Opinion
Criminal Action 18-359-4 (JDB)
12-15-2023
UNITED STATES OF AMERICA, v. THOMAS KENNEDY MCCORMICK, Defendant.
MEMORANDUM OPINION AND ORDER
JOHN D. BATES UNITED STATES DISTRICT JUDGE
On March 3, 2020, defendant Thomas McCormick pleaded guilty to Racketeer Influenced Corrupt Organization (“RICO”) Conspiracy in violation of 18 U.S.C. § 1962(d) and Aggravated Identity Theft in violation of 18 U.S.C. § 1028A. The Court sentenced McCormick on November 15, 2023 to eighteen months' incarceration but at the parties' request, deferred a determination of restitution while the parties attempted to resolve certain issues. The parties could not reach a resolution and the Court held a restitution hearing on December 12, 2023. The Court delivered an oral ruling at that hearing and indicated that it would memorialize its reasoning in a forthcoming opinion. For the reasons articulated at the hearing and explained further below, the Court will order restitution to JP Morgan Chase in the amount of $105,793 and to American Express Bank in the amount of $43,919, for a total restitution figure of $149,712.
McCormick agreed to forfeit $8,051.25, which will be offset against the balance of the restitution. See Consent Order of Forfeiture [ECF No. 146-1] at 4.
Background
The following narrative is drawn from the parties' agreed-upon facts. See Agreed Statement of Facts in Supp. of Guilty Plea [ECF No. 101] (“SOF”); Presentence Investigation Report [ECF No. 139] (“PSR”). Darkode was an invitation-only online forum that operated from approximately 2008 to December 2013. SOF ¶¶ 2, 5. Darkode's primary purpose was to facilitate the creation, exchange, and sale of software designed to infect computers and electronic devices with malware. Id. ¶ 2. Darkode members used the forum to post and discuss completed malware, solicit advice and recommendations as to unfinished malware, and coordinate sales of malware to non-members. Id. ¶¶ 2, 6.
McCormick, using the moniker “Fubar,” joined Darkode in March 2009 and became an administrator in 2013. Id. ¶¶ 23, 25. As an administrator, McCormick moderated and managed forum threads selling and/or providing malware, services to render malware undetectable to antivirus software, access to botnets, and access to databases of stolen personally identifiable information (“PII”) such as social security numbers and dates of birth. PSR ¶ 39. McCormick also conspired to buy, sell, and trade malware, botnets, and stolen PII used to fraudulently obtain money from others. Id. ¶ 40.
On December 5, 2013, FBI agents executed a search warrant on McCormick's dormitory at the University of Massachusetts-Amherst. SOF ¶ 26. The agents seized three USB thumb drives, a microSD card, a Windows 8 Pro Surface, an iPhone 4, and an Apple laptop. Id. ¶ 30. One of the thumb drives contained malware that can be used to steal banking credentials. Id. Another drive contained over 30,000 credit and debit card numbers associated with over 1,600 financial institutions. Id. ¶ 32. As relevant here, JP Morgan Chase (“JPMC”) reported $366,532 in fraud associated with the stolen accounts on the drive and American Express Bank (“AmEx”) reported $312,461 in fraud associated with the stolen accounts on the drive, for a total of $678,993 in fraud losses. Id.
On March 3, 2020, McCormick pleaded guilty to one count of RICO Conspiracy in violation of 18 U.S.C. § 1962(d) (Count I) and one count of Aggravated Identity Theft in violation of 18 U.S.C. § 1028A (Count III). At sentencing, the Court ordered McCormick to serve twelve months' incarceration on Count I and six months' incarceration on Count III, to run consecutively, followed by thirty-six months' supervised release. See Judgment [ECF No. 146] at 2-3. Upon request of the parties, the Court postponed making a restitution determination while the parties attempted to negotiate an amount. See Nov. 15, 2023 Min. Entry. The parties filed supplemental briefing on their respective restitution positions, see Gov't's Supplemental Mem. in Aid of Sentencing Re: Restitution [ECF No. 148] (“Gov't Mem.”); Def.'s Position on Restitution [ECF No. 149] (“Def. Mem.”), and, upon the Court's Order, filed addenda identifying all evidence they intended to produce at the restitution hearing, see Gov't's Supplemental Mem. in Aid of Sentencing Re: Restitution Hearing Evidence [ECF No. 152] (“Gov't Add.”); Def.'s Addendum to Sentencing Mem. [ECF No. 151] (“Def. Add.”).
18 U.S.C. § 3664(d)(5) authorizes a court to “set a date for the final determination of the victim's losses, not to exceed 90 days after sentencing,” if the victim's losses are not ascertainable prior to sentencing.
The government seeks restitution in the amount of $678,993, the total dollar amount JPMC and AmEx reported in fraud associated with the accounts on the drive in McCormick's possession. Gov't Mem. at 2. McCormick argues that the Court should not order any restitution because (1) the government did not identify actual loss suffered by JPMC or AmEx; and (2) McCormick did not directly participate in the charges at issue. Def. Mem. at 6-8. Alternatively, McCormick asks the Court to apportion liability and reduce his restitution amount to reflect his contribution to the victims' losses, which he argues was limited. Id. at 8-9.
Analysis
Restitution in this case is authorized by the Mandatory Victims Restitution Act (“MVRA”), which applies, inter alia, to “an offense against property under [Title 18] . . ., including any offense committed by fraud or deceit . . . in which an identifiable victim or victims has suffered . . . pecuniary loss.” 18 U.S.C. § 3663A(c)(1)(A)(ii), (c)(1)(B). The purpose of the MVRA is “essentially compensatory,” not punitive: it serves “to restore a victim, to the extent money can do so, to the position [the victim] occupied before sustaining injury.” United States v. Fair, 699 F.3d 508, 512 (D.C. Cir. 2012) (alteration in original) (quoting United States Boccagna, 450 F.3d 107, 115 (2d Cir. 2006)). Accordingly, restitution is “limited to the actual, provable loss suffered by the victim and caused by the offense conduct.” Id.; see United States v. Bikundi, 926 F.3d 761, 791 (D.C. Cir. 2019); United States v. Smith, 297 F.Supp.2d 69, 72 (D.D.C. 2003). The government bears the burden of establishing the amount of loss suffered by the victim by a preponderance of the evidence. Fair, 699 F.3d at 513; In re Sealed Case, 702 F.3d 59, 66 (D.C. Cir. 2012).
The MVRA defines “victim” as “a person directly and proximately harmed as a result of the commission of an offense for which restitution may be ordered.” 18 U.S.C. § 3663A(a)(2). Where, as here, the offense involves “as an element a scheme, conspiracy, or pattern of criminal activity,” the court must order restitution to “any person directly harmed by the defendant's criminal conduct in the course of the scheme, conspiracy, or pattern.” Id.
I. Amount of Loss
Because the MVRA only authorizes courts to order restitution for actual, provable losses suffered by the victim, courts may not order restitution for losses that are unsubstantiated or speculative. See United States v. Cienfuegos, 462 F.3d 1160, 1168-69 (9th Cir. 2006). Nor should courts order restitution if “the number of identifiable victims is so large as to make restitution impracticable,” 18 U.S.C. § 3663A(c)(3)(A), or if “determining complex issues of fact related to the cause or amount of the victim's losses would complicate or prolong the sentencing process,” such that the burden on the sentencing process outweighs the need to provide restitution, id. § 3663A(c)(3)(B).
Although the government bears the burden of proving the amount of actual loss to the victim, the government need not prove the amount of restitution “with exactitude.” In re Sealed Case, 702 F.3d at 66. “Some degree of approximation . . . is not fatal,” and district courts are charged with estimating “the amount of the victim's loss,” based on the facts in the record, “with some reasonable certainty.” Id. (cleaned up).
For much of this litigation, the government pursued $678,993 in restitution on the theory that two victim financial institutions-JPMC and AmEx-reported losses of $366,532 and $312,461, respectively. See Gov't Mem. at 2. But, as the government conceded at the restitution hearing, neither institution suffered actual losses in those amounts. See Gov't Add. at 1-2. The government proffers, the defense agrees, and the Court now accepts, that JPMC has identified an actual loss of $124,462.04 and AmEx has identified an actual loss $51,669, with the remaining amounts attributable to chargebacks to various merchants. See id.; Def. Mem. at 6; Def. Add. at 1. To recover the remaining $502,831.96, the government pivoted-on the night before the restitution hearing-to include as victims of the offense the merchants underlying these chargebacks. Gov't Add. at 2.
The parties have represented to the Court that JPMC and AmEx provided itemized spreadsheets reflecting fraud charges totaling $366,532.74 for JPMC and $312,461.10 for AmEx.
The government states that “a chargeback occurs when the underlying bank suffers a fraud loss and requires that the merchant who handled the fraudulent transaction suffer the loss instead of the bank.” Gov't Add. at 2.
The government has not met its burden of proving actual loss to the merchant victims. Despite having had evidence of the loss amounts attributable to each merchant in its possession for years, the government was unable to answer many of the Court's questions as to the contents of the spreadsheets, nor could the government identify the merchants or the specific losses attributable to them.The MVRA “limits the order of restitution to the sum of losses to identifiable victims.” United States v. Grimes, 173 F.3d 634, 640 (7th Cir. 1999) (emphasis added). Thus, courts have found that district judges erred where they ordered restitution to “unidentified” victims. Id. at 639-40; see also United States v. Catoggio, 326 F.3d 323, 328 (2d Cir. 2003); United States v. Zakhary, 357 F.3d 186, 191 (2d Cir. 2004) (“Under these circumstances [where ‘no . . . identification of victims or determination of their losses was made'], we are obliged to vacate that part of the judgment of conviction ordering restitution.”). The government bears the burden of establishing actual loss to identifiable victims. Its inability to do so years after obtaining the evidence on which it now seeks to rely, at a hearing specifically held to address restitution, prevents the Court from ordering restitution to victims other than those identified as suffering actual losses: JPMC and AmEx.
With respect to JPMC, the government conceded at the restitution hearing that it does not even know “whether JP Morgan has maintained” records that sufficiently identify the merchant victims.
The Court takes further issue with the government's attempt to recover losses from charges that predate McCormick's entry into the conspiracy. The MVRA authorizes restitution for a “person directly harmed” by the defendant's criminal conduct in the course of a conspiracy. 18 U.S.C. § 3663A(a)(2). McCormick cannot be held responsible for losses that occurred prior to his participation in the conspiracy for which he was convicted. See United States v. Flaschberger, 408 F.3d 941, 943 (7th Cir. 2005) (finding error where the district court ordered restitution for losses from years preceding the scheme alleged in indictment). Despite the government's agreement that McCormick's restitution order should not include losses prior to March 2009, the reported losses reflected on the spreadsheets are based on at least some charges that predate McCormick's entry into Darkode. Def. Mem. at 8. Although the exact amount is unknown, McCormick's counsel estimates that approximately $55,000, or roughly eight percent, of the banks' reported losses are from charges prior to March 2009.
The Court considers McCormick's entry date into the Darkode conspiracy to be March 21, 2009, which the government agrees is the earliest date on which his participation can be documented. See SOF ¶ 25.
McCormick's counsel estimated $54,000 from AmEx and $900 from JPMC. The government did not review the spreadsheets to identify whether any chargebacks predate March 2009.
Accordingly, the government has failed to meet its burden as to the $678,993 it seeks in restitution. The Court further concludes that it would be too difficult, and too burdensome on the sentencing process, to allow the government more time to attempt to identify the victims and quantify the losses at this stage. See 18 U.S.C. 3663A(c)(3).
The Court thus makes the following findings: JPMC suffered an actual loss of $124,462.04 and AmEx suffered an actual loss of $51,669. A fifteen percent decrease in these amounts is proper to account for the estimated amount attributable to charges preceding McCormick's involvement.These calculations result in $105,793 to JPMC and $43,919 to AmEx, which the Court estimates with reasonable certainty are the amounts of the victim financial institutions' losses.
This fifteen percent decrease is more than the eight percent decrease the defense requested.
II. Causation
McCormick argues that the government has not demonstrated that he directly harmed the victims because the government has not offered evidence that he actually used the information found in his possession to rack up the fraudulent charges. The Court rejects this argument. It is axiomatic that “the defendant should not be required to pay restitution for harm he did not cause.” In re Sealed Case, 702 F.3d at 66. But when the defendant is convicted of a conspiracy, courts may “order restitution for damage resulting from any conduct that was part of the conspiracy.” United States v. Emor, 850 F.Supp.2d 176, 203 (D.D.C. 2012) (quoting United States v. Elson, 577 F.3d 713, 723 (6th Cir. 2009)). In these circumstances, restitution can extend beyond a specific criminal act to cover losses resulting from the overall scheme, see United States v. Thomas, 862 F.Supp.2d 19, 21 (D.D.C. 2012), and courts must “determine the scope of the defendant's fraud scheme and the harm suffered by victims as a result of conduct taken by the defendant pursuant to that scheme,” Emor, 850 F.Supp.2d at 203; see United States v. Bogart, 490 F.Supp.2d 885, 903 (S.D. Ohio 2007) (“[T]he Court[] under the MVRA must order restitution that relates directly to a victim's losses within the course of the entire scheme and not simply the loss caused by the specific conduct that is the basis for the offense of conviction.”).
As part of McCormick's guilty plea, he admitted to his participation in a conspiracy to buy, sell, and trade malware, botnets, and stolen PII used to fraudulently obtain money from others. SOF ¶ 24. Moreover, McCormick personally wrote code to insert undetectable malware in a victim's computer, installed ransomware for a pay-per-install affiliate program, and, at the time of his arrest, possessed 21,639 compromised accounts. Id. ¶¶ 29, 32. Even if McCormick did not himself use the accounts to make fraudulent purchases, these losses were both foreseeable and directly tied to his conduct in the conspiracy.
III. Apportionment
Where more than one defendant has contributed to the loss of a victim, the MVRA grants courts discretion to “make each defendant liable for payment of the full amount of restitution” or “apportion liability among the defendants to reflect the level of contribution to the victim's loss.” 18 U.S.C. § 3664(h). McCormick asks the Court to apportion his liability, due to (1) his lack of “direct” contribution to the victims' loss, and (2) his position as the fourth co-defendant in the indictment. Def. Mem. at 8. The Court concludes that given the purpose of restitution to make victims whole and the circumstances of this case, which include the unlikelihood that restitution will be collected from McCormick's co-defendants, apportionment is neither required nor warranted.
The three other co-defendants in this case have not been extradited to the United States.
Nonetheless, McCormick's restitution order of $149,712 is less than one quarter of the $678,993 the government seeks.
* * *
For the foregoing reasons, and upon consideration of the entire record herein, it is hereby
ORDERED that McCormick shall pay restitution in the amount of $105,793 to JP Morgan Chase and $43,919 to American Express Bank, for a total of $149,712; it is further
ORDERED that the restitution shall be joint and several with respect to the other defendants in this case; it is further
ORDERED that payments need not begin until McCormick has completed service of his term of incarceration; it is further
ORDERED that McCormick's minimum payment schedule, subject to adjustment by probation depending on his employment, is $300 a month; and it is further
ORDERED that McCormick's restitution amount shall be offset by the $8,051.25 forfeiture payment this Court has previously ordered.
SO ORDERED.