Opinion ID: 222924
Heading Depth: 1
Heading Rank: 13

Heading: Enhancement for device-making equipment and production of access devices

Text: Barrington's next challenge is directed to the two-level enhancement for use of device-making equipment (keyloggers) and the production of unauthorized access devices (usernames and passwords) under U.S.S.G. § 2B1.1(b)(10). This section authorizes a two-level enhancement if the offense involved (A) the possession or use of any (i) device-making equipment... or (B) the production or trafficking of any (i) unauthorized access device.... Section 2B1.1(b)(10)(A) applies to an offense involving the possession or use of any (i) device-making equipment .... For purposes of § 2B1.1(b)(10), `Device-making equipment' has the meaning given that term in 18 U.S.C. 1029(e)(6); and (ii) includes (I) any hardware or software that has been configured as described in 18 U.S.C. 1029(a)(9); and (II) a scanning receiver referred to in 18 U.S.C. 1029(a)(8). U.S.S.G. § 2B1.1 cmt. n.9(A). `Scanning receiver' has the meaning given that term in 18 U.S.C. 1029(e)(8). Id. Device-making equipment is defined to include any equipment, mechanism, or impression designed or primarily used for making an access device.... 18 U.S.C. § 1029(e)(6). Scanning receiver is defined as a device or apparatus that can be used to intercept a wire or electronic communication in violation of chapter 119 [the Federal Wiretap Act, 18 U.S.C. §§ 2510-2522] or to intercept an electronic serial number, mobile identification number, or other identifier of any telecommunications service, equipment, or instrument. 18 U.S.C. § 1029(e)(8). Section 2B1.1(b)(10)(B) applies to an offense involving the production or trafficking of any (i) unauthorized access device. . . . U.S.S.G. § 2B1.1(10)(B). `Production' includes manufacture, design, alteration, authentication, duplication, or assembly. Id. at cmt. n.9(A). Unauthorized access device means any access device that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud. 18 U.S.C. § 1029(e)(3); see also U.S.S.G. § 2B1.1 cmt. n.9(A) (`Unauthorized access device' has the meaning given that term in 18 U.S.C. 1029(e)(3).). For purposes of both the statutory definition of device-making equipment and the text of U.S.S.G § 2B1.1(b)(10)(B), an access device means any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument). 18 U.S.C. § 1029(e)(1). [23] Barrington objected to the Presentence Investigation Report on the ground that use of key logger software . . . does not satisfy the definition of an apparatus for intercepting the `communication' of identification data. (Dkt. 140 at 4). Similarly, Appellant now contends that the district court erred in treating the keylogger software as equivalent to a scanning receiver. Without citing any authority, he also argues that the enhancement in § 2B1.1(b)(10)(A) applies only where the defendant employs an apparatus that remotely intercepts the `communication' of identification data. Appellant did not contend below and does not now contend that the usernames and passwords obtained through use of the keylogger were not a means of account access within the meaning of 18 U.S.C. § 1029(e)(1). As explained during trial by FAMU's Network Infrastructure manager, a keylogger is a device, either hardware-or software-based, that captures everything a user does, including keystrokes typed or entered on the computer. He explained that data captured by a keylogger can be retrieved through automatic email, which transmits the keystrokes to a remote email address without the knowledge of the user. Further, Special Agent Ed Waters described the forensic examination of the Registrar computers and Barrington's laptop. Agent Waters confirmed that the keyloggers installed on the Registrar computers had captured the usernames and passwords typed into the Registrar computers and that the data had been stored in keylogger logs. The keylogger was configured to send the data to two email addresses associated with Barrington and his co-conspirators, and the keylogger logs reflected that the data had been transmitted to those email addresses. The explanations of these witnesses support the district court's finding that the keyloggers used by Barrington and his co-conspirators constituted device-making equipment. The keyloggers captured, stored and were configured to transmit the username and password of an authorized user, and were therefore designed to capture and transmit, and thereby make the access device which enabled the conspirators to access identifiable student accounts. [24] The username and password combinations could be used to access FAMU's protected computer system and the students' accounts to obtain credit hours for classes either failed or not taken and to obtain partial refunds of tuition payments. As discussed, those credits are unquestionably things of value. Additionally, the conspirators obtained the usernames and passwords with intent to defraud FAMU, thereby rendering them unauthorized access devices as defined in 18 U.S.C. § 1029(e)(3) (any access device that is . . . obtained with intent to defraud.). In sum, the record evidence sufficiently supports a finding that keyloggers constitute device-making equipment as defined in 18 U.S.C. § 1029(e)(6). However, the district court apparently based its conclusion that the keylogger software constituted device-making equipment on the finding that the keylogger software constituted a scanning receiver. See Dkt. 169 at 46 (I find that the keylogger software that defendants installed constitutes a scanning receiver and therefore meets the definition of device making equipment.) (emphasis added). We do not believe this finding is adequately supported by the record. Scanning receiver is defined to include any device or apparatus that can be used to intercept a wire or electronic communication in violation of [the Wiretap Act]. . . . 18 U.S.C. § 1029(e)(8). The Wiretap Act provides criminal and civil sanctions for the unlawful interception of electronic communications. See id. §§ 2511(1), 2520. Intercept means the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device. Id. § 2510(4). With exceptions not relevant here, electronic communication is defined as any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce.. . . Id. § 2510(12) (emphasis added). We have held that, to violate the Wiretap Act, an interception of electronic communications must occur contemporaneously with their transmission. United States v. Steiger, 318 F.3d 1039, 1048-49 (11th Cir.2003). Accordingly, use of a keylogger will not violate the Wiretap Act if the signal or information captured from the keystrokes is not at that time being transmitted beyond the computer on which the keylogger is installed (or being otherwise transmitted by a system that affects interstate commerce). [25] Conceivably, the keylogger software at issue here could be used to contemporaneously capture information or signals being transmitted beyond the user's computer. If so, this would bring the keylogger software within the definition of a scanning receiver as a device or apparatus that can be used to intercept a wire or electronic communication in violation of [the Wiretap Act]. 18 U.S.C. § 1029(e)(8) (emphasis added). However, the Government points to no evidence in the record showing that the keylogger at issue here had that capacity and we have found none. Arguably, the district court's inadequately supported characterization of the keylogger software as a scanning receiver was merely an aspect of a more fundamental finding that the keylogger software constituted device-making equipment, which is fully supported by the record. We need not decide the point because the two-level enhancement was independently supported under U.S.S.G. § 2B1.1(10)(B). [26] Appellant contends that viewing or recording of personal identification data does not constitute production of such data within the meaning of U.S.S.G. § 2B1.1(10)(B). That is, Appellant contends that the conspirators did not produce an access device within the meaning of the Guideline by acquiring the Registrar employees' passwords and usernames because those passwords and usernames already existed. Appellant is mistaken. The contention that a preexisting means of account access cannot be produced is contradicted by the plain language of the Guideline application note, which defines the term production to include duplication or assembly of preexisting items. See U.S.S.G. § 2B1.1 cmt. n.9(A) (`Production' includes manufacture, design, alteration, authentication, duplication, or assembly.). The capture, storage, and transmittal of the Registrar employees' usernames and passwords was at least a duplication or assembly of the usernames and passwords. That the usernames and passwords already existed when they were duplicated or assembled does not matter. The district court expressly found that the defendants produced unauthorized access devices when they retrieved the passwords and user names from the data on the keyloggers. That finding was not clear error and the application of the two-level enhancement for production of an unauthorized access device under U.S.S.G. § 2B1.1(10)(B) was proper. In conclusion, the district court did not abuse its discretion with respect to any of Barrington's claimed procedural errors. None of the issues have merit and his sentence was procedurally reasonable.