Friday, August 19, 2011

Grades, Keylogging and Fraud

As Wikipedia notes, “[i]n criminal law, . . . fraud is an intentional deception made for personal gain”. This post deals with a case in which three undergraduate students at Florida A&M University [FAMU] were charged with and ultimately convicted of fraud and identity theft in violation of federal law. U.S. v. Barrington, __ F.3d __, 2011 WL 3503206 (11th Cir. 2011).

Barrington, Christopher Jacquette and Lawrence Secrease were charged with conspiracy to commit wire fraud in violation of 18 U.S. Code §§ 371 & 1349, use of a computer to further a scheme to defraud in violation of 18 U.S. Code § 1030(a)(4) and three counts of aggravated identity theft in violation of 18 U.S. Code § 1028A. U.S. v. Barrington, supra. According to the opinion cited above, the convictions arose from

a scheme [Barrington] and his co-conspirators concocted. . . . Secrease and Barrington, roommates at the time, began discussing how to change grades for friends who were applying to graduate school. During the summer of 2007, Barrington changed grades for himself, Jacquette and several fraternity brothers using forged University grade change slips. When . . . they ran out of blank grade change slips, they developed a plan to access the system using keylogger software.

Secrease was with Barrington in the Registrar's Office in August 2007 when they attempted to install the first keylogger.

They eventually installed keylogger software on various University computers, including an office computer used by a Registrar employee and four terminals placed in the University's grand ballroom during registration. The keyloggers covertly recorded the keystrokes made by Registrar employees as they signed onto their computers, capturing their usernames and passwords. That data was automatically transmitted to various email accounts, including Barrington's personal email address.

Using the surreptitiously obtained usernames and passwords, the conspirators accessed FAMU's grading system, changed grades, added credits for courses which had been failed or not taken, and changed the residencies of several non-resident students to qualify them for in-state tuition. The changes were made via the Internet from the conspirators' home computers, campus computers at FAMU and Florida State University, and from several wireless laptops.

U.S. v. Barrington, supra.

The FAMU Police Department and the FBI investigated and found FAMU’s grading

system had been accessed by unauthorized means. The investigation was triggered after a FAMU professor discovered one of his students, Barrington's sister, had received two unauthorized grade changes. The University . . . discovered that between August and October 2007, . . . 30 to 35 unauthorized changes were made to Barrington's grades, all but one from a lower grade to an A. Barrington's sister received 5 grade changes from F or C to A. Jacquette received approximately 43 grade changes and Secrease approximately 36. Ultimately, . . . in excess of 650 unauthorized grade changes [were] made, involving at least 90 students. As a result of the grade changes and residency changes, the University incurred a loss of $137,000 in tuition it otherwise would have received.

U.S. v. Barrington, supra.

FAMU police interrogated Barrington, but he denied knowing anything about the grade changes. U.S. v. Barrington, supra. After the University reversed the grade changes, Barrington held a meeting with Jacquette, Secrease and some other students’ whose grades were changed; they “agreed to re-install keyloggers on the Registrar’s computers” so they could change grades a second time. U.S. v. Barrington, supra.

They installed the keyloggers “using flash drive devices” and continued to change grades, even though law enforcement was still investigating. U.S. v. Barrington, supra. Barrington and his colleagues tried to conceal what they were doing by making “random grade changes for students” who were not involved in the original scheme. U.S. v. Barrington, supra. Their theory was that the police would believe either that it was other students who were making the changes or that the changes were the result of a “`flaw or hiccup’” in the Registrar’s computer system. U.S. v. Barrington, supra.

It all fell apart in November of 2007, when officers executed search warrants at their residences and found the usernames and passwords of Registrar employees, notes concerning classes and the grade changes to be made for each and documents from the Registrar’s office. U.S. v. Barrington, supra. Barrington had given the laptop they used to change grades to another student, but that student turned it over to the police. U.S. v. Barrington, supra. Barrington, Jacquette and Secrease were charged with the federal crimes listed above, after which Jacquette and Secrease pled guilty and were given “substantial assistance departures” pursuant to 18 U.S. Code § 3553(3) at sentencing. U.S. v. Barrington, supra.

Barrington went to trial and was convicted. U.S. v. Barrington, supra. He appealed, raising several issues, the first of which was that the district court judge erred in letting Jacquette testify as to how Barrington “changed grades using forged instructor signatures on University grade change slips.” U.S. v. Barrington, supra. Barrington claimed this evidence was admitted in violation of Federal Rule of Evidence 404(b), which provides as follows:

Evidence of other crimes, wrongs, or acts is not admissible to prove the character of a person in order to show action in conformity therewith. It may, however, be admissible for other purposes, such as proof of motive, opportunity, intent, preparation, plan, knowledge, identity, or absence of mistake or accident. . . .

In ruling on Barrington’s argument, the 11th Circuit noted that courts use a “three step test” in determining the admissibility of “extrinsic 404(b) evidence: (1) the evidence must be relevant to an issue other than the defendant's character; (2) there must be sufficient proof so that the jury could find that the defendant committed the extrinsic act; and (3) the evidence must possess probative value that is not substantially outweighed by undue prejudice.” U.S. v. Barrington, supra. It also noted that by “pleading not guilty, Barrington placed his intent to participate in the grade changing scheme in issue”, which meant that the prosecution “could . . . produce qualifying 404(b) extrinsic evidence to prove intent.” U.S. v. Barrington, supra.

The 11th Circuit explained that when extrinsic evidence, such as Jacquette’s testimony, is offered to prove intent, its relevance is determined by comparing the intent involve in “`perpetrating both the extrinsic and charged offenses’” and noted that when, “as here, the state of mind required for the charged offense and the extrinsic act is identical, the first prong of the” test noted above is satisfied. U.S. v. Barrington, supra. Jacquette testified that Barrington began changing grades, using grade change slips, in the summer of 2007 but eventually had to find a new system because he ran out of slips. U.S. v. Barrington, supra. They first tried to steal Registrar employees’ passwords, but when that failed, Jacquette “mentioned the use of keylogger programs, which eventually became the operational method of the charged scheme.” U.S. v. Barrington, supra.

The 11th Circuit therefore found that Jacquette’s testimony was property admitted because (i) the extrinsic and charged conduct involved the same intent, i.e., to defraud, (ii) there “was an adequate basis for the jury to find that Barrington actually committed the extrinsic acts” given that Jacquette “had personal knowledge of Barrington’s conduct” and the probative value of the evidence wasn’t outweighed by prejudice because the extrinsic act evidence “was not only similar to the charged scheme in its objectives, but explained the events immediately preceding the formation of the charged conspiracy and the reason the scheme evolved as it did.” U.S. v. Barrington, supra.

Barrington also argued that the evidence was insufficient to support his conviction for aggravated identity theft in violation of 18 U.S. Code § 1028A. U.S. v. Barrington, supra. The identity theft counts were based on the fact that Barrington and his colleagues used the keyloggers to obtain the usernames and passwords of Registrar Office employees, which they then used in the grade-changing scheme. U.S. v. Barrington, supra. On appeal, Barrington argued that the evidence presented at trial didn’t prove he committed aggravated identity theft because “the passwords the conspirators used to access the Registrar's computer system belonged to the university and do not constitute personal identity information of the individual university employees.” U.S. v. Barrington, supra.

As Barrington noted in his appellate brief, in Flores-Figueroa v. U.S., 129 S.Ct. 1886 (2009), the Supreme Court held that to convict someone of aggravated identity theft in violation of § 1028A, the government must prove beyond a reasonable doubt that the defendant knew the means of identification at issue in the case belonged to another person. Brief of the Appellant, U.S. v. Barrington, 2010 WL 5621783. Barrington argued that in this case, the usernames and passwords were

not personal to any individuals. They were merely a means to allow employees to access University data, like a key to a lock. The key belonged not to the employee, but to the employer. The statute was not meant to apply to such information, any more than it would apply to the theft of a magnetic striped access card that would allow an employee access to a bank vault.

Brief of the Appellant, U.S. v. Barrington, supra.

The 11th Circuit didn’t agree. It found that each of the elements required for a conviction

under § 1028A was proven. The Government proved Barrington, without authority, knowingly used the usernames and passwords of the Registrar employees during and in relation to the wire fraud conspiracy. The conspirators knew the usernames and passwords were unique to the employees and would enable them to access the protected grading system. [They] targeted [these employees] for that very purpose.

The usernames and passwords were sufficient to identify the Registrar employees who had authority to access FAMU's protected grading system. By statutory definition, a `means of identification’ includes `any name or number’ when used in conjunction with any other information `to identify a specific individual.’ 18 U.S. Code § 1028(d)(7). . . .

Clearly, the usernames and passwords, considered together, constituted a `means of identification’ for those specific individuals and Barrington knew that. . . . In sum, the evidence was sufficient to support Barrington's convictions for aggravated identity theft.

U.S. v. Barrington, supra.

Finally, Barrington argued, relying on a number of procedural issues involved in sentencing under the U.S. Sentencing Guidelines, that his 84 month sentence was “unreasonable.” U.S. v. Barrington, supra. One of his arguments was that the district court judge erred in calculating the financial loss to FAMU resulting from the changed grades; he said there was no evidence FAMU “lost or gained money as the result of failing grades being changed to passing grades”. U.S. v. Barrington, supra. The district court judge found that passing grades were given

`to students who did not earn them, and these grades could not have been obtained by students without retaking the classes.’ Further, it found that the `value of the grade change is the cost for retaking the class, which is the figure that has been used to calculate the loss amount.’ . . .

The district court calculated intended loss at $ 141,830.42. . . . [of which] $ 87,579.52 represented lost tuition for changes from out-of-state to in-state student residencies and $ 54,250.90 represented 319 credit hours lost for 119 courses for which grades had been changed from failing to passing or had been awarded for classes never taken or from which students had withdrawn. The loss for each credit hour was determined based on whether the student would have paid in-state or out-of-state tuition.

U.S. v. Barrington, supra. The 11th Circuit found the court’s calculation of loss was both reasonable and accurate; since it also rejected Barrington’s other challenges to his sentence, it affirmed the sentence as well as the conviction. U.S. v. Barrington, supra.

No comments: