Computer Theft and “Access”

This post examines a recent decision from the Superior Court of New Jersey – Appellate Division. The case is State v. Kin Chi Wong, 2011 WL 2437225 (2011), and it arises from Wong’s conviction on second-degree computer theft in violation of New Jersey Statutes § 2C:20-25 and third-degree theft by deception in violation of New Jersey Statutes § 2C:20-4. State v. Kin Chi Wong, supra.

We’re only concerned with the computer theft conviction which arose from what the opinion refers to as an “elaborate scheme” in which Kin Chi Wong opened four

accounts at TD Bank, when it was Commerce Bank. . . . Two . . . were in the name of Yi Han Zheng and the other(s) were in the name of Xi Yi Gao.

[F]rom November 2006 to August 2007, . . . Commerce Bank had a policy of making funds readily available to its customers on the next business day after a check was deposited into an account. Following several legitimate deposits into the Zheng accounts, a series of checks, in amounts such as $20,000 and $50,000, were deposited [and] were then immediately drawn upon by use of a Visa card linked to the accounts.

Numerous cash advances were taken against the accounts through the Global Cash Access (GCA) computer system at Trump Plaza Casino in Atlantic City (Trump). . . .

The deposited checks were subsequently determined to be void for insufficient funds, and the Zheng accounts became overdrawn. When the bank closed the two Zheng accounts for fraudulent activity in December 2006, the combined loss on the accounts was $25,622.98.

About one week before the bank closed the Zheng accounts, checking and savings accounts were opened in the name of Xi Yi Gao at another branch in New York. These accounts were also linked to a Visa debit card. The same pattern ensued: a series of legitimate deposits were made into the accounts, followed by a series of larger deposits, which were immediately drawn upon by use of the debit card before the checks in question proved void for insufficient funds. The Visa card was used to make a series of withdrawals through the GCA service at Trump in August 2007. The bank closed the Gao accounts in September 2007 for fraudulent activity; the bank's loss on the two accounts totaled $52,068.02.

State v. Kin Chi Wong, supra.

Commerce Bank investigative analyst Kelly Loverdi, who was assigned to the Gao case "[i]dentified a “connection to the Zheng accounts, as the same maker deposited checks in Gao and Zheng's accounts.” State v. Kin Chi Wong, supra. She contacted State Police Detective Eric Hubbs in January 2008 about “the GCA transactions at Trump.” State v. Kin Chi Wong, supra. She gave Hubbs “dates in November 2006 and August 2007” and he obtained surveillance tapes of logs for those dates. State v. Kin Chi Wong, supra. On April 20, 2008, a surveillance officer at Trump contacted Hubbs and told him “Xi Yi Gao was in the casino.” State v. Kin Chi Wong, supra. State troopers responded and arrested a man who “identified himself as Kin Chi Wong.” State v. Kin Chi Wong, supra.

When he was arrested, Kin Chi Wong was carrying three New York driver’s licenses in the names of

Kin Chi Wong, Yi Han Zheng and Xi Yi Gao; two Trump player cards, a Total Rewards card and a Hilton Casino player card in the name of Xi Yi Gao; a Bank of America Visa card in the name of Zhang Wei Guang; a Capital One Platinum card in the name of Yuet M. Chik; a Washington Mutual Visa card in the name of Xiu Qi; a Chase Visa card in the name of Xiu F. Qi; a Citibank Mastercard in the name of Xiu Fang Qi; an ATM receipt for a $2004 withdrawal from the Citibank Mastercard in Qi's name; an Auction Access card in the name of Kin Chi Wong; and a guest card receipt from Trump.

State v. Kin Chi Wong, supra. After reviewing these documents, surveillance tapes and photographs “from both Trump and the bank,” Hubbs determined that Kin Chi Wong was the person who “`was using different identifications . . . at the bank as well as in the casino”. State v. Kin Chi Wong, supra.

As noted above, based on all this and other evidence, Kin Chi Wong was charged with computer theft in violation of New Jersey Statutes § 2C:20-25. We’ll get to the nature and elements of that charge in a minute. First, we need to review testimony on which the prosecution relied to prove the charge at trial:

Marianne Simpson works at the GCA facility in Trump. She described GCA as a company that allows people to `take advances on their credit cards. . . . [GCA is] like the middleman.’ She described the process . . .as follows:

`They could . . . go to the A.T.M., and the A.T.M. would give them the funds or . . . process the receipt which would tell them to go to the cashier. If they . . . took the receipt, came to the cashier, the cashier would take their ID, their credit card, run it through the computer, make sure all the information: customer's name, address, ID, was in the system, then it would print up a check. On the back of the check, we would emboss the credit card, time stamp it with our time stamp, and have the customer initial the fee and sign the front of the check. Then we would compare the . . . signature on the check to the one on the credit card and the ID. . . .'

`[I]f they swipe it through the A.T.M., then when we swipe it at the cage, it processes it through with the dollar amount, but if they come right to us, we . . . follow the same . . . procedures. We just have to put in the dollar amount they requested.’

Simpson [said] GCA services are provided through a computer system, and each cashier has a terminal. She identified a series of GCA-issued checks in the names of Zheng, from November 2006 and Gao, from August 2007. The checks indicated that a Visa credit card was used for the transactions.

Alexis Esquilin, an employee of GCA, described the service and its processes in greater detail. At Trump, casino employees run GCA's service. The equipment GCA provides to process transactions is a computerized, `web-base[d]’ product. Once the cashier is satisfied with the identification presented by the customer, such as `a driver's license . . . or a passport[,]’ the cashier `run[s] the transaction through a kiosk or a terminal at which time it goes out to [GCA's] authorization center. It then in return goes out to the issuing bank. They either accept or decline the transaction based upon available funding. [It g]oes back to [GCA's] authorization center at which time the cashier gets a message either to print the check or that the transaction's been declined.’

State v. Kin Chi Wong, supra.

This evidence was, as I noted above, submitted to prove the computer theft charge. Under New Jersey Statute § 2C:20-25(c), a “person is guilty of” computer-related theft if he/she “purposely or knowingly and without authorization” accesses or attempts to

access any data, data base, computer, computer storage medium, computer program, computer software, computer equipment, computer system or computer network for the purpose of executing a scheme to defraud, or to obtain services, property, personal identifying information, or money, from the owner of a computer or any third party. . . .

The offense is a “crime of the second degree” if “the value of the services, property, personal identifying information, or money obtained or sought to be obtained exceeds $ 5,000” (which doesn’t seem a problem here). New Jersey Statute § 2C:20-25(g).

Kin Chi Wong argued, at trial and again on appeal, that the prosecution didn’t prove beyond a reasonable doubt that he “accessed” a computer as that term is used in New Jersey Statute § 2C:20-25(c). State v. Kin Chi Wong, supra. According to this opinion, he “interpret[ed] the statute as requiring that he personally operate the computer in the course of `executing a scheme to defraud, or to obtain . . . money, from the owner of a computer or any third party.’” State v. Kin Chi Wong, supra. It's not an obviously specious argument; as I’ve probably noted in earlier posts, and as those familiar with the evolution of “hacking” and computer intrusion crimes know, they have traditionally involved perpetrators who personally “broke into” a computer system, either for the sake of simply gaining “access” to the system or for the purpose of facilitating a crime such as theft or fraud.

The Appellate Division pretty summarily rejected this interpretation of the statute, noting that it was “satisfied that such a strained interpretation finds no support in the statute and, in fact, is inconsistent with the broader language prohibiting `otherwise mak[ing] use’ of a computer for a fraudulent purpose.” State v. Kin Chi Wong, supra.

As to the “broader language”, the court first pointed out that the “legislative history of the computer theft statutes indicates that `[t]he intent of th[e] bill [was] to provide a comprehensive approach to prosecuting the increasing varieties of computer abuse.’” State v. Kin Chi Wong, supra (quoting Assembly Judiciary Committee, Statement to A–1301 (March 26, 1984)). It then noted that the “statutory definition of `access’ is consistent with such a `comprehensive approach.’” State v. Kin Chi Wong, supra.

As to the second point, New Jersey Statute § 2C:20-23(a) defines “access” as “to instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer storage medium, computer system, or computer network.” The question, then, was whether Kin Chi Wong had engaged in any of the acts that constitute “access”.

I don’t have the briefs in the case so I can’t be sure precisely what his argument was, but I think this passage from the Appellate Division at least suggests what his theory was:

Esquilin did not specifically testify that either the cashier or the customer `swiped’ the credit card at the cashier's terminal. The prosecutor asked, `what kind of system is used to . . . facilitate the communication between the card being swiped, your authorization center, the authorizing bank, and then back to the authorization center?’ (Emphasis added.) Esquilin responded with the name of the product, `K.C.P.W.,’ which she described as a web-based product[,]’ meaning `it's all done through the Internet . . . via computer’ [and did not] correct or otherwise comment on the prosecutor's reference to a card `being swiped.’

State v. Kin Chi Wong, supra.

The Appellate Division did not find process of “swiping” a card relevant to the state’s case against Kin Chi Wong:

The testimony of Simpson and Esquilin established beyond a reasonable doubt that GCA's services are provided by computer, including access to the Internet. It is of no moment whether defendant or a cashier swiped the Visa card at the terminal in the GCA kiosk, or whether defendant used that card first at an A.T.M. machine to produce a receipt upon which GCA relied in accessing the cash on his behalf through its computer, The evidence clearly established that defendant `ma[d]e use of’ the `resources of’ GCA's “computer . . . [and] computer network.’

State v. Kin Chi Wong, supra. The court also found that the evidence proved that

defendant `ma[d]e use of’ GCA's computer/network services to obtain cash fraudulently [as required by the New Jersey Statutes § 2C:20-25(c)]. [He was clearly aware of the bank's `immediate access’ policy and took advantage of that policy to make withdrawals immediately upon the deposits of the insufficiently funded checks.

State v. Kin Chi Wong, supra.

“Crime Zone” and Expert/Lay Witness Testimony

As Wikipedia explains, an expert witness is someone who “ by virtue of education, training, skill, or experience is believed to have . . . specialized knowledge in a particular subject . . . sufficient that others may . . . legally rely upon the” witness’ “opinion about an evidence or fact issue within the scope of his expertise.”

The other type of witness who testifies at trials and other court proceedings is the “lay witness,” which one site defines as “[a]ny witness not testifying as an expert witness and who is thereby generally precluded from testifying in the form of an opinion.”

As I’ve noted in other posts, in the United States each state and the federal system has, respectively, rules of evidence that govern who can testify and in what capacity (expert or lay witness) and the matters as to which they can testify. Since this post is going to deal with a case from Texas, I’ll use the Texas Rules of Evidence to illustrate how these rules deal with expert and lay witnesses.

Texas Rule of Evidence 701 deals with the issue noted above: opinion testimony by lay witnesses. It states that

[i]f the witness is not testifying as an expert, the witness' testimony in the form of opinions or inferences is limited to those opinions or inferences which are (a) rationally based on the perception of the witness and (b) helpful to a clear understanding of the witness' testimony or the determination of a fact in issue.

Texas Rules of Evidence 702 deals with expert testimony, stating that

[i]f scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise.

That brings us to Mendoza v. State, 2011 WL 2402045 (Texas Court of Appeals 2011). According to this opinion, Cecilio Mendoza was charged with and convicted by a jury of attempted capital murder and burglary of a habitation with intent to commit robbery and sentenced to 47 years in prison on the first charge and 15 years on the second charge, the two sentences to be served concurrently. Mendoza v. State, supra. The opinion summarizes the facts that led to Mendoza’s convictions as follows:

In the early morning hours of February 26, 2007, [Mendoza] and . . . Jose Limon, wearing ski masks and carrying guns, entered the home of the Vallejo family in Brownsville, Texas. One of the family members escaped and called 911. Police officers arrived, entered the house, and a shootout ensued. Limon died at the scene. Officer Trujillo suffered multiple injuries, but survived. [Mendoza] attempted to escape by jumping through a window, but the police apprehended him nearby.

Mendoza v. State, supra. If you’d like to read Officer Trujillo’s account of what happened at the scene, check out the news story you can find here.

Not surprisingly, Mendoza appealed. Mendoza v. State, supra. He raised a number of issues on appeal, but we’re only concerned with one of them: the admission of “State’s Exhibits 547, 548, 549, 550 and 551.” Mendoza v. State, supra.

The exhibits are DVDs which depict three-dimensional (`3D’) computer-generated representations of the crime scene. Appellant complains the trial court erred in admitting (1) the 3D exhibits as scientific evidence and (2) the testimony of Officer Julio Briones as expert testimony. Officer Briones created the exhibits by using a commercially-available computer software program.

Mendoza v. State, supra.

According to Officer Briones, he created the exhibits by

entering room measurements, the officers' and suspects' locations, and other relevant information into a computer software program. The computer software, Crime Zone, utilizes the information to create a three-dimensional representation of a physical setting. The software was also used to create State's Exhibit 546, a `flat’ diagram of the house showing the officers' and suspects' locations.

Mendoza v. State, supra.

On appeal, Mendoza argued that the trial judge erred when he admitted a

`3-D’ exhibit and the testimony of Officer Briones as expert testimony. Briones was not an expert and the `3-D’ exhibit was not scientific evidence. Therefore, the trial court erred when it permitted Briones' to testify as an expert and admitted the `3-D’ exhibit.

Appellant’s Brief, Mendoza v. State, 2010 WL 4621085 (2010).

In his brief on appeal, Mendoza pointed out that, as noted above, expert testimony is

admissible if the expert is qualified and the testimony is relevant and based upon a reliable foundation. . . . If the witness possesses scientific, technical or other specialized knowledge that will assist the fact-finder and if the witness is qualified as an expert by knowledge, skill, experience, training, or education, then that expert may testify with an opinion. . . . [T]he testimony of Briones on Voir Dire demonstrated that he did not have the qualifications to testify as an expert. Briones had no specialized education, skill, experience or training in the creation or use of `3-D’ exhibit. In fact, his only experience using the `3-D’ exhibit amounted to testifying in court with such an exhibit one other time.

Appellant’s Brief, Mendoza v. State, supra.

Mendoza also argued that the evidence did not meet the test for determining if expert testimony is reliable which the Texas Court of Criminal Appeals articulated in Kelly v. State, 824 S.W.2d 568 (1992):

[E]vidence derived from a scientific theory, to be considered reliable, must satisfy three criteria in any particular case: (a) the underlying scientific theory must be valid; (b) the technique applying the theory must be valid; and (c) the technique must have been properly applied on the occasion in question.

Kelly v. State, supra.

Mendoza argued that the prosecution did not introduce any evidence to satisfy the Kelly criteria with regard to the scientific techniques involved,

the validity of those techniques, whether those techniques had been verified and how they had been verified. Further, no evidence was introduced regarding the potential rate of error of the technique or other experts who could test or evaluate the technique. More significantly, there was no evidence to demonstrate that the technique had been properly applied in this case or that the `3-D’ exhibit accurately depicted the scene, the specific positions and locations of the individuals at the scene, and the actions, or points of view of the various individuals at the scene immediately prior to and during the relevant events.

Mendoza v. State, supra.

The prosecution argued, in response, that Mendoza was mischaracterizing the evidence:

This is not scientific evidence, nor was Briones' testimony expert testimony. The software used, Crime Zone, is commercially-available software. The [prosecutor] explained . . . the evidence was demonstrative, an `aid to the jury’ to understand Briones' testimony. [He said] Briones was not testifying as an expert on trajectory angles or any other scientific matter. Therefore, . . . this evidence was not the type of evidence [Mendoza] claims it to be. It is instead `demonstrative evidence,’ the same as a diagram created by police officers as part of an accident report, or a map drawn by a witness from the stand.

State’s Appellate Brief, Mendoza v. State, 2010 WL 4621083 (2010).

The prosecution pointed out that demonstrative evidence “is admissible if it tends to aid the jury in the resolution of the case” and that the decision to admit such evidence is left to the discretion of the trial judge. State’s Appellate Brief, Mendoza v. State, supra. It also pointed out that the 3D diagram was properly authenticated: Briones testified that he created it “based on his own personal knowledge” of the locations of the objects in the diagram and on measurements he “personally took” at the crime scene. State’s Appellate Brief, Mendoza v. State, supra. Finally, the prosecution noted that the trial judge held a hearing on the admissibility of the diagram, at which defense counsel cross-examined Briones and as a result of which the judge “held that Officer Briones had the requisite knowledge and technical skill to operate the computer software used to create the 3D diagram.” State’s Appellate Brief, Mendoza v. State, 2010 WL 4621083 (2010).

The Court of Appeals agreed with the prosecution, holding that the “trial court did not abuse its discretion in admitting the 3D exhibits.” Mendoza v. State, supra. It noted that the trial judge asked the prosecutor,

`What are you—you utilizing him as an expert to testify about how it was created?’ The State responded, `we can utilize [Briones] as a layperson.’ Briones testified that he: (1) was familiar with the Crime Zone software used in this case; (2) had used the software on at least two previous occasions and to create State's Exhibit 546, a `flat’ diagram of the crime scene; (3) believed the diagrams were to scale; and (4) believed the exhibits would assist the jury in determining what happened the night of the crime.

Mendoza v. State, supra.

The Court of Appeals also noted that diagrams are

generally admissible to explain the testimony of a witness and render it more intelligible. . . . Moreover, even if the trial court erred in admitting the 3D exhibits, the improper admission of evidence is harmless if the record contains other, properly admitted evidence that is probative of the same matter. . . . Here, . . . State's Exhibit 546 had been admitted and depicted the same information without the 3D enhancement.

Mendoza v. State, supra. Because it rejected this and the other arguments Mendoza made on appeal, the Court of Appeals affirmed his conviction. Mendoza v. State, supra.

“Dangerous Contraband”

This post examines an issue I, for one, hadn’t thought of and which, according to a recent opinion, was “a first impression issue in the State of New York.” People v. Green, __ N.Y.S.2d __, 2011 WL 2320239 (New York County Court – Sullivan County 2011).

Barry Green “was charged . . . with one count of promoting prison contraband in the first degree (New York Penal Law § 205.25), a class D nonviolent felony.” People v. Green, supra. Section 205.25 provides, in part, as follows:

A person is guilty of promoting prison contraband in the first degree when:

1. He knowingly and unlawfully introduces any dangerous contraband into a detention facility; or

2. Being a person confined in a detention facility, he knowingly and unlawfully makes, obtains or possesses any dangerous contraband.

The opinion explains that Green, “being a person confined in a detention facility, knowingly and unlawfully possessed a dangerous contraband, to wit: a Motorola cell phone and charger.” People v. Green, supra. A footnote explains that, at the time, he was “serving a sentence at the Woodbourne Correctional Facility, a medium security prison.” People v. Green, supra.

The opinion notes that the facts of the

are little in dispute in that there is no question that [Green] knowingly possessed contraband, i.e., a cell phone, since a defendant's knowing possession refers only to the voluntariness of the possession itself, and may be established by his own testimony. . . . Here, [Green] admitted to the Department of Correction's investigators that the cell phone found in his possession was his and the defense at trial argued that it was just `innocent’ possession of contraband and not dangerous.

People v. Green, supra.

The case was tried by a jury, which convicted Green of “promoting prison contraband”, after which he appealed. People v. Green, supra. At trial and again on appeal, Green argued that the

possession and use of the cell phone was not dangerous since [his only use of it] was to call his wife and family regarding certain marital difficulties. At trial, there was not a scintilla of evidence disputing [Green’s] claim that the cell phone was not used for any other purpose than calling his family. Thus, [he] again argued that the cell phone is merely contraband, making possession thereof in state prison a class A misdemeanor, and that it is not dangerous contraband as required to elevate the possession in state prison to a class D felony.

People v. Green, supra.

The prosecution, on the other hand, argued that

a cell phone is by its very nature DANGEROUS contraband, and it need not be established that the cell phone was actually or, intended to be, used to endanger the security of the Woodbourne Correctional Facility or those therein. The People argued that the cellphone is capable of such use as may endanger the safety and security of the detention facility and those therein.

Thus, [Green’s] admitted innocent use of the cell phone established possession thereof in state prison and provided the jury with a proper legal basis for their finding that the cell phone is DANGEROUS contraband and [Green] was guilty of possession thereof.

People v. Green, supra (capitalization in original).

In analyzing the arguments, the court noted, first, that New York Penal Law § 205.00(3) defines “contraband” as “any article of thing which a person confined in a detention facility is prohibited from obtaining or possessing by statute, rule, regulation or order.” People v. Green, supra. It also noted that New York Penal Law § 205.00(4) defines “dangerous contraband” as contraband that is “capable of such use as may endanger the safety or security of a detention facility or any person therein.” People v. Green, supra.

This court explained that the New York Court of Appeals has found that in determining if an item is dangerous contraband, courts look not for

any element of intent to use the item unlawfully because it is the item itself that is determinative as to the issue of whether the item creates the proscribed, `substantial probability that [it] will be used in a manner that is likely to cause death or other serious injury, to facilitate an escape, or to bring about other major threats to a detention facility's institutional safety or security.’

People v. Green, supra (quoting People v. Finley, 10 NY3d 647 (2008)).

According to this opinion, the Finley court rejected the

presumption that dangerous contraband should be so broad as to incorporate `any item that, when present in a detention facility, could lead to altercations and inmate disobedience,’ noting the harsher felony consequences for possessing dangerous contraband, as compared to contraband.

People v. Green, supra (quoting People v. Finley, 10 NY3d 647 (2008)).

The Green court then explained that New York Penal Law § 205.00(3) grants the State Department of Correctional Services [DOCS] the authority to declare what is contraband. People v. Green, supra. It noted that “[d]espite the nonexistence of any memoranda, rule or order by DOCS that lists what is considered to be DANGEROUS contraband”, New York courts “have found various types of prohibited items [such as knives, razor blades, drugs and drawings of a prison yard] to be DANGEROUS contraband.” People v. Green, supra (capitalization in original).

The opinion then reviews decisions from two states (Kentucky and Michigan) and from several federal courts (in Michigan and Texas) that held cell phones are dangerous (I refuse to capitalize it) contraband. People v. Green, supra. For example, in Burdell v. Morgan, 2006 WL 1045501 (Kentucky Court of Appeals 2006), the court held that a cell phone is dangerous contraband because it could be used to facilitate an escape.

The Green court then noted that in this case the prosecution argued that unlike calls

from a monitored prison phone land line, conversations between an inmate and those whom he chooses to reach with a cell phone cannot be monitored by the detention facility. This poses an immediate safety risk to any institution where an inmate possesses a cell phone, given the possibility that cell phones would allow inmates to conduct clandestine dealings with the outside world to form an escape plan, arrange for a murder of a prosecution witness or coordinate other illegal operations from within a detention facility.

Additionally, these security risks were emphasized at trial through the testimony of Superintendent Walsh, who testified that neither correctional officers, civil employees, nor himself, are allowed to possess a cell phone while inside a correctional facility because of the inherent risk that they pose to security and safety of staff and inmates.

People v. Green, supra.

The court therefore held that

as a matter of law a cell phone, no matter how a defendant may use it, is inherently DANGEROUS because a cell phone or other telecommunication device has a substantial probability that the item itself may be used in a manner that is likely to bring out major threats to a detention facility's institutional safety or security by the defendant, or other inmates, in the facility.

People v. Green, supra (capitalization in original). (It also noted that “[b]y its verdict in the instant case the voice of the community has spoken that mere possession of a cell phone by an inmate is DANGEROUS” People v. Green, supra (capitalization in original)).

So the court affirmed the jury verdict finding Green guilty. People v. Green, supra.

Although the court decided the issue, it noted that “courts should be the last, not the first, to determine what types of contraband are dangerous,” and therefore called on the DOCS to develop “a formal list of items that it determines to be dangerous contraband.” People v. Green, supra. It seems only fair to put inmates on notice as to what is, and is not “dangerous.”

I wonder if – assuming inmates have access to computers – an email account, a web-based email account, would be considered “dangerous contraband?” If it was, I wonder under what circumstances the inmate could be deemed to have “possessed” the contraband?