United States v. CuomoUnited States v. Cuomo
UNITED STATES OF AMERICA, Appellee, v. GUY CUOMO, a.k.a. John Monaco, Defendant-Appellant.*
Before: KEARSE, PARK, and PEREZ, Circuit Judges.
STEVEN D. CLYMER, Assistant United States Attorney, Syracuse, New York (Carla B. Freedman, United States Attorney for the Northern District of New York, Joshua R. Rosenthal, Assistant United States Attorney, Syracuse, New York, on the brief), for Appellee.
ANDREW LEVCHUK, Amherst, Massachusetts, for Defendant-Appellant.
KEARSE, Circuit Judge:
Defendant Guy Cuomo appeals from a judgment entered in the United States District Court for the Northern District of New York, following a jury trial before Thomas J. McAvoy, Judge, and sentencing by Mae A. D‘Agostino, Judge, convicting him of conspiracy to commit computer fraud, in violation of
I. BACKGROUND
The present prosecution had its origin in investigations by the United States Department of Labor‘s Office of the Inspector General (“DOL-OIG“) into suspected crimes involving unemployment insurance (or “UI“) programs. DOL-OIG Special Agents zeroed in on conduct from 2015 through April 2018 by Cuomo who, along with codefendant Jason “J.R.” Trowbridge, operated both a “skip tracing” company called Paymerica Corporation and a sister company called Ameripay Corporation (“Ameripay“) that ostensibly engaged in debt collection but also performed skip tracing. “Skip tracing” (or “skiptracing“) refers generally to a process of finding information about a person--often a debtor
The trial evidence leading to Cuomo‘s conviction of the above offenses, taken in the light most favorable to the government, is described in detail in a Decision and Order of the district court dated July 13, 2022 (“D.Ct. Op.“), denying motions by Cuomo for a judgment of acquittal. (See Cuomo brief on appeal at 3 (“The district court, as required by law, summarized the facts in the light most favorable to the verdicts.” (footnote omitted)).) Under the same standard, we summarize the evidence as follows.
A. The Evidence of Deceptive Practices
Paymerica Corporation and Ameripay shared office space and had substantial financial and employee overlap; here, as in the district court proceedings, they will generally be referred to collectively as “Paymerica,” D.Ct. Op. at 5-6. In their skip tracing operations, “Paymerica employees obtained debtors’ POE information by impersonating the debtors” in commencing for them “online applications for unemployment insurance (‘UI‘) in the states where the debtors lived.” Id. at 6.
[W]hen Paymerica‘s customers provided [Paymerica] with the names, social security numbers, and addresses of debtors whose POE information the customers sought to purchase, Paymerica employees initially verified this personal-identifying information--including social security numbers--for the debtors by using TLO, a commercial database. From there, Paymerica employees obtained the requested POE information for the debtors from state workforce agencies by starting false UI applications in each debtor‘s name and with each debtor‘s personal-identifying information. Among other things, Paymerica employees created online accounts for the debtors with the states--for instance, a NY.gov account in New York--and then used the online accounts to start fraudulent UI applications in the debtors’ names by submitting, inter alia, the debtor‘s name, date of birth, and social security number.
Id. (record citations omitted) (emphases added). In addition,
Paymerica employees routinely created and used fraudulent email accounts ... to circumvent identity-verification measures implemented by New York and other state governments. Four cooperating witnesses ... testified that the entire process was about impersonating debtors. According to the witnesses, this was done so that the states would falsely recognize Paymerica employees as the target debtors and provide restricted POE information meant only for those debtors to Paymerica.
Id. at 6-7 (record citations omitted) (emphases added); see id. at 6 (the “[f]our cooperating witnesses” were “Paymerica employees who ... admittedly commit[ed] Computer Fraud, Misuse of a Social Security Number, or Aggravated Identity Theft“).
“Paymerica employees took steps to avoid detection and cover up their actions.... The skip tracers always used aliases when making verification calls to victims’ places of employment.” Id. at 7 (record citations omitted). Cuomo himself, “for his skiptracing activities,” used the alias “John Monaco.” (Trial Transcript (“Tr.“) 328-29.)
Cuomo also “personally impersonated numerous debtor-victims [in starting] New York State UI applications, including C.C. and S.A., the respective victims of the [identity theft] counts against [him].” D.Ct. Op. at 8. In March 2018, Cuomo logged on to the New York State UI website and initiated unemployment insurance applications
In addition to the use of aliases, impersonations, and “phony email accounts,”
Paymerica employees employed other means to evade the states’ security measures. For example, when the state governments blocked an internet protocol (“IP“) address associated with Paymerica‘s offices, Paymerica employees used a virtual private network (“VPN“) to mask their true IP address. They also used untraceable, internet-based phone systems that were paid for with anonymous retail gift cards to further conceal their true identities. In addition, when the states added additional identity verification questions in response to Paymerica‘s fraudulent activities, the skip tracers used information from TLO to answer highly personal questions about the debtors they impersonated.
Id. at 7-8 (record citations omitted) (emphases added).
Cuomo performed skip tracing himself, and when Trowbridge was not available he supervised the other Paymerica employees, including those engaged in skip tracing. See id. at 8. Cuomo also administered and maintained the TLO account--a subscription to a database maintained by TransUnion that contained public, proprietary, and personal information. Trowbridge could not be associated with that account because he had a prior felony conviction. See id. Cuomo “was ... aware that Trowbridge and other[ Paymerica employees] used VPNs and other measures to avoid detection by law enforcement.” Id. (citing Tr. 559-60 (DOL-OIG Special Agent‘s testimony as to Cuomo‘s description to interviewing agents of his co-conspirators’ use of various measures “‘to hide from the states‘” (other record citations omitted))). (See Part II.A.2. below with respect to confidentiality measures taken by New York State.)
There was no evidence that Cuomo or his coconspirators actually filed an unemployment insurance application for any debtor they impersonated. They initiated applications because merely starting that process gave them access to the debtor‘s most recent employer; none of the applications was completed. See D.Ct. Op. at 11-12.
“Once [Paymerica] obtained[] the POE information[, it] was sold to the requesting third parties for approximately $90 per debtor.” Id. at 7 (citing Tr. 595-97). Paymerica had received requests from customers to research approximately 200,000 persons, and all 50 states were represented in those requests. (See Tr. 597.) In the period from mid-December 2015 to early April 2018, for its largest customer, Paymerica found POE information on some 11,294 individuals, for which it billed the customer $1,013,220. (See id. at 595-97.)
B. The Verdict and Judgment
The jury found Cuomo guilty of accessing a protected computer and obtaining information, in violation of
Cuomo was sentenced principally to a total of 45 months’ imprisonment. On Counts 1, 2, 12, and 13 (relating to computer fraud and misuse of social security numbers), he received four 21-month prison terms to be served concurrently with each other, based on calculations under the advisory Sentencing Guidelines (“Guidelines“). (See Part III below.) On Counts 7 and 18 (aggravated identity theft), Cuomo was sentenced--as mandated by
II. CUOMO‘S CHALLENGES TO HIS CONVICTIONS
On appeal, Cuomo contends principally that his convictions should be reversed on the grounds that his conduct did not violate either the Computer Fraud and Abuse Act of 1986 (“CFAA“) or the Social Security Act. He also argues that the trial court‘s instructions on the counts charging violations of those statutes were erroneous or deficient, and that the evidence was insufficient to support his convictions of aggravated identity theft and misuse of, or conspiracy to misuse, social security numbers.
As to issues of statutory interpretation, our standard of review is de novo. See, e.g., United States v. Gu, 8 F.4th 82, 86 (2d Cir. 2021) (“Gu“), cert. denied, 142 S. Ct. 1186 (2022). And although we review de novo the ultimate legal question of sufficiency of the evidence to support a conviction, our “standard of review is exceedingly deferential to the jury‘s apparent determinations” of facts. United States v. Flores, 945 F.3d 687, 710 (2d Cir. 2019) (“Flores“) (internal quotation marks omitted), cert. denied, 141 S. Ct. 375 (2020); see Gu, 8 F.4th at 86. We view the evidence in the light most favorable to the government, crediting every credibility determination and every inference that could have been drawn in favor of the government. See, e.g., Flores, 945 F.3d at 710; Gu, 8 F.4th at 86. “A sufficiency challenge must fail if ‘any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.‘” Flores, 945 F.3d at 710 (quoting Jackson v. Virginia, 443 U.S. 307, 319 (1979) (emphasis in Jackson)).
We also review de novo challenges to the propriety of the trial court‘s instructions to the jury, if those challenges have been properly preserved. See, e.g., United States v. Botti, 711 F.3d 299, 307 (2d Cir. 2013) (“Botti“); United States v. Bahel, 662 F.3d 610, 634 (2d Cir. 2011). Unpreserved challenges to instructions are reviewed only for plain error. See, e.g.,
A. The CFAA
Cuomo contends that his convictions on Counts 1 and 2--computer fraud and conspiracy to commit computer fraud--should be reversed, arguing that his conduct did not violate the CFAA, that the evidence was insufficient to show that he accessed the computer without authorization, and that the district court erroneously instructed the jury as to the meaning of “without authorization.” We reject all of these contentions.
1. Statutory Construction
The CFAA, dealing with fraud and related activity in connection with computers, provides in part that it is unlawful for a person (a) to “intentionally access[] a computer without authorization or exceed[] authorized access, and thereby obtain[] ... information from any protected computer,” or (b) to “conspire[]” to do so.
The word “authorization” is not defined in the CFAA, and we have viewed it as “a word of ‘common usage, without any technical or ambiguous meaning,‘” United States v. Valle, 807 F.3d 508, 524 (2d Cir. 2015) (“Valle“) (quoting United States v. Morris, 928 F.2d 504, 511 (2d Cir.) (“Morris“), cert. denied, 502 U.S. 817 (1991)). It thus suggests “‘permission or power granted by authority.‘” Valle, 807 F.3d at 524 (quoting Random House Unabridged Dictionary 139 (2001)). Both Valle and Morris were prosecutions for alleged violation of the “exceeds authorized access” clause, by defendants who concededly had authorization to access the relevant computer but did so for improper purposes.
The Supreme Court has treated the CFAA‘s “without authorization” and “exceeds authorized access” clauses as coordinated elements of “the computer-context understanding of access as entry.” Van Buren v. United States, 593 U.S. 374, 390 (2021). It reasoned that the “gates-up-or-down” statutory structure “treats the ‘without authorization’ and ‘exceeds authorized access’ clauses consistently,” as “without authorization” refers to whether “one either can or cannot access a computer system,” and “exceeds authorized access” refers to whether “one either can or cannot access certain areas within the system.” Id. at 390 (emphases added). The Court suggested that such “gates” might consist of “a specific type of authorization--that is, authentication, which turns on whether a user‘s credentials allow him to proceed past a computer‘s access gate, rather than on other, scope-based restrictions.” Id. at 390 n.9 (internal quotation marks omitted).
2. Sufficiency of the Evidence
Cuomo contends chiefly that his (and his cohorts‘) computer searches for debtors’ POEs were not “without authorization” within the meaning of
To obtain place-of-employment information, Paymerica employees used ny.gov. All that was needed to create an account was a username and email address. Any
member of the public could create a ny.gov account. . . . Ny.gov could be used to access a host of services, including searching for jobs, creating a JobZone profile, getting assistance with employment-related activities, like resume writing, cover letters, and interview skills; or exploring careers, training opportunities, apprenticeship opportunities, and other job seeker resources, and accessing services for veterans. . . . These services were available to any member of the public and off limits to no one. There was no gate blocking entry to ny.gov.
(Cuomo brief on appeal at 18-19 (emphasis added).) These arguments do not, however, reflect the scope of the CFAA or the structure of the gates on ny.gov.
First, Cuomo‘s argument mistakenly conflates websites and computers. Section
Second, some parts of websites are “outward facing,” i.e., “they are exposed to the public” (id. at 145); but other parts are not (see, e.g., id. at 155). See generally hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1199 (9th Cir. 2022) (“[A] defining feature of public websites is that their publicly available sections lack limitations on access; instead, those sections are open to anyone with a web browser.” (emphasis added)). When the website‘s host computer introduces “gates” for areas of the website that require authorization to access, those parts of the website and the computer or computers hosting them are not freely available to the public. See id. at 1198-99, 1199 n.17.
While Van Buren left open the question of whether the “gates-up-or-down inquiry” into authorization “turns only on technological (or ‘code-based‘) limitations on access, or instead also looks to limits contained in contracts or policies,” 593 U.S. at 390 n.8 (emphases added), we need not resolve that question because the gate at issue here is code-based. The NYS-ITS Manager testified that in 2017-2018, users could obtain information as to an individual‘s place of employment through ny.gov by taking two steps. To begin, users would have to create an ny.gov account, which merely required them to provide a name and a verifiable email address. (See Tr. 147.) To continue, the user could start an application for unemployment insurance; but in order to proceed further--and obtain information from the mainframe--the user was “required to put in a valid social security number and an address, mailing address[,] to verify they are who they say they are.” (Id. at 151 (emphasis added); see id. at 161 (a person “ha[s] to enter ... specific information to access specific portions of the mainframe” (emphasis added))). “When you fill out that application with the unemployment insurance area, it would go to the mainframe to actually pull records out for work history of a person if they put in the proper social and address for that person.” (Id. at 152 (emphasis added).)
[Y]ou can get into a web page but you might not have access to records unless you [have] actually proven who you say you are. . . . When you fill out that application with the unemployment insurance area, it would go to the mainframe to actually pull records out for work history of a person if they put in the proper social and address for that person.
(Tr. 151-52 (emphases added).) These controls were “put into place to prevent people from seeing records of other people.” (Id. at 156.)
This evidence as to the New York State computer gates, along with the evidence described in Part I.A. above--as to Cuomo‘s and other Paymerica employees’ impersonations and subterfuges to circumvent those gates and obtain POE information for Paymerica customers--was sufficient to support the jury‘s findings that Cuomo, in violation of
3. The CFAA Instruction as to “Authorization”
On appeal, Cuomo argues that the trial court gave the jury an erroneous instruction as to the meaning of “without authorization” in
“A computer‘s user accesses a computer without authorization if the user bypasses an authentication requirement that requires the user to demonstrate that the user is a person authorized to access the information [on] another computer. A password is an example of an authentication requirement but authentication requirements may take other forms.”
(Cuomo brief on appeal at 31-32 (quoting Tr. 722).) Cuomo contends that this was erroneous because it “failed to acknowledge that Cuomo had a valid ny.gov account” (Cuomo brief on appeal at 32), and allowed the jury to believe “it could convict based on” “terms of service or contractual limitations imposed by a website” (id. at 32, 33), and that “[t]he jury should have been instructed, consistent with Valle, that to find that Cuomo acted without authorization, it had to find that Cuomo had no permission at all to access the ny.gov site” (id. at 33 (emphasis in original)).
Cuomo made no objection in the district court to the instructions on the CFAA counts. (See, e.g., Tr. 747-58.) Thus, his present challenge to this instruction is reviewable only for plain error. He cannot meet that test because, inter alia, the instruction given by the court was not erroneous.
First, his complaint that the instruction did not acknowledge that he “had a valid ny.gov account” again conflates the computer with the website. Cuomo‘s access to the public-facing aspects of the website did not give him authorization to access the private POE information, stored on the mainframe, which he sought to obtain for Paymerica‘s customers.
Nor has Cuomo shown error or plain error by arguing that the jury should have been instructed that in order to find that he accessed the computer without authorization in violation of the CFAA, it needed to find that he had no permission
Finally, as discussed in Part II.A.1. above, Van Buren indicated that identity “authentication, which turns on whether a user‘s credentials allow him to
proceed past a computer‘s access gate,” constitutes “a specific type of authorization.” 593 U.S. at 390 n.9 (internal quotation marks omitted (emphasis ours)). The instruction here that a user who accesses a computer by bypassing the authentication requirement can be found to have accessed the computer “without authorization” was not error, much less an error that was “plain.”
B. Social-Security-Number Misuse
Cuomo contends that his convictions on counts 13 and 12—misuse of a social security number and conspiracy to misuse social security numbers, respectively—should be reversed on the grounds that the district court gave an erroneous instruction as to the elements of such misuse and erred in failing to instruct the jury as to the theory of his defense, and that under his proposed instructions the evidence was insufficient to support his convictions on those charges. These arguments are meritless.
The
for the purpose of obtaining anything of value from any person, or for any other purpose—
. . . .
(B) with intent to deceive, falsely represent[] a number to be the social security account number assigned by the Commissioner of Social Security to him or to another person, when in fact such number is not the social security account number assigned by the Commissioner of Social Security to him or to such other person.
[t]o act with intent to deceive means to act with the intention of misleading or giving false information. However, it is not necessary for the government to prove that anyone was actually deceived or misled.
(Id. at 740 (emphasis added).)
Cuomo objected to these instructions; he had requested that the jury be instructed that it needed to find that his claimed ownership and use of the debtor‘s social security number constituted a misrepresentation to “someone“—presumably a live person (see generally Cuomo brief on appeal at 36-37). His proposed change to the “represented to New York State” part of the court‘s instruction would have replaced “New York State” with “someone“; and as to the “intent to deceive” element, his proposed substitute would have told the jury that it needed to find that Cuomo “intended to deceive someone for any purpose,” and that “[t]o ‘act with intent to deceive’ simply means to act deliberately for the purpose of misleading someone.” (Cuomo‘s Proposed Jury Charge at 4 (emphases added); see Tr. 755-58.)
A defendant is not entitled to have the court give his proposed instruction to the jury unless it is, inter alia, legally correct. See, e.g., United States v. Prawl, 168 F.3d 622, 626 (2d Cir. 1999). Cuomo‘s proposed language would not have been a correct instruction.
To begin with, his theory that to violate
Second, Cuomo‘s repeated proposed references to “someone“—along with defense counsel‘s rhetorical questions “who is Mr. Cuomo intending to deceive? The website? The computer?” (Tr. 817), and his request to omit the reference to “New York State“—were apparently intended to imply that one could not be prohibited from, or punished for, acting with intent to deceive or defraud a government. Such an implication would have been misleading and of course is fallacious, see generally
Nor, with
In sum, the evidence was ample to allow the jury to find that Cuomo, with intent to deceive state governments, provided debtors’ social security numbers, falsely claiming they were his own—and conspired to do so—in order to obtain access to and sell debtors’ POE information to Paymerica‘s customers, in violation of
C. Aggravated Identity Theft
Cuomo was convicted on two counts (Counts 7 and 18) of aggravated identity theft under
during and in relation to any felony violation enumerated in subsection (c), knowingly . . . uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years.
Cuomo contends that the evidence was insufficient to support his convictions for aggravated identity theft, arguing principally that there was insufficient evidence of the predicate felonies, i.e., of computer fraud in violation of
We are unpersuaded by Cuomo‘s contention that a different result is required by the Supreme Court‘s recent decision in Dubin v. United States, 599 U.S. 110 (2023). Dubin involved an aggravated-identity-theft prosecution premised on the defendant‘s “‘us[ing]’ a patient‘s means of identification ‘in relation to’ healthcare fraud,” a federal offense under
use of the patient‘s name was not at the crux of what made the underlying overbilling fraudulent. The crux of the healthcare fraud was a misrepresentation about the qualifications of [defendant‘s] employee. The patient‘s name was an ancillary feature of the billing method employed.
599 U.S. at 132. “[W]ith fraud or deceit crimes like the one in this case, the means of identification specifically must be used
This interpretation of
In sum, Cuomo‘s contentions provide no basis for setting aside the jury‘s verdicts.
III. SENTENCING CHALLENGES
As indicated in Part I.B. above, Cuomo‘s sentence to 45 months’ imprisonment included 21 months for the computer-related and social-security-number-misuse counts. In calculating the Guidelines-recommended sentences for these offenses, the district court adopted the fact descriptions and recommendations of the presentence report (“PSR“) for several increases in his Guidelines offense level. (See Sentencing Transcript, August 11, 2022 (“S.Tr.“), at 3.) Cuomo‘s base offense level was 6. His total offense level was 16, resulting from (A) three enhancements for specific offense characteristics, i.e., (1) two steps under § 2B1.1(b)(2)(A)(i) because the offense involved 10 or more victims, (2) two steps under § 2B1.1(b)(10)(C) because it involved sophisticated means, and (3) two steps under § 2B1.1(b)(18) because it involved an intent to obtain personal information, and (B) a four-step upward adjustment under § 3B1.1(a) because of his leadership role in the criminal activity. On appeal, Cuomo challenges the increases with respect to personal information and leadership role.
We review the “reasonableness of sentencing decisions for abuse of discretion, a standard incorporat[ing] de novo review of questions of law, including . . . interpretation of the Guidelines, and clear error review of questions of fact.” United States v. Taylor, 961 F.3d 68, 74 (2d Cir. 2020) (internal quotation marks omitted).
A. Cuomo‘s Role
The Guidelines recommend a four-step increase in offense level for a “defendant [who] was an organizer or leader of a criminal activity that involved five or more participants,” Guidelines § 3B1.1(a)—including the defendant, see, e.g., United States v. Paccione, 202 F.3d 622, 625 (2d Cir.) (”Paccione“), cert. denied, 530 U.S. 1221 (2000). “Whether a defendant is considered a leader depends upon the degree of discretion exercised by him, the nature and degree of his participation in planning or organizing the offense, and the degree of control and authority exercised over the other members of the conspiracy.” United States v. Beaulieau, 959 F.2d 375, 379-80 (2d Cir. 1992). A defendant may be a leader of a crime even if it was planned, financed, and orchestrated by another participant. See, e.g., United States v. Williams, 23 F.3d 629, 635 (2d Cir.), cert. denied, 513 U.S. 1045 (1994).
We review the district court‘s conclusion that a defendant met the criteria for “a leadership enhancement under U.S.S.G. § 3B1.1(a) de novo, but review the court‘s findings of fact supporting its conclusion for clear error.” See, e.g., Paccione, 202 F.3d at 624. Sentencing judges are “given latitude concerning their supervisory role findings, even when their findings were not as precise as they might have been,” United States v. Napoli, 179 F.3d 1, 14 (2d Cir. 1999) (”Napoli“) (internal quotation
The district court, in addressing Cuomo‘s role, stated as follows:
I‘ve looked at the nature and scope of the illegal activity, the degree with which this defendant oversaw this illegal conspiracy. And I find that based upon the fact that this defendant incorporated and was president of Ameripay; that this defendant established the account with TLO which allowed him to get information about debtors and that this defendant used both Ameripay and Paymerica to get the identity of debtors; also that he managed co-conspirators . . . ; that his employees characterize this defendant as a manager when Mr. Trowbridge was not present; . . . [and] this defendant was very involved with a number of these supposed debtors.
(Sentencing Tr. 6-7 (emphases added).)
Cuomo challenges the sufficiency of the court‘s findings, stating principally that the TLO account was a “legitimate business expense for anyone involved in pursuing judgment debtors,” that “[t]he employees were not Cuomo‘s employees,” and that “[t]here were no ‘supposed debtors’ in this case. Ameripay pursued debtors who had court judgments against them.” (Cuomo brief on appeal at 42 (emphasis in original).) He also argues that the district court ignored “ample evidence that Trowbridge was the sole manager and leader.” (Id.) These arguments are wide of the mark.
The test for reviewing the court‘s findings is not whether there were legitimate aspects of the business of Ameripay and Paymerica, or whether the individuals who did most of the skip-tracing were employees of Cuomo personally, rather than of the company he incorporated and its affiliate, or even whether there was evidence from which the court could have ruled differently. Rather, the “sentencing court‘s findings as to the defendant‘s role in the offense will be overturned only if they are clearly erroneous.” Napoli, 179 F.3d at 15 (internal quotation marks omitted). And “[w]here there are two permissible views of the evidence, the factfinder‘s choice between them cannot be clearly erroneous.” Anderson v. City of Bessemer City, 470 U.S. 564, 574 (1985).
The district court‘s findings that Cuomo was Ameripay‘s founder and president and that he managed other coconspirators are supported by testimony and documents in the trial record. Ameripay‘s corporate documents showed Cuomo as its founder and president. Multiple witnesses who worked at Paymerica also testified that Cuomo was “second in command” to Trowbridge (e.g., Tr. 354, 389), and that Cuomo supervised the skiptracers (id. at 460), “audited” their time and attendance (id. at 559) and the quality of their performance (id. at 463), and reported to Trowbridge on their productivity or on their “goofing off” (id. at 433). As summarized in the PSR, whose factual descriptions the sentencing judge expressly adopted, Paymerica employees characterized Cuomo as being in charge when Trowbridge was not present, and Trowbridge traveled “a lot.”
We see no clear error in the sentencing court‘s findings as to Cuomo‘s leadership role in the conspiracy, which demonstrate that Cuomo was intimately involved in organizing and planning the conspiracy and that he exercised direct authority over most of his coconspirators. We thus affirm
B. Personal Information
The Guidelines recommend a two-step increase in offense level if “the defendant was convicted of an offense under
“‘Personal information‘” is defined to mean[] sensitive or private information involving an identifiable individual (including such information in the possession of a third party), including (A) medical records; (B) wills; (C) diaries; (D) private correspondence, including e-mail; (E) financial records; (F) photographs of a sensitive or private nature; or (G) similar information.
Guidelines § 2B1.1, Application Note 1 (emphasis added).
Cuomo contends that “[t]his enhancement is inapplicable” because “places of employment are not listed in the definition.” (Cuomo brief on appeal at 44.) But we need not reach this issue. “An error in Guidelines calculation is harmless if correcting the error would result in no change to the Guidelines offense level and sentencing range.” United States v. Cramer, 777 F.3d 597, 603 (2d Cir. 2015). The Guidelines provide that appropriate offense-characteristic enhancements are to be applied before the application of adjustments on account of the defendant‘s role, see Guidelines § 1B1.1(a); and without the personal-information enhancement, the two-step increases for each of the other two offense-characteristic enhancements (number of victims and sophisticated means) would have increased Cuomo‘s offense level from 6 to level 10. However, the guideline establishing the sophisticated-means enhancement—whose applicability Cuomo does not challenge on appeal—(see Government brief on appeal at 75; Cuomo reply brief on appeal at 21)—while initially providing for a two-step enhancement, dictates that “[i]f the resulting offense level is less than level 12, increase to level 12,” see Guidelines § 2B1.1(b)(10)(C) (emphasis added). Accordingly, even if Cuomo‘s challenge to the application of the personal-information enhancement were successful, the sophisticated-means enhancement would increase his enhanced offense level to level 12. The four-step adjustment for his leadership role increases his offense level to level 16, leaving his total offense level and sentencing range unchanged.
CONCLUSION
We have considered all of Cuomo‘s contentions on this appeal and have found them to be without merit. The judgment of the district court is affirmed.