Opinion
3:22-cr-00168-WHO-1
03-16-2023
UNITED STATES OF AMERICA, Plaintiff, v. MIKLOS DANIEL BRODY, Defendant.
PRETRIAL ORDER ON MOTIONS IN LIMINE AND OBJECTIONS TO EXHIBITS RE: DKT. NOS. 148, 149
William H. Orrick United States District Judge
This case arises out of an alleged intrusion into and subsequent damage of secure computer servers and systems at First Republic Bank (“FRB”). Defendant Miklos Brody is charged with (1) obtaining information for a protected computer, in violation of 18 U.S.C. §§ 1030(a)(2)(C), (c)(2)(B); (2) intentional transmission of a program, information, code, or command to cause damage to a protected computer, in violation of 18 U.S.C. §§ 1030(a)(5)(A), (c)(4)(B)(i); and (3) making a false statement to a government agency, in violation of 18 U.S.C. § 1001(a)(2). Superseding Indictment (“SI”) [Dkt. No. 101].
Before me are motions in limine filed by Brody and the government, along with their objections to the motions. My decisions are subject to change depending on the presentations at trial, including whether the parties open the door to particular evidence. Before either party acts contrary to these rulings, they are ORDERED to raise the issue to me outside the presence of the jury, during one of the daily pretrial conferences at 8:00 a.m.
BACKGROUND
The alleged intrusion into FRB's computer systems began on the evening of March 11, 2020, and lasted until the morning of March 12, 2020. See SI. The background facts are outlined in my previous Order at Dkt. No. 143, and this order assumes familiarity with those facts. At issue here are thirteen motions in limine, five filed by Brody (“Def. Mot.”), Dkt. No. 149, and eight filed by the government (“Gov. Mot.”), Dkt. No. 148. Each party filed an opposition. (“Def. Oppo.”) [Dkt. No. 159]; (“Gov. Oppo.”) [Dkt. No. 154]. I held a pretrial conference on March 13, 2023, which included a hearing on these motions, and Brody as well as counsel for both parties appeared.
DISCUSSION
I. BRODY'S MOTIONS IN LIMINE
A. No. 1: Exclude Evidence Concerning the Circumstances of the Termination including Any Evidence Referring to Pornography No. 2: Exclude Evidence of Skiing
Brody seeks to exclude any evidence related to his termination-except for the fact that he was terminated-and specifically moves to exclude evidence that refers to pornography or that shows he was skiing on March 2, 2020, rather than home sick as he told his employer. Def. Mot. 1:18-2:11; 4:10-5:3. Brody argues that the pornography-related evidence is inflammatory, highly prejudicial, and irrelevant, and the introduction of it risks the jury improperly convicting him for violating FRB's internal policy rather than the charged statutes. Id. 2:12-3:28. He also asserts skiing-related evidence is propensity evidence with no probative value and that the seizure of such evidence violated his Fourth Amendment rights. See id. 5 n.1. In turn, the government argues that to present a coherent and comprehensible story, including to establish Brody's motive and intent, it must be permitted to present evidence that Brody plugged into his work computer a USB drive with pornography, and that he did so while he was skiing in Tahoe rather than home sick, as he had told FRB. Gov. Mot. 18:20-22:17.
In its motion, the government seeks to admit all “contextual, inextricably intertwined evidence of the reasons for Brody's firing” including the specific violation of allegedly plugging into his work computer a USB drive with pornography. Gov. Mot. 18:20-21:17. I address these motions together.
I addressed and rejected Brody's argument concerning Fourth Amendment violations in my prior Order. [Dkt. No. 143].
Brody's motions are DENIED. Evidence of Brody's actions between March 2 and March 20 is admissible; the evidence related to pornography and skiing are “inextricably intertwined” with the government's theory of the case because they are probative of motive and intent. See United States v. Vizcarra-Martinez, 66 F.3d 1006, 1012 (9th Cir. 1995). Several exhibits show that Brody contemporaneously told coworkers, family members, and other individuals that he was unfairly fired for plugging in a USB drive to watch a movie while he was sick. Allowing Brody to assert this version of the facts without permitting the government to provide context to support its version of the facts prejudices the government by precluding it from effectively explaining its theory of motive and intent. Indeed in Vizcarra-Martinez, 66 F.3d at 1013, the Ninth Circuit explained that “other act” evidence may be admitted without running afoul of FRE 404 “to explain either the circumstances under which particular evidence was obtained or the events surrounding the commission of the crime,” specifically noting that the prosecution may present prejudicial evidence to contextualize a defendant's allegedly illegal conduct and rebut defenses. Here, the government seeks to use this evidence to contextualize its allegations that Brody was motivated to commit the intrusion and to rebut Brody's defenses that someone else committed the alleged acts. See also id. (explaining that “the prosecution is not restricted to proving in a vacuum the offense” and that the jury “cannot be expected to make its decision in a void” (quoting United States v. Daly, 974 F.2d 1215, 1216 (9th Cir. 1992))). Accordingly, using this evidence to show motive and intent is permissible.
The government seeks to introduce this evidence for other contextual reasons, as well, including to support its theory for why Brody did not bring his company-issued MacBook to his termination meeting.
To the extent that Brody asserts he would be prejudiced by either category of evidence, any speculative prejudice is outweighed by the highly probative nature of the evidence-particularly because it is not clear that there is other evidence of motive or intent. And neither viewing pornography nor “taking a mental health day,” Def. Mot. 4:18, 4:25-26, is unlawful, so there is no risk that the jury would conflate those actions with the alleged federal law violations here. Additionally, I am not persuaded by Brody's argument that introducing evidence of pornography or skiing will cause the jury to improperly convict him of the charged crimes based solely on the evidence that he violated FRB's internal policies. See Def. Mot. 2:12-3:9. The jury will receive substantial evidence of the alleged intrusion, including the dates that it occurred, and will receive proper instructions as to the elements of the crime; there is no risk that the jury will base its ultimate decision on separate actions that occurred weeks before the alleged crime. I am similarly unpersuaded by Brody's assertion that evidence of the violation of company policy is “propensity” evidence that the government wants to use to show Brody committed a federal crime; not only does that stretch logic, but also the government has repeatedly explained that it seeks to use the evidence only to establish motive and intent.
Indeed, Brody's citation regarding this point, to United States v. Wolf, 820 F.3d 1499, 1504-05 (9th Cir. 1987), supports the government's position. There, the Ninth Circuit held that evidence of civil violations could be presented to the jury in criminal cases where the civil violation “was not directly or indirectly an element of any of the charges” but rather “provided background information bearing on motive and intent.” Id. Though violating a private employer's internal policy likely does not constitute a “civil violation,” I agree that given the reasoning in Wolf, it can be used to establish background information on motive and intent.
Accordingly, the government may admit such evidence. To the extent that Brody would like to request a limiting instruction on either category of evidence, he is free to suggest one.
B. No. 3: Exclude Undisclosed Expert Testimony
Brody seeks to ensure that the government will not introduce previously undisclosed experts at trial. Def. Mot. 5:4-6:18. He does not say whether the government has implied it will do so, but it seems his concern is that the government's three disclosed witnesses do not have expertise in Terraform technology and so should not be allowed to testify about the Terraform-related allegations. Id. With respect to evidence about Terraform, the government says this it plans to introduce only fact testimony, not opinion testimony that would call for an expert, and that it will have testify “percipient fact witnesses at First Republic Bank with personal knowledge of that fact.” Gov. Oppo. 4:9-22.
Federal Rule of Criminal Procedure 16(a)(1)(G) provides that, if the defendant so requests, the government must disclose information about each expert witness it intends to use or call at trial. Under Rule 16(d)(2), if the government fails to comply with these disclosure requirements, the court may (A) “order that party to permit the discovery or inspection; specify its time, place, and manner; and prescribe other just terms and conditions”; (B) “grant a continuance”; (C) “prohibit that party from introducing the undisclosed evidence”; or (D) “enter any other order that is just under the circumstances.” Fed. R. Crim. Proc. 16(d)(2)(A)-(D).
Given the lack of any indication that the government intends to introduce any previously undisclosed expert testimony, this motion is DENIED. Should the issue become relevant at trial, Brody may raise it again then.
C. No. 4: Excluding Lay Testimony Offered as Expert Testimony
Brody moves to exclude any lay testimony offered as expert witness testimony. Def. Mot. 7:1-8:5. Again he points to no specific testimony or witness and provides no indication that the government plans on introducing such testimony, but it seems his concern is that the government will use lay witnesses to explain complex or technical evidence that requires expert testimony to parse. See id.
To the extent that this motion is directed at FRB employees who will testify about technical topics within their personal knowledge and experience, particularly pertaining to discovering, investigating, assessing, and repairing damage from the intrusion, see Gov. Oppo. 5:1-7:11, Brody's motion is DENIED. Witnesses may testify to matters for which they have personal knowledge. Fed.R.Evid. 602. And lay witnesses may testify to their opinions under FRE 701, outside of the scope of expert testimony permitted by FRE 702.
On this point, I agree with the reasoning in USA v. Chen, where the Hon. Beth Labson Freeman permitted lay witnesses to testify as to “their personal knowledge and positions in the day-to-day affairs of a business without being qualified as an expert and running afoul of Rule 701's bar of lay testimony ‘based on scientific, technical or other specialized knowledge'” even where the testimony concerned trade secrets, computer forensics, and other technical information. No. 17-CR-00603-BLF-1, 2021 WL 2662116, at *9 (N.D. Cal. June 29, 2021). Judge Freeman held that the witnesses' “opinion testimony” would be admitted “not because of experience, training or specialized knowledge within the realm of an expert, but because of the particularized knowledge that the witness has by virtue of his or her position in the business.” Id. (quoting Fed.R.Evid. 701 Advisory Committee Note to 2000 Amendment). The same is true here: FRB employees that participated in the discovery, investigation, assessment, or repair processes related to the intrusion may testify as to their personal knowledge and experience without being qualified as experts. See id. (outlining witnesses' experience and citing GSI Tech., Inc. v. United Memories, Inc., No. 5:13-cv-01081-PSG, 2015 WL 12942201, at *2 (N.D. Cal. Oct. 14, 2015) (“Thus, a lay witness with personal experience of the treatment of certain information may testify as to whether that information was considered or treated as confidential.”)).
The point is echoed by the Hon. Edward J. Davila's unpublished order in In re Google AdWords Litigation:
[J]ust because the underlying facts and data are technical in nature does not transform the information into “expert testimony” when those facts are within the personal knowledge and experience of the company's employee. [The lay witness] may offer lay witness opinions regarding [the defendant's] business, so long as those opinions are based on his own personal, particularized knowledge and experience relating to his employment at [the defendant].No. 5:08-CV-3369 EJD, 2012 WL 28068, at *5 (N.D. Cal. Jan. 5, 2012), reversed on other grounds sub nom. Pulaski & Middleman, LLC v. Google, Inc., 802 F.3d 979 (9th Cir. 2015) (collecting cases).
Accordingly, this motion is DENIED. If the issue comes up in a more specific context at trial, or if FRB employees testify beyond the scope of what is permitted by this Order, Brody may raise an appropriate objection at that time.
D. No. 5: Implement Fed. R. Crim. P. 16 by Excluding Any Statement of Defendant Not Previously Produced.
Brody moves to exclude any of his statements that were not previously produced by the government. Def. Mot. 8:6-28. The government says that the motion should be denied as moot because it produced all statements in its possession, custody, or control. Gov. Oppo. 7:17-21.
FRCP 16(a)(1)(A) provides that upon the defendant's request, the government must disclose “the substance of any relevant oral statement made by the defendant, before or after arrest, in response to interrogation by a person the defendant knew was a government agent if the government intends to use the statement at trial.” FRCP 16(a)(1)(B) provides that upon the defendant's request, the government must disclose all written or recorded statements made by the defendant if the statement is in the government's possession, custody, or control and knows or should know it exists.
Brody again fails to provide any context for his motion or any indication that this could be an issue at trial, and the government asserts that it has complied with its duties. Accordingly, this motion is DENIED. Should the issue arise in context at trial, Brody may raise it again then.
II. THE GOVERNMENT'S MOTIONS IN LIMINE
A. No. 1: Exclude the Testimony of Defense Expert John Cauthen Under Rules 104, 401, 702, and 403
The government moves to exclude the testimony and report of Brody's witness, John Cauthen, under Daubert and FRE 104, 401, 702, and 403, or in the alternative requests a Daubert hearing to test the reliability of the testimony and/or limit the testimony to particular conclusions. Gov. Mot. 1:1-12:2; see also id. Ex. A, Defense Expert John Cauthen's Report and Appendices (“Cauthen Rep.”). The government attacks Cauthen's credentials as related to this report and also challenges his methodology as well as specific conclusions for lack of evidentiary support. Brody contends that this is a “classic battle of the experts” and that if Cauthen is excluded, so too should the government's expert, though Brody does not actually move to exclude that expert. Def. Oppo. 1:2-10:16.
Brody agrees to not introduce “evidence about intrusions at other banks or the assets of [FRB] unless the Government opens the door.” Def. Oppo. 7:7-7. I will hold him to this concession; the government may object to introduction of such testimony at trial.
Pursuant to FRE 104(a), I must “determine at the outset” whether Cauthen is qualified, and then I must determine whether his report and proposed testimony meet the standards of FRE 702.Expert testimony is admissible under Rule 702 if it is both relevant and reliable, as shown by the proponent by a preponderance of the evidence. See Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579, 589 (1993); Zeiger v. WellPet LLC, 526 F.Supp.3d 652, 667 (N.D. Cal. 2021). Evidence is relevant if it assists the trier of fact in understanding or determining a fact in issue. Cooper v. Brown, 510 F.3d 870, 942 (9th Cir. 2007).
FRE 702 provides:
A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if:
(a) the expert's scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue;
(b) the testimony is based on sufficient facts or data;
(c) the testimony is the product of reliable principles and methods; and
(d) the expert has reliably applied the principles and methods to the facts of the case.Fed. R. Evid. 702.
For evidence to be reliable, the expert testimony must have “a reliable basis in the knowledge and experience of the relevant discipline.” Primiano v. Cook, 598 F.3d 558, 565 (9th Cir. 2010). “The focus of the reliability inquiry is on the principles and methodology an expert uses in forming the opinions rather than the expert's conclusions.” In re Viagra (Sildenafil Citrate) & Cialis (Tadalafil) Prod. Liab. Litig., 424 F.Supp.3d 781, 790 (N.D. Cal. Jan. 13, 2020). The ultimate question is whether the proponent can “establish the reliability of the principles and methods employed to draw a conclusion regarding the particular matter to which the expert testimony was directly relevant.” United States v. Hermanek, 289 F.3d 1076, 1094 (9th Cir. 2002) (citation and quotation marks omitted). Although Daubert proffers “several reliability factors,” the reliability inquiry is flexible, giving the district court broad latitude to determine the appropriate form of inquiry. United States v. Valencia-Lopez, 971 F.3d 891, 898 (9th Cir. 2020) (citations omitted). The Ninth Circuit has acknowledged that Daubert “may be harder to apply when the expert testimony is ‘experience-based' rather than ‘science-based.'” Id. “But any such difficulty cannot simply lead to a ‘that goes to weight, not admissibility' default.” Id. A note to Rule 702 offers additional guidance: “If the witness is relying solely or primarily on experience, then the witness must explain how that experience leads to the conclusion reached, why that experience is a sufficient basis for the opinion, and how that experience is reliably applied to the facts.” Fed.R.Evid. 702 Advisory Committee Note (2000).
The Ninth Circuit has emphasized Daubert's guidance that Rule 702 “should be applied with a ‘liberal thrust' favoring admission.” Messick v. Novartis Pharm. Corp., 747 F.3d 1193, 1196 (9th Cir. 2014) (citing Daubert, 509 U.S. at 588). “Shaky but admissible evidence is to be attacked by cross examination, contrary evidence, and attention to the burden of proof, not exclusion.” Primiano, 598 F.3d at 564. The district court “is supposed to screen the jury from unreliable nonsense opinions, but not exclude opinions merely because they are impeachable.” Alaska Rent-A-Car, Inc. v. Avis Budget Grp., Inc., 738 F.3d 960, 969 (9th Cir. 2013). “The district court is not tasked with deciding whether the expert is right or wrong, just whether his testimony has substance such that it would be helpful to a jury.” Id. at 969-70.
The government addresses Cauthen's conclusions in three groups and so I do the same.
1. Conclusions B, C, D, E, F, G, H, I, J, M: Concerning the Failure to Identify, Preserve, or Collect Certain Records of Other Users
These conclusions relate to the purported failure of the government and FRB investigators to collect or preserve all records of other users on the network at the time of the intrusion, and related alleged failure to obtain evidence that would exonerate Brody. This is a primary defense Brody plans to assert, and it would hobble his defense if he lacked an expert to expound on it.
I note that many of the conclusions are apparently identical. For example, Conclusion (g) reads:
Key records were not preserved, were selectively collected, missing or collected in a dubious manner. Government investigator failed to identify, preserve and collect network records of other users on the network during the intrusion which resulted in an incomplete, biased, and ultimately misleading investigation. These records are needed to trace and determine each alleged transmission[] of a “program, information, code, or command to the FRB computer system,” and could exonerate Mr. Brody of the charges and identify the Persons responsible for the alleged transmissions and damage during the intrusion.In turn, Conclusion (j) is nearly identical:
The failure of FRB to identify, preserve and collect network records of other users on the network during the intrusion which resulted in an incomplete, biased, and ultimately misleading internal investigation. These records are needed to trace and determine each alleged transmission[] of a “program, information, code, or command to the FRB computer system,” and could exonerate Mr. Brody of the charges and identify the Persons responsible for the alleged transmissions and damage during the intrusion.Conclusions (e) and (m) also appear to make identical findings.
The government does not dispute Cauthen's experience, which includes many years as a forensic examiner, time spent as an FBI agent investigating cybercrime, and numerous examples of providing expert depositions and reports as well as testifying in civil and criminal lawsuits, “including criminal computer intrusion cases in the Ninth Circuit involving terminated employees accused of attacking a former employer.” Def. Oppo. 2:23-26; see also Cauthen Rep. 4-6 (outlining training and experience). I also agree with Brody's assertion that “[t]he manner in which a network intrusion is investigated is beyond the common knowledge of average jurors.” Id. 4:13-14. Accordingly, with respect to issues relating to the scope and course of cybercrime investigations, the defense has shown that Cauthen's testimony is based on his “technical or other specialized knowledge,” Fed.R.Evid. 702(a), and that it has “a reliable basis in the knowledge and experience of the relevant discipline,” Primiano, 598 F.3d at 565. For that reason, I reject the government's assertions that testimony concerning the scope of the investigation will not assist the jury, see Gov. Mot. 4:3-10, that blaming FRB's security protocols and the government's investigation are outside the scope of Cauthen's expert experience, id. 5:12-6:2, and that how one person would have investigated the case has no bearing on the adequacy of this investigation, id. 6:3-11. The motion is DENIED as to these points.
As noted below, infra Part II.B, Brody is precluded from asserting as defenses in this case FRB's negligence in failing to implement stricter security or reckless disregard for its own policies regarding terminating former employees' login credentials.
With respect to the government's assertion that these conclusions rest on inaccurate and unreliable principles and disproven evidence, id. 4:11-5:11, its arguments are grounded in evidentiary issues that are properly subject to cross-examination, not to full exclusion from trial, see Alaska Rent-A-Car, 738 F.3d at 969-70 (explaining district courts may not exclude expert opinions “merely become there are impeachable”). For example, the government argues that Cauthen's focus on “missing” VPN logs and other records is “unsound” because the government's own expert points to available VPN logs and notes that Brody deleted other supposedly missing logs, but each of those is a question of fact that may be addressed through cross-examination. And I do not find Cauthen's methodology “unsound” on this point, because he opines that based on his “training and experience”-which he outlines in detail in the report-he finds it “highly unusual for a large organization such as FRB to not enable VPN logs or comparable records.” Cauthen Rep. at 12. He then explains what VPN records show and reasons that because the investigators did not collect all records, it is not possible to determine who took each alleged action. Id. This conclusion may certainly be impeachable, for all the reasons the government points out. But that does not mean it is “unreliable” or “nonsense” or otherwise unhelpful to the jury. See Alaska Rent-A-Car, 738 F.3d at 969-70.
Cauthen may also be impeached based on his statement in the report that Brody committing the intrusion “is just one explanation for what happened” based on the available evidence. Cauthen Rep. at 18 n.60.
However, I agree with the government that Cauthen's conclusions that the evidence was “tainted” are not based in evidence or experience and are unreliable. See Cauthen Rep. at 15, 44. Though Cauthen sufficiently explains his bases for concluding that it was unusual and unfair that records were not preserved or provided, he does not point to underlying evidence that anything was “tainted,” nor does he explain what he means by “tainted” or how that might affect the outcome of the investigation. See Valencia-Lopez, 971 F.3d at 900 (finding a particular expert conclusion should have been where the evidence did “not explain the methodology by which” the expert reached his conclusion because “his general testimony” about his experience was “too ‘vague and generalized' to establish any reliable principles or methods” (quoting Hermanek, 289 F.3d at 1094)). This term carries particularly prejudicial weight, especially where Cauthen uses it without further explanation or grounding. See also Fed.R.Evid. 702 Advisory Committee Note (2000) (“If the witness is relying solely or primarily on experience, then the witness must explain how that experience leads to the conclusion reached, why that experience is a sufficient basis for the opinion, and how that experience is reliably applied to the facts.”). And while Cauthen may testify as an expert, he may not testify about facts to which he lacks personal knowledge. See Fed.R.Evid. 703. Accordingly, the government's motion is GRANTED as to statements related to “tainted” evidence.
For the same reasons, Cauthen's statements concerning the “chain of custody” are excluded. He provides no context for these statements and does not explain them in a way that is helpful for the jury. Most importantly, he does not relate them to his specialized or technical experience. The government's motion is GRANTED as to these statements.
Finally, I echo the government's concern that this section of Cauthen's report will mislead the jury or confuse the issues, particularly given Cauthen's failure to explain most of the technical terms and concepts discussed throughout. See Fed.R.Evid. 403. I add that in addition to being confusing, much of the analysis and many of the conclusions in this section are needlessly cumulative. But I do not find either of those reasons sufficient to exclude these conclusions at this stage. If the defense presents Cauthen's testimony in a way that will confuse, mislead, or waste time, the government may so object at trial.
See, e.g., supra n.8.
The defense is again cautioned that trial is not the venue to relitigate discovery disputes, and it will be held to its concession in its papers and at the hearing that it does not intend to raise discovery disputes at trial. See Def. Oppo. 10:27-28. Specifically, Cauthen may testify about his conclusions concerning the investigation, but he may not do so in a way that presents to the jury already-settled discovery disputes. For example, while he is permitted to say that FRB does not maintain certain records, he is not permitted to argue that FRB had particular records but refused to turn them over if those records were addressed in my previous Orders.
2. Conclusion O: Concerning the Theft of the MacBook
Cauthen's Conclusion (o) finds that the available evidence concerning Brody's work MacBook is “consistent with having been stolen.” Cauthen Rep. at 2, 44. This section of the report lists crime statistics about San Francisco, cites news articles to explain how thieves detect laptops in vehicles before breaking in, and provides nine examples of police reports concerning vehicle break-ins in the area Brody reported his break-in during the months leading up to the report. Id. 45-46. Cauthen also points to one piece of evidence that he says shows “the MacBook was ultimately tied to an IP address in China.” Id. at 46. He then concludes that “the location may be targeted by thieves who seek to monetize their stolen property,” that the available evidence “is consistent with the MacBook . . . as having been stolen in a similar manner to other reported vehicle thefts,” and that government investigators failed to pursue “other common law enforcement leads” in attempting to track down the laptop. Id.
This testimony is relevant to Count 3 which charges Brody with making false statements to the government about the theft of his laptop. Accordingly, I reject the government's argument that these conclusions are irrelevant. See Got. Mot. 8:24.
Cauthen may testify that the particular location in San Francisco is subject to similar break ins and car thefts so long as he relates it to his “training and experience” and requires his “independent judgment” rather than acts as merely a “conduit or transmitter” for the hearsay in the news articles and police reports. United States v. Gomez, 725 F.3d 1121, 1129 (9th Cir. 2013) (citation omitted); see also Fed.R.Evid. 702(a) (providing an expert may only testify if their “scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence”). The articles and reports themselves may not be admitted.
Cauthen may also testify concerning the connection between Brody's MacBook and China because the report shows the conclusion drawn from that fact was based on Cauthen's “training and experience,” as was his opinion that it was unusual for the government investigators to not obtain law enforcement reports from the same area. Cauthen Rep. At 46.
The motion is DENIED, with boundaries to Cauthen's testimony noted above.
3. Conclusions K, L, and N and “Damages” Opinions: Concerning Whether Brody Used the “dbrody” Account
These conclusions show that Cauthen found insufficient evidence to show that Brody was responsible for the actions of the dbrody account during the intrusion and that, based on Cauthen's experience and knowledge, investigations into cybercrimes usually yield more complete records and findings. The government seeks to exclude these conclusions for failing to cite supporting evidence, ignoring certain evidence, and failing to explain other evidence. Gov. Mot. 9:11-11:17. In a footnote the government says, “The report is so replete with inaccuracies that the government has provided only a sampling in this omnibus motion ....If the Court orders a Daubert hearing, the government requests an additional opportunity to more fully brief the problems with the proposed testimony.” Id. at 9 n.6.
Most of the government's arguments parallel those made in II.A.1. Again, the government does not contest Cauthen's qualifications, and I find he is qualified to provide reliable testimony relating to these conclusions. The thrust of the government's argument is that Cauthen's methods were unreliable-but Cauthen repeatedly connects his findings and conclusions to his experience and knowledge from his years as a forensic analyst and law enforcement agent. See Primiano, 598 F.3d at 565 (holding reliability is based on “the knowledge and experience of the relevant discipline”). Even if that connection is somewhat tenuous, I find it sufficient in this case and for these conclusions.
And while the government presents some persuasive arguments-particularly that Cauthen ignored key evidence and seemed to misconstrue other evidence-once again I find that most of the government's concerns are mostly disputes grounded in factual contentions that are properly addressed on cross-examination. See Valencia-Lopez, 971 F.3d at 898 (finding district courts have broad latitude with respect to the reliability inquiry). For example, the government says that Cauthen calls the lack of UDID records on March 11 “inconsistent” with other records but fails to acknowledge that not having the UDID on a date does not mean it did not exist. Gov. Mot. 10: 10-14. Certainly this is helpful additional context for the jury, but it does not show that Cauthen's method was unreliable. And while it seems that Cauthen ignored or failed to account for certain evidence, see id. 10:20-27, given the facts of this particular case and the extent of the available evidence and records, this assertion goes to “contrary evidence” or “the burden or proof” that the government may attack on cross-examination. See Primiano, 598 F.3d at 564; see also Messick, 747 F.3d at 1196 (emphasizing the “liberal thrust” favoring admission). Accordingly, the government's motion to exclude these conclusions is DENIED.
That said, I agree that these sections of the report are dense, filled with technical language, and often difficult to parse. Cauthen again fails to define or explain certain technical terms, including the names of logs and particular actions. Consequently, I will revisit any objections concerning confusion, misleading the jury, or cumulative evidence as they arise at trial.
B. No. 2: Exclude Arguments Designed to Nullify
The government moves to exclude any argument “aimed at jury nullification.” Gov. Mot. 12:4-12. Specifically, the government seeks to preclude Brody from “blaming the victim,” meaning from asserting that FRB gave Brody the opportunity to “victimize[]” it. Id. 12:13-13:2.Brody seems to say that he intends to use evidence of FRB's investigation into the intrusion to support his defense that the investigation was not competent, though he also says that “[t]he evidence will show that FRB had a number of vulnerabilities that contributed to the intrusion.” Def. Oppo. 10:19-26.
The government also seeks to preclude Brody from referring to FRB's “wealth,” Gov. Mot. 13:3-18; from raising discovery disputes before the jury, id. 13:19-27; and from argument about punishment, including collateral consequences of conviction, id. 14:1-8. Brody says he will not raise “any discovery disputes, evidence of the bank's assets or punishment unless the Government opens the door to these issues.” Def. Oppo. 10:27-28. The motion is GRANTED as to these pieces of evidence.
Brody may use relevant evidence to argue to the jury that FRB's investigation was inadequate and to argue that someone else was responsible for the intrusion. But as discussed in my previous Order, it is not a viable defense to argue that Brody is not responsible for the intrusion because FRB failed to prevent it from happening. [Dkt. No. 143] 47:26-48:10; see also United States v. Lindsey, 850 F.3d 1009, 1015 (9th Cir. 2017) (holding, in the wire fraud context, “that a victim's negligence is not a defense” to the crime). The defendant in Lindsey, like Brody, argued that his constitutional right to present a complete defense was violated by the district court precluding him from asserting a particular defense about the victim-lenders' alleged negligence in preventing the crime. Id. at 1014. The Ninth Circuit held that the victim-lenders' “negligence, or even intentional disregard, cannot excuse another's criminal fraud” and cited several other circuits that have similarly held “that a fraud victim's negligence is not a defense to criminal charges under the federal fraud statutes.” Id. at 1014-15 (collecting cases). Though that case specifically addressed viable defenses to wire fraud, I find its reasoning persuasive here. FRB's negligence in failing to implement stricter security protocols “or even [its] intentional disregard” in failing to follow its own policies regarding terminating former employees' login credentials are not defenses to criminal charges under the Computer Fraud and Abuse Act. See id. Accordingly, Brody is precluded from making this argument at trial. The limitation does not violate Brody's constitutional right to present a complete defense for the same reasons the defendant's right in Lindsey was not violated: it is not a viable defense.
Importantly, and as noted, Brody is not precluded from arguing that the investigation was inaccurate, that someone else committed the intrusion, or that the evidence (including, for example, of the Cleartext passwords) somehow supports his argument that he did not commit the intrusion. All of those are viable defenses to the alleged crimes. Accordingly, I will not wholesale ban Brody from introducing that kind of evidence, as the government seems to seek. Besides that exception, this motion is GRANTED.
C. No. 3: Admit English Translation of a Family Group Chat and Conversation with “Hackdude” Containing Party-Opponent and Non-Hearsay Statements
The government moves to admit the English-language translation of a group message chat with his family members, translated from Hungarian. Gov. Mot. 14:9-16:23. In opposition, Brody says much of the conversation is hearsay and inadmissible under the Confrontation Clause and FRE 401 and 403. Def. Oppo. 11:1-12:16. He argues that the messages about skiing and the messages concerning his termination should be excluded for the same reasons as addressed in his first and second motions in limine.
All of Brody's messages are admissible as non-hearsay statements of a party opponent under FRE 801(d)(2), and many are also admissible as statements going to his then-existing state of mind under FRE 803(3) related to his motive, intent, and plan. Many of the messages from the other people in the group chat-which exceptions detailed below-are admissible as non-hearsay statements admitted for the effect on the listener, not for the truth, and some are admissible as questions not admitted for the truth of the matter asserted. See United States v. Lin, No. 15-cr-00065-BLF-1, 2018 U.S. Dist. LEXIS 68194, *17 (N.D. Cal. April 23, 2018) (“[S]tatements offered for their effect on the listener/reader . . . are admissible. Specifically, the Government intends to offer the questions made and posed to Defendants not for their truth, but for the purpose of establishing the ‘effect on listener' and each Defendants' state of mind.” (first citing L.A. News Serv. V. CBS Broad., Inc., 305 F.3d 924, 935-36, amended by 313 F.3d 1093 (9th Cir. 2002); and then citing United States v. Payne, 944 F.2d 1458, 1472 (9th Cir. 1991)); see also United States v. Torres, 794 F.3d 1053, 1061 (9th Cir. 2015) (“[To avoid] instances where a party attempts to admit hearsay by cloaking statements under the guise of a question, the focus of the inquiry should be on what the declarant intended to say, whether implied or directly asserted.” (citation omitted)); United States v. Grant, No. 14-cr-00590-PJH-1, 2016 U.S. Dist. LEXIS 70848, *2 (N.D. Cal. May 27, 2016) (granting the government's motion to admit statements and inquiries “offered to provide context for defendant's responses and to show the effect on the listener”).
That said, I agree with Brody that some of the messages should not be admitted under FRE 403 because some are needlessly cumulative, risk unfair prejudice, and may mislead the jury or waste time. At the hearing, the government offered to pare down the list of messages, provide them to Brody, and resubmit them to me. The government must exclude:
The “Rows” refer to the numbered rows in Column A of the government's exhibit at Gov. Mot. Ex. F (“Family Group Chat Thread”).
• Rows 137-39: Brody's mother's questions asking, “Camera in the gym?” and “There isn't one?” are not clearly being admitted for their effect on Brody because he does not respond to them. Additionally, they are more prejudicial than probative because the jury may take them for the truth of the matter asserted and affect Brody's defense,
while the questions themselves are not probative of any element of the alleged crimes.
A few messages appear irrelevant:
• Row 99: Brody's mother's location.
• Row 115: No translation provided.
• Rows 117-24: Members of group chat planning a Skype call.
• Row 141: Link about COVID-19 closures.
• Row 143: Asking if car insurance will pay for a new key.
• Row 145: Brody's mother's dream.
• Row 170: Consolation from Anna B.
• Row 212: No translation provided.And there are other sections that appear cumulative or are of questionable relevance. The government should redact other unnecessary passages from the exhibit. It should provide the redacted version to the defense by April 1, 2023, and any objections can be raised at the hearing on April 6, 2023.
The government also moves to admit an online conversation between Brody and someone using the name “Hackdude.” Gov. Mot. 16:23-17:5; see also id. Ex. G. Brody again says much of this conversation is hearsay and inadmissible under the Confrontation Clause and FRE 401 and 403. Def. Oppo. 12:14-16.
All of Brody's statements are admissible as non-hearsay statements of a party opponent under FRE 801(d)(2), and many are admissible as statements going to his then-existing state of mind under FRE 803(3) related to his motive, intent, and plan. The statements from “Hackdude” are admissible for their effect on Brody. See Lin, 2018 U.S. Dist. LEXIS 68194, *17. The statements explain Brody's alleged subsequent actions, including learning more about how much the “fix[]” costs, looking for the serial number, and questioning the process. They also provide context to understand his own statements concerning his then-existing state of mind, particularly concerning his plan for his laptop.
Brody's family's texts and Hackdude's statements also do not violate the Confrontation Clause because they are not admitted for their truth. See Woods v. Etherton, 578 U.S. 113, 117 (2016) (“The Confrontation Clause prohibits an out-of-court statement only if it is admitted for its truth.” (citing Crawford v. Washington, 541 U.S. 36, 59 n.9 (2004))); see also United States v. Wahchumwah, 710 F.3d 862, 871 (9th Cir. 2013) (holding there was no Confrontation Clause issue where anonymous statements were offered not for their truth “but merely to explain why” a federal investigation occurred (first citing Crawford, 541 U.S. at 59 n.9; and then citing United States v. Whitman, 771 F.2d 1348, 1352 (9th Cir. 1985)). Each is admitted to show the effect on the listener or to provide context for Brody's messages, but not for the truth of the matter asserted. Even Hackdude's statements implying that he cleaned or reprogrammed the laptop are not admitted for their truth but rather to show Brody's thinking, planning, and intent with respect to his computer.
Accordingly, the motion is GRANTED in part and DENIED in part. The messages are conditionally admissible subject to the government's anticipated submission of a pared down version of the group chat. The full “Hackdude Conversation” is admissible.
D. No. 4: Admit Brody's Police Report as Non-Hearsay and as Adoptive Admission
The government moves to admit the SFPD police report filed by Brody on March 19, 2020. Gov. Mot. 17:6-18:19. Statements in a police report “attributed to another person are . . . [inadmissible] hearsay.” Quiroz v. City of Los Angeles, No. CV 18-10733-KS, 2019 WL 8013117, at *4 (C.D. Cal. Nov. 19, 2019) (quoting Colvin v. United States, 479 F.2d 998, 1003 (9th Cir. 1973)). But where the statements are attributed to the defendant, they may come in as party-opponent admissions. See Manion v. Ameri-Can Freight Sys. Inc., No. CV-17-03262-PHX-DWL, 2019 WL 3718951, at *4 (D. Ariz. Aug. 7, 2019) (“[T]he portions of the police report that contain [the defendant's] own statements aren't subject to exclusion under the hearsay rules because such statements qualify as party-opponent admissions.”). Brody's statements are similarly admissible here.
Further, the whole report is admissible as a non-hearsay adoptive admission of statements of a party opponent. See Fed.R.Evid. 801(d)(2)(B). Brody forwarded the police report to FRB and told the FRB representative that he could get all the requested details-including a “statement fully describing the circumstances surrounding the” loss of the laptop as well as the “exact date/time, location, manner of loss and [Brody's] actions prior to and after the loss occurred”- from the report. Gov. Mot. Ex. E at pdf 2. Brody stated that the report noted one detail incorrectly, saying that the laptop was in his trunk and the alleged thief used the stolen car key to open the trunk. Id. Taken together, Brody's forwarding of the email, pointing to it for the answers to the relevant questions, and noting the one detail the report missed show that the circumstances meaningfully tie Brody and the police report together, see Transbay Auto Serv., Inc. v. Chevron USA Inc., 807 F.3d 1113, 1121 (9th Cir. 2015), and they also show that Brody read, understood, and acceded to the statements in the report, see United States v. Monks, 774 F.2d 945, 950 (9th Cir. 1985). Accordingly, this constitutes an adoptive admission, and the report is admissible.
This motion is GRANTED.
E. No. 5: Admit Contextual, Inextricably Intertwined Evidence of the Reasons for Brody's Firing
This motion is addressed above in the section analyzing Brody's first and second motions in limine and is GRANTED.
F. No. 6: Admit Summary Charts of Voluminous Records
The government moves to admit five summary charts of “voluminous records” under FRE 1006. Gov. Mot. 22:19-24:8; Gov. Mot. Exs. H-1, H-2, H-3, H-4, H-5. Brody opposes admission of all charts; he says two “are vehicles to put expert opinions and inadmissible testimonial hearsay in an expert report (in the form of a table) before the jury” and the remaining three are “expert reports concerning forensic information . . . involv[ing] expert testimony for which no expert reports have been provided.” Def. Oppo. 14:8-16:21.
The attachments to the government's motion correspond to exhibit numbers as follows: H-1 is Ex. 19, H-2 is Ex. 18, H-3 is Ex. 80, H-4 is Ex. 81, and H-5 is Ex. 97.
FRE 1006 provides that a proponent of evidence “may use a summary, chart, or calculation to prove the content of voluminous writings, recordings, or photographs that cannot be conveniently examined in court.” Fed.R.Evid. 1006. The proponent must make the underlying documents available for inspection by the opposing party and the court. Id.
The government may use the H-1 narrative summary table as a demonstrative during its expert's testimony, though it may not admit the table as an exhibit with the explanatory notes. If the government seeks to admit a version of the table without the explanatory notes at trial, the government should remove any lines that reference underlying inadmissible evidence-for example, the third row of pdf 5 points to the Superseding Indictment as the “source file” for the “activity” that “Brody was escorted out of the office after being fired.” Gov. Mot. Ex. H-1 at pdf 5. The Superseding Indictment is not evidence. See Ninth Cir. Model Crim. Jury Instructions 1.2 (“The indictment is not evidence and does not prove anything.”). To the extent that the proper foundation for other lines may be established at trial, such as for the many rows relying in part on evidence gathered in interviews, these may be conditionally admitted.
See, e.g., Mot. Ex. H-1 at pdf 9 (citing, among other things, “Kraus Interview Summary” as source of technical information); id. at pdf 10, Row 1 (citing, among other things, “Interview with Alex Apke” as source of technical information); id. at pdf 11, Row 2 (citing, among other things, “Apke and Kloss Interview Summary” as source of technical information).
As presented, the H-2 “master chronological table” would be admissible if the foundation is laid for the underlying information and an expert explains its relevance to the jury. Its current state is confusing and risks misleading the jury.
Brody expressed a concern that a specific entry in H-2 provides an improper legal opinion by stating, “All employees, especially in IT, should know that once they are escorted off premises and terminated, that they are not permitted to access any of their employers' systems even if the credentials are not deactivated.” Def. Oppo. 14:24-27. I cannot find that line in the government's table.
At the hearing, the government clarified that Exhibits H-3, H-4, or H-5 were prepared by witness Nick Daigle and will come in with his testimony. Defense agreed that the tables may be admitted with Daigle's testimony as he will be able to cross-examine the witness. Accordingly, these tables are admissible and other relevant objections may be raised at trial.
G. No. 7: Exclude Defense Summary Tables of Discovery Disputes Under Rule 1006
The government moves to exclude two of Brody's proposed demonstratives as inadmissible under FRE 1006: Brody's “Table of Evidence and Records Requested from FRB that FRB Confirms are Not Available,” and Brody's “Table of Evidence and Records Requested from FRB that Have Not Been Provided or Are Incomplete.” Gov. Mot. 24:9-25:2. The government argues that FRE 1006 allows for summaries of voluminous writings but the only reason these materials (subpoena requests and responses) are voluminous is because Brody was “so expansive” in his discovery requests, and so permitting the demonstratives would violate the “spirit” of FRE 1006. Id. 24:14-19. The government also says that the underlying materials are inadmissible as non-party hearsay because all statements were made by attorneys, and because the charts are irrelevant, confusing, and unfairly prejudicial. Id. 24:20-25:2. Brody says that he needs this evidence to support his defense that exculpatory evidence would have been found had a more thorough investigation been conducted. Def. Oppo. 16:27-17:4. Alternatively, Brody requests FRB custodian witnesses to testify “to establish the records that were not provided.” Id. 17:17-18.
The tables that Brody has prepared appear to relitigate discovery issues, suggest that First Republic Bank has not been responsive to requests, contain counsel's notes and perspectives, and include confusing and prejudicial information. The underlying materials are hearsay because each request comes from subpoenas and subpoena responses, which are attorney-created documents, and Brody submits them for their truth-that that records were unavailable. Brody seeks to apply the hearsay exception for the absence of records of regularly conducted activities. See Fed.R.Evid. 803(7). While that exception could apply in theory, he does not show that for each alleged missing piece of information “a record was regularly kept for a matter of that kind.” Id. 803(7)(B). Indeed, much of the first table consists of information that FRB says was not available which implies the records were not regularly kept.
Further, the summary tables are inherently confusing and risk misleading the jury. Listing dozens of highly technical requests-without definitions or other terminology to help the jury understand-and then saying the information was not provided or was unavailable is confusing and not particularly probative of any claim or defense. Brody may argue that the bank failed to retain specific records or provide specific information by questioning the FRB custodians knowledgeable about the discovery process and other relevant witnesses. But presenting highly technical and unexplained “summary charts” to the jury would violate FRE 403 because the probative value of this evidence is substantially outweighed by the risk of confusing the issues and misleading the jury.
While Brody may argue that FRB's investigation was flawed or lacking, I remind him that he may not relitigate discovery disputes in front of the jury.
That said, Brody may create a summary of all the information he asserts is critical to his defense that does not exist in the record, titled something like “Table of Evidence That Is Not Available Or Is Incomplete.” The table may then list the evidence itself, not including terms like “provide all records,” “identify,” and so forth. Then it could be used as a demonstrative. Similar to the government's demonstrative, it may include explanatory notes on the relevance of the missing information. This demonstrative should be provided to the government by April 1, 2023, and any concerns about it may be raised at the hearing on April 6, 2023.
H. No. 8: Motion Regarding Authenticity of Apple Business Records
Finally, the government moves to admit two sets of Apple business records-concerning an iPhone and a MacBook-without having to call a custodian as a witness. Gov. Mot. 25:3-13. Brody does not oppose the motion. Def. Oppo. 17:22-23. It is GRANTED.
III. CONTESTED EXHIBITS
The parties submitted a list of contested exhibits. In advance of the hearing, Brody withdrew his objections to Exhibits 41, 42, 43, 44, 54, 55, 56, 57, 58, 59, 73, 74, 75, 76, 78, and the government withdrew its objection to Exhibit 291. Unless otherwise noted below, the remaining exhibits are admitted subject to further objections at trial.
• Exhibits 45 and 53: The parties agreed to meet and confer about the authenticity issues with these exhibits. If the sole remaining issue is that the underlying data could have been changed between March and September 2020, as alluded to at the hearing, I note that the witnesses may testify about their actions during this time and so the evidence is admissible through relevant witnesses, subject to further objections at trial.
• Exhibit 91: The government agreed to trim this exhibit to the last page only, which apparently shows a photo that Brody took of the serial number of his computer. This photo is admissible subject to further objection at trial.
• Exhibit 100: The government indicated it will introduce this exhibit through Daigle and that previous witnesses will lay the foundation to establish that the username in the exhibit was one used by Brody. Subject to those qualifications and further objections at trial, it is admitted.
• Exhibits 296, 298, 300, 302, 304, 306: If the defense seeks to admit these portions of these aggregate exhibits, it must split them into separate exhibits so that I can determine whether the underlying evidence is admissible, as explained at the hearing.
• Exhibits with audio recordings: The government agreed to further redact the recordings to remove unnecessary and prejudicial comments, and the parties will work together before trial to finalize these recordings.
CONCLUSION
For those reasons, the motions in limine are GRANTED in part and DENIED in part.
IT IS SO ORDERED.