UNITED STATES of America, Plaintiff-Appellee, v. Dimetriace Eva-Lavon JOHN, Defendant-Appellant.
No. 08-10459.
United States Court of Appeals, Fifth Circuit.
Feb. 9, 2010.
263
No. 08-11121, USA v. Harris, AFFIRMED; No. 08-11151, USA v. Williams, Sentence VACATED and REMANDED for resentencing with instructions.
OWEN, Circuit Judge:
Dimetriace Eva-Lavon John was found guilty by a jury on all counts of a seven-count indictment arising out of her involvement in a scheme to incur fraudulent charges on accounts held by various Citigroup customers. John challenges her convictions and sentence in this appeal. We affirm the convictions but vacate her sentence and remand for further proceedings.
I
Dimetriace Eva-Lavon John was employed as an account manager at Citigroup for approximately three years. By virtue of her position, she had access to Citigroup‘s internal computer system and customer account information contained in it. In September 2005, John provided Leland Riley, her half-brother, with customer account information enabling Riley and other confederates to incur fraudulent charges.
John accessed and printed information pertaining to at least seventy-six corporate customer accounts and provided it to Riley. The information was in the form of either scanned images of checks written by the account holders or printouts of computer screens containing detailed account information. Before he was apprehended, Riley and cohorts used information John had provided to incur fraudulent charges on four different accounts.
A grand jury returned a seven-count indictment against John. Count 1 charged John with conspiracy to commit access device fraud in violation of
Marc Woodson Barta, Asst. U.S. Atty. (argued), Dallas, TX, for U.S.
Kevin Joel Page (argued), Fed. Pub. Def., Dallas, TX, for John.
A Presentence Report (PSR) concluded that the Sentencing Guideline applicable to the conspiracy count was
II
John has raised several issues regarding her convictions. Her first contention is that the evidence was insufficient to support her convictions on Counts 6 and 7 under
Whether John‘s convictions on Counts 6 and 7 may be sustained depends on the proper interpretation of “exceeds authorized access” as used in
John was convicted of violating
(a) Whoever—
. . .
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (
15 U.S.C. 1681 et seq. ); . . .shall be punished as provided in subsection (c) of this section.3
The term “exceeds authorized access” is defined in
John argues that she was authorized to use Citigroup‘s computers and to view and print information regarding accounts in the course of her official duties. The evidence, she contends, reflects only that she was not permitted to use the information to which she had access to perpetrate a fraud, she could make changes to account information only in compliance with a customer‘s request, and she was not permitted to take material she printed regarding accounts from her office building. She asserts that her mental state or motive at the time she accessed or printed account information cannot determine whether she violated
We first note that John was not charged in Counts 6 or 7 with altering information in Citigroup‘s computer system. She was charged with “exceeding authorized access” and obtaining confidential Citigroup and Home Depot customer account information.
The statute at issue prohibits both accessing a computer “without authorization” and “exceed[ing] authorized access” to obtain specified information.4 The statute does not define “authorized,” or “authorization,” which is used in the definition of “exceeds authorized access.”5 The question before us is whether “authorized access” or “authorization” may encompass limits placed on the use of information obtained by permitted access to a computer system and data available on that system. We conclude that it may, at least when the user knows or reasonably should know that he or she is not authorized to access a computer and information obtainable from that access in furtherance of or to perpetrate a crime.
To give but one example, an employer may “authorize” employees to utilize computers for any lawful purpose but not for unlawful purposes and only in furtherance of the employer‘s business. An employee would “exceed[] authorized access” if he or she used that access to obtain or steal information as part of a criminal scheme.
In United States v. Phillips, this court analyzed whether a criminal defendant had accessed university computers “without authorization” in violation of
John‘s use of Citigroup‘s computer system to perpetrate a fraud was also contrary to Citigroup employee policies, of which she was aware. The First Circuit has held that an employment agreement can establish the parameters of “authorized” access. In EF Cultural Travel BV v. Explorica, Inc., the plaintiffs brought a civil action under the Computer Fraud and Abuse Act (CFAA)8 seeking injunctive relief against former employees who had become competitors.9 The former employees used their knowledge of codes that they had obtained while in their former employment to create a high-speed computer program to mine their former employer‘s public website for pricing information.10 The former employees had entered into a broad confidentiality agreement with their former employers protecting proprietary information.11 The First Circuit held “that because of the broad confidentiality agreement [the former employees‘] actions ‘exceed[ed] authorized access’ ” within the meaning of
While we do not necessarily agree that violating a confidentiality agreement under circumstances such as those in EF Cultural Travel BV would give rise to criminal culpability, we do agree with the First Circuit that the concept of “exceeds authorized access” may include exceeding the purposes for which access is “authorized.” Access to a computer and data that can be obtained from that access may be exceeded if the purposes for which access has been given are exceeded. In other words, John‘s access to Citigroup‘s data was confined. She was not authorized to access that information for any and all purposes but for limited purposes.
In the present case, the Government demonstrated at trial that Citigroup‘s official policy, which was reiterated in training programs that John attended, prohibited misuse of the company‘s internal computer systems and confidential customer information. Despite being aware of these policies, John accessed account information for individuals whose accounts she did not manage, removed this highly sensitive and confidential information from Citigroup premises, and ultimately used this information to perpetrate fraud on Citigroup and its customers.
We recognize that the Ninth Circuit may have a different view of how “exceeds authorized access” should be construed. In LVRC Holdings LLC v. Brekka, a civil proceeding, the Ninth Circuit construed
The Ninth Circuit‘s reasoning in Brekka was influenced by its recognition that “[f]irst, and most important,
There are no such concerns in the present case. An authorized computer user “has reason to know” that he or she is not authorized to access data or information in furtherance of a criminally fraudulent scheme. Moreover, the Ninth Circuit‘s reasoning at least implies that when an employee knows that the purpose for which she is accessing information in a computer is both in violation of an employer‘s policies and is part of an illegal scheme, it would be “proper” to conclude that such conduct “exceeds authorized access” within the meaning of
III
At trial, the Government presented testimony from an expert witness who opined that John‘s fingerprints were on Citigroup documents that were found in Riley‘s possession. John contends that the district court erred in admitting this testimony because it was never established that the evidence was reliable. John asserts that the error is not harmless because this evidence was necessary to connect John to the fraudulent scheme.
The Supreme Court has articulated a non-exclusive list of factors that a district court may consider in determining whether expert evidence is reliable: (1) whether the expert‘s technique can be tested; (2) whether the technique has been subject to peer review; (3) known or potential rate of error associated with the technique; (4) the existence of standards or controls; and (5) whether the technique or theory has been generally accepted in the scientific community.27 This test is flexible, and the proponent of the expert testimony need not satisfy each factor.28 Further, a district court has broad latitude in deciding how to determine reliability, as well as in its ultimate reliability determination.29
John‘s threshold argument is that the district court “abdicated its gatekeeping function” by failing to hold a Daubert hearing on the matter. However, we agree with a number of our sister circuits that have expressly held that in the context of fingerprint evidence, a Daubert hearing is not always required.30 As the Seventh Circuit has noted: “Those [courts] discussing the issue have not excluded fingerprint evidence; instead, they have declined to conduct a pretrial Daubert hearing on the admissibility of fingerprint evidence or have issued brief opinions asserting that the reliability of fingerprint comparison cannot be questioned.”31
We agree that in most cases, absent novel challenges, fingerprint evidence is sufficiently reliable to satisfy
John also asserts that the fingerprint evidence was inadmissible because the Government‘s expert did not explain how many matching points were required to determine that the prints were hers. She asserts that because of the expert‘s silence on the quantitative standard, the Daubert factors cannot be satisfied because the expert‘s technique is by definition standardless, untestable, and its error rate indeterminable.
We are unpersuaded by this argument because there is no universally accepted number of matching points that is required for proper identification, as this varies depending on the quality of the print.36 A number of circuits have determined that this “sliding-scale” procedure is testable, generally accepted, and sufficiently reliable37 and that its known error rate is essentially zero.38
Moreover, although the Government‘s fingerprint expert did not testify to a precise number of matching points, contrary to John‘s assertion, he gave extensive testimony regarding the uniqueness of fingerprints generally, as well as the particular identification methodology used. In fact, the expert provided a detailed step-by-step description of the identification process focusing on one specific print. As to this particular example, the expert also pointed out eight specific matching points to the jury and noted that more were found.
John challenges the reliability of the Government‘s fingerprint evidence because it was not subject to “blind verification,” which requires a second expert to match the prints without being told the results of the original test. However, we have not located any case law supporting John‘s assertion that blind verification is required.
John has not demonstrated that the district court abused its discretion by admitting the fingerprint expert‘s testimony. Issues regarding the accuracy of fingerprint evidence in a particular case gen-
Even if the district court erred in this respect, the error was harmless. The Government demonstrated at trial that all the account information in question was printed from John‘s computer on days that John was at work. Along with other evidence presented at trial, the jury could have reasonably reached the same verdict.
IV
During trial, the defense sought to introduce evidence that allegedly would have demonstrated that John‘s half-brother Riley had other inside sources at Citigroup. John contends that this evidence would have created reasonable doubt as to whether John was the informant who provided Riley with customer account information. To raise this doubt, the defense sought to have police officers who interro-gated Riley testify to statements he allegedly made. The Government objected on the basis that this testimony would be hearsay, and those objections were sustained.
John does not argue that this testimony would not have been hearsay or that it would have fallen within a hearsay exception. More importantly, John has not offered any proof as to what the officers’ testimony would have been and accordingly cannot prevail on a direct challenge to the district court‘s ruling.41 Nevertheless, John attempts to frame her evidentiary challenge as a constitutional issue. She argues that adherence to the hearsay rule in this case violated her right to “present a complete defense” under the Due Process Clause and the Compulsory Process Clause of the Sixth Amendment.
The Supreme Court has stated that a defendant‘s right to present a complete defense “is abridged by evidence rules that infringe upon a weighty interest of the accused and are arbitrary or disproportionate to the purposes they are designed to serve.”42 However, “the accused
John relies on Chambers v. Mississippi, in which the Supreme Court held that, given the particular facts of that case, exclusion of trustworthy hearsay evidence critical to the defense, coupled with an unrelated error, resulted in a denial of due process.44 However, the facts of Chambers45 are distinguishable. In Chambers, the district court excluded testimony, on hearsay grounds, by three different parties who would have testified that an individual other than the defendant admitted to committing the murder in question.46 The Court found that these particular statements, which were offered at trial, were made in “circumstances that provided considerable assurance of their reliability.”47 In particular, the Court noted that (1) the confessions were made spontaneously to close acquaintances shortly after the murder; (2) each statement was corroborated by other evidence; (3) the same confession was made three times; (4) the confessions were against interest; and (5) the person who allegedly made the confession was available to testify.48 No such evidence is present in this case. John offers only speculation as to what the witnesses in question would have said had they been allowed to testify.
Moreover, the Court‘s decision in Chambers did not rest solely on the hearsay issue. In Chambers, the defendant called the individual who confessed to the murder as a witness, but when cross-examined by the State, the witness repudiated his confession. The defendant, in turn, could not redirect because of the state‘s “voucher” rule, which barred parties from impeaching their own witnesses. Thus, in combination with the hearsay rule, the voucher rule—which the Court noted bore little relationship to the realities of the criminal process—completely prevented the defendant from impeaching a highly damaging witness.49 The Court‘s ultimate holding that the defendant was denied a fair trial rested on the combined effects of the hearsay and voucher rules. John‘s situation is not analogous to Chambers. The district court did not err.
V
John contends her convictions must be reversed because the Vice President of Citigroup for Risk and Commercial Operations, Mitch Raymond, improperly speculated as to what John‘s mental state must have been, suggesting to the jury that she acted with fraudulent intent. John also argues that Raymond‘s testimony was unsupported lay opinion in violation of
Prosecution: But assume [the account] had [an administrative block code], that date of 8/1/2003, and assume a call came in from somebody who was unknown to your person answering the phone, was
