United States v. Radu Miclaus

• Court: Court of Appeals for the Sixth Circuit
• Decided: October 5, 2021
• Docket: 19-4273
• Status: Published

Opinion

RECOMMENDED FOR PUBLICATION Pursuant to Sixth Circuit I.O.P. 32.1(b) File Name: 21a0231p.06

UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT

┐ UNITED STATES OF AMERICA, │ Plaintiff-Appellee, │ > Nos. 19-4247/4273 │ v. │ │ BOGDAN NICOLESCU (19-4247); RADU MICLAUS │ (19-4273), │ Defendants-Appellants. │ │ ┘

Appeal from the United States District Court for the Northern District of Ohio at Cleveland. No. 1:16-cr-00224—Patricia A. Gaughan, District Judge.

Argued: March 3, 2021

Decided and Filed: October 5, 2021

Before: WHITE, LARSEN, and NALBANDIAN, Circuit Judges. _________________

COUNSEL

ARGUED: David L. Doughten, Cleveland, Ohio, for Appellant in 19-4247. Catherine Adinaro Shusky, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Cleveland, Ohio, for Appellant in 19-4273. Laura McMullen Ford, UNITED STATES ATTORNEY’S OFFICE, Cleveland, Ohio, for Appellee. ON BRIEF: David L. Doughten, Cleveland, Ohio, for Appellant in 19-4247. Catherine Adinaro Shusky, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Cleveland, Ohio, for Appellant in 19-4273. Laura McMullen Ford, UNITED STATES ATTORNEY’S OFFICE, Cleveland, Ohio, for Appellee.

WHITE, J., announced the judgment and delivered the opinion of the court in which she joined in all but Section III.D., and LARSEN and NALBANDIAN, JJ., joined in full. WHITE, J. (pp. 28–29), delivered a separate opinion dissenting from Part III.D. of the court’s opinion. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 2

_________________

OPINION _________________

HELENE N. WHITE, Circuit Judge [Except as to Section III.D.]. For nine years, Defendants-Appellants Radu Miclaus and Bogdan Nicolescu ran a sophisticated, multimillion- dollar cyber-fraud ring out of Romania. They were extradited to the United States, and a federal jury in Ohio convicted them of wire fraud, conspiracy to commit wire fraud, conspiracy to commit computer fraud, aggravated identity theft, conspiracy to commit money laundering, and conspiracy to traffic in counterfeit service marks. The district court sentenced them to eighteen and twenty years’ imprisonment, respectively. On appeal, they raise several challenges to their convictions and sentences. We AFFIRM their convictions, VACATE their sentences, and REMAND for resentencing.

I.

Beginning around 2007, Nicolescu, Miclaus, and a handful of coconspirators began posting fake car auctions on eBay. Their group, dubbed “Bayrob” by the FBI (a combination of “eBay” and “robbery”), set up auctions that appeared to show vehicles for sale by US-based sellers. In reality, Bayrob had neither vehicles to sell nor a US address. Operating from in and around Bucharest, Romania, the group used various technologies to conceal its IP addresses, and employed US-based “money mules,” (falsely described to victims as “eBay Escrow Agents”) to collect payments from unsuspecting buyers. The money mules then wired the victims’ payments to various locations in Europe, where individuals associated with Bayrob collected the payments and brought them to Miclaus and Nicolescu in Romania. All told, the Bayrob group orchestrated the eBay fraud more than 1,000 times and reaped between $3.5 million and $4.5 million.

At some point in 2014, Bayrob began employing a custom-made trojan horse virus to facilitate new money-making schemes. Nicolescu, a skilled computer programmer, created the virus, which he embedded in links in the group’s eBay auctions and in spam emails widely disseminated by Bayrob. Once a victim clicked the link and downloaded the virus onto the victim’s computer, it ran quietly in the background until the unsuspecting victim tried to visit Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 3

certain popular websites, including eBay, Facebook, PayPal, Gmail, Yahoo, and Walmart. At that point, instead of connecting to the real website, the virus discreetly redirected the victim’s computer to a look-a-likewebsite created by Bayrob, which collected the victim’s account credentials, identities, and credit-card information, and stored it all on Bayrob’s servers in Romania. Bayrob collected more than 70,000 account credentials this way, including 25,000 stolen credit-card numbers. Bayrob used the stolen credit cards to pay its own expenses, including costs for server space, VPNs, and registering domain names, and it sold some of the stolen credit cards on AlphaBay, a website on the dark web frequented by criminals, for prices ranging from $1–$35.

Around the same time, Bayrob concocted a third money-making scheme. This time it harnessed the processing power of its network of 33,000 virus-infected computers to “mine” for cryptocurrency. Nicolescu’s trojan horse virus worked by commandeering an infected computer’s processor and forcing it to solve difficult mathematical equations that generate bitcoin, a process known as “cryptomining.” With their computers’ processing power tied up generating bitcoin for Bayrob, the victims’ computers slowed to a crawl. Bayrob exchanged the bitcoins generated by its cryptomining activities for cash, generating approximately $10,000–$20,000 per month in 2014, and $30,000–$40,000 per month in 2015 and 2016.

The FBI caught on to Bayrob’s activities in 2015 and executed a search warrant on the cell phone of Tiberiu Danet, a Bayrob member, as he traveled through the Miami airport. Using information obtained from Tiberiu’s phone, the FBI and Romanian police executed a search warrant on Nicolescu’s, Miclaus’s, and Tiberiu’s residences in Romania. The searches turned up a trove of servers, hard drives, and other computing equipment used by the group. The FBI was not able to decrypt much of the information on Bayrob’s servers, but the cache of seized files the FBI was able to review included spreadsheets the group used to keep track of its victims and spreadsheets showing money Bayrob had moving through its money-mule network in the United States and Europe.

In 2016, Nicolescu and Miclaus were indicted for conspiracy to commit wire fraud, twelve counts of wire fraud, conspiracy to commit computer fraud, conspiracy to traffic in Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 4

counterfeit service marks, five counts of aggravated identity theft, and conspiracy to commit money laundering. They were convicted on all counts after a two-and-a-half-week jury trial.1

At Defendants’ sentencing hearing, FBI agent Ryan MacFarlane testified that the eBay scheme generated between $3.5 million and $4.5 million in losses. The FBI calculated that figure by reviewing spreadsheets Bayrob used to keep track of its victims and cross-referencing the information in the spreadsheets with victim complaints filed with the FBI’s Internet Crime Complaint Center (ICCC). MacFarlane estimated that the true eBay loss figure was substantially higher than $3.5 to $4.5 million, since only 30–35% of victims filed complaints with the ICCC. According to MacFarlane, true losses may have been as high as $10 million to $30 million.

At the conclusion of the sentencing hearing, the district court calculated Nicolescu’s and Miclaus’s Guidelines range for the conspiracy-to-commit-money-laundering grouping (Counts 1–15 and 21). The district court added eighteen levels to their Guidelines calculation under U.S.S.G. § 2B1.1(b)(1)(J) for causing a loss between $3.5 and $9.5 million, two levels under U.S.S.G. § 2B1.1(b)(4) for being in the business of receiving and selling stolen property, two levels under U.S.S.G. § 2B1.1(b)(11)(B)(i) for trafficking unauthorized access devices, four levels under U.S.S.G. § 2B1.1(b)(19)(A)(ii) for having been convicted of an offense under 18 U.S.C. § 1030(a)(5)(A), and four levels under U.S.S.G. § 3B1.1(a) for being an organizer or leader of criminal activity, as well as other enhancements not at issue in this appeal. The result was an adjusted offense level of forty-three, which at criminal history category I produced a Guidelines range of life imprisonment. Since a life sentence exceeded the statutory twenty-year maximum on any of the offenses in the grouping, the parties agreed to (and the district court applied) a five-level reduction for an applied total offense level of thirty-eight. After the five-level reduction, Nicolescu’s and Miclaus’s Guidelines range was 235 to 293 months. They were sentenced to 216 and 192 months’ imprisonment, respectively, on Counts 1 through 13 and 21, concurrent sentences of sixty months on Count 14 and 120 months on Count 15, and mandatory twenty-four month sentences on Counts 16 through 20, to run concurrently with each

1The jury acquitted Nicolescu and Miclaus on sentencing enhancements under 18 U.S.C. § 3559(g)(1) for false registration of domain names (pertaining to all counts). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 5

other but consecutively to all the other sentences, for a total sentence of 240 (Nicolescu) and 216 (Miclaus) months’ imprisonment.

This appeal followed.

II.

Nicolescu and Miclaus each appeal one substantive count of conviction and the application of multiple sentencing enhancements. We consider the challenges to their substantive convictions first.

A.

Nicolescu contends the district court erred in denying his motion for acquittal based on insufficiency of the evidence on Count 14, which charges conspiracy to violate 18 U.S.C. § 1030(a)(5)(A) and two other statutes.

We review a district court’s denial of a motion for judgment of acquittal de novo. United States v. Howard, 947 F.3d 936, 947 (6th Cir. 2020). When reviewing the sufficiency of the evidence, we assess “whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Jackson v. Virginia, 443 U.S. 307, 319 (1979).

The jury convicted Nicolescu and Miclaus on Count 14, which alleged a conspiracy with three objects:

(i) to intentionally access a computer without authorization, and thereby obtain information from a protected computer, and the offense was committed for purposes of commercial advantage and private financial gain, in violation of Title 18, United States Code, Section 1030(a)(2)(C); and (ii) to intentionally access a computer without authorization and by means of such conduct furthered the intended fraud and obtained something of value, specifically, money, in excess of 3 to 4 million dollars, in violation of Title 18, United States Code, Section 1030(a)(4); and (iii) to knowingly cause the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally cause damage without authorization to a protected computer, and the offense caused damage affecting Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 6

ten or more protected computers in a one year period, in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and (c)(4)(B).

R. 1, PID. 24 (Indictment ¶ 89). On appeal, Nicolescu challenges the sufficiency of the evidence on only the third object of the conspiracy, § 1030(a)(5)(A) and (c)(4)(B). Since this court must assume the evidence on the two unchallenged objects was sufficient, his failure to challenge the sufficiency of the evidence on the other two charged objects is fatal to his claim. See Griffin v. United States, 502 U.S. 46, 56–57 (1991) (“[W]hen a jury returns a guilty verdict on an indictment charging several acts in the conjunctive . . . the verdict stands if the evidence is sufficient with respect to any one of the acts charged.” (alteration in original) (quoting Turner v. United States, 396 U.S. 398, 420 (1970))). Moreover, the jury heard testimony from multiple witnesses that Nicolescu’s computer virus caused its victims’ computers to run slowly because the virus was using their computers’ processing power to mine for bitcoin. Such testimony was enough for a reasonable juror to find that Nicolescu conspired to damage a protected computer, in violation of § 1030(a)(5)(A) and (c)(4)(B).2

B.

Miclaus contends the district court erred in denying his motion for acquittal on Counts 16 through 20, which charged aggravated identity theft in violation of 18 U.S.C. § 1028A, because

2Nicolescu’s brief describes his challenge as one to the sufficiency of the evidence, see Nicolescu Br. at 43 (“The evidence is insufficient to establish that the appellant conspired to violate 18 U.S.C. §1030(a)(5)(A)”), but to the extent Nicolescu intended to argue—as some of his briefing seems to suggest—that “slowing” of a computer cannot constitute “damage” to a computer as a matter of law, see id. (“Here, Nicolescu challenges whether he caused damage as required by the statute.”), this challenge too fails. 18 U.S.C. § 1030(e)(8) defines “damage” as “any impairment to the integrity or availability of data, a program, a system, or information[.]” Applying the same statute in the civil context, we looked to the ordinary meaning of the terms “impairment,” “integrity,” and “availability” and defined “damage” for purposes of § 1030(a)(5)(A) as “a transmission that weakens a sound computer system—or, similarly, one that diminishes a plaintiff’s ability to use data or a system[.]” Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 301 (6th Cir. 2011). Nicolescu’s virus, which caused infected computers to “run very slowly,” R. 233, PID. 3729, would constitute an “impairment to the integrity . . . of . . . [the] system.” See 18 U.S.C. § 1030(e)(8). In other words, the virus was a “transmission that . . . diminishe[d] a [victim’s] ability to use . . . a system.” Pulte Homes, Inc., 648 F.3d at 301; see also United States v. Carlson, 209 F. App’x 181, 184–85 (3d Cir. 2006) (finding that criminal defendant intentionally caused “damage” to victim’s computer under § 1030(a)(5)(A) when he flooded victim inboxes with thousands of spam emails, “which would clog the address, result in delays, and at times require the purging of all e-mails, causing valuable business-related e-mails to be permanently lost”). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 7

the government did not present evidence that Miclaus aided and abetted the “use” of each of the five aggravated-identity-theft victims’ credit cards. Miclaus Br. at 43–50.

We review the district court’s denial of Miclaus’s motion for judgment of acquittal de novo, and again assess whether, viewing the evidence in the light most favorable to the prosecution, any rational juror could have found the essential elements proven beyond a reasonable doubt. Howard, 947 F.3d at 947.

To sustain a conviction for aggravated identity theft, the government must prove the defendant “(1) knowingly used, without lawful authority, a means of identification of another person; and (2) used that means of identification during and in relation to an enumerated predicate felony.” United States v. Vance, 956 F.3d 846, 857 (6th Cir.), cert. denied, 140 S. Ct. 2819 (2020). Here, the alleged predicate felonies were computer fraud under § 1030 and wire fraud under § 1343. The jury was instructed, pursuant to Sixth Circuit Pattern Jury Instruction 15.04, that “use” means “active employment of the means of identification during and in relation to the [predicate felony]. Active employment includes activity such as displaying or bartering. ‘Use’ also includes a person’s reference to a means of identification in his possession for the purpose of helping to commit the [predicate felony].” R. 242, PID. 5759–60. Miclaus does not argue that a credit-card number is not a “means of identification,” nor does he challenge our pattern jury instruction’s definition of “use,” so we assume the correctness of both here.

At trial, the jury heard that the names, addresses, and credit-card numbers of the five victims identified in Counts 16 through 20 were found on one of Bayrob’s internal victim- tracking spreadsheets (Exhibit 1204 at trial). An FBI agent testified that the FBI spoke with four of the victims and the fifth victim’s wife and confirmed that the identity and credit-card information in Bayrob’s spreadsheet was accurate. Some of the victims testified at trial and confirmed the same. Valentin Dima, a Bayrob member who cooperated with the government, testified that Bayrob had a practice of testing the validity of each credit-card number before adding it to its victim-tracking spreadsheets by “creating e-mail addresses through Yahoo, and then . . . upgrad[ing] the account [to] Yahoo plus,” which required a valid credit card, to see if each stolen credit card was still valid. R. 240, PID. 5341–42. The spreadsheet contained a column with “0’s” and “1’s” for each card, with “1” indicating that the card was still valid and Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 8

could be used for purchases, and “0” indicating that the card did not work. The spreadsheet contained another column where Bayrob members noted operational purchases they made with the stolen cards, including for website hosting and VPNs.

Miclaus contends the government failed to prove Bayrob “used” each victim’s credit-card number because not every victim testified that fraudulent purchases were made on their credit cards. Miclaus’s challenge fails because even if fraudulent purchases were not made on each card, Dima testified that his job was to test each credit card before adding it to the spreadsheet, and the jury could see that the spreadsheet contained “0’s” and “1’s” for each card. 3 A means of identification is “used” whenever it is “employ[ed]” or “convert[ed] to one’s service.” United States v. Michael, 882 F.3d 624, 626 (6th Cir. 2018) (quoting Webster’s New International Dictionary 2806 (2d ed. 1942)). Sending a stolen credit-card number to Yahoo as part of a sham email account upgrade transaction for the sole purpose of having Yahoo run that credit-card number and report back whether it is still valid for future operational purchases is an “active employment” of that stolen credit-card number. Indeed, situations where a defendant impersonates a victim—as Bayrob did when it purported to be each of the victims in transactions with Yahoo—were the “principal target” of § 1028A. Michael, 882 F.3d at 627. Accordingly, when viewed in the light most favorable to the government, the evidence was sufficient for a reasonable juror to find Miclaus guilty on Counts 16 through 20.

C.

Miclaus also challenges the substance of the district court’s aggravated-identity-theft jury instruction. He contends that it omitted an element: that Miclaus be found to have committed an enumerated felony.

Miclaus did not object to the instruction at trial, so we review for plain error. United States v. Small, 988 F.3d 241, 254 (6th Cir. 2021). “In the context of challenges to jury

3Even if Dima did not specifically testify that he tested each of the five aggravated-identity-theft victims’ credit-card numbers, Dima’s testimony about his activities testing cards, coupled with the evidence that the spreadsheet contained either a “0” or a “1” for every card, is circumstantial evidence that the five aggravated-identity-theft victims’ credit-card numbers were tested. “Circumstantial evidence alone is sufficient to sustain a conviction and such evidence need not remove every reasonable hypothesis except that of guilt.” Howard, 947 F.3d at 947 (quoting United States v. Lowe, 795 F.3d 519, 522–23 (6th Cir. 2015)). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 9

instructions, plain error requires a finding that, taken as a whole, the jury instructions were so clearly erroneous as to likely produce a grave miscarriage of justice.” Id. (quoting United States v. Newsom, 452 F.3d 593, 605 (6th Cir. 2006)).

As noted in the preceding section, to sustain a conviction for aggravated identity theft, the government must prove the defendant “(1) knowingly used, without lawful authority, a means of identification of another person; and (2) used that means of identification during and in relation to an enumerated predicate felony.” Vance, 956 F.3d at 857. Here, the indictment alleged the predicate felonies were “Computer Fraud” under § 1030, and “Wire Fraud” under 18 U.S.C. § 1343, which are predicate felonies under § 1028A. See § 1028A(c)(4) (predicate offenses include provisions in chapter 47, which includes § 1030 computer fraud); § 1028A(c)(5) (predicate offenses include provisions in chapter 63, which includes § 1343 wire fraud). Paragraph 123 of the indictment alleges:

123. From on or about February 25, 2013, through on or about July 1, 2015, in the Northern District of Ohio, Eastern Division, and elsewhere, Defendants BOGDAN NICOLESCU, TIBERIU DANET, and RADU MICLAUS, and others presently known and unknown to the Grand Jury, did knowingly use, without lawful authority, a means of identification of another person during and in relation to a felony violation enumerated in Title 18, United States Code, Section 1028A(c), to wit, the commission of Computer Fraud, a violation of Title 18, United States Code, Section 1030, and Wire Fraud, a violation of Title 18, United States Code, Section 1343, knowing that the means of identification belonged to another actual person, in violation of Title 18, United States Code, Sections 1028A(a)(l) and 2.

R. 1, PID 34 (Indictment ¶ 123). At trial, the district court’s jury instruction on the aggravated- identity-theft count read:

Counts 16 through 20 of the indictment charge Defendants Bogdan Nicolescu and Radu Miclaus with the crime of aggravated identity theft, Title 18 United States Code, Sections 1028A(a)(1) and 2.

Count 16 through 20 of the indictment charge each Defendant with using a means of identification of another person during and in relation to a felony violation listed in the statute. For you to find each Defendant guilty of this crime, you must find that the Government has proved each and every one of the following elements beyond a reasonable doubt. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 10

First, that each Defendant committed the following violation charged in Count 16 through 20. The violation charged in Count 16 through 20 is a felony violation listed in the statute; Second, that each Defendant knowingly used a means of identification of another person without lawful authority; Third, that each Defendant knew the means of identification belonged to another person; Fourth, that the use was during and in relation to the crime charged in Counts 16 through 20; ... The term “during and in relation to” requires that the means of identification have some purpose or effect with respect to the crime charged in Counts 16 through 20. In other words, the means of identification must facilitate or further or have the potential of facilitating or furthering the crime charged in Counts 16 through 20, and its presence or involvement cannot be the result of accident or coincidence.

R. 242, PID. 5758–61.

Miclaus is correct that the district court’s aggravated-identity-theft jury instruction was erroneous. The instruction should have specified, when describing the first and fourth elements and defining the term “during and in relation to,” that the predicate felonies charged in Counts 16 through 20 were § 1343 wire fraud and § 1030 computer fraud. Instead, the instruction referred back to Counts 16 to 20 as a whole. Such an error does not automatically warrant reversal, however. See United States v. Kuehne, 547 F.3d 667, 682 (6th Cir. 2008) (failure to instruct jury on elements of predicate offense in 18 U.S.C. § 924(c)(1) conviction was harmless because “the jury was presented with uncontroverted evidence supporting the predicate drug offenses”). Indeed, in the context of this case, we find it highly unlikely that the district court’s error led any juror astray.

To start, the jury had the indictment during its deliberations and the indictment clearly explains that the predicate offenses are § 1030 computer fraud and § 1343 wire fraud. The jury was instructed on the substantive elements of § 1030 computer fraud when it was instructed on Count 14, which charged conspiracy to commit computer fraud, and on the substantive elements of wire fraud when it was instructed on Counts 2 through 13, which charged wire fraud. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 11

It convicted Nicolescu and Miclaus on all twenty-one counts, including wire fraud and conspiracy to commit computer fraud.

Further, the aggravated-identity-theft allegations were inextricably intertwined with the computer-fraud and wire-fraud allegations. Over the course of the two-week trial, the jury heard testimony from some of the aggravated-identity-theft victims that their computers became infected with a virus after visiting an eBay auction, and it heard from the FBI that the aggravated-identity-theft victims’ credit-card information was found in Bayrob’s internal spreadsheets. That created the strong inference that Nicolescu and Miclaus obtained the victims’ credit-card information via the virus, and the jury was presented with no alternative explanation for how the aggravated-identity-theft victims’ credit-card information ended up in Bayrob’s spreadsheets. The jury then heard that Bayrob tested the stolen credit cards in preparation for—and in some cases to actually make—operational purchases necessary to support its vast online operation. This all adds up to a strong circumstantial case for aggravated identity theft: Bayrob came into possession of the aggravated-identity-theft victims’ credit-card information using the fake eBay auctions and the virus, which violated § 1343 and § 1030, and they used the stolen credit-card information when they verified the cards and made operational purchases with them, in violation of § 1028A. Because the offenses were so intertwined, it is unlikely that any juror could have believed that Miclaus was guilty of aggravated identity theft without also believing he was guilty of computer and wire fraud. We therefore find it unlikely that the district court’s error “produce[d] a grave miscarriage of justice” here. Newsom, 452 F.3d at 605. Miclaus’s claim is without merit.

III.

Nicolescu and Miclaus also challenge multiple sentencing enhancements applied by the district court. We consider each in turn. A.

The district court applied an eighteen-level Guidelines enhancement under U.S.S.G. § 2B1.1(b)(1)(J) for causing losses of more than $3.5 million and less than $9.5 million. Nicolescu contends that was error because the government’s evidence only established a Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 12

$1.1 million gain for Bayrob as a result of the eBay scheme and $100,000 in fraudulent purchases on victims’ credit cards. Nicolescu argues that though a loss calculation under § 2B1.1(b)(1)(J) may include intended losses in addition to proven losses, doing so in this case rendered the district court’s loss calculation unduly speculative, since the government did not provide wire transfer information for all $3.5 million in alleged losses and instead relied on a $500-per-stolen-credit-card multiplier found in the Guidelines commentary to reach the estimated loss figure. Nicolescu contends that the government should have been required to present evidence of the credit limit of each of the stolen credit cards.

Under the Guidelines, if the loss attributable to a theft exceeds $3.5 million but is less than $9.5 million, the district court is instructed to increase the offense level by eighteen levels. § 2B1.1(b)(1)(J). Section 2B1.1’s application notes define the applicable loss amount as “the greater of actual loss or intended loss.” Id. § 2B1.1 cmt. n.3(A). “Actual loss” is “the reasonably foreseeable pecuniary harm that resulted from the offense.” Id. § 2B1.1 cmt. n.3(A)(i). “Intended loss” is “the pecuniary harm that the defendant purposely sought to inflict[,]” which may include losses “that would have been impossible or unlikely to occur[.]” Id. § 2B1.1 cmt. n.3(A)(ii). In calculating the loss amount, the district court “need only make a reasonable estimate of the loss,” and its determinations are “entitled to appropriate deference.” Id. § 2B1.1 cmt. n.3(C). If the loss amount cannot reasonably be determined, the district court may use “the gain that resulted from the offense as an alternative measure[.]” Id. § 2B1.1 cmt. n.3(B).

As a threshold matter, the district court cited both Agent MacFarlane’s testimony regarding the eBay-auction scheme and the credit cards Bayrob sold on AlphaBay when addressing the $3.5 million loss figure, but the district court found that “Agent Mac[F]arlane’s testimony [about the losses attributable to the eBay scheme] alone satisfies the Government’s burden.” R. 230, PID. 3257. Therefore, even if this court’s recent decision in United States v. Riccardi renders invalid any loss calculation based on a $500-per-stolen-credit-card multiplier, we need not address the stolen credit cards Bayrob sold on AlphaBay if the losses from the eBay scheme —which do not rely on a multiplier—totaled more than $3.5 million. See 989 F.3d 476, 489 (6th Cir. 2021) (invalidating § 2B1.1 cmt. n.3(F)(i)’s $500-per-access-device multiplier). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 13

We review the district court’s findings regarding the losses attributable to the eBay scheme under a deferential clear-error standard. Id. at 487. In arriving at the $3.5 million loss figure, the district court relied heavily on Agent MacFarlane’s testimony at the sentencing hearing that the eBay scheme generated losses between $3.5 million and $4.5 million. The FBI calculated that figure after reviewing victim information found in an unencrypted spreadsheet that Bayrob members used to track payments from their victims, and then cross-referencing that information with complaints in the FBI’s ICCC database and tallying the loss amounts from those complaints. The FBI was able to match the information found on Bayrob’s servers with particular victim complaints by looking at “specific indicators that were associated with the Bayrob Group, such as known e-mail accounts, known money mules, known fax numbers and other technical indicators that allowed [the FBI] to identify complaints that were related to the Bayrob Group[.]” R. 230, PID. 3201. According to MacFarlane, the $3.5 million figure is based only on “actual observed transactions” from ICCC “complaints that [the FBI was] able to identify” that were also “consistent with the behavior of the Bayrob eBay fraud operation.” Id. at 3201–03. The FBI discounted ICCC complaints that alleged loss amounts that “weren’t realistic.” Id. at 3202. And, according to MacFarlane, the $3.5 million figure is a “conservative estimate” because only 30–35% of the eBay victims the FBI identified on Bayrob’s servers also filed complaints with the ICCC. Id. at 3203–04. The FBI estimates that the actual losses from the eBay scheme may have been as high as $30 million.

“In challenging the court’s loss calculation, [Nicolescu] must carry the heavy burden of persuading this Court that the evaluation of the loss was not only inaccurate, but was outside the realm of permissible computations.” United States v. Jackson, 25 F.3d 327, 330 (6th Cir. 1994). Nicolescu’s primary argument is that the district court should have used traceable gains: here the $1.1 million in wire transfers the FBI was able to trace through one of Bayrob’s money mules back to Europe, instead of the $3.5 million figure provided by the FBI, which was based on verified ICCC victim complaints, but was not always backed up by evidence of specific wire transfers showing how each victim’s money ended up in Bayrob’s possession. The FBI was not able to trace more victim wire transfers back to Bayrob because the FBI was not able to decrypt much of the information on Bayrob’s servers, and MacFarlane testified that Nicolescu and Miclaus declined to assist the FBI in identifying the other money mules the group used. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 14

Although more specificity about Bayrob’s illicit gains may have been preferable, “the district court need only make a reasonable estimate of the loss using a preponderance of the evidence standard.” United States v. Ellis, 938 F.3d 757, 760 (6th Cir. 2019) (quoting United States v. Wendlandt, 714 F.3d 388, 393 (6th Cir. 2013)). And the Guidelines commentary provides that the district court “shall use the gain that resulted from the offense as an alternative measure of loss only if there is a loss but it reasonably cannot be determined.” § 2B1.1 cmt. n.3(B) (emphasis added). Here, the district court based its $3.5 million loss calculation on (i) Agent MacFarlane’s detailed testimony about the FBI’s efforts to identify specific victim complaints attributable to Bayrob, including his assurances that the $3.5 million loss figure was based on “actual observed transactions,” (ii) the district court’s own review of Bayrob’s internal victim-tracking spreadsheets, and (iii) victim statements submitted to the district court. R. 230, PID. 3258. Given the practical difficulties the government and the district court faced in obtaining more precise detail about victim losses—some of which can be attributed to Defendants’ decision to encrypt the files on their servers and their refusal to provide the FBI with the decryption key—the district court’s reliance on victim statements and ICCC complaints was reasonable, and we cannot say on the record before us that the district court’s $3.5 million loss calculation was clearly erroneous.

U.S.S.G. § 2B1.1(b)(4) provides for a two-level increase if “the offense involved receiving stolen property, and the defendant was a person in the business of receiving and selling stolen property[.]” At the sentencing hearing, the district court applied the two-level § 2B1.1(b)(4) enhancement because it found that Nicolescu and Miclaus “operated a long- standing and highly sophisticated scheme” whereby they “obtained vast amounts of credit card data, which [they] did, in fact, sell” on AlphaBay “even if [they were] not initially in the business of buying and selling property.” R. 230, PID. 3263–64.

Nicolescu and Miclaus contend that was error because § 2B1.1(b)(4) was intended to apply to defendants who “fence” stolen goods for others, and Bayrob was not a fence: it only sold credit cards on the dark web that the group itself stole. Nicolescu Br. at 30; Miclaus Br. at 18. The government’s brief takes a broader view of the reach of the Guideline: the government Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 15

contends that § 2B1.1(b)(4) is not limited to fencing cases, and the language of § 2B1.1(b)(4) covers situations where defendants “receive” stolen goods from a computer virus and then sell them on the dark web. Appellee’s Br. at 44–45. Additionally, the government suggests that the enhancement can apply when a defendant “receives” stolen property from a coconspirator and then sells it—even when the object of the conspiracy was to steal the same property.

“When reviewing the district court’s application of the Sentencing Guidelines, we review the district court’s factual findings for clear error and mixed questions of law and fact de novo.” United States v. Tolbert, 668 F.3d 798, 800 (6th Cir. 2012) (quoting United States v. May, 568 F.3d 597, 604 (6th Cir. 2009)). We review the district court’s interpretation of the Sentencing Guidelines de novo. Id.

By its terms, § 2B1.1(b)(4) applies “[i]f the offense involved receiving stolen property” and “the defendant” was “in the business of receiving and selling stolen property[.]” In determining whether a defendant is “in the business of” receiving and selling stolen property, Application Note 5 to § 2B1.1 instructs courts to consider “(A) [t]he regularity and sophistication of the defendant’s activities; (B) [t]he value and size of the inventory of stolen property maintained by the defendant; (C) [t]he extent to which the defendant’s activities encouraged or facilitated other crimes; [and] (D) [t]he defendant’s past activities involving stolen property.” § 2B1.1 cmt. n.5.

We have not yet addressed whether § 2B1.1(b)(4) is limited in its application to defendants who sell goods that others have stolen, as opposed to defendants who sell goods they have stolen themselves, but in United States v. Warshawsky, we addressed a prior version of the same Guideline and explained that “[a] person ‘in the business of receiving and selling stolen property’ is a person once referred to less flatteringly as a ‘fence.’” 20 F.3d 204, 214 (6th Cir. 1994). A few months later, citing Warshawsky, we recognized that for purposes of the enhancement, there is a difference between “a person who receives stolen property” and a person “who sells property that he himself has stolen[,]” because the Sentencing Commission “decided that fences deserve longer sentences than mere thieves” because fencing facilitates and encourages other crimes while mere thievery does not. United States v. Koehler, 24 F.3d 867, Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 16

871 (6th Cir. 1994). Accordingly, we explained that only those who sell goods that others have stolen are subject to the “fencing” enhancement. Id.

Warshawsky and Koehler interpreted U.S.S.G. § 2B1.2, which was deleted and consolidated with § 2B1.1 in November 1993. United States v. Vigil, 644 F.3d 1114, 1119 (10th Cir. 2011). The 1993 amendment also added the first clause to the current iteration of the enhancement, which now requires that “the offense involved receiving stolen property[.]” Id. But neither the addition of the first clause nor consolidation with § 2B1.1 provides us with reason to question what we said in Warshawsky and Koehler: the defendant must “receive” stolen goods before he can be “in the business of receiving and selling stolen property.” A defendant does not “receive” goods he himself stole. See United States v. McMinn, 103 F.3d 216, 219 (1st Cir. 1997) (“Under the common-law tradition, stealing property from another normally does not equate with ‘receiving’ property from its rightful owner.”); Baugh v. United States, 540 F.2d 1245, 1246 (4th Cir. 1976) (“[L]ogic . . . instructs us that there is an inherent inconsistency in treating a taking as a receipt.”). Accordingly, § 2B1.1(b)(4) is limited in its application to professional fences—it does not apply to thieves who merely sell goods they stole.4 Our sister circuits have almost unanimously reached the same conclusion. See, e.g., United States v. Borders, 829 F.3d 558, 568 (8th Cir. 2016); Vigil, 644 F.3d at 1118; United States v. Bradley, 644 F.3d 1213, 1287 (11th Cir. 2011); Kimbrew, 406 F.3d at 1152; McMinn, 103 F.3d at 219–21; United States v. Sutton, 77 F.3d 91, 94 (5th Cir. 1996); United States v. Braslawsky, 913 F.2d 466, 468 (7th Cir. 1990) (coming to same conclusion about prior version of the enhancement, § 2B1.2(b)(3)(A)). But see United States v. Collins, 104 F.3d 143, 144 (8th Cir. 1997) (holding that a thief was “in the business” of receiving and selling stolen property when he delivered goods he had stolen to an auction house and split the proceeds with the auction house after the goods were sold).

4In 2001, the Sentencing Commission added Application Note 5 to § 2B1.1, which adopted a “totality of the circumstances” test for determining whether a defendant’s fencing activities were frequent enough to consider him “in the business of” receiving and selling stolen property. Vigil, 644 F.3d at 1120. Application Note 5 had the effect of abrogating a different test this court had adopted in Warshawsky. Id. But the addition of Application Note 5 and the abrogation of the test adopted in Warshawsky does not affect our analysis here, since “both tests operate on the predicate that the defendant is a fence.” United States v. Kimbrew, 406 F.3d 1149, 1154 (9th Cir. 2005). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 17

Nonetheless, that holding does not end our inquiry here. In its brief, the government contends that Nicolescu and Miclaus are eligible for the enhancement because they “received” stolen credit cards from the computer virus Nicolescu created and Miclaus injected into his fake eBay auction listings. Appellee’s Br. at 39–40. The government cites no authority in support of its novel theory of receipt. We find the government’s theory to be linguistically untenable. The virus was a tool created and employed by Nicolescu and Miclaus to steal victims’ credit-card numbers. Tools and other inanimate objects do not commit larceny. People do. For that reason, Defendants cannot “receive” stolen goods from their tools. Were we to adopt the government’s reading, it would effectively collapse larceny and receipt of stolen goods—“distinct substantive offense[s]” at common law—into the same offense. 76 C.J.S. Receiving Stolen Goods § 1 (2021); see also McMinn, 103 F.3d at 219. We decline to adopt such an anomalous interpretation.

Moreover, our interpretation is consistent with the Application Note, which we are bound to apply. See Stinson v. United States, 508 U.S. 36, 38 (1993); United States v. Paauwe, 968 F.3d 614, 618 (6th Cir. 2020). Application Note 5 to § 2B1.1 instructs courts to consider “[t]he extent to which the defendant’s activities encouraged or facilitated other crimes” when deciding whether to apply the enhancement. Fences induce others to commit property crimes by providing them with a ready market for their stolen goods. See Warshawsky, 20 F.3d at 215; Koehler, 24 F.3d at 871. Thieves who sell goods they stole typically do not. Here, the government conceded at oral argument that there was no evidence that Bayrob sold goods stolen by anyone outside of the group. Thus, there is no evidence that Nicolescu and Miclaus acted as “fences.”

Alternatively, the government suggests that Nicolescu and Miclaus are subject to this enhancement because the individuals within Bayrob responsible for stealing some of the credit cards were not necessarily the same people who sold them on AlphaBay. Appellee’s Br. at 41 (“Nicolescu gave Valentin Danet access to Bayrob’s Alpha Bay account to sell the stolen credit cards and provided the bitcoin payment wallets used for the sales.”); Appellee’s Br. at 45 (“[T]he defendant[s] received some of the stolen data in part through phishing-initiated theft that was developed by a co-conspirator.”); Oral Arg. at 28:50 (arguing that Nicolescu and Miclaus Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 18

received stolen cards from other Bayrob members who had personally stolen them). In other words, the government’s argument is that an individual who “receives” stolen property from a coconspirator and then sells it is operating as a fence. The government’s theory is untenable where, as here, the object of the conspiracy was to steal the property. If two or more individuals conspire to steal something, all members of the conspiracy are accountable for the theft. See U.S.S.G. § 1B1.3(a)(1)(B) (outlining requirements to hold defendant liable for jointly undertaken conduct in calculating advisory Guidelines sentencing range); United States v. Hamm, 952 F.3d 728, 744 (6th Cir. 2020) (discussing requirements for holding a defendant liable for the crimes of a coconspirator under Pinkerton v. United States, 328 U.S. 640 (1946)); see also United States v. Gilbert, 725 F. App’x 370, 373 (6th Cir. 2018) (discussing Pinkerton liability in the context of aggravated identity theft). It would be strange, therefore, not to think of such conspirators as participating in the theft, even if they do not do so physically or personally.

If an individual is responsible for stealing property, then he cannot fence the same property. See Koehler, 24 F.3d at 871; Warshawsky, 20 F.3d at 214–15. Thus, even if other members of Bayrob completed some of the credit-card thefts themselves and then passed those cards on to Nicolescu or Miclaus to sell (or if defendants stole the cards and gave them to other Bayrob members to sell), the “seller” did not receive stolen property within the meaning of § 2B1.1(b)(4). The seller conspired to steal. That made him a thief, not a fence. Cf. Kimbrew, 406 F.3d at 1150–54 (declining to apply fencing enhancement where defendant conspired to obtain computers via fraud, which a coconspirator would then re-sell).

The government looks for contrary support in the Eighth Circuit’s decision in United States v. Borders. See 829 F.3d at 568–69. In Borders, the Eighth Circuit found that it was not clear error to apply § 2B1.1(b)(4) to a defendant who “often scouted and stole trucks” for another defendant who gave him “shopping lists” of property to steal. Id. at 569. It also applied the enhancement to the defendant who wrote the “shopping lists” and sold the property. Id. But Borders’s § 2B1.1(b)(4) analysis did not grapple with the fact that both defendants were engaged in a conspiracy to steal the property in question. As such, we do not find it instructive.

We conclude that the district court erred in applying a two-level enhancement under § 2B1.1(b)(4) for receiving and selling stolen property. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 19

The district court applied a four-level leadership-role enhancement under U.S.S.G. § 3B1.1(a) to both Defendants’ Guidelines calculations. On appeal, Nicolescu, whose online moniker was “Master Fraud 1,” R. 236, PID. 4383, contends that he was, in fact, not the master of the frauds. He asserts that he “was not the leader in the money laundering” and was “equally responsible as others, but had no more authority tha[n] at least two other members of Bayrob[.]” Nicolescu Br. at 30–31. In his telling, only a two-level enhancement was warranted. Miclaus argues that the leadership-role enhancement was not warranted because he “was not recruiting members, writing code, maintaining the servers, or recruiting money mules” and “[h]is only roles were to post fraudulent auctions on eBay and to, occasionally, accept money from Antonovici to pass along to other members of the group.” Miclaus Br. at 39.

This court reviews “the district court’s legal conclusion that a person is an organizer or leader under [§] 3B1.1 deferentially, and its factual findings for clear error.” United States v. Sexton, 894 F.3d 787, 794 (6th Cir. 2018) (alteration in original) (internal quotation marks omitted) (quoting United States v. House, 872 F.3d 748, 751 (6th Cir. 2017)). “Under the clear- error standard, we abide by the court’s findings of fact unless the record leaves us with the definite and firm conviction that a mistake has been committed.” Id. (quoting United States v. Yancy, 725 F.3d 596, 598 (6th Cir. 2013)). The deferential review of the district court’s ultimate legal conclusion is based on the recognition that the “trial judge is most familiar with the facts and is best situated to determine whether someone is or is not a ‘leader’ of a conspiracy that the jury found existed.” United States v. Washington, 715 F.3d 975, 983 (6th Cir. 2013).

Section 3B1.1(a) provides for a four-level increase “[i]f the defendant was an organizer or leader of a criminal activity that involved five or more participants or was otherwise extensive[.]” To decide whether a defendant was an “organizer or leader,” the Guidelines direct courts to consider a number of factors, including

the exercise of decision making authority, the nature of participation in the commission of the offense, the recruitment of accomplices, the claimed right to a larger share of the fruits of the crime, the degree of participation in planning or organizing the offense, the nature and scope of the illegal activity, and the degree of control and authority exercised over others. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 20

§ 3B1.1 cmt. n.4. “The government bears the burden of proving that the enhancement applies by a preponderance of the evidence.” United States v. Vandeberg, 201 F.3d 805, 811 (6th Cir. 2000). “A district court need not find each factor in order to warrant an enhancement.” United States v. Castilla–Lugo, 699 F.3d 454, 460 (6th Cir. 2012).

Nicolescu. At the sentencing hearing, the district court explained that “[w]itnesses testified that [Nicolescu] was the mastermind behind the entire operation” which “includes the money laundering scheme.” R. 230, PID. 3275–76. The district court noted that Nicolescu was “a constant member of the scheme,” and found that he was a leader in the conspiracy because he “controlled the money mule network in the United States which was necessary to the success of the money laundering scheme” and “provided directives to other members in the conspiracy.” Id.

Ample evidence supported a finding that Nicolescu was the primary leader of the Bayrob group and the orchestrator of its various schemes, including the money-laundering conspiracy. Over the course of the two-and-a-half-week trial, the court heard how Nicolescu created the computer virus, recruited the money mules, instructed the mules to divide the wire transfers into increments below $3,000 to avoid detection, and kept 25% of the profits—the highest percentage (along with two other members) in the Bayrob group. The district court did not err in applying a four-level enhancement to Nicolescu’s Guidelines calculation under § 3B1.1(a).

Miclaus. The government argued that a four-level enhancement was warranted for Miclaus because he was one of only two Bayrob members who had been with the group since its inception, was responsible for hundreds of fraudulent auction postings on eBay, and was the Bayrob member in charge of collecting money from Antonovici and the European money mules. The district court summarily agreed, noting that “there can be more than one leader or organizer of a criminal conspiracy[,]” and after recounting the § 3B1.1(a) factors, stating, “I do, in fact, agree that Mr. Miclaus was, in fact, a leader or organizer, not the sole, but a leader or organizer.” R. 230, PID. 3296.

Miclaus did not write code or set up physical or cyber infrastructure for the group, and he received only 10% of the group’s profits—the smallest share of any of the Bayrob members. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 21

While these factors would seem to cut against a finding that Miclaus was a leader of the Bayrob group, the § 3B1.1(a) enhancement was for the money-laundering conspiracy specifically, and Miclaus had an outsized role in the group’s money-laundering activities: he was the group’s most prolific poster on eBay—more than 947 fraudulent auctions—which generated the money that was the raison d’etre of the money-laundering conspiracy, he recruited Antonovici to return to the conspiracy after a multi-year absence, and he exercised control over Antonovici and the other European money mules in his role as the Bayrob member responsible for collecting the profits from the cryptomining scheme and the eBay fraud as they came in from the United States. Miclaus and Nicolescu were also the only two constant members of the conspiracy, as other members came and went over the years Bayrob operated. We must review the district court’s decision to apply a leadership-role enhancement under § 3B1.1 deferentially, Sexton, 894 F.3d at 794, and on this record, we cannot conclude that the district court committed reversible error in applying a four-level leadership-role enhancement to Miclaus’s Guidelines calculation.

D.

The district court imposed a two-level enhancement under U.S.S.G. § 2B1.1(b)(11)(B)(i), which applies “[i]f the offense involved . . . the production or trafficking of any . . . unauthorized access device.” Here, the district court concluded that Bayrob’s sale of stolen credit-card numbers constituted trafficking in unauthorized access devices. See U.S.S.G § 2B1.1 cmt. n.10 (defining “unauthorized access device” as “any card . . . that can be used . . . to obtain money, goods, services, or any other thing of value” that has been “stolen . . . with intent to defraud”). Nicolescu and Miclaus don’t dispute that point. Instead, they say that Application Note 2 to U.S.S.G. § 2B1.6 precludes the trafficking enhancement. That provision relates to their aggravated identity theft convictions under 18 U.S.C. § 1028A.

The aggravated-identity-theft statute mandates a two-year sentence if, during the commission of certain enumerated felonies, the defendant “knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person[.]” 18 U.S.C. § 1028A(a)(1). A sentence under § 1028A must be served consecutively to any other sentence imposed (except for another § 1028A sentence imposed at the same time). Id. § 1028A(b)(2), (b)(4). For that reason, Application Note 2 to U.S.S.G. § 2B1.6 provides: Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 22

If a sentence [for aggravated identity theft] is imposed in conjunction with a sentence for an underlying offense, do not apply any specific offense characteristic for the transfer, possession, or use of a means of identification when determining the sentence for the underlying offense. A sentence [for aggravated identity theft] accounts for this factor for the underlying offense of conviction, including any such enhancement that would apply based on conduct for which the defendant is accountable under § 1B1.3 (Relevant Conduct).

U.S.S.G. § 2B1.6 cmt. n.2 (emphasis added). Because the mandatory two-year § 1028A sentence already accounts for “the transfer, possession, or use of a means of identification” during the commission of the predicate offense, Application Note 2 was added “to prevent a defendant from being doubly penalized for the same conduct.” See United States v. Taylor, 818 F.3d 671, 675 (11th Cir. 2016). Nicolescu and Miclaus read Application Note 2 to say that the mandatory § 1028A sentence already accounts for unauthorized-access-device trafficking. Accordingly, they argue, the district court wrongly enhanced their total sentences twice for the same conduct.

The district court reasoned that, despite the mandatory two-year sentence under § 1028A, it could apply a two-level enhancement under § 2B1.1(b)(11)(B)(i) because “trafficking” includes additional conduct not captured in “transfer, possession, or use.” R. 230, PID. 3268. We have not yet opined on whether “transfer[ring] . . . a means of identification” as contemplated in § 1028A and Application Note 2 to § 2B1.6 is synonymous with “trafficking [an] unauthorized access device” as used in § 2B1.1(b)(11)(B)(i). If “transferring” and “trafficking” are indeed synonymous, then an enhancement under § 2B1.1(b)(11)(B)(i) would not be appropriate.5 But if the culpable conduct involved in “trafficking” is “different than or in addition to” the “transfer, possession, or use,” then the enhancement can apply. See Taylor, 818 F.3d at 675. For example, in United States v. Lyles, we rejected a defendant’s argument that Application Note 2 prevented a loss-based enhancement under U.S.S.G. § 2B1.1(b)(1). 506 F. App’x 440, 446–47 (6th Cir. 2012). We explained that the loss-based enhancement “punishe[d]

5The phrase “means of identification” includes “unauthorized access devices.” See 18 U.S.C. §§ 1028(d)(7)(D), 1029(e)(3); U.S.S.G §§ 2B1.1 cmt. n.10(A), 2B1.6 cmt. n.2. Therefore, these terms do not create a meaningful distinction between the conduct covered in § 2B1.1(b)(11)(B)(i) and that covered in Application Note 2 to § 2B1.6. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 23

the defendant for inflicting a particular monetary harm rather than for transferring, possessing, or using a means of identification.” Id. at 447.

Neither § 2B1.1(b)(11), § 2B1.6, nor the relevant commentary defines “traffic” or “transfer.”6 When the Guidelines “do[] not define a term, we generally give the term its ordinary meaning.” Riccardi, 989 F.3d at 486 (citation omitted). The ordinary meaning of “traffic” carries a commercial aspect, which the word “transfer” does not. Compare “Traffic,” Oxford English Dictionary, oed.com (“To engage in trade or commerce, esp[ecially] between one country, region, or community and another; to buy and sell, or barter, goods or commodities; to trade.”), and “Traffic,” Am. Heritage Coll. Dict. (3d ed. 1993) (“The commercial exchange of goods; trade.”), with “Transfer,” Oxford English Dictionary, oed.com (“To convey or take from one place, person, etc. to another; to transmit, transport; to give or hand over from one to another.”), and “Transfer,” Am. Heritage Coll. Dict. (3d ed. 1993) (“To convey or cause to pass from one place, person, or thing to another.”). As Nicolescu’s counsel conceded at oral argument, trafficking is transfer plus something else, such as marketing or sale. So, although all “trafficking” involves “transfer,” the converse is not true. Here, in addition to “transferring” stolen credit-card numbers to others on the internet, Bayrob also marketed them on AlphaBay and accepted payment in return for their sale. The commercial aspect of “trafficking” is not captured by the § 1028A conviction, and the best reading of the Guidelines suggests that “trafficking” unauthorized access devices should bear additional consequences that mere transfer does not.

By contrast, a Guideline provision adjacent to § 2B1.1(b)(11)(B) illustrates the type of enhancement that § 2B1.6 does prevent. That provision is § 2B1.1(b)(11)(C). It imposes a two- level enhancement for “(i) the unauthorized transfer or use of any means of identification

6Our dissenting colleague points out that one statute defines “traffic” to mean “transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of.” 18 U.S.C. § 1029(e)(5) (emphasis added). But another nearby statute defines “traffic” to include a commercial component: “[T]he term ‘traffic’ means . . . (A) to transport, transfer, or otherwise dispose of, to another, as consideration for anything of value; or (B) to make or obtain control of with intent to so transport, transfer, or otherwise dispose of.” Id. § 1028(d)(12) (emphasis added). In any event, the relevant Guidelines and Application Notes define many other terms using definitions contained in 18 U.S.C. §§ 1028 and 1029. But the Sentencing Commission has not chosen to do so with respect to the word “traffic.” Therefore, these statutes are not binding, and we instead look to the ordinary meaning of the disputed terms. See Riccardi, 989 F.3d at 486. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 24

unlawfully to produce or obtain any other means of identification, or (ii) the possession of 5 or more means of identification that unlawfully were produced from, or obtained by the use of, another means of identification.” U.S.S.G. § 2B1.1(b)(11)(C) (emphasis added). Both § 2B1.1(b)(11)(C) and § 2B1.6 use the terms “transfer,” “possession,” and “use.” Section 2B1.1(b)(11)(B) does not; it uses “trafficking.” Courts “usually ‘presume differences in language like this convey differences in meaning.’” Wis. Central Ltd. v. United States, 138 S. Ct. 2067, 2071 (2019) (quoting Henson v. Santander Consumer USA Inc., 137 S. Ct. 1178, 1723 (2017)); see DePierre v. United States, 564 U.S. 70, 83 (2011) (“[T]he usual rule [is] that ‘when the legislature uses certain language in one part of the statute and different language in another, the court assumes different meanings were intended.’” (quoting Sosa v. Alvarez-Machain, 542 U.S. 692, 711 n.9 (2004))); cf. United States v. Howse, 478 F.3d 729, 733 (6th Cir. 2007) (finding that identical language in two Guidelines provisions carried the same meaning in each). Because nothing in the Guidelines or commentary suggests that this presumption should not hold, Application Note 2 bars enhancements under § 2B1.1(b)(11)(C) but not “trafficking” enhancements under § 2B1.1(b)(11)(B).

Additionally, treating “trafficking” and “transferring” as equivalent in this context, might render superfluous parts of a related statute, 18 U.S.C. § 1028. “A statute should be construed so that effect is given to all its provisions, so that no part will be inoperative or superfluous, void or insignificant.” Hibbs v. Winn, 542 U.S. 88, 101 (2004) (citation omitted). Section 1028 makes it a crime to “knowingly traffic[] in . . . authentication features for use in false identification documents, document-making implements, or means of identification.” 18 U.S.C. § 1028(a)(8). But it also, separately, makes it a crime to “knowingly . . . transfer[] . . . a document-making implement or authentication feature . . . [to create] a false identification document.” Id. § 1028(a)(5). If “transferring” and “trafficking” are the same, these provisions would be redundant.

We acknowledge that our holding charts a new course among our sister circuits, which have held that the trafficking enhancement cannot apply to a defendant convicted of aggravated identity theft. The First Circuit offered the earliest decision on point, reasoning that because the “trafficking of a means of identification involve[s] a transfer,” it would violate Application Note Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 25

2 of § 2B1.6 to impose a trafficking enhancement in these circumstances. United States v. Jones, 551 F.3d 19, 25 (1st Cir. 2008) (emphasis added). Other circuits have followed the First Circuit’s reasoning. See United States v. Charles, 757 F.3d 1222, 1226 (11th Cir. 2014); United States v. Doss, 741 F.3d 763, 768 (7th Cir. 2013); United States v. Lyons, 556 F.3d 703, 708 (8th Cir. 2009) (“Given that the plain meaning of trafficking involves a transfer, the enhancement in § 2B1.1(b)(10)(B)(i) for trafficking of an unauthorized access device is one such specific offense characteristic that cannot be applied.” (emphasis added)).

But these circuits apply a different rule entirely to another component of the disputed Guideline. In addition to covering the “trafficking” of an unauthorized access device, § 2B1.1(b)(11)(B) also applies to the “production” of such a device. “Production” would seem to “involve” the “possession” (and potentially also the “use” or “transfer”) of an unauthorized access device. Yet, no circuit has held that § 2B1.6 or Application Note 2 can prevent a “production” enhancement. See Taylor, 818 F.3d at 676 (upholding an enhancement under § 2B1.1(b)(11)(B)(i) for “production of an unauthorized access device/means of identification [because ‘production’] is separate and distinguishable from the mere transfer, possession, or use of such device”); United States v. Jones, 792 F.3d 831, 835 (7th Cir. 2015) (same); United States v. Jenkins-Watts, 574 F.3d 950, 962 (8th Cir. 2009) (same). And, in an unpublished opinion, so have we. United States v. Wiley, 407 F. App’x 938, 942–43 (6th Cir. 2011).

Examining these “production” cases, the proper rule becomes clear: “[I]f the defendant’s underlying conduct is limited to transfer, possession, or use of a means of identification of another, then the enhancement cannot apply; if the conduct is different than or in addition to such transfer, possession, or use, then the enhancement can apply.”7 Taylor, 818 F.3d at 675. As discussed above, the ordinary meaning of “trafficking” is not “limited to transfer, possession, or

7Our dissenting colleague counters that the “production” cases are different because to “produce” is defined in 18 U.S.C. § 1029(e)(4) as to “design, alter, authenticate, duplicate, or assemble.” We again question the reliance of a definition outside of § 1028a, see supra note 7; but we acknowledge that the Application Notes to § 2B1.1 define “production” similarly, to “include[] manufacture, design, alteration, authentication, duplication, or assembly,” § 2B1.1 cmt. n.10. Under this definition, a person engaged in “production” will in most instances also possess or use an unauthorized access device. But that just confirms the point we make here—that the enhancement under § 2B1.1(b)(11)(B) applies when a person does something different than, or in addition to, the transfer, possession, or use of an unauthorized access device. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 26

use.” It involves marketing or sales activity beyond mere “transfer”—it is transfer plus something more.

Bayrob’s marketing and sales of stolen credit cards constituted trafficking in unauthorized access devices. Accordingly, the district court did not err in adding a two-level enhancement under § 2B1.1(b)(11)(B)(i).

E.

The district court applied a four-level enhancement under U.S.S.G. § 2B1.1(b)(19)(A)(ii), which applies when a defendant is convicted of an offense under § 1030(a)(5)(A). Miclaus and Nicolescu were convicted on Count 14, which alleged a § 1030(a)(5)(A) violation as one of the objects of a conspiracy under 18 U.S.C. § 371, but they were convicted of the § 371 conspiracy—not a substantive offense under § 1030(a)(5)(A). The government concedes error, and we agree.8 The district court erred in applying a four-level enhancement under § 2B1.1(b)(19)(A)(ii) because Nicolescu and Miclaus were not convicted of an offense under § 1030(a)(5)(A).

IV.

The district court determined that after all the sentencing enhancements were applied, Nicolescu and Miclaus had an adjusted offense level of forty-three. The parties then agreed to subtract an additional five levels, down to an offense level of thirty-eight, which yielded a Guidelines range of 235 to 293 months’ imprisonment.

The district court’s errors in imposing a two-level enhancement under § 2B1.1(b)(4) for receiving and selling stolen property, and a four-level enhancement under § 2B1.1(b)(19)(A)(ii) for being convicted of an offense under § 1030(a)(5)(A) resulted in six levels being erroneously added to Nicolescu’s and Miclaus’s offense level. At thirty-seven, the correct level, their category I criminal history yields a Guidelines range of 210 to 262 months’ imprisonment. Though the district court sentenced Nicolescu and Miclaus below the incorrectly calculated

8Only Miclaus objected to this enhancement, but the government agreed to forego an abandonment argument with respect to Nicolescu. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 27

range on Counts 1 through 13 and 21, and their sentences for those counts fall within (Nicolescu) and below (Miclaus) the correctly calculated range, we cannot conclude that the errors were harmless.9 “[B]ecause the Guidelines range is the starting point for the district court’s analysis[,]” and absent some indication that the district court would have imposed the same sentence regardless of the error, it is for the district court to “decide whether, starting from the correct Guidelines range, a downward variance remains appropriate.” United States v. Montgomery, 998 F.3d 693, 700 (6th Cir. 2021). Accordingly, we remand so that Nicolescu and Miclaus can be resentenced under a correctly calculated Guidelines range.

V.

For the reasons set forth above, we AFFIRM Nicolescu’s and Miclaus’s convictions, VACATE their sentences, and REMAND for resentencing.

9Miclaus failed to object to the § 2B1.1(b)(4) enhancement below, so our review with respect to Miclaus is for plain error. But even under plain-error review, Miclaus is entitled to resentencing under a correctly calculated Guidelines range because the error was clear, it affected his substantial rights, and it affected the fairness of the proceedings below. See Rosales-Mireles v. United States, 138 S. Ct. 1897, 1907–08, 1911 (2018); Molina-Martinez v. United States, 136 S. Ct. 1338, 1343 (2016). Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 28

DISSENT _________________

HELENE N. WHITE, Circuit Judge, concurring in part and dissenting in part.

I would not affirm the imposition of the two-level enhancement under U.S.S.G. § 2B1.1(b)(11)(B)(i) for “trafficking” in unauthorized access devices.

The district court applied the two-level enhancement to the grouping that included the wire-fraud convictions because the relevant conduct included Bayrob’s sale of stolen credit-card information on AlphaBay, and the district court found that this conduct constituted “trafficking” in unauthorized access devices for purposes of § 2B1.1(b)(11)(B)(i). I do not quarrel with that aspect of the analysis. The problem with applying an enhancement under § 2B1.1(b)(11)(B)(i) for “trafficking” in this case is that Defendants were also convicted of § 1028A aggravated identity theft, and another provision of the Guidelines, Application Note 2 to U.S.S.G. § 2B1.6, precludes any enhancement to the underlying offense (here, wire fraud) “for the transfer, possession, or use” of a means of identification (the stolen credit-card information) when a defendant is already subject to a mandatory two-year consecutive sentence under § 1028A for the “transfer, possession, or use” of a means of identification. The application note recognizes that allowing both would impermissibly punish the defendant twice for the same conduct. United States v. Taylor, 818 F.3d 671, 675 (11th Cir. 2016).

“Trafficking” a stolen credit-card number necessarily involves transferring it. Neither § 2B1.1(b)(11)(B)(i) nor § 2B1.6 define “trafficking.” But 18 U.S.C. § 1029 (the very next provision of the United States Code after § 1028A) which prohibits “traffic[king] in . . . unauthorized access devices,” defines “traffic” to mean “transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of[.]” § 1029(e)(5) (emphasis added). Thus, in enhancing Defendants’ sentences for “trafficking” stolen credit-card numbers, the district court also impermissibly punished them a second time for the inextricable element of “transferring” them, which is expressly prohibited by Application Note 2 of § 2B1.6. Nos. 19-4247/4273 United States v. Nicolescu, et al. Page 29

That is why every court of appeals to consider the issue has held that the § 2B1.1(b)(11)(B)(i) “trafficking” enhancement cannot be imposed in these circumstances. See United States v. Lyons, 556 F.3d 703, 708 (8th Cir. 2009) (“Given that the plain meaning of trafficking involves a transfer, the enhancement in § 2B1.1(b)([11])(B)(i) for trafficking of an unauthorized access device is one such specific offense characteristic that cannot be applied” because of Application Note 2 to § 2B1.6); United States v. Jones, 551 F.3d 19, 25 (1st Cir. 2008) (holding that § 2B1.1(b)(11)(B)(i) enhancement was precluded by Application Note 2 to § 2B1.6 because under “the plain meaning of the words, [the defendant’s] trafficking of a means of identification involved a transfer (though the reverse is not necessarily true)”); United States v. Charles, 757 F.3d 1222, 1226–27 (11th Cir. 2014) (same); United States v. Doss, 741 F.3d 763, 766–68 (7th Cir. 2013) (same).

Lastly, the majority’s invocation of cases permitting an enhancement under the “production” prong of § 2B1.1(b)(11)(B) is unavailing. The majority reasons that “‘[p]roduction’ would seem to ‘involve’ the ‘possession’ (and potentially also the ‘use’ or ‘transfer’) of an unauthorized access device,” and so if we recognize production as a distinct action supporting the enhancement, we should likewise permit an enhancement for trafficking when “the [punished] conduct is different than or in addition to such transfer, possession, or use.” Maj. Op. at 31. However, unlike trafficking, production is statutorily defined as different in kind from “transfer, possession, or use.” While 18 U.S.C. § 1029’s definition of “traffic” includes the word “transfer,” its definition of “produce” does not similarly include any aspect of the § 1028A “transfer, possession, or use” language, defining it instead to include “design, alter, authenticate, duplicate, or assemble.” § 1029(e)(4)-(5).

Accordingly, I dissent from the affirmance of the application of the § 2B1.1(b)(11)(B)(i) enhancement.