Exceeding Authorized Access and the Kochind.com Mockup

As I’ve noted in earlier posts, federal and state “hacking” statutes criminalize two distinct types of unauthorized access: One is the “outsider” crime, in which the person was not authorized to have any access to the computer system at issue; the other is the “insider” crime, in which the person was authorized to access the computer system for certain purposes but (allegedly) exceeded the scope of the authorization in ways that violate the criminal statute at issue.

As I’ve also noted, the general federal computer crime statute – 18 U.S. Code § 1030 – creates a civil cause of action for those who have been injured by someone’s gaining unauthorized access to their computer system or someone exceeding the scope of their authorized access to such a system. Section 1030(g) says “[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief”.

This post is about a civil suit a corporation brought against certain defendants, alleging, among other things, that they either (i) gained unauthorized access to the company’s website or (ii) exceeded their authorized access to the site. The case is Koch Industries, Inc., v. Does, 2011 WL 1775765 (U.S. District Court for the District of Utah 2011). This, according to the opinion, is how the lawsuit came about:

Koch Industries is a Kansas corporation that owns multiple companies involved in a wide variety of industries, including oil, coal, chemicals, fibers, pollution control equipment, forest and consumer products, and commodity trading. . . .

Koch maintains a website under the domain name kochind.com. In addition to describing its companies, Koch's website expresses Koch's policy viewpoints on several political issues. The website also includes periodic editorials taking issue with such things as the conclusions of scientists regarding climate change and the Obama administration's environmental policies. Furthermore, Koch uses its website to respond to critics of its political viewpoints. Because of the nature of Koch's businesses, the website provides only information and there are no products for sale on the website.

During . . . this litigation, Defendants identified themselves as anonymous members of Youth for Climate Truth, a group concerned about global climate change. This case arises from a press release created by Defendants purporting to announce a decision by Koch Industries to stop funding organizations that deny climate change. The press release was emailed to various new organizations and included a link to a website created by Defendants, www.koch-inc.com.

Defendants' site had the same look as the actual Koch Industries site but included the fake press release. Defendants' site also contained a link to the actual Koch website.

Defendants' press release announced that Koch would `restructure its support for organizations that undertake climate change research and advocacy.’ The release claimed the company would withdraw funding from groups `whose positions on climate change could jeopardize America's continued global competitiveness in the energy and chemical sectors.’ Such sentiments were in stark contrast to the policy viewpoints usually expressed by Koch. The press release and website were designed to appear as though they were created by Koch and did not mention the name of Youth for Climate Truth or any of its members.

Koch Industries, Inc. v. Does, supra.

The opinion notes that the Does’ “fake website at www.koch-inc.com was up for a few hours” but still “drew a fair amount of media attention.” Koch Industries, Inc. v. Does, supra. It also notes that the New York Times and The Hill “wrote articles identifying the press release and website as hoaxes”, as did other print and online sources. Koch Industries, Inc. v. Does, supra. Although, according to the opinion, there is “no evidence any media organization was fooled” by the Does’ actions, Koch Industries sued, alleging various causes of action. Koch Industries, Inc. v. Does, supra.

You may wonder who these “Does” are. When Koch Industries filed the lawsuit, it didn’t know their names, so it used the “John Doe” procedure. As you can read in this short online article about drafting a federal complaint, plaintiffs who want to sue someone but don’t know their identity can file a complaint naming John Doe (or John Doe #1, John Doe #2, John Doe #3, etc.) as the defendant(s). Once the plaintiff finds out the identity or identities of the defendant(s), he/she/it can then amend the caption of the complaint to add their real names.

That is what Koch Industries did here:

After filing the Complaint, Koch filed an ex parte motion for accelerated discovery to seek the identity of the anonymous Defendants. Koch sought to serve subpoenas on Fast Domain, the domain registration company Defendants used to register the domain name koch-inc.com, and BlueHost.com, the web-hosting company Defendants used to set up the fake website. This court granted Koch's motion and the subpoenas were served.

Because of the media's coverage of the court's order allowing the issuance of subpoenas to uncover the identity of the Defendants, [they] learned of the lawsuit and filed the present motion. In filing the motion, Defendants disclosed the name of the group behind the fake press release and website. . . . [but] seek to keep the names of the individuals involved anonymous. Although the web companies complied with the subpoenas, the identities of individuals who may have been disclosed through such compliance have not been disclosed publicly or to the court.

Koch Industries, Inc. v. Does, supra.

The “motion” the court refers to is the Does’ “Motion to Quash Subpoenas, Issue Protective Order, and Dismiss Complaint.” Koch Industries, Inc. v. Does, supra.

The parts that sought the protective order and the quashing of the subpoenas were obviously intended to preserve the anonymity of the various Does. The motion to dismiss the complaint was a direct attack on the lawsuit, which is why the district court judge addressed it first.

Koch Industries asserted three causes of action: trademark infringement and unfair competition; a violation of the Anticybersquatting Consumer Protection Act; and, as noted above, a violation of 18 U.S. Code § 1030. Koch Industries, Inc. v. Does, supra.

I’m not going to deal with the first two because it would take too long and because they don’t implicate criminal law as directly as the § 1030 claim. If you want to read about how the judge dealt with them, you can find the opinion here.

To prevail in a claim under 18 U.S. Code § 1030(g), the plaintiff has to prove that the defendant committed a computer crime, i.e., violated the criminal provisions of § 1030. The plaintiff, of course, seeks damages and other civil relief, not the incarceration or other punishment of the defendant.

In its § 1030(g) claim, Koch Industries seems to have alleged that the Does committed either or both of the crimes I described above:

Koch asserts that in creating the fake website Defendants acted without authorization and inconsistent with the company's grant of access. Even if Defendants had some limited authorization, Koch contends that they acted beyond the authorization granted by breaching its website's Terms of Use. Accordingly, Koch's [§ 1030] theory is [based on Koch’s claim] that Defendants agreed to the Terms of Use by using Koch's website.

Koch Industries, Inc. v. Does, supra.

The district court judge didn’t buy either theory:

To state a plausible claim under § 1030, one must be guilty of gaining `unauthorized access’ or `exceeding authorized access’ to a protected computer system. But in this case, Defendants created a mockup of Koch's website using information Koch made `publicly available on the Internet, without requiring any login, password, or other individualized grant of access.’ Cvent, Inc. v. Eventbrite, Inc., 739 F.Supp.2d 927 (E.D. Va. 2010). `By definition, therefore, [the defendants] could not have ‘exceeded’ [their] authority to access that data.’

Koch Industries, Inc. v. Does, supra. The judge noted that in Cevent,

as with Koch's website, the defendant took `no affirmative steps’ to prevent such access. The website was `not password-protected, nor [were] users of the website required to manifest assent to the Terms of Use, such as by clicking “I agree” before gaining access to the database. Rather, anyone . . . [could] access and search [the] information at will.’ Like Koch's website, the Terms of Use did `not appear in the body of the first page’ of the website; instead “`t]he link to access the Terms [was] buried at the bottom of the first page.’ Accordingly, the site was `not protected in any meaningful sense by its Terms of Use or otherwise.’

Koch Industries, Inc. v. Does, supra.

The district court judge therefore found that the Does were given

unimpeded access to the information on Koch's public website. Koch's complaint is not that Defendants obtained the information without authorization, but rather that they ultimately used the information in an unwanted manner. [Section 1030] addresses only the act of trespassing or breaking into a protected computer system; it does not purport to regulate the various uses to which information may be put.

Koch Industries, Inc. v. Does, supra.

Finally, the judge explained that while this was a civil suit under § 1030, his conclusion as to the extent of the

conduct prohibited by [§ 1030] `is equally applicable in the criminal context’ and must be interpreted consistent with the `rule of lenity,’ avoiding `surprising and novel’ interpretations that `impose unexpected burdens on defendants.’ LVRC Holdings LLC, 581 F.3d 1127 (9^th Cir. 2009). If Koch's legal theory is correct, any violation of its Terms of Use -- that is, any use of its website's content of which Koch does not approve -- could expose a political critic to criminal prosecution. Such a result is clearly beyond Congress' intent in passing [18 U.S. Code § 1030].

Koch Industries, Inc. v. Does, supra.

The judge therefore dismissed Koch’s § 1030 claim, along with the other claims it asserted in the complaint. Koch Industries, Inc. v. Does, supra. And that, of course, mooted the Does’ requests to quash the subpoenas Koch had issues and to have the court issue a protective order safeguarding their identities. Koch Industries, Inc. v. Does, supra. By granting the motion to dismiss, the judge ended the lawsuit. Koch Industries, Inc. v. Does, supra.

The Website, Arson and Thorazine

As Wikipedia notes, the crime of arson is generally defined as “intentionally or maliciously setting fire to structures or wildland areas.” The Model Penal Code, an influential template of criminal laws, expanded the definition of the crime a bit. Under § 220.1(1) of the Model Penal Code someone “is guilty of arson . . . if he starts a fire or causes an explosion with the purpose of” destroying a building or occupied structure or “destroying or damaging any property . . . to collect insurance for such loss.”

This post examines a recent opinion from the Iowa Supreme Court that involved, in part, an issue involving the definition of arson. The case is State v. Soboroff, __ N.W.2d __, 2011 WL 1900219 (2011), and this is how it arose:

The City of Calamus water system serves approximately 400 residents and an additional 350 people when the elementary school . . . is in session. In November 2007, the Calamus water system included a 128–foot tall water tower and a reservoir tank.

Duane Levien. . . . oversaw the water system for Calamus. . . . . On November 12, 2007, Levien was approached by an unnamed citizen and handed a printout from a website known as `freeworldkgb.’ [It] was of a slideshow entitled `Target for Tonight.'

The first slide contained a photograph of the Calamus water tower with the text, `I am thinking that if we drop enough Thorizine (sic) in the city water supply it might calm the population down enough so they wont (sic) call us n–––––s anymore, or dumb Jew n–––––s.’ The second slide had a photograph of a toad and said `with his help, freeworldkgb has procured 500 pounds of Thorizine (sic).’ Subsequent slides contained photographs of three city residents with various comments, including a statement, `I have decided that they could use some medication.’ . . . [T]he `freeworldkgb website belonged to [Jeffrey] Soboroff.

Levien knew Soboroff . . . had both made and been the subject of complaints within the community. Levien had signed a petition to have Soboroff civilly committed in June or July 2007. . . .

Levien believed `Target for Tonight’ was a reference to the previous night. He contacted the Sheriff's Office and the regional field office for the Iowa Department of Natural Resources. Levien then flushed the entire Calamus water system and drained all the water out of the tower and the reservoir tank, a process that took five to six hours. [He] did not take a sample of the water to test whether any Thorazine had actually been placed into the water tower or the reservoir tank.

State v. Soboroff, supra.

Deputy Christoffersen responded to Levien’s call, was shown the slideshow and went to Soboroff’s home to speak with him. State v. Soboroff, supra. He used “the audio from his in-car camera” to record the conversation. State v. Soboroff, supra. The recording began with Soboroff saying, “`I'm not f–––ing around with anybody anymore. I'm tired of these a-holes.’” State v. Soboroff, supra. When Christoffersen told him someone had made a complaint, “Soboroff said, `F–––‘em! I put that on there to irritate them, and I'm glad they're irritated.’” State v. Soboroff, supra.

A couple of days later, officers executed a search warrant at Soboroff’s home. State v. Soboroff, supra. Soboroff recorded the search with a handheld video camera, and then posted the video online. State v. Soboroff, supra.

During the video, Soboroff acknowledged twice that the officers were looking for 500 pounds of Thorazine. When [they told] Soboroff they were seizing his computer, [he] questioned why, and then stated, `Look, that is a satirical article, that's all that that is.’ The background image on Soboroff's computer was a picture of the Calamus water tower. The officers did not find any Thorazine during the search.

State v. Soboroff, supra.

About a week later, Soboroff was charged “by trial information with threats in violation of Iowa Code § 712.8”. State v. Soboroff, supra. Section 712.8 states that anyone who “threatens to place . . . any incendiary or explosive device or material, or any destructive substance or device in any place where it will endanger persons or property, commits” a felony. Soboroff moved to dismiss the charge “on the ground there was no evidence . . . he had made a threat involving `any incendiary or explosive device or material, or any destructive substance or device’” as required by the statute, but the trial judge denied the motion, holding that § 712.8 “ was not limited to incendiary or explosive types of devices and materials.” State v. Soboroff, supra.

The case went to trial. After the evidence had been presented, and before submitting the case to the jury, the judge instructed them that to convict Soboroff they had to find beyond a reasonable doubt (i) that he threatened “to place a destructive substance” in the city’s water supply, (ii) that the substance “as of a type that would endanger persons or property” and (iii) that he “made the threats willfully and unlawfully.” State v. Soboroff, supra. The jury found Soboroff guilty, the judge sentenced him to a prison term “not to exceed five years” but suspended the sentence and put him on probation for two years.” State v. Soboroff, supra.

Soboroff then appealed, arguing that the evidence presented at trial was “insufficient evidence to sustain his conviction because § 712.8 which is part of the `arson’ chapter of the Iowa Code, applies only to threats . . . involving materials that might cause fires or explosions, not to materials whose harmful effects occur when they are consumed within the human body.” State v. Soboroff, supra. The prosecution, on the other hand, argued that “Thorazine was a “destructive substance or device” in this case because it could ruin the water supply and endanger people.” State v. Soboroff, supra.

The Supreme Court began its analysis of these arguments by noting that its “primary goal in interpreting a statute is to ascertain and give effect to the legislature’s intent.” State v. Soboroff, supra. It also noted that the state legislature “has not told us what they meant by `destructive substance or device.’” State v. Soboroff, supra. So it did what courts usually do in this situation, i.e., check out dictionary definitions. The court explained that the word “destructive” “is broad. It is defined by one dictionary as `having the capability, property, or effect of destroying.' Webster's Third New International Dictionary 615 (unabr. ed. 2002). `Destroy’ is then defined as: `to ruin the structure, organic existence, or condition of.’ Id.” State v. Soboroff, supra.

The Supreme Court noted that in U.S. v. Jones, 308 F.3d 748 (2002), the U.S. Court of Appeals for the 7^th Circuit held that anthrax spores would be a “destructive substance” within the meaning of 18 U.S. Code § 31(a)(3), which defines “destructive substance” as “an explosive substance, flammable material, . . . or other chemical, mechanical, or radioactive device or matter of a combustible, contaminative, corrosive or explosive nature”. State v. Soboroff, supra (emphasis added). It also noted that the legislature did not specifically limit the scope of § 712.8 to explosive or incendiary materials; instead, it added the reference to a “destructive substance or device”, which must have been meant to expand the statute’s applicability beyond that of traditional arson statutes. State v. Soboroff, supra.

Finally, the Iowa Supreme Court noted that it was true that while “what Soboroff did would not have been considered a threat to commit common law arson”, § 712.8’s “presence in the arson chapter [of the Iowa Criminal Code] is largely a historical accident.” State v. Soboroff, supra. The court explained that the original version of the statute was included in a section of the Criminal Code that was entitled “Injuries by Explosives – Bomb Threats.” State v. Soboroff, supra. When the Criminal Code was revised “effective January 1, 1978,” what is now § 712.8 “was modified and moved to the arson chapter” of the Code. State v. Soboroff, supra.

The Court then explained that the present arson chapter (chapter 712) of the Code

includes not only §§ 712.1 through 712.6, which appear to be arson-related laws that address only fires, explosions, and `incendiary or explosive’ materials and devices, but also §§ 712.7 and 712.8, covering `false reports’ and `threats.’ Unlike the preceding provisions in chapter 712, §§ 712.7 and 712.8 apply to materials that are `destructive,’ as well as those that are `incendiary or explosive .’ If anything, the difference in wording between §§ 712.1 through 712.6 . . . and §§ 712.7 and 712.8, not to mention their separate ancestry, supports a broader interpretation of the latter provisions.

State v. Soboroff, supra.

The Supreme Court therefore agreed with the trial judge that § 712.8 can encompass a

threat to put . . . a psychotropic drug into a town's water supply. This kind of threat, like a threat to release radioactive -- but not incendiary or explosive -- matter, can be viewed . . . as involving a `destructive substance.’ Substantial evidence therefore supports a jury finding that Soboroff's statements on his website related to the placement of a destructive substance in a place where it would endanger people.

State v. Soboroff, supra.

The court did not, though, affirm Soboroff’s conviction. He also argued, on appeal, that his attorney was ineffective for “not requesting a jury instruction that defined “threat” and made it clear that a reasonable person of ordinary intelligence would have understood Soboroff’s comments and actions as a “threat” under § 712.8. State v. Soboroff, supra. The Iowa Supreme Court agreed with Soboroff on this one:

While there was substantial evidence of a real threat, there was also evidence from which a jury could have concluded that Soboroff's statements were `idle talk.’ . . .The State's own expert testified that Thorazine is available only by prescription and in small quantities. It would be `near[ly] impossible’ to obtain 500 pounds of it. Someone who claimed to have such a quantity might not have deserved to be taken seriously.

Also, there was no evidence Soboroff intentionally disseminated his statements to anyone, apart from putting them on his website. And, although it is a double-edged sword, [his] reputation for instability could have supported a jury finding that a reasonable person would not take his statements. . . . [H]ad the jury been instructed on the `reasonable person’ standard for illegal threats, we think there is a reasonable probability the outcome . . . would have been different. . . .

State v. Soboroff, supra. It therefore reversed the conviction and remanded the matter for a new trial. State v. Soboroff, supra. If you’d like to read a little more about Soboroff and the facts in this case, check out the news story you can find here.

I usually don’t opine on the outcome of the cases I write about, primarily because I sympathize with the judges, lawyers, officers, defendants and others who are involved. It’s one thing to criticize someone’s competence in a private conversation, another to “publish” your two cents on someone’s alleged fallibility.

My two cents on this case doesn’t involve criticizing any of the lawyers or judges in the case, at least not as such. I can see the logic of the Iowa Supreme Court’s analysis of whether § 712.8’s reference to a “destructive substance” can be construed to reach substances that harm people, rather than property. My reservations about the propriety of this approach are based on a basic principle of criminal law (actually, all law): As a website explains, law “must be knowable: in other words, the content of the Law. . . must be published by the State in such a way that all citizens can discover what rights and responsibilities are given to, or imposed upon, them”.

Since the threat statute at issue in this case is codified in the arson chapter of the Iowa Criminal Code, and since it encompasses the use of incendiary and explosive materials and devices, I think a reasonable person would understand it as an arson threat statute, not a drug threat statute. I also suspect that when the statute uses the term “destructive”, it means – or was originally intended to mean – materials and devices that damage or destroy property, not people. I think, therefore, that it would be a good idea for the Iowa legislature either to make it explicit that § 712.8 encompasses threats to use materials or devices that damage or “destroy” people, as well as property . . . assuming, of course, that the Iowa Code doesn’t have another threat statute that might address this type of conduct.

Community College, Grades and Computer Fraud

A law dictionary – indeed, what is probably the classic law dictionary – defines “fraud” as a “knowing misrepresentation of the truth or concealment of a material fact to induce another to act to his or her detriment.” Black’s Law Dictionary (9^th ed. 2009). Black’s is defining the traditional kind of fraud: As I’ve noted in earlier posts, the crime we know as fraud was developed centuries ago to address a type of theft.

As I explained in those posts, theft is taking someone’s property without their permission; it becomes robbery if you use force to take the property. Fraud, though, is different: You use false statements to trick the victim into handing over his/her property voluntarily . . . so it’s really not “theft” in the classic sense. That’s why English common law came up with the new crime of “larceny by trick”, or theft by trick, which eventually became known as “fraud.” You trick the person into giving you their property, which they wouldn’t do if they weren’t operating under a misapprehension as to what the facts are.

That brings me to the evolved type of fraud we’ll examine in this post: “Computer fraud” in violation of California law. California Penal Code § 502(c)(1) says that anyone who

[k]nowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data [is guilty of a crime].

Under California Penal Code § 502, then, computer fraud has the following elements: (i) knowingly (ii) accessing and altering/damaging/deleting/destroying/using data to (iii) devise/execute a scheme to defraud or wrongfully control/obtain money, property or data. Section 182(a)(1) of the California Penal Code makes it a separate crime for “two or more persons” to conspire to “commit any crime”, including computer fraud.

And that brings us to People v. Nemati, 2011 WL 1792278 (California Court of Appeals 2011). Khalid Nemati was charged with and convicted of one count of conspiracy to commit computer fraud in violation of §§ 182(a)(1) and 502(c)(1). People v. Nemati, supra. According to the Court of Appeals’ opinion, this is what the conspiracy involved:

[Nemati] was one of several persons involved in a scheme to alter grades recorded in the computer system of Diablo Valley College (Diablo Valley), a community college with an enrollment exceeding 20,000 students. A student who worked in the Diablo Valley admissions office, Rocky Servo, was given access to the school's records database and discovered he could alter grades recorded in the system. At some point in 2003, Servo began to accept money in return for changing students' recorded grades.

When Servo was fired for unrelated reasons in 2004, he recruited a coworker to carry on the grade-change operation. When this student transferred to another school in 2006, he passed the business to a third student. The operation unraveled in February 2006, when this student was terminated from the admissions office and confessed to police. . . .

Servo knew [Nemati], a student at Diablo Valley, prior to the commencement of the scheme. At some point in 2004, Servo began accepting grade-change requests from [Nemati] on behalf of other students. [He] gave Servo envelopes containing the requests and money collected from the requesting students, and Servo made or arranged for the changes.

Servo continued to accept such requests from [Nemati] after he left the admissions office in September 2004, passing them to his successor, and eventually met with [Nemati] `four or five’ times, accepting `two or three’ grade-change requests each time. Four Diablo Valley students testified they gave [Nemati] a list of classes and cash and later learned their grades had been changed.

People v. Nemati, supra.

According to the opinion, when Nemati testified at trial he “acknowledged a passing acquaintance with Servo,” admitted knowing another witness, conceded “acquaintance with a third witness and “said a fourth . . . looked familiar”. People v. Nemati, supra. He also denied “any involvement in the grade-changing scheme” but could not “explain why the witnesses chose to implicate him.”

After he was convicted, Nemati appealed his conviction to the Court of Appeals, raising two issues we’ll get to later in this post. I want to begin by analyzing whether the grade changing operation amounted to computer fraud in violation of § 502(c)(1). To do that, let’s analyze what the opinion says Servo did; for the purposes of analysis, only, we’ll assume Servo engaged in the conduct the opinion attributes to him.

According to the court, he “accessed” a computer system and “altered” data. If we accept what the court says, then Servo committed the first two elements of computer fraud. What about the third element? The first option here is that the data was accessed and altered to execute a scheme to defraud. As I noted above, “fraud” involves deceiving someone to trick them into surrendering property or money. Who, then, would this scheme have been designed to defraud? Presumably it wasn’t the students who were paying to have their grades changed, because they got what they paid for. Was it the college itself? . . . the other students, those who didn’t pay to have their grades changes? I don’t see how it could be the other students because they weren’t defrauded into surrendering anything of value; the surrender, if one existed, came on the part of the college’s computer system (or the college, maybe). I’m not sure these facts would support a true “fraud” case.

That brings us to the second option for the third element: that the scheme was to wrongfully obtain money or property. (The statute also includes data, but I don’t see that the data was the object of the scheme we’re postulating here.) Black’s Law Dictionary defines “wrongful” as “[c]ontrary to the law; unlawful”. Was it contrary to the law to take money to change grades? It looks like bribery, but I couldn’t find a California bribery statute that applied here; the ones I found applied to bribing government officials, jurors, employees of financial institutions, employees who take money to give up trade secrets, etc. If we accept what the opinion says about what Servo and the others were doing, it clearly involved obtaining money, so that doesn’t seem a problematic factor. But it looks like establishing that the conduct was “wrongful” could be somewhat problematic.

That, I’m afraid, ends my digression on the substantive crime of computer fraud . . . with which, of course, Nemati was not charged. He was charged with conspiring to commit computer fraud and appealed, arguing that the conviction should be set aside for either or both of two reasons.

One was the applicable statute of limitations. As the opinion explains, the statute of limitations for

conspiracy is generally held to be three years, commencing with the last overt act committed in furtherance of the conspiracy.. . . The last overt act in furtherance alleged in the information occurred on August 16, 2005. The statute ran from that date until an arrest warrant was issued on September 30, 2008, more than three years later. . . . Accordingly, under the allegations of the information, the prosecution was not commenced until after the expiration of the statute of limitations.

People v. Nemati, supra.

The prosecution argued that the case was commenced before the statute of limitations ran because “there was evidence at trial of acts in furtherance of the conspiracy as late as February 2006, thereby proving the prosecution timely under a three-year statute”. People v. Nemati, supra. The Court of Appeals agreed with the prosecution:

Julian Revilleza, assumed grade-changing duties after Servo's firing in 2004. Although Revilleza did not describe any specific grade changes after September 2005, it can be inferred from his testimony that he made such changes periodically but continuously from the time he took over until he transferred to another college in January 2006, after training his replacement, Jeremy Tato. . . .

Tato testified he made several grade changes between January and February 2006. Finally, the changes requested by [Selymon] Shahsamand and arranged by [Nemati] occurred in February 2006. All of this activity was undertaken in furtherance of the conspiracy. . . . Accordingly, there is no question the prosecution was timely commenced under a three-year statute of limitations.

People v. Nemati, supra.

Nemati’s other argument arose under Penal Code § 111, which provides as follows:

A conviction can not be had upon the testimony of an accomplice unless it be corroborated by such other evidence as shall tend to connect the defendant with the commission of the offense; and the corroboration is not sufficient if it merely shows the commission of the offense. . . .

An accomplice is . . . one who is liable to prosecution for the offense charged against the defendant on trial in the cause in which the testimony of the accomplice is given.

California Penal Code § 111.

At trial, the judge “properly identified Servo and the four witnesses who testified they gave money to [Nemati] as accomplices to the conspiracy and instructed the jury that additional corroborating evidence was required to tie [him] to the crime.” People v. Nemati, supra. Nemati argued that the jury’s “implicit finding of such evidence was unsupported”, i.e., corroborating evidence wasn’t presented. People v. Nemati, supra. And the Court of Appeals noted there was no direct evidence of Nemati’s involvement

in the conspiracy outside the testimony of the accomplices. No written communications by [Nemati] relating to the conspiracy were submitted. While there was documentary evidence confirming that grade changes occurred at the times and in the manner claimed by the witnesses who paid [Nemati], none of this documentary evidence mentioned [him]. Further, each of the non-accomplice witnesses either was unaware of [Nemati] or was familiar with his name only because it had been mentioned by one of the accomplices during the investigation.

People v. Nemati, supra.

Notwithstanding this, the court found that “adequate corroborating evidence” was

provided by [Nemati’s] testimony that he knew Servo and three of the four witnesses who claimed to have given him money to obtain grade changes. This acknowledgment confirmed that [Nemati] was in a position to play exactly the role the witnesses unanimously claimed for him: that of intermediary between Servo, who controlled access to the persons making the grade changes, and the students who provided money to obtain grade changes. . . . [T]he admission thereby tends to implicate [Nemati] by relating to an element of the crime -- the agreement necessary between participants in a conspiracy.

People v. Nemati, supra.

The Court of Appeals also noted that Nemati’s “acknowledged personal connections, and his inability innocently to explain their incriminating nature, permitted the jury to be reasonably satisfied that the common story of these witnesses was true.” People v. Nemati, supra.

The court therefore affirmed Nemati’s conviction and, in so doing, upheld the sentence of three years’ probation imposed on him by the trial judge. People v. Nemati, supra.