Monday, November 24, 2014

The FBI, the Protected Computer and Coram Nobis

On December 1, 2008, the U.S. Department of Justice filed an information, alleging that 
on five occasions between January 19, 2007 and July 5, 2007, [Mark Thomas Rossini] `intentionally and knowingly exceeded his authorized access to a protected computer belonging to the Federal Bureau of Investigation, an agency of the United States headquartered in the District of Columbia, and by such act obtained information from the Federal Bureau of Investigation that he was not permitted to receive,’ in violation of Title 18 of the U.S. Code § 1030(a)(2)(B), the Computer Fraud and Abuse Act. . . . On December 8, 2008, [Rossini] entered a guilty plea as to all charges in the information.
Rossini v. U.S., 2014 WL 5280531 (U.S. District Court for the District of Columbia 2014).
In pleading guilty, Rossini
conceded that the following facts were true:

`Between January 3, 2007 and July 30, 2007, the defendant made over 40 searches of the ACS for FBI information that were for purely personal purposes, and not connected to FBI business. Each of these searches exceeded the defendant's authorized use of the ACS system, and were [sic] not part of any of his assigned work. As part of these searches, the defendant obtained information to which he was not entitled.’
Rossini v. U.S., supra.  The ACS was the FBI’s Automated Case Support System; as this press release explains, in 2013 the FBI replaced the “paper-based” ACS System with a new digital system.  If you would like to know more about the facts involved in this prosecution, check out the news stories you can find here and here.  The story you can find here says Rossini "passed" an FBI document to "actress Linda Fiorentino "to help the defense lawyers for rogue detective Anthony Pellicano". 
On May 14, 2009, Rossini was sentenced to
1) twelve months of probation for each of the five counts, to run concurrently; 2) a special assessment fee of $125; 3) a fine of $5,000 to be paid at a monthly rate of $250; and 4) 250 hours of community service. . . . Since judgment was imposed, [he] completed payment on the Court-imposed fines, his supervised release was terminated, and he completed his community service. U.S. v Rossini, supra.  
And in June of 2014, he filed a Motion for Writ of Error Coram Nobis.  Docket, U.S. v. Rossini, Case No. 1:08-MJ-00692.  As the District Court Judge in this case explained,
`[t]he writ of coram nobis is an ancient common-law remedy designed “to correct errors of fact.”’ U.S.v. Denedo, 556 U.S. 904 (2009) (quoting U.S. v. Morgan, 346 U.S. 502 (1954)). Originally, the writ was intended as a means of correcting `technical errors.’ U.S. v. Denedo, supra.

Today it is used to correct `fundamental errors,’ when no other remedy is available. U.S. v. Denedo, supra. Thus, `coram nobis . . . may collaterally attack only constitutional or jurisdictional errors or serious defects in the trial either not correctible on direct appeal or where exceptional circumstances justify the failure to appeal on those grounds.’ U.S. v. McCord, 509 F.2d 334 (U.S. Court of Appeals for the D.C. Circuit 1974).
Rossini v. U.S., supra.  
He went on to explain that in his opinion in U.S. v. Williams, 630 F.Supp.2d 28 (U.S. District Court for the District of Columbia 2009),
Judge Hogan indicated that `the D.C. Circuit's precedent in this area is thin.’ . . . He pointed to the leading case, U.S. v. Hansen, 906 F.Supp. 688 (U.S. District Court for the District of Columbia 1990), in which Judge Joyce Hens Green . . ., in the absence of D.C. Circuit authority for analyzing a petition for a writ of error coram nobis, looked to the practice of the 3rd, 4th, 9th and 10th Circuits. U.S. v. Hansen, supra.

Under their precedents, relief by writ of coram nobis was only available when: `(1) a more usual remedy is not available; (2) valid reasons exist for not attacking the conviction earlier; (3) adverse consequences exist from the conviction sufficient to satisfy the case or controversy requirement of Article III; and (4) the error is of the most fundamental character. U.S. District Court for the District of Columbia. Accord U.S. v. Akinsade, 686 F.3d 248 (U.S. Court of Appeals for the 4th Circuit 2012); Klein v. U.S., 880 F.2d 250, 254 (U.S. Court of Appeals for the 10th Circuit 1989); Hirabayashi v. U.S., 828 F.2d 591, 604 (U.S.Court of Appeals for the 9th Circuit 1987).
Rossini v. U.S., supra.  This judge decided he would “follow Judge Hogan's and Judge Green's lead and apply those factors.”  Rossini v. U.S., supra.  
He therefore began his analysis with the first factor, i.e., whether a “more usual remedy” was available.  Rossini v. U.S., supra.  The judge noted that both Rossini and the
government agree that because [he] waived his right to an appeal when he accepted the plea agreement, and because he has now completed the various elements of his sentence, the more usual remedies of either a direct appeal or a motion for habeas corpus relief pursuant to 28 U.S. Code § 2255 . . . are not available. . . . . Thus [Rossini] has satisfied the first of the coram nobis requirements.
Rossini v. U.S., supra.  
Next, the judge took up the second issue – valid reasons for not attacking his conviction sooner.  Rossini v. U.S., supra.  Rossini’s argued that he did not do so because there
was a change in the law governing his conviction. . . . [He] claims it was not until this Court issued its decision in Lewis–Burke Assocs., LLC v. Widder, 725 F. Supp. 2d 187 (U.S. District Court for the District of Columbia 2010) and the 9th Circuit issued its decision in U.S. v. Nosal, 642 F.3d 781 (U.S. Court of Appeals for the 9th Circuit 2011), that he became aware he had grounds to file a petition for a writ of coram nobis.
Rossini v. U.S., supra.  
The judge went on to explain that Rossini’s argument was “flawed” because
both the Widder and Nosal decisions adopted the 9th Circuit's reasoning in LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (U.S. Court of Appeals for the 9th Circuit 2009), . . . issued in 2009, well before [his] current filing, which occurred five years later on June 6, 2014. . . .The government also argues that [Rossini] could have based his argument on the reasoning in Shamrock Foods Co. v. Gast, 535 F. Supp.2d 962 (U.S. District Court for the District of Arizona 2008), . . . in which the court ruled on the application of the [Computer Fraud and Abuse Act] to conduct similar to that at issue in this case. . . . The government's arguments are persuasive because there was authority in existence well before [he] filed his current petition . . . which could have supported the argument he makes now.
Rossini v. U.S., supra.  
The District Court Judge then went on to explain that “even” if this court’s decision
in Widder had been deemed to apply retroactively, which it was not, [Rossini] still lacked a valid reason for not attacking his conviction earlier because the argument he now advances has in fact previously been successfully asserted, albeit not in this circuit. On February 20, 2008, the District Court for the District of Arizona issued its decision in Shamrock. In that case, a civil action, the court unequivocally held that `[t]he general purpose of the [Computer Fraud and Abuse Act] ‘was to create a cause of action against computer hackers (e.g., electronic trespassers).’

To that end, the court concluded the following with respect to sections 1030(a)(2) and section (4) of the Computer Fraud and Abuse Act:

`Given the plain language, legislative history, and principles of statutory construction, the restrictive view of authorization is adopted. [A] violation for accessing without authorization occurs only where initial access is not permitted. And a violation for exceeding authorized access occurs where initial access is permitted but the access of certain information is not permitted.’

Shamrock Foods Co. v. Gast, supra. . . .

Less than two years later, . . . the [U.S. Court of Appeals for the 9th Circuit] issued its decision in LVRC Holdings LLC v. Brekka, supra. In that case, a company sued a former employee for violating sections 1030(a)(2) and (4) of the [Computer Fraud and Abuse Act] by accessing its computer without authorization and in excess of authorizations. First, the court noted that `an employer gives an employee “authorization” to access a company computer when the employer gives the employee permission to use it.’ LVRC Holdings LLC v. Brekka, supra. 

Thus, the court concluded that because the company gave the employee permission to access its computer, he did not act `without authorization’ when he acted for purposes contrary to the company's interest, both while employed by the company and then after he left the company. LVRC Holdings LLC v. Brekka, supra. For the same reason, the court also concluded that the employee did not `exceed authorization.’ LVRC Holdings LLC v. Brekka, supra. . . . The court clearly stated therefore that an individual violates the above two sections of the Computer Fraud and Abuse Act by accessing data for which he lacks authorization, not for using data that he is authorized to access for purposes contrary to the company's interest.

Finally, on July 28, 2010, this Court issued its decision in Lewis–Burke Assocs., LLC v. Widder, supra. . . . [T]he issue . . . was whether an employee violated the Computer Fraud and Abuse Act by taking confidential and proprietary computer data with him when he left the company where he used to work, in violation of [18 U.S. Code § 1030(a)(2)]. . . .[T]his Court also noted that the primary purpose of the Computer Fraud and Abuse Act was to deter computer hacking. . .Then, following the Brekka line of cases, this Court noted that when an employer gives an employee permission to use its computer system, it is giving that employee authorization to access the data contained therein. . . . [T]his Court concluded that `[w]hether [an employee] had permission to copy documents onto his thumb drive or to subsequently use the data from a non-[work] computer, after he had left its employ, is not a question that relates to his liability under the Computer Fraud and Abuse Act’.” 

[T]he information against [Rossini] was filed on December 1, 2008, almost ten months after the . . .Shamrock decision was issued. Understandably, even if [he] had been aware of the Shamrock opinion, he may not have felt compelled to base his motion for a writ of coram nobis upon the authority of a case from the District Court for the District of Arizona.

However, when the 9th Circuit issued its September 15, 2009 opinion in LVRC Holdings LLC v. Brekka, supra, [Rossini] should have been compelled to file the current motion. . . . [A]s of . . . the Brekka decision, which was issued four months after [he] was sentenced, he should have been aware there was circuit authority for the proposition that he was not guilty of a misdemeanor violation of the [Computer Fraud and Abuse Act] when he accessed FBI information for personal reasons. Nothing whatsoever justifies his delay.
Rossini v. U.S., supra (emphasis in the original).
The judge then took up the third factor:  adverse consequences. Rossini v. U.S., supra.  Rossini argued that, “as a former FBI counterterrorism specialist who has been convicted of violating the [Computer Fraud and Abuse Act], he has not been able to obtain work in his field of expertise.”  Rossini v. U.S., supra.  The U.S. Department of Justice conceded that
while it is true that adverse consequences flow from a criminal conviction, it argues that not every person who has been convicted of a crime is entitled to a writ of coram nobis. . . .  The government also notes the following: `His admitted behavior in conducting personal searches of the FBI database, obtaining information from that database, and sharing it with a third party would be an obvious impediment to any effort on his part to obtain future permanent employment in the counterterrorism field, quite separate and apart from the conviction to which that conduct lead.’
Rossini v. U.S., supra.  
Here, too, the judge found the government’s argument to be “persuasive.”  Rossini v. U.S., supra.  He pointed out that to satisfy the “case or controversy” requirement of
Article III, [Rossini] must show 1) that he suffered some actual or threatened injury as a result of the respondent's conduct; 2) that the injury resulted from the petitioner's conduct; and 3) that the injury is likely to be redressed by a favorable action. Valley Forge Christian Coll. v. Ams. United for Separation of Church and State, Inc., 454 U.S. 464 (1982). . . .

[E]ven if [Rossini’s] writ . . . was granted and his conviction was vacated, the injury he claims he suffered -- that he can no longer obtain employment in the field of counterterrorism -- would not necessarily be redressed. . . . [Rossini] . . . admitted to having accessed information on the FBI database, over forty times, and used it for personal purposes. This behavior is hardly likely to make him an attractive candidate for future work in the field of counterterrorism, where the need to maintain secrecy is of paramount importance. . . . [H]ad [Rossini] not admitted to the conduct at issue, vacating his judgment would have favorably redressed his injury. Thus, [he] cannot . . . argue that the adverse consequences he suffered were either solely the result of his conviction or . . . are sufficient to satisfy Article III's case or controversy requirement.
Rossini v. U.S., supra.  
Finally, the judge took up the fourth and final issue: an “error of fundamental character”. Rossini v. U.S., supra.  The judge began by noting that it
is hard to understand what error of a fundamental character haunts [his] conviction. [Rossini], represented by obviously competent counsel, chose to plead guilty and gain the benefits of doing so when he could have demanded a trial and asserted what might have been the successful argument that his behavior did not violate the statute. Instead, he chose to limit his sentencing exposure by pleading guilty.

Now that the law is more favorable to his position, he wants to undo the bargain he made and get the result he chose not to try to get in the first place. A writ of coram nobis is designed to cure a fundamental error, not a bad case of buyer's remorse.
Rossini v. U.S., supra.  
He on to explain that “[a]lternatively,” Rossini “might” argue that because the                     
information did not charge a crime, this Court lacked jurisdiction over the subject matter and its exercising that jurisdiction to convict him was a fundamental error. See, e.g., U.S. v. Peters, 310 F.3d 709 (U.S. Court of Appeals for the 11th Circuit 2002). But, in this Circuit, it is clear that a claim that the indictment fails to state an offense does not deprive the court of jurisdiction over the subject matter. See U.S. v. Delgado-Garcia, 374 F.3d 1337 (U.S. Court of Appeals for the D.C. Circuit 2004).

This is because the substantive sufficiency of the indictment is a matter that goes to the merits of the case, rather than to the district court's subject matter jurisdiction. U.S. v. Delgado–Garcia, supra. Accord U.S. v. George, 676 F.3d 249 (U.S. Court of Appeals for the 1st Circuit 2012). . . . Thus, the only possible avenue of relief [Rossini] could pursue is not available.
Rossini v. U.S., supra.  
The U.S. District Court Judge therefore denied Rossini’s motion. Rossini v. U.S., supra.  

No comments: