Wednesday, April 27, 2011

Sentencing, PIN Numbers and Impossible Loss

As I’ve explained in earlier posts, sentencing in the federal system is governed by the Federal Sentencing Guidelines which, which, as Wikipedia notes, are “rules that set out a uniform sentencing policy for individuals and organizations convicted of felonies and serious misdemeanors in the United States federal courts system. And as Wikipedia explains, sentencing under the Guidelines is based primarily on two factors: (i) the conduct associated with the offense and (ii) the defendant's criminal history (the criminal history category).

This post is about a recent decision from the U.S. Court of Appeals for the 2d Circuit in which the court addressed the defendant’s challenging “the procedural and substantive reasonableness” of the sentence imposed on him after he was convicted of conspiracy to commit wire fraud and damage a protected computer for personal gain in violation of 18 U.S. Code §§ 371, 1343, 1030(a)(2)(C) and (a)(5)(A) (1 count); money laundering in violation of 18 U.S. Code § 1956(a)(2)(B)(i) (1 count); and access device fraud in violation of 18 U.S. Code § 1029(2)-(3), (5) (3 counts). U.S. v. Volynskiy, 2011 WL 1486158 (2d Cir. 2011).

This is how the prosecution described the conduct that led to these charges against Aleksey Volynskiy:

From 2006 through 2007, Volynskiy, [Alexander] Bobnev, and other co-conspirators participated in a scheme to steal funds from bank and brokerage accounts by hacking into those accounts . . . (using personal financial information obtained through computer viruses), and then launder[ing] the stolen proceeds. . . . Bobnev and co-conspirators in Russia used . . . `Trojan Horses’ to hack into the personal computers of multiple victims in the United States. . . . After the Trojan Horses captured the victims' account information, Bobnev and other co-conspirators used the information to access victims' bank and brokerage accounts, and thereafter made unauthorized sales of securities and unauthorized wire transfers out of these accounts.

Volynskiy, along with co-conspirators in the United States, set up `drop’ accounts to receive the funds stolen from their victims' bank and brokerage accounts. They sent a portion of the stolen funds from various `drop’ accounts to co-conspirators in Russia through money-remitting services (such as Western Union), and retained a portion . . . for themselves. . . .

During the same time period that Volynskiy and Bobnev were carrying out [this] scheme, . . . Volynskiy also stole funds from bank accounts by withdrawing money from those accounts at ATMs, using stolen credit card numbers.

Brief for the United States of America, U.S. v. Volynskiy, 2011 WL 365229 (2d Cir. 2011).

Volynskiy was caught after one of his co-conspirators became a cooperating witness for the FBI. Brief for the United States of America, supra. On November 25, 2008, he was indicted on the above charges, and on August 4, 2009, he pled guilty to all the charges “without a plea agreement.” Brief for the United States of America, supra. On April 6, 2010, the district judge who had the case sentenced Volynskiy to “concurrent terms of 37 months' imprisonment on each count, to be followed by concurrent terms of three years' supervised release”. Brief for the United States of America, supra. As I noted earlier, Volynskiy appealed the sentence. U.S. v. Volynskiy, supra.

Volynskiy’s first argument was that the judge “miscalculated the total loss amount applicable to his Guidelines” range of possible penalties “by $90,000 – based on $500 for each of 180 credit card numbers Volynskiy provided to the” cooperating witness. U.S. v. Volynskiy, supra. At the sentencing hearing, the defense attorney said “he believed the loss amount from the 180 credit card numbers given to the cooperating witness was zero”, basing this contention “the fact that the information given was not sufficient to create the credit cards in that no PIN numbers were provided.” Brief for Defendant, U.S. v. Volynskiy, 2011 WL 1486158. The judge, however, decided to include the $90,000 “under an `intended loss’ theory.” Brief for Defendant, supra.

The issue arose under U.S. Sentencing Guideline § 2B1.1. Application note 3(A)(i) for this guideline states that “loss” is “the greater of actual loss or intended loss” and defines “actual loss” as “the reasonably foreseeable pecuniary harm that resulted from the offense”. It defines “reasonably foreseeable pecuniary harm” as “pecuniary harm that the defendant knew or, under the circumstances, reasonably should have known, was a potential result of the offense.”

In Volynskiy’s appeal, his attorney argued that he could not have reasonably foreseen

any pecuniary harm by giving the cooperating witness credit card numbers without associated PIN numbers and encoded information necessary to create a credit card. He could not have reasonably foreseen any potential loss resulting from that act and thus did not `intend’ a loss of $90,000. . . . Volynskiy was never shown to have made any profit from the transfer of the credit card numbers nor to have any knowledge that they would be used without authorization.

Brief for Defendant, supra.

The Court of Appeals was not persuaded: It explained that even “if Volynskiy could not use the counterfeit cards without PIN numbers, such fraudulent use was clearly his ultimate intent. Indeed, Volynskiy stated that he understood that co-conspirators could obtain access numbers.” U.S. v. Volynskiy, supra. In arriving at this result, the Court of Appeals at least implicitly approved the district court judge’s use of “an `intended loss’ theory.” U.S. v. Volynskiy, supra.

As noted above, Application note 3(A)(i) for § 2B1.1 of the Sentencing Guidelines defines “actual loss.” Application note 3(A)(ii) defines “intended loss” as “the pecuniary harm that was intended to result from the offense” and includes “intended pecuniary harm that would have been impossible or unlikely to occur”. The court clearly agreed with the prosecution’s argument on this issue, which was that there was

no question that Volynskiy provided credit card numbers and other information to a CW [cooperating witness] for the express purpose of creating fraudulent credit cards that could be used to obtain money. Each of those credit card numbers was properly counted as part of the intended loss caused by [his] conduct. Whether he could have completed the scheme on his own or needed the CW's help was irrelevant because Volynskiy's fraudulent intent was clear.

Brief for the United States of America, supra.

That brings us to Volynskiy’s argument as to the “substantive unreasonableness” of the sentence imposed on him. He claimed the sentence was “substantively unreasonable because it fails adequately to account for his youth, rehabilitation, attempt to cooperate, and eventual deportation” and because “the district court [judge] placed undue weight on the need for general deterrence.” Brief for Defendant, supra. In Volynskiy’s appellate brief, his attorney explained that he was a 23-year-old man with

no prior criminal history. He made only $8,000 for his part in the scheme and for that he had ruined his life. [Volynskiy] had tried to assist the government but simply did not have the type of information in which the FBI was interested. Furthermore, . . . [his] role in the offense . . . was clearly less than that of the other participants. He had no skills that would have allowed him to engage in computer hacking and had no involvement in that part of the scheme. He merely acted as a bridge between codefendant Bobnev and the cooperating witness.

Brief for Defendant, supra. Earlier, the defense brief explains that Volynskiy was

born in the former Soviet Union in the former city of Gorky and came to the United States in March of 2001. He . . . was not aware of being a citizen of any country. He came to this country when he was 14 or 15 years old and attended La Guardia High School in New York for 3 years.

Brief for Defendant, supra.

Judge Denny Chin, who was a federal district court judge in the Southern District of New York until April, 2010, when he became a judge on the Second Circuit Court of Appeals, sentenced Volynskiy. (Chin was, of course, not on the three-judge panel of the Second Circuit that decided this appeal.) At the sentencing hearing, Judge Chin explained that in imposing the sentence he considered a

number of mitigating factors, such as Volynskiy's young age, the absence of any criminal history, the support of his family and friends, and his efforts to `find the right path’ since his arrest. [He] noted that while he considered Volynskiy's immigration status, `it's a common collateral consequence that we see in this courthouse.’ Judge Chin also explained that he considered the seriousness of the crimes, and that `while general deterrence might be a slippery concept, it's very much a part of the calculus’; in particular, he noted that the success of computer hackers in Russia was due in part to assistance from people in the United States like Volynskiy, who helped carry out the crimes.

Brief for the United States of America, supra.

The Court of Appeals judges rather brusquely rejected Volynskiy’s substantive unreasonableness argument:

In imposing a sentence at the low end of the Guidelines range, the experienced district judge expressly considered the factors cited by Volynskiy. He nevertheless declined to impose a non-Guidelines sentence because of the serious nature of Volynskiy's crimes, his important role and long involvement in the scheme, and the need for general deterrence of international hackers. On this record, the district court acted well within its `considerable sentencing discretion’ in imposing the challenged term of incarceration.

U.S. v. Volynskiy, supra. The court therefore upheld Volynskiy’s sentence.

If you’d like to read more about the scam and/or read the indictments, check out the news story you can find here.

No comments: