The Boyfriend, the Altered Password and the Computer Fraud and Abuse Act

This post examines an opinion from the U.S. Court of Appeals for the 2d Circuit:  Sewell v. Bernardin, 795 F.3d 337 (2015).  The court begins by explaining that

[i]n order to resolve this appeal, we address a matter of first impression in this Circuit: the operation of the statutes of limitations applicable under the civil enforcement provisions of the Computer Fraud and Abuse Act (CFAA.), 18 U.S. Code § 1030, and the Stored Communications Act (SCA.), 18 U.S. Code § 2701, et seq.  A plaintiff bringing an action under the CFAA's civil enforcement provision must do so `within 2 years of the date of the act complained of or the date of the discovery of the damage.’ 18 U.S. Code § 1030(g). The SCA provides that `[a] civil action under this section may not be commenced later than two years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation.’ 18 U.S. Code § 2707(f).

Sewell v. Bernardin, supra. 

The statutes cited above are statutes of limitations, and, as Wikipedia explains,

[s]tatutes of limitations are laws passed by a legislative body in common law systems to set the maximum time after an event when legal proceedings may be initiated.  When the period of time specified in a statute of limitations passes, a claim can no longer be filed. The intention of these laws is to facilitate resolution in a reasonable length of time. . . .

The court goes on to explain how, and why, this case arose:

[t]he plaintiff, Chantay Sewell, filed suit under both statutes alleging that her former boyfriend, defendant Phil Bernardin, had gained access to her e-mail and Facebook accounts without her permission and therefore in violation of the CFAA and the SCA. She asserts that she discovered that she could not log into her www.aol.com (AOL.) e-mail account on or about August 1, 2011 `because her password was altered.’ Complaint ¶ 11. . . . More than six months later, on or about February 24, 2012, she contends, she discovered that she could not log into her www.facebook.com (`Facebook’) account `because her password was altered.’ . . .

The district court granted Bernardin's motion to dismiss Sewell's claims as untimely, and Sewell appealed. Because Sewell filed suit on January 2, 2014, we conclude that her claims relating to Bernardin's alleged unlawful access of her e-mail account are time-barred, but that her claims relating to his alleged unlawful access of her Facebook account were timely filed.

Sewell v. Bernardin, supra.  You can, if you are interested, read more about how and why this case arose in the news stories you can find here, here and here.

As Wikipedia explains, when a plaintiff (the person who files a civil suit) initiates a lawsuit, the defendant, the person who is being sued, can file a motion to dismiss the suit under Rule 12(b)(6) of the Federal Rules of Civil Procedure for failing to state a cause of action upon which relief can be granted.  Having lost at the District Court level, Sewell is arguing that the court erroneously granted Bernardin’s motion to dismiss.

The Court of Appeals then takes up Sewell’s argument, explaining that

[w]e accept as true at this stage of the proceedings all facts alleged in Sewell's complaint. See Town of Babylon v. Fed. Hous. Fin. Agency, 699 F.3d 221 (U.S. Court of Appeals for the 2d Circuit 2012). According to those allegations, Sewell and Bernardin were involved in a `romantic relationship’ from in or about 2002 until 2011. Sewell maintained a private e-mail account with AOL and a private social media account with Facebook, including in 2011 and 2012. She did not knowingly share her account passwords with Bernardin or any other person and was the only authorized user of each account.

On or about August 1, 2011, Sewell discovered that her AOL password had been altered, and she was therefore unable to log into her AOL e-mail account. That same month, malicious statements about her sexual activities were e-mailed to various family members and friends `via Sewell's own contacts list maintained privately within her email account.’ Complaint ¶ 19 . . . .

Sewell v. Bernardin, supra. 

The Court of Appeals goes on to explain that

[o]n February 24, 2012, Sewell found herself unable to log into her Facebook account. Then, on March 1, 2012, someone other than she posted a public message from her Facebook account containing malicious statements, again concerning Sewell's sex life.

Sewell alleges that Bernardin obtained her AOL and Facebook passwords without her permission while he was a guest in her home. Verizon Internet records confirmed that Bernardin's computer was used to gain access to the servers on which Sewell's accounts were stored. He then changed her AOL and Facebook passwords. Bernardin allegedly thereby obtained access to Sewell's electronic communications and other personal information and sent messages purporting to be from her.

On May 15, 2013, Sewell filed a separate suit against Bernardin's wife, Tara Bernardin, and `John Does # 1–5,’ apparently believing that Tara Bernardin and others unknown to her had gained access to her Internet accounts. The complaint raised claims strikingly similar to those that she is pursuing in the instant action. Tara Bernardin settled her suit with Sewell on September 27, 2013, and the court accordingly entered judgment in Sewell's favor shortly thereafter. Several months later, on January 2, 2014, Sewell filed the instant action against Phil Bernardin, alleging violations of the SCA and CFAA.

On August 2, 2014, the United States District Court for the Eastern District of New York . . . granted Bernardin's motion to dismiss, holding that Sewell's claims were time-barred under the CFAA's and SCA's applicable two-year statutes of limitations. This appeal followed.

Sewell v. Bernardin, supra. 

The court began its analysis of the arguments in this case by explaining that

[w]e review the grant of a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) de novo, `accepting as true factual allegations made in the complaint, and drawing all reasonable inferences in favor of the plaintiff[ ].’ Town of Babylon v. Fed. Hous. Fin. Agency, supra. `Dismissal under Fed.R.Civ.P. 12(b)(6) is appropriate when a defendant raises a statutory bar,’ such as lack of timeliness, `as an affirmative defense and it is clear from the face of the complaint, and matters of which the court may take judicial notice, that the plaintiff's claims are barred as a matter of law.’ Staehr v. Hartford Financial Services Group, 547 F.3d 406 (U.S. Court of Appeals for the 2d Circuit 2008).

Sewell v. Bernardin, supra. 

The court then outlined the applicable statute of limitations under both statutes, starting with the Computer Fraud and Abuse Act:

The CFAA criminalizes, inter alia, `intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer,’ 18 U.S. Code § 1030(a)(2)(C), and `intentionally access[ing] a protected computer without authorization, and as a result of such conduct, caus[ing] damage and loss,’ 18 U.S. Code § 1030(a)(5)(C).

The statute also provides a civil cause of action to `[a]ny person who suffers damage or loss by reason of a violation of this section.’ 18 U.S. Code § 1030(g). To be timely, such a civil suit must be filed `within 2 years of the date of the act complained of or the date of the discovery of the damage.’ 18 U.S. Code § 1030(g). `Damage,’ in turn, is defined as `any impairment to the integrity or availability of data, a program, a system, or information.’ 18 U.S. Code § 1030(e)(8). The statute of limitations under the CFAA accordingly ran from the date that Sewell discovered that someone had impaired the integrity of each of her relevant Internet accounts.

Sewell v. Bernardin, supra. 

It then did the same for the Stored Communications Act, noting that under the SCA, it is a crime to:

(1) intentionally access[ ] without authorization a facility through which an electronic communication service is provided; or

(2) intentionally exceed[ ] an authorization to access that facility; and thereby obtain[ ], alter[ ], or prevent[ ] authorized access to a wire or electronic communication while it is in electronic storage in such system. . . .

18 U.S. Code § 2701(a).

As with the CFAA, the SCA establishes a civil cause of action:

 [A]ny . . .  person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind’ may file suit. 18 U.S. Code § 2707(a). A civil action under this section must be commenced no `later than two years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation.’ 

18 U.S. Code § 2707(f).

In other words, the limitations period begins to run when the plaintiff discovers that, or has information that would motivate a reasonable person to investigate whether, someone has intentionally accessed the `facility through which an electronic communication service is provided’ and thereby obtained unauthorized access to a stored electronic communication. 18 U.S. Code § 2701(a).

Sewell v. Bernardin, supra. 

The court then analyzed the extent to which Sewell’s claims against Bernardin complied with these statutes of limitations:

The District Court Judge granted Bernardin's motion to dismiss Sewell's claims as untimely based on the court's conclusion that Sewell was `aware that the integrity of her computer had been compromised’ as of August 1, 2011. Sewell v. Bernardin, 50 F. Supp. 3d 204, 212 (U.S. District Court for the Eastern District of New York 2014). The court reasoned that Sewell's August 1, 2011, discovery—which related to the unauthorized use of her AOL account—provided her with a reasonable opportunity to discover the full scope of Bernardin's alleged illegal activity more than two years before she brought this suit on January 2, 2014. We agree with the district court as its decision related to Sewell's AOL account, but disagree with it as it related to her Facebook account.

Sewell v. Bernardin, supra. 

It went on to point out that Sewell

discovered the `damage’ to her AOL account for CFAA purposes on August 1, 2011, when she learned that she could not log into her AOL e-mail account. That she may not have known exactly what happened or why she could not log in is of no moment. The CFAA's statute of limitations began to run when Sewell learned that the integrity of her account had been impaired.

The SCA's statute of limitations began to run when Sewell `first . . .  had a reasonable opportunity to discover,’ 18 U.S. Code § 2707(f) that someone had `intentionally access[ed] [her AOL account] without authorization,’ 18 U.S. Code § 2701(a). She had such an opportunity as soon as she discovered that she could not obtain access to that account because her password had been `altered’ inasmuch as, accepting her other allegations as true, further investigation would have led her to Bernardin.

Sewell's CFAA and SCA claims with regard to her AOL account were first made on January 2, 2014, and were premised on damage and unauthorized access to her AOL account which she had or should have discovered some two years and five months earlier. The two-year statutes of limitations had therefore run.

Sewell v. Bernardin, supra. 

The Court of Appeals then addressed Sewell’s Facebook claims, which it said

appear to have accrued on or about February 24, 2012. Her complaint alleges that she `was the sole authorized user of’ her Facebook account. Compl. ¶ 10. . . On or about `February 24, 2012, [she] discovered she could no longer log into or access her account with www.facebook.com because her password [had been] altered.’ Compl. ¶ 12. . . . There is nothing in the facts as alleged in the complaint from which to infer that anyone gained unauthorized access to her Facebook account before then. Thus, taking these allegations as true, there would have been no damage, for CFAA purposes, or violation, for SCA purposes, for Sewell to discover with respect to her Facebook account before that date, which was less than two years before the suit was brought.

Sewell v. Bernardin, supra. 

It went on to explain that the

fact that Sewell had discovered `damage’ to her AOL account based on her inability to access AOL's computer servers at an earlier date does not lead to a different result. Contrary to the district court's remark, Sewell did not allegedly discover `that the integrity of her computer had been compromised” as of August 1, 2011. . . . She discovered only that the integrity of her AOL account had been compromised as of that time. Her CFAA claim accordingly is premised on impairment to the integrity of a computer owned and operated by AOL, not of her own physical computer.

As a result, Sewell has two separate CFAA claims, one that accrued on August 1, 2011, when she found out that she could not access her AOL account, and one that accrued on February 24, 2012, when she found out that she could not access her Facebook account.

Sewell v. Bernardin, supra (emphasis in the original).

The court then pointed out that

[l]ike her Facebook-related CFAA claim, Sewell's Facebook-related SCA claim is also timely. Under the SCA, a civil plaintiff must file her claim within two years of discovery or a reasonable opportunity to discover intentional and unauthorized access to an electronic communication facility. The District Court Judge concluded that Sewell `had a reasonable opportunity to discover the Defendant's illegal activity’ vis-à-vis her Facebook account as of August 1, 2011. . . . But as we have noted, there is no allegation in the complaint that Sewell's Facebook account and the computer servers on which her information was stored were tampered with before February 24, 2012, when she alleges that she was unable to log into her Facebook account. She could not reasonably be expected to have discovered a violation that, under the facts as alleged in the complaint, had not yet occurred.

The district court's conclusion may rest on the assumption that a plaintiff is on notice of the possibility that all of her passwords for all of the Internet accounts she holds have been compromised because one password for one Internet account was compromised. We do not think that that is a reasonable inference from the facts alleged in the complaint. We take judicial notice of the fact that it is not uncommon for one person to hold several or many Internet accounts, possibly with several or many different usernames and passwords, less than all of which may be compromised at any one time. At least on the facts as alleged by the plaintiff, it does not follow from the fact that the plaintiff discovered that one such account—AOL e-mail—had been compromised that she thereby had a reasonable opportunity to discover, or should be expected to have discovered, that another of her accounts—Facebook—might similarly have become compromised.

Sewell v. Bernardin, supra. 

The Court of Appeals then “pause[d]” to

acknowledge that the statutes of limitations governing claims under the CFAA and SCA, as we understand them, may have troubling consequences in some situations. Even after a prospective plaintiff discovers that an account has been hacked, the investigation necessary to uncover the hacker's identity may be substantial. In many cases, we suspect that it might take more than two years. But it would appear that if a plaintiff cannot discover the hacker's identity within two years of the date she discovers the damage or violation, her claims under the CFAA and SCA will be untimely.

The plaintiff does have the option of initiating a lawsuit against a Jane or John Doe defendant, but she must still discover the hacker's identity within two years of discovery or a reasonable opportunity to discover the violation to avoid dismissal. This is because we have concluded `that Rule 15(c) does not allow an amended complaint adding new defendants to relate back if the newly-added defendants were not named originally because the plaintiff did not know their identities.’ Barrow v. Wethersfield Police Dep't, 66 F.3d 466 (U.S. Court of Appeals for the 2d Circuit 1995).

Sewell v. Bernardin, supra. 

The appellate court therefore affirmed the judgment of the District Court Judge “in part” and “vacated and remanded” the case “in part for further proceedings.” Sewell v. Bernardin, supra.  

The SEC, Company Smartphones and the Employee Passcodes

This post examines an opinion from a U.S. District Court Judge who sits in the U.S. District Court for the Eastern District of Pennsylvania:  Securities and Exchange Commission v. Bonan Huang, et al., 2015 WL 5611644 (2015). He begins the opinion by explaining that

Plaintiff Securities and Exchange Commission (‘SEC‘) seeks penalties, disgorgement and equitable relief arising from Defendants' trading on certain retail stocks based on allegedly material nonpublic information available to Defendants while they worked as data analysts for Capital One, a large credit card issuer bank (‘Bank‘).  Bank provided Defendants with smartphones but allowed them to create and set their own passcodes to access the smartphone. Bank's policies confirmed it owned the smartphone and any corporate documents on the smartphones. Consequently, Bank also requested its employees to not keep records of their personal passcodes for security reasons.

Upon leaving the Bank, Defendants returned their smartphones. The Bank provided the smartphones to the SEC. SEC cannot access the data on the smartphones as it does not know the passcode. SEC believes the smartphones contain unidentified Bank documents and issued an interrogatory or document request requiring Defendants ‘[i]dentify the Passcode for the [smartphone] that you used during the course of your employment‘. Defendants responded by invoking their Fifth Amendment right.

SEC now moves to compel production of Defendants' passcodes for their work-issued smartphones. . . . The SEC argues Defendants, as former Bank data analysts, are corporate custodians in possession of corporate records, and as such cannot assert their Fifth Amendment privilege in refusing to disclose their passcodes. . . . Defendants disagree they are corporate custodians and argue providing the passcodes to their phones is ‘testimonial‘ in nature and violates the Fifth Amendment.

Securities and Exchange Commission v. Bonan Huang, et al., supra.  You can, if you are interested, read more about the case in the news stories you can find here and here.

The references to the Fifth Amendment above are, of course, references to the privilege against self-incrimination, which is part of the protections provided by that Amendment to the U.S. Constitution.  As Wikipedia explains, the Fifth Amendment privilege protects

individuals from being forced to incriminate themselves. Incriminating oneself is defined as exposing oneself (or another person) to `an accusation or charge of crime,’ or as involving oneself (or another person) `in a criminal prosecution or the danger thereof.’ The privilege against compelled self-incrimination is defined as `the constitutional right of a person to refuse to answer questions or otherwise give testimony against himself or herself. . . .’ To `plead the Fifth’ is to refuse to answer any question because `the implications of the question, in the setting in which it is asked’ lead a claimant to possess a `reasonable cause to apprehend danger from a direct answer’, believing that `a responsive answer to the question or an explanation of why it cannot be answered might be dangerous because injurious disclosure could result.’

Wikipedia, supra (quoting Ohio v. Reiner, 532 U.S. 17 (2001) (emphasis in the original)).

The judge began his analysis of the parties’ arguments by explaining that the SEC

claims the ‘corporate records‘ cases govern our analysis. See Bellis v. U.S., 417 U.S. 85 (1974); Braswell v. U.S., 487 U.S. 99 (1988). In Bellis, a partner of a then dissolved law firm was subpoenaed to appear and testify before a grand jury and to bring all partnership records within his possession. Bellis v. U.S.,supra. The former partner appeared but refused to bring the records and asserted his Fifth Amendment privilege against compulsory self-incrimination. Bellis v. U.S., supra. The district court compelled the records' production and the court of appeals affirmed. Bellis v. U.S., supra. In affirming the district court's decision, the United States Supreme Court relied on the ‘collective entity‘ doctrine. Bellis v. U.S., supra. The doctrine prevents an individual from ‘rely[ing] upon the privilege to avoid producing records of a collective entity which are in his possession in a representative capacity, even if these records might incriminate him personally.‘  Bellis v. U.S.,

In Braswell, the Government subpoenaed books and records of two corporations, of which petitioner served as president and sole shareholder. Braswell v. U.S., supra. The petitioner refused to produce the documents asserting his Fifth Amendment privilege. Braswell v. U.S., supra. Citing the ‘collective entity‘ doctrine, the district court compelled production and the court of appeals affirmed. The Supreme Court affirmed after recounting the Court's Fifth Amendment jurisprudence in the context of corporate custodians. Braswell v. U.S., supra. The Court again reiterated a corporate custodian may not invoke the Fifth Amendment to avoid producing corporate records. Braswell v. U.S., supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The judge then outlined the arguments the defendants made in response:

Defendants point to more recent cases, albeit none from the Supreme Court. In In re Grand Jury Duces Tecum Dates March 25, 2011, 670 F.3d 1335 (U.S. Court of Appeals for the 11th Circuit 2012), the Eleventh Circuit found a person accused of possessing child pornography may assert his Fifth Amendment privilege to avoid decrypting a hard drive. In In re Grand Jury Duces Tecum, supra. In reaching this conclusion, the court of appeals did not focus on whether the privilege applies to underlying documents but on whether the act of decryption and production were testimonial. In re Grand Jury Duces Tecum, supra. The court of appeals held decryption and production of the hard drives ‘would require the use of the contents of Doe's mind and could not be fairly characterized as a physical act that would be nontestimonial in nature.‘ In re Grand Jury Duces Tecum, supra. Thus, the decryption and production were testimonial and within the scope of the Fifth Amendment. In re Grand Jury Duces Tecum, supra.

Defendants also rely on U.S. v.Kirschner, 823 F. Supp. 2d 665 (U.S. District Court for the Eastern District of Michigan 2010) where the Government subpoenaed ‘all passwords‘ associated with defendant's computer. computer.  U.S. v. Kirschner, supra. The district court found revealing the password akin to providing the combination of a wall safe-an act deemed to be testimonial by the Supreme Court. U.S. v. Kirschner, supra (citing U.S.v. Hubbell, 530 U.S. 27 (2000)). Accordingly, the district court denied the Government's request to compel defendant produce his computer passcodes.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The District Court Judge then found that,

as the SEC is not seeking business records but Defendants' personal thought processes, Defendants may properly invoke their Fifth Amendment right. SEC does not necessarily disagree with the courts' conclusions in In re Grand Jury and Kirschner arguing these cases involve child pornography and do not involve records of a third party entity, as here. The SEC focuses on the contents of the underlying documents contained on the device, claiming without any cited evidence, there are Bank records on the smartphones. We agree with the SEC as to Defendants' inability to preclude production of the Bank's documents.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

But the judge also went on to explain that

[h]owever, the SEC‘s reliance on the content of the documents is misplaced. In re Grand Jury persuades us to not look at the underlying documents to determine whether the act of producing a passcode is testimonial. In re Grand Jury Deces Tecum, supra (`Whether the drives’ contents are testimonial, 

however, is not the issue.‘). By relying on the corporate records cases of Bellis and Braswell, the SEC would have us focus on the nature of the documents allegedly contained in the phone rather than what they have requested, which are passcodes to the phones. Here, the SEC seeks to compel production of the passcodes which require intrusion into the knowledge of Defendants and no one else.  There is no evidence the Bank assigned Defendants passcodes to their phones or kept track of Defendants' passcodes. To the contrary, the Bank asked employees not to keep records of their passwords for safety reasons.

Absent waiver of the confidentiality attendant to this personal thought process, we cannot find the personal passcodes to the Bank's smartphones to be corporate records falling under the collective entity cases. We find Defendants' confidential passcodes are personal in nature and Defendants may properly invoke the Fifth Amendment privilege to avoid production of the passcodes.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

(In a footnote, the judge points out that

[t]o date, the SEC has not answered Defendants' request as to whether there is any ongoing criminal investigation. Defendants, presently residing in the Far East, are evaluating possible criminal prosecution for the same conduct.

Securities and Exchange Commission v. Bonan Huang, et al., supra.) 

He went on to note that the SEC

then argues the ‘foregone conclusion‘ doctrine applies to override Defendants' invocation of the Fifth Amendment privilege. An act of production is not testimonial if the proponent of production can show with ‘reasonable particularity,‘ ‘at the time it sought to compel the act of production, it already knew of the materials, thereby making any testimonial aspect a foregone conclusion.‘  In re Grand Jury Duces Tecum, supra. Thus, ‘where the location, existence, and authenticity of the purported evidence is known with reasonable particularity, the contents of the individual's mind are not used against him, and therefore no Fifth Amendment protection is available.‘  In re Grand Jury Duces Tecum, supra.

The SEC argues any incriminating testimonial aspect to Defendants' production of the their personal passcodes already is a foregone conclusion because it can show Defendants were the sole users and possessors of their respective work-issued phones. . . . The SEC's argument misses the mark in this regard. The court of appeals' reasoning in In re Grand Jury again persuades our analysis. There, the Court of Appeals for the Eleventh Circuit refused to apply the ‘foregone conclusion‘ doctrine because the Government could not meet its burden of showing with ‘reasonable particularity‘ what ‘if anything, was hidden behind the encrypted wall.‘ In re Grand Jury Duces Tecum, supra. While the Government need not ‘identify exactly‘ the underlying documents it seeks, ‘categorical requests for documents the Government anticipates are likely to exist simply will not suffice.‘ In re Grand Jury Duces Tecum, supra. There, the Government could not show the encrypted drives actually contained any files, nor could it show which files would if any prove to be useful. In re Grand Jury Duces Tecum, supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

He also explained that

[h]ere, the SEC proffers no evidence rising to a ‘reasonable particularity‘ any of the documents it alleges reside in the passcode protected phones. Instead, it argues only possession of the smartphones and Defendants were the sole users and possessors of their respective work-issued smartphones. SEC does not show the ‘existence‘ of any requested documents actually existing on the smartphones. Merely possessing the smartphones is insufficient if the SEC cannot show what is actually on the device. See In re Grand Jury Duces Tecum, supra. (‘In short, the Government physically possess the media devices, but it does not know what, if anything, is held on the device.‘).

Neither In re Boucher, 2009 WL 424718 (U.S. District Court for the District of Vermont 2009) nor U.S. v. Gavegnano, 305 F. App'x 954 (U.S. Court of Appeals for the 4th Circuit 2009), militate a different result. In Boucher, an ICE agent accessed the encrypted part of the drive at issue, viewed the contents of the drive, and ascertained it may contain images and videos of child pornography. In re Boucher, supra. Thus, the defendant providing access to the encrypted portion of the drive ‘add[ed] little or nothing‘ to the Government's information. In re Boucher, supra. Likewise, in Gavegnano, the Government could independently verify the defendant was the sole user and that he accessed child pornography websites because the computer was monitored for all activity. U.S. v. Gavegnano, supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra.  He also noted that

the SEC has no evidence any documents it seeks are actually located on the work-issued smartphones, or that they exist at all. Thus, the foregone conclusion doctrine is not applicable.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The judge therefore held that

[s]ince the passcodes to Defendants' work-issued smartphones are not corporate records, the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their Fifth Amendment privilege. Additionally, the foregone conclusion doctrine does not apply as the SEC cannot show with ‘reasonable particularity‘ the existence or location of the documents it seeks. Accordingly, the SEC's motion to compel the passcodes is denied.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

Craigslist, Age-Regression and Entrapment

After a jury found Jacob Mendoza “guilty of one count of child solicitation by electronic device contrary to [New Mexico Statutes] § 30–37–3.2”, he appealed, arguing, in part that “he was entrapped”.  State v. Mendoza, 2015 WL 5118099 (Court of Appeals of New Mexico 20150.  You can, if you are interested, read a little about how the charge arose in the news stories you can find here, here and here.

The Court of Appeals began its opinion by explaining that in

State v. Schaublin, 344 P.3d 1074 (2015), . . . we discussed an advertisement placed in the Craigslist website by Agent Phil Caroland of the Curry County Sheriff's office. This case involves the same Craigslist ad as discussed in Schaublin, by Agent Caroland posing as `Myrna Gonzales,’ a fifteen-year-old girl. State v. Schaublin, supra. . After engaging in a sexually explicit e-mail discussion with Myrna, [Mendoza] arranged to meet her in person. When Defendant appeared for the meeting, he was arrested. He was later charged with one count of child solicitation. Additional facts are provided as necessary in our discussion.

State v. Mendoza, supra.  This post only examines Mendoza’s argument regarding the alleged entrapment.

The opinion goes on to explain that “[p]rior to trial, [Mendoza] sought dismissal of the child solicitation charge on the ground that he was subjectively and objectively entrapped as a matter of law.” State v. Mendoza, supra. The Court of Appeals began its analysis of his argument by explaining that

`New Mexico recognizes two major approaches to the defense of entrapment, the subjective approach and the objective approach.’ State v. Schaublin, supra. Subjective entrapment, which focuses on the defendant's predisposition, is normally resolved by a fact-finder and is only rarely resolved as a matter of law by the court. State v. Schaublin, supra.

State v. Mendoza, supra. 

The Court of Appeals went on to explain that

[o]bjective entrapment, which `focuses upon the inducements used by the police[,]’ is broken into two subsets, factual and normative. State v. Schaublin, supra. . . . A defendant seeking to establish objective entrapment under a factual approach would attempt to prove to a fact-finder that `as a matter of fact . . .  police conduct created a substantial risk that a hypothetical ordinary person not predisposed to commit a particular crime would have been caused to commit that crime.’ State v. Schaublin, supra (alterations, internal quotation marks, and citation omitted). A defendant seeking to establish objective entrapment under a normative approach, that is as a matter of law, would seek a ruling by the district court that `as a matter of law and policy [the] police conduct exceeded the standards of proper investigation.’ State v. Schaublin, supra (alternations, internal quotation marks, and citation omitted).

In the present case, the district court concluded [Mendoza] was not subjectively or objectively entrapped as a matter of law, but the court allowed the jury to resolve the issue whether [he] was subjectively or objectively entrapped, as a matter of fact. The jury rejected [Mendoza’s] entrapment defenses when it found him guilty of child solicitation. On appeal, [he] seeks reversal of his conviction on the grounds that he was subjectively and objectively entrapped as a matter of law. Because Defendant challenges the court's rejection of his entrapment defense, as a matter of law, our review is de novo. State v. Vallejos, 122 N.M. 318, 924 P.2d 727, rev'd in part on other grounds,. . . 123 N.M. 739, 945 P.2d 957 (New Mexico Supreme Court 1997). [Mendoza] does not challenge the jury's conclusion that he was not objectively entrapped as a matter of fact.

State v. Mendoza, supra. 

The court then began by outlining what constitutes subjective entrapment, noting that

`[s]ubjective entrapment occurs when the criminal design originates with the police, and they implant in the mind of an innocent person the disposition to commit the alleged offense and induce its commission in order to generate a prosecution.’ State v. Schaublin, supra. . . . It is permissible for police to set a trap for the unwary criminal by means of a ruse. State v. Schaublin, supra. The line between the permissible use of a ruse and impermissible entrapment is drawn at the point where the police `persuade[ ] an otherwise law abiding citizen to engage in criminal activity through repeated and consistent appeals[.]’ State v. Schaublin, supra.

`[E]ntrapment as a matter of law exists only when there is undisputed testimony which shows conclusively and unmistakably that an otherwise innocent person was induced to commit the act.’ U.S. v. Dozal–Bencomo, 952 F.2d 1246 (U.S. Court of Appeals for the 10th Circuit 1991) . . . (a court `may find entrapment as a matter of law if the evidence satisfying the essential elements of entrapment is uncontradicted’). . . . Subjective entrapment is rarely held to exist as a matter of law. State v. Schaublin, supra.

State v. Mendoza, supra. 

The Court of Appeals then began analyzing Mendoza’s argument, explaining that to

support his contention that he was subjectively entrapped as a matter of law, Defendant argues that (1) Myrna's ad was posted in a section of Craigslist that required each user to be at least eighteen years old, and therefore, it was reasonable for him to assume that any posting in that section was done by an adult; (2) he was misled by photographs of a twenty-six-year-old woman purporting to be Myrna; and (3) Myrna “pushed to set up a meeting with [him] after engaging him in [a] sexual discussion. Defendant claims he lacked the predisposition to commit child solicitation and that, but for the foregoing circumstances by which [he] argues the police entrapped him, he would not have engaged in such `conversations[.]’

[Mendoza’s] argument in this regard resembles the argument made by the defendant in Schaublin. In Schaublin, the defendant argued that, because Myrna's ad was in the adults-only section of Craigslist, the officer used an age-regressed photograph of an adult woman to accompany the `Myrna’ persona, and Myrna `inserted sexuality into their communications[,]’ he was subjectively entrapped as a matter of law. . . . We held that because Myrna `informed [the d]efendant immediately, in her response to [his] initial response to her ad, that she was fifteen years old[,]’ and because the record reflected that the defendant, not Myrna, first broached the topic of sexuality, `the jury could reasonably have concluded that [the d]efendant engaged with Myrna willingly and without having been persuaded to do so[.]’  State v. Schaublin, supra.

State v. Mendoza, supra. 

The court went on to explain that Mendoza

attempts to distinguish this case from Schaublin on the ground that the `Myrna’ photos in Schaublin were age-regressed and that the photos in the present case depicted a twenty-six-year-old woman whose photo had not been subject to age-regression. This distinction is contradicted by the record in the present case in which Agent Caroland testified that the Myrna photographs that had been sent to [Mendoza] had been subjected to an age-regression process by the National Center for Missing and Exploited Children and were intended to represent a pre-teen or young teenage girl. 

Furthermore, even were we to assume that the Myrna photographs in the present case were not age-regressed, such a fact would not `conclusively and unmistakably’ demonstrate that [Mendoza] was not predisposed to commit child solicitation such that [he] was entitled to a ruling that, as a matter of law, he was subjectively entrapped. See U.S. v. Dozal–Bencomo, supra.

`[E]ntrapment as a matter of law exists only when there is undisputed testimony which shows conclusively and unmistakably that an otherwise innocent person was induced to commit the act.’ . . . Here, as in Schaublin, in Myrna's first reply to [Mendoza’s] first e-mail to her, Myrna stated she was `15 and going to be in 10th grade.’

Therefore, even if we were to agree with [Mendoza] that the Myrna photographs had not been age-regressed, at best this would have created a circumstance in which there existed evidence supporting [his] argument that he believed Myrna was an adult and evidence supporting the State's position that [Mendoza] believed Myrna was a fifteen-year-old child. Under these circumstances, the district court properly determined that the issue of subjective entrapment should be resolved by the jury as a matter of fact. fact. See U.S. v. Dozal–Bencomo, supra (recognizing that subjective entrapment may only be found as a matter of law where the relevant facts are uncontradicted).

State v. Mendoza, supra. 

The court also found that,

although [Mendoza] argues that Myrna `pushed’ to meet him after engaging in a `sexual discussion’ with him, the record reflects [he] initiated the sexual discussion by asking Myrna, `R u still a virgin?’ and he initiated the plan to meet by asking Myrna whether she could `get away’ and by stating `I wanna see how well u can please me. I just need to find us a place[.]’ The record is devoid of any evidence that Agent Caroland used repeated and consistent appeals to persuade [him] to communicate with or meet Myrna. Myrna. See State v. Schaublin, supra (standard used to determine whether a defendant was subjectively entrapped includes `repeated and consistent appeals’ to `persuade[ ] an otherwise law abiding citizen to engage in criminal activity’). In sum, under the circumstances of this case, the district court did not err in denying [Mendoza’s] motion to dismiss on the ground that he was subjectively entrapped as a matter of law. See U.S. v. Dozal–Bencomo, supra (recognizing that entrapment as a matter of law may be found where it is unmistakable `that an otherwise innocent person was induced to commit the act’ (internal quotation marks and citation omitted)).

State v. Mendoza, supra. 

The Court of Appeals then took up “objective entrapment”, noting that the

district court determined that the police conduct was not unconscionable, and [Mendoza’s] motion to dismiss on the ground that he was objectively entrapped as a matter of law was denied. [He] challenges the district court's denial of his motion to dismiss, reiterating that he was objectively entrapped as a matter of law.

State v. Mendoza, supra. 

It began its analysis of this argument by explaining that

[o]bjective entrapment may be held to exist as a matter of law when the district court determines that `as a matter of law [the] police conduct exceeded the standards of proper investigation[ .]’ State v. Vallejos, 123 N.M. 739, 945 P.2d 957 (New Mexico Supreme Court 1997). This is distinct from the issue of objective entrapment as a matter of fact in which a jury considers whether, as a factual matter, the `police conduct created a substantial risk that an ordinary person not predisposed to commit a particular crime would have been caused to commit that crime[.]’ State v. Vallejos, supra.

In his argument, [Mendoza] conflates these distinct forms of objective entrapment and argues that he was objectively entrapped as a matter of law because the Myrna ad `created a substantial risk [that] an ordinary person would be lured into committing’ child solicitation. Since [he] expressly limits his argument on appeal to the issue of objective entrapment as a matter of law and he does not challenge the jury's verdict, we do not consider whether the jury properly concluded that, as a matter of fact, the police did not create a substantial risk that an ordinary person would be lured into committing child solicitation.

Instead, we limit our discussion of objective entrapment to [Mendoza’s] argument, that is, whether the police were guided by an `illegitimate purpose’ and that they acted unconscionably when they placed the ad in an adults-only section of Craigslist, used photographs of a twenty-six-year-old woman to depict `Myrna,’ and engaged [him] in two days of conversation `attempting to bait him into a sexual discussion[.]’

Before fully discussing [Mendoza’s] argument, however, we observe that, although [he] characterizes the photographs as depicting `a [twenty-six] year old,’ the evidence presented at the hearing on the motion to dismiss on entrapment grounds was that the photographs were of a twenty-three-year-old deputy and . . . had been age-regressed to portray a pre-teen or young teenage girl. Therefore, we do not accept [his] characterization that the photographs portrayed a twenty-six-year-old woman.

State v. Mendoza, supra. 

The Court of Appeals went on to point out that the issue as to whether the

law enforcement practice of posting an ad in an adults-only section of a website and using an age-regressed photo of an adult to accompany the false persona of a fifteen-year-old child, who purportedly placed the ad, constitutes objective entrapment as a matter of law is one of first impression in New Mexico. In State v. Vallejos, supra, our Supreme Court cautioned the judiciary not to `micro-manage police investigative procedures’ and stated that a determination of objective entrapment should be `reserved for only the most egregious circumstances[.]’ . . . Additionally, the Supreme Court noted that objective entrapment is not indicated simply because the police participate `in a crime [that] they are investigating’ or use `deception to gain the confidence of suspects[.]’

State v. Mendoza, supra. 

It also noted that in State v. Vallejos, supra, the New Mexico Supreme Court illustrated

the distinction between a permissible `degree of deception’ and impermissible `unconscionable methods’ of crime detection [by providing] several examples to serve `as indicia of unconscionability.’ . . .   Among the examples of unconscionable police methods are giving a defendant free illicit drugs until he is addicted and then playing on his addiction to persuade him to purchase illicit drugs; overcoming a defendant's demonstrated hesitancy by persistent solicitation; threatening or using violence; appealing to sympathy or friendship; offering `inordinate gain or . . .  excessive profit’; `excessive involvement by the police in creating the crime’; manufacturing `a crime from whole cloth’; and acting with the `illegitimate purpose’ of `ensnar[ing] a defendant solely for the purpose of generating criminal charges and without any motive to prevent further crime or protect the public at large.’ . . .

The court then applied the foregoing standards to determine that the police methods used in Vallejos, specifically, law enforcement's use of illegal drugs to set up drug transactions and their use of assumed identities as drug dealers to capture potential drug buyers did not constitute objective entrapment as a matter of law because none of the indicia of unconscionability were present. . . . 

State v. Mendoza, supra. 

The Court of Appeals went on to apply these standards to the Mendoza case, noting that

[i]n the present case, the record is void of any evidence that Agent Caroland persuaded [Mendoza] to engage in child solicitation by any of the indicia of unconscionability discussed in Vallejos.  Although [Mendoza] argues that Agent Caroland attempted `to bait him into a sexual discussion’ with Myrna, as noted earlier, the subject of sex was introduced into his and Myrna's conversation by [Mendoza]. Further, the record is void of any indication that the agent used persistent solicitation to overcome any hesitancy expressed by [him] to engage in a sexual relationship with Myrna, attempted to appeal to [his]sense of sympathy or friendship, or offered [Mendoza] any form of profit or gain.

Nor, under the circumstances of this case, was the act of placing an ad in the adults-only section of Craigslist an unconscionable police practice. Although the ad itself did not indicate Myrna's age, Agent Caroland represented Myrna to be a fifteen-year-old child in his first reply to Defendant's response to the ad. Thus, despite the placement of the ad in the adults-only section of Craigslist, [Mendoza] was made aware at the outset that the ad had not been placed by an adult.

Additionally, in terms of the conscionability of police practices, we see little distinction between Agent Caroland perpetuating the ruse that he was a fifteen-year-old girl who was breaking the rules of Craigslist by posting an ad in an adult-restricted section and the law enforcement practice of posing undercover as a drug dealer. . . . In each instance, law enforcement is playing a role and engaging in a ruse intended to root out criminals. Likewise, just as the Vallejos Court approved the use of actual illicit drugs in the drug sale by undercover agents posing as drug dealers, we approve the use in the present case of age-regressed photographs to accompany the Myrna persona. . . .

To hold that it was impermissible for Agent Caroland to use the age-regressed photographs that were essentially a `prop’ that permitted him to believably maintain the Myrna persona would amount to micro-management of police investigative procedures that is not within the purview of this Court. . . .

State v. Mendoza, supra. 

The court concluded this section of its opinion by noting that

[o]n a final note in regard to Defendant's objective entrapment argument, we observe that § 30–37–3.2(D) expressly provides that `[in] a prosecution for child solicitation . . .  it is not a defense that the intended victim of the defendant was a peace officer posing as a child under sixteen years of age.’ Thus, in drafting § 30–37–3.2(D) the Legislature appears to have contemplated that the police would use methods such as Agent Caroland's `Myrna’  Craigslist ad to enforce the prohibition against child solicitation. The obvious legislative intent behind § 30–37–3.2 further supports our conclusion that the activity here did not exceed the standards of proper investigation and was not unconscionable under State v. Vallejos, supra (stating that the appellate court should not interfere with the policy and enforcement decisions of the legislative and executive branches of government). In sum, [Mendoza’s] argument that he was objectively entrapped as a matter of law does not demonstrate grounds for reversal.

State v. Mendoza, supra. 

For these and other reasons, the Court of Appeals affirmed Mendoza’s conviction.