Source: https://www.pbwt.com/second-circuit-blog/aol-outlaw-must-bear-the-burden-of-proving-who-pays-the-price/
Timestamp: 2019-04-19 16:45:33+00:00

Document:
In its decision, the Second Circuit affirmed that defendants bear “the full burden” of proving that a victim has been fully compensated for the losses they caused before they can obtain a modification of a restitution order under the Mandatory Victims Restitution Act (“MVRA”), 18 U.S.C. §§ 3663A, 3664, and concluded that Smathers had failed to demonstrate other recoveries by AOL should eliminate his restitution obligation. Defendants must show that there are appropriate offsets to restitution. It is not the government’s obligation to disprove such claims. This decision strengthens the position of victims of crime who have sustained financial losses as a result of defendants’ actions.
In 2003, while employed at AOL, Smathers stole a list containing the usernames of millions of AOL customers. Smathers sold the list for $28,000 to individuals who used it to spam customers with unwanted advertisements an estimated 7 billion times over the next year. Aside from the annoyance to consumers, these spam e-mails cost AOL over $300,000 to process. Smathers pleaded guilty to conspiracy, theft, and e-mail fraud charges in 2005, and the district court sentenced Smathers to a 15-month term of imprisonment and ordered him to pay restitution to AOL under the MVRA. Although Smathers’s plea agreement stated that AOL’s losses were $300,000, and the district court’s judgment so ordered this as the “total loss,” the judge only imposed a restitution award of $84,000, believing that a greater amount would result in a windfall to AOL.
Meanwhile, AOL initiated civil litigation against the spammers, including one of the individuals who purchased the customer list that Smathers misappropriated. Although the record from the civil litigation is largely sealed, the public docket disclosed that AOL eventually obtained a default judgment against some of the culpable parties in excess of $12 million and including—at least according to news sources—a Hummer automobile. A parallel criminal case against one of Smathers’s co-conspirators also resulted in a restitution award to AOL. After learning of this, Smathers filed several letters with the district court over the course of the next decade seeking to have the court modify his $84,000 restitution award on the grounds that AOL’s recovery in the other litigation fully satisfied the restitution Smathers owed.
The Second Circuit began its analysis with the text of the MVRA, a federal statute intended to “provide full compensation to victims of . . . crimes.” Slip Op. 8. Consistent with its compensatory purpose, the Court noted that the MVRA does not authorize a victim to recover more in restitution than necessary to compensate it for its losses. Slip Op. 9 (citing 18 U.S.C. § 3664(j)(2)). Specifically, the MVRA states that “[a]ny amount paid to a victim under an order of restitution shall be reduced by any amount later recovered as compensatory damages for the same loss by the victim [in another proceeding].” 18 U.S.C. § 3664(j)(2) (emphasis added). The MVRA also commits the decision of which party bears the burden of proof in disputes regarding modifications to an existing restitution award to the court in its discretion “as justice requires.” Slip Op. 11–12 (quoting 18 U.S.C. § 3664(e)).
The subject of restitution and other financial penalties continues to give rise to frequent litigation before the Circuit. In this case, the Court reviewed the district court’s construction of the MVRA, both in formulating Smathers’s restitution obligation and in considering his request for a reduction. This exercise required the district court to grapple with the difficulty of valuing the harms of cybersecurity crimes like hacking. The district court tried to figure out the actual expense to AOL, neither including overhead expenses to AOL caused by the crime, nor merely basing restitution on the amount of money received by Smathers for selling the information. Today, courts might also include the victim’s costs of investigation as part of the restitution owed by the defendant. See, e.g., United States v. Amato, 540 F.3d 153 (2d Cir. 2008).
At any rate, neither the district court nor the Second Circuit found any room for ambiguity in assigning the full responsibility for compensating AOL for its losses—and for finding out if compensation already had been paid—to Smathers. Crime victims who benefit from MVRA restitution awards are not parties to the criminal cases in which their injuries are prosecuted. Therefore, the Second Circuit needed to decide only whether it was fair for Smathers or the government to bear the burden of proving whether AOL had been compensated for Smathers’s crimes.
Companies who are victims of hacking likely owe fiduciary obligations to their shareholders to vigorously recover money and good-will lost in a cybersecurity breach, so companies may have an independent interest in seeking compensation from wrongdoers outside of the MVRA’s restitution channels. Nevertheless, the Second Circuit’s opinion makes clear that defendants cannot simply point to companies’ efforts to recoup losses in order to excuse their requirement to pay restitution for their crimes. Restitution is based on principles of equity, and the Second Circuit’s decision seems eminently equitable under the circumstances here, where Smathers expected to avoid paying up by asking the government to do the leg work for him.
Defendants have strong incentives to do this leg work, given that restitution awards can be high, and they do not expire until 20 years after release from imprisonment, and the unpaid obligation can be sought from the defendant’s estate. See 18 U.S.C. § 3613(b), (f). The government can refute the defendant’s evidence where appropriate, such as where the victim has not actually received the compensation identified by the defendants. See, e.g., United States v. Yalincak, 853 F.3d 629, 636 (2d Cir. 2017). This decision seems likely to increase such post-sentencing litigation in the future.
 The Court briefly considered whether it had jurisdiction to review the district court’s 2016 order denying Smathers’s motion under 28 U.S.C. § 1291, which authorizes appellate review of only “final decisions” by lower courts. Slip Op. 10. The Court found that the district court had “unconditional[ly] dismiss[ed]” Smathers’s motion, which was sufficient to render it a final decision for purposses of the Second Circuit’s jurisdiction. Slip Op. 11.

References: § 3664
 § 3664
 § 3664
 v. 
 § 3613
 v. 
 § 1291