonable certainty are the amounts of the victim financial institutions’

losses.

II. Causation

McCormick argues that the government has not demonstrated that he directly harmed the

victims because the government has not offered evidence that he actually used the information

found in his possession to rack up the fraudulent charges. The Court rejects this argument. It is

axiomatic that “the defendant should not be required to pay restitution for harm he did not cause.”

In re Sealed Case, 702 F.3d at 66. But when the defendant is convicted of a conspiracy, courts

may “order restitution for damage resulting from any conduct that was part of the conspiracy.”

McCormick’s counsel estimated $54,000 from AmEx and $900 from JPMC. The government did not 7

review the spreadsheets to identify whether any chargebacks predate March 2009. 8 This fifteen percent decrease is more than the eight percent decrease the defense requested.

7 United States v. Emor, 850 F. Supp. 2d 176, 203 (D.D.C. 2012) (quoting United States v. Elson,

577 F.3d 713, 723 (6th Cir. 2009)). In these circumstances, restitution can extend beyond a

specific criminal act to cover losses resulting from the overall scheme, see United States v.

Thomas, 862 F. Supp. 2d 19, 21 (D.D.C. 2012), and courts must “determine the scope of the

defendant’s fraud scheme and the harm suffered by victims as a result of conduct taken by the

defendant pursuant to that scheme,” Emor, 850 F. Supp. 2d at 203; see United States v. Bogart,

490 F. Supp. 2d 885, 903 (S.D. Ohio 2007) (“[T]he Court[] under the MVRA must order restitution

that relates directly to a victim’s losses within the course of the entire scheme and not simply the

loss caused by the specific conduct that is the basis for the offense of conviction.”).

As part of McCormick’s guilty plea, he admitted to his participation in a conspiracy to buy,

sell, and trade malware, botnets, and stolen PII used to fraudulently obtain money from others.

SOF ¶ 24. Moreover, McCormick personally wrote code to insert undetectable malware in a

victim’s computer, installed ransomware for a pay-per-install affiliate program, and, at the time of

his arrest, possessed 21,639 compromised accounts. Id. ¶¶ 29, 32. Even if McCormick did not

himself use the accounts to make fraudulent purchases, these losses were both foreseeable and

directly tied to his conduct in the conspiracy.

III. Apportionment

Where more than one defendant has contributed to the loss of a victim, the MVRA grants

courts discretion to “make each defendant liable for payment of the full amount of restitution” or

“apportion liability among the defendants to reflect the level of contribution to the victim’s loss.”

18 U.S.C. § 3664(h). McCormick asks the Court to apportion his liability, due to (1) his lack of

“direct” contribution to the victims’ loss, and (2) his position as the fourth co-defendant in the

indictment. Def. Mem. at 8. The Court concludes that given the purpose of restitution to make

8 victims whole and the circumstances of this case, which include the unlikelihood that restitution

will be collected from McCormick’s co-defendants, 9 apportionment is neither required nor

warranted. 10

* * *

For the foregoing reasons, and upon consideration of the entire record herein, it is hereby

ORDERED that McCormick shall pay restitution in the amount of $105,793 to JP Morgan

Chase and $43,919 to American Express Bank, for a total of $149,712; it is further

ORDERED that the restitution shall be joint and several with respect to the other

defendants in this case; it is further

ORDERED that payments need not begin until McCormick has completed service of his

term of incarceration; it is further

ORDERED that McCormick’s minimum payment schedule, subject to adjustment by

probation depending on his employment, is $300 a month; and it is further

ORDERED that McCormick’s restitution amount shall be offset by the $8,051.25

forfeiture payment this Court has previously ordered.

SO ORDERED.

/s/ JOHN D. BATES United States District Judge

Dated: December 15, 2023

9 The three other co-defendants in this case have not been extradited to the United States.

Nonetheless, McCormick’s restitution order of $149,712 is less than one quarter of the $678,993 the 10

government seeks.