Opinion ID: 3049332
Heading Depth: 2
Heading Rank: 2

Heading: sufficiency of the evidence

Text: “There is sufficient evidence to support a conviction if, viewing the evidence in the light most favorable to the prosecution and drawing all reasonable inferences, any rational trier of fact could have found the essential elements of the 8294 UNITED STATES v. SHEA crime beyond a reasonable doubt.” United States v. Bazuaye, 240 F.3d 861, 863 (9th Cir. 2001); see also Jackson v. Virginia, 443 U.S. 307, 319 (1979). “Circumstantial evidence and inferences drawn from it may be sufficient to sustain a conviction.” United States v. Jackson, 72 F.3d 1370, 1381 (9th Cir. 1995). When the issue of sufficiency of the evidence is preserved by making a motion for acquittal, we review the district court’s denial of the motion de novo. United States v. Tucker, 133 F.3d 1208, 1214 (9th Cir. 1998). [1] We have had rare occasion to interpret sufficiency of the evidence under the Computer Fraud and Abuse Act, which punishes any person who “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.” 18 U.S.C. § 1030(a)(5) (A)(i). Our decisions have thus far concentrated on the issue of damages. See, e.g., United States v. Middleton, 231 F.3d 1207 (9th Cir. 2000); United States v. Sablan, 92 F.3d 865 (9th Cir. 1996). Damages are not at issue in this appeal — only the question of the defendant’s involvement. Our analysis here is therefore aided by applicable principles from decisions interpreting similar criminal statutes. [2] Wire fraud, like computer fraud, has transmission as one of its elements. See 18 U.S.C. § 1343. To prosecute crimes involving the element of “transmission,” the government must offer sufficient proof that the person charged is the same person who sent the transmission. Circumstantial evidence is sufficient to prove that the transmission has occurred. See United States v. Rush, 749 F.2d 1369, 1373 (9th Cir. 1984). We confronted a wire fraud conviction based on facts similar to those presented here in United States v. Mullins, 992 F.2d 1472 (9th Cir. 1993). In that case, a trio of travel agents had manipulated an airline’s reservation system to transfer frequent flyer miles into sham accounts. Id. at 1475. The government witness testified that each of these transfers was tied to one of the defendants’ passwords, and an FBI UNITED STATES v. SHEA 8295 search of their offices revealed records of the ticket sales tied to their fake accounts. Id. The defendants argued, as Shea does in this case, that other employees could have accessed the passwords and accounts, and that the system was generally not secure. Id. at 1477. Nevertheless, we observed that there was “overwhelming” evidence to support the conviction, despite the possibility that someone else accessed the computer. Id. We have also found analogous cases where computer transmissions provided the basis for the prosecution’s theory, even if “transmission” itself was not an element of the offense. In our review of a bank fraud prosecution, we found sufficient evidence to support a conviction where the defendant had deployed a computer program to alter ATM records. See United States v. Bonallo, 858 F.2d 1427 (9th Cir. 1988). We noted that the defendant had the necessary programming skills, and the program file was found in his own file library. Id. at 1434. Because the government had also offered evidence of the defendant’s comings and goings from the banks in question, the sufficiency ruling did not rest on access and programming skills alone. Id. In an Eighth Circuit case bearing some resemblance to Shea’s, the court found sufficient evidence to support an extortion conviction where the defendant argued he had not sent the e-mails at issue. See United States v. Ray, 428 F.3d 1172, 1174 (8th Cir. 2005) (per curiam). A computer expert had testified that the e-mails were created on the defendant’s computer and saved on that computer’s hard drive. Id. The e- mails had been sent at a time when the defendant was using his computer, and there was no evidence of remote access to the computer at the time. Id. The evidence also showed the defendant had the knowledge and ability to follow through on the threats presented in the emails. Id. In another Eighth Circuit case, the court upheld an aiding and abetting conviction where there was no direct evidence that the defendant had used the computer where files had been improperly down8296 UNITED STATES v. SHEA loaded. See United States v. Levine, 477 F.3d 596, 605-06 (8th Cir. 2007). The court held that the evidence offered, proving the defendant’s access to the computer and the defendant’s motive, was sufficient. Id. At Shea’s trial, the prosecution constructed a timeline for the two relevant programs: Collector-Summary-II, the authorized program used in the day-end process, and CLEAR.CF.MARKS, the “time bomb,” which was launched by Collector-Summary-II. Both the prosecution and the defense elicited a great deal of testimony on how the BACS computer system works. For our purposes, it is relevant to describe the multiple levels of network and database access available to BACS employees: (1) BACS employees signed in to a Windows network where each employee had a user name and could select a personal password; (2) from there, they could log on to the database of the Columbia Ultimate Business System (CUBS), which operated on a Unix platform, as opposed to Windows. To work on the database, BACS employees had individual user names (which were also tied to user numbers) and selected their own passwords; (3) certain employees could also sign in to the Collector System, through distinct passwords that were assigned to each of them and based on their Social Security numbers. These passwords were archived in a separate file readable by only certain higher-level employees. These user names and passwords were not tied to each other, or to any given machine. So, for example, a person who knew all the relevant names and passwords could log in as one employee for the BACS Windows network, and then log in as another employee for the CUBS Universe database, and then sign in to the Collector System using another employee’s UNITED STATES v. SHEA 8297 password. The defense highlighted that any user could switch Unix identities in the CUBS database (the second level) with the right passwords, and that certain employees had “root” access or “super user” access that gave them permission to access any part of the system, though a password would still be necessary to enter the Collector System. Shea had root and super user access and could also access the list of employee passwords for the Collector System. The following timeline could be constructed from the testimony at trial: On December 9, 2002, at 6:53 p.m., a person logged on to the BACS network using Shea’s Windows user name at a computer in Shea’s office. A person at the same time logged on to the CUBS database under the Unix user name assigned to “LIB2002.” This account had been created during the system conversion to the latest release of CUBS — the job for which Shea was initially hired. This Unix user accessed the Collector-Summary-II source code and edited one line of the code to execute CLEAR.CF.MARKS. On December 27, 2002, at 10 a.m., BACS CEO Michael Priest called Shea into his office to discuss his work habits, which were “below acceptable,” according to Shea’s supervisor. At 2:23 p.m. that day, the Collector System logs indicated that user SHEAB edited the source code of CLEAR.CF.MARKS to change the trigger date from January 22 to January 15, 2003.1 1 There are two types of code involved in this case. “Source code” is essentially a set of directions that a programmer writes in text form. When the source code is complete, the programmer runs the code through a “compiler” that produces “object code” in a language that only the computer can read. See Microsoft Corp. v. AT&T Corp., 127 S. Ct. 1746, 1754 n.8 (April 30, 2007) (“Software in the form in which it is written and understood by humans is called source code. To be functional, however, software must be converted (or compiled) into its machine-useable ver8298 UNITED STATES v. SHEA On January 6, 2003, Shea’s supervisor, CIO William Stambaugh informed Shea that he would have to submit to a “performance plan,” which dictated that he check in by phone when he planned to be absent. The next day, January 7, at 7:27 a.m., Unix user 412, an identity tied to Shea, compiled the source code of CLEAR.CF.MARKS into object code. This date and time is the last recorded access to the CLEAR.CF.MARKS object code. Therefore, further alterations to the source code would not have affected the program that eventually ran on January 29.2 On January 9, at 11:36 a.m., user SHEAB accessed the source code, but BACS’s logs do not show that any modifications were made. The logs also show that the user entered a code to delete any record of commands entered by SHEAB. This user also entered a “clear screen” command several times, to move all text off the screen. Clearing the screen would have prevented anyone from observing the commands that were being typed. This user also entered a “WHO” command to confirm which user identity would be tied to the commands in the company’s logs. On January 15, CLEAR.CF.MARKS would have run based on the source code changes made in December, but it did not sion, a sequence of binary number instructions typed object code.” (internal citation and quotations omitted)). See also Blueport Co., LLP v. United States, 02-1622 C, ___ Fed.Cl. ___, 2007 WL 1321740 at  n.11 (Fed. Cl. May 7, 2007). The government witnesses analogized this distinction in two ways: First, the source code as the recipe for a pie, and the object code as the actual pie. Second, the source code can be seen as the design for an assembly line, and the object code as the assembly line itself. On the BACS system, source code was stored in one file directory, and object code was stored in another. This distinction helped BACS and Columbia Ultimate determine which file had been edited by looking at the directory marker. 2 The pie was baking in the oven, to continue the metaphor. Alternatively, the time bomb fuse had been lit, in the government’s phrasing. UNITED STATES v. SHEA 8299 — suggesting changes to the date had been made at some other time prior to January 7, when the source code was compiled into object code. The government offered evidence that the final source code had a trigger date of January 29. This date was written in a computer programming language called “Pick,” which Shea, but few others in the company, knew. On January 16, “SHEAB” again accessed the program but the log reflected no modification. The next day, a Friday, Shea did not show up for work, and Stambaugh decided to terminate him. Shea was apprised of his termination at the office on Monday, January 20. CLEAR.CF.MARKS allegedly triggered early in the morning January 30. [3] Viewing the evidence in the light most favorable to the prosecution, with all reasonable inferences that can be drawn from the record, we hold that a rational juror could have found Shea guilty. His access to the relevant files is undisputed. His ability to program in the Unix database and in the Collector System files is undisputed and appears to have been unique among BACS employees. His antagonistic relationship with BACS executives provided him with a motive, and the timing of certain edits corresponds with the meetings and e-mails that preceded his termination. Shea argues that there is no evidence that he compiled the source code a second time, after January 7, to change the trigger date from January 15 to January 29. The government, however, offered evidence that the final version of the source code did contain the date of January 29. Drawing reasonable inferences from the record, this edit must have occurred before January 7, otherwise the “time bomb” would have gone off on January 15, and it did not. Though the government did not offer any evidence of this second change, the circumstantial evidence that the change occurred is sufficient to sustain the conviction on appeal. [4] Shea also argues that several other BACS employees had access to his computer or could have logged on as him 8300 UNITED STATES v. SHEA remotely. He presented evidence to the jury that another BACS employee was logged in from Shea’s desktop computer at all the relevant times. However, given Shea’s level of access, which included access to the Unix names and passwords of all other BACS employees, and given Shea’s tendency to open multiple sessions at once from his computer, operating from both his laptop and desktop computers, a juror could reasonably infer that Shea had logged in as the other employee during all the relevant times. Because the prosecution “need not affirmatively rule out every hypothesis except that of guilt,” Wright v. West, 505 U.S. 277, 296 (1992) (internal quotation marks omitted), we find that reasonable inferences from this record support Shea’s conviction.