Court Opinion

ID: 3134116
Source: CourtListenerOpinion
Date Created: 2015-10-22 16:00:57.704087+00
Date Added: 2024-06-11T12:05:12.281696
License: Public Domain

NOT RECOMMENDED FOR FULL-TEXT PUBLICATION
                           File Name: 15a0710n.06

                                        Case No. 14-5718

                          UNITED STATES COURT OF APPEALS
                               FOR THE SIXTH CIRCUIT
                                                                                        FILED
                                                                                   Oct 22, 2015
UNITED STATES OF AMERICA,                           )                         DEBORAH S. HUNT, Clerk
                                                    )
       Plaintiff-Appellee,                          )
                                                    )       ON APPEAL FROM THE UNITED
v.                                                  )       STATES DISTRICT COURT FOR
                                                    )       THE EASTERN DISTRICT OF
IBRAHIMSHAH SHAHULHAMEED,                           )       KENTUCKY
                                                    )
       Defendant-Appellant.                         )
                                                    )
                                                    )

       BEFORE: BOGGS, SUTTON, and STRANCH, Circuit Judges.

       BOGGS, Circuit Judge. On the evening of August 23, 2012, Ibrahimshah Shahulhameed

was fired from his job at GlobalSource IT as a contractor for Toyota Motors. A few hours later,

Toyota experienced a cyberattack that rendered several of its computer servers inoperable.

Toyota’s investigation revealed that the attack came from Shahulhameed’s Toyota-owned laptop

and Shahulhameed’s user account.       An independent investigator and the FBI corroborated

Toyota’s findings.

       Shahulhameed was arrested and charged with “knowingly caus[ing] the transmission of a

program, information, code, or command, and as a result of such conduct, intentionally caus[ing]

damage without authorization, to a protected computer,” resulting in at least $5,000 of damage in

a one-year period, in violation of 18 U.S.C. § 1030(a)(5)(A), (c)(4)(B)(i). After a five-day trial,
Case No. 14-5718
United States v. Shahulhameed
a jury returned a guilty verdict. Shahulhameed appeals on the ground that there was insufficient

evidence to support the conviction.     After carefully considering the evidence, we affirm

Shahulhameed’s conviction.

                                               I

       In reviewing the sufficiency of the evidence, we must affirm the conviction if “after

viewing the evidence in the light most favorable to the prosecution, any rational trier of fact

could have found the essential elements of the crime beyond a reasonable doubt.” United States

v. Warshak, 631 F.3d 266, 308 (6th Cir. 2010) (quoting Jackson v. Virginia, 443 U.S. 307, 319

(1979)).

                                               II

                                               A

       A reasonable jury could have found that Shahulhameed knowingly transmitted computer

codes and commands to a protected computer. Dennis James Seibert, Jr., a specialist in Toyota’s

information security department, testified that Shahulhameed’s password-protected user account

(“ishah”) logged in to Toyota’s remote-access system on the following occasions:

                                             Login                         Logout
                                       August 23, 2012                August 24, 2012
           Access #1                    11:56:04 PM                    1:55:26 AM
                                       August 24, 2012                August 24, 2012
           Access #2
                                        3:10:10 AM                     4:20:07 AM
                                       August 24, 2012                August 24, 2012
           Access #3
                                        4:40:45 AM                     6:13:48 AM
                                       August 24, 2012                August 24, 2012
           Access #4
                                        6:26:07 AM                     6:55:09 AM

The IP address associated with these log ins, 10.235.0.150, matched the IP address of the

Toyota-owned laptop issued to Shahulhameed for work. Logging in to the remote-access system

                                               2
Case No. 14-5718
United States v. Shahulhameed
from a Toyota-owned laptop using an assigned user name and password is the only way to access

Toyota’s servers from outside of Toyota’s facilities.

       That night, during those remote log-in sessions, Shahulhameed’s laptop accessed

Toyota’s computer servers and transmitted codes and commands to them. Shahulhameed’s

laptop made changes to the configuration files for the ToyotaSupplier.com website, the eKanban

system, the Long Lead Time Parts system, and the Oracle Business Intelligence system. A

search of the Internet browsing history on Shahulhameed’s laptop confirmed that his laptop

accessed the servers.    Because these changes came from Shahulhameed’s laptop and his

password-protected user account, a reasonable jury could have found that Shahulhameed was

behind them.

       In addition, Toyota’s computer systems were “protected.” A “protected computer” is a

computer “used in or affecting interstate or foreign commerce or communication.” 18 U.S.C.

§ 1030(e)(2)(B). Tom Cantrell, assistant manager at Toyota’s information systems technology

department, testified that approximately 700 suppliers across the United States interact with

Toyota through ToyotaSupplier.com, and that the above-mentioned computer systems are used

by Toyota employees in states across the country. Based on the foregoing evidence, a reasonable

jury could have found that Shahulhameed knowingly transmitted computer codes and commands

to Toyota’s protected computer systems.

                                                B

       The evidence also shows that Shahulhameed acted without authorization. Authorization

requires approval or sanction. See WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 204

(4th Cir. 2012). Andrew Sell, a technical recruiter for GlobalSource IT, testified that he received

a call on August 23, 2012, from Adi Gimpaunu, a GlobalSource contractor working for Toyota,

                                                 3
Case No. 14-5718
United States v. Shahulhameed
stating that Shahulhameed had harassed Gimpaunu by demanding that Gimpaunu pay

Shahulhameed a “finder’s fee,” or something to that effect. Managers at Toyota heard about the

incident and called GlobalSource that evening, stating that one of the two contractors had to be

removed. Sell called Shahulhameed on the evening of August 23, 2012, and “told him that the

decision has been made that your project has been terminated, that you should have no contact

with anyone at Toyota, [and] that you should not report to Toyota tomorrow morning, the next

day.” Sell asked if Shahulhameed understood, and Shahulhameed said, “yes, okay.” Sell also

sent Shahulhameed an e-mail that same evening clarifying that he should not report to work the

next day and that he should not have contact with anyone at Toyota. Shahulhameed testified that

he received the e-mail and replied to it.

       Shahulhameed argues that his access was authorized because Toyota did not disable his

user account until at least eight hours after his conversation with Andrew Sell. But Toyota’s

failure to disable his account does not mean that his access was authorized; the phone call and e-

mail from Sell are sufficient to establish a lack of authorization. Given the late hour—Sell e-

mailed Shahulhameed around midnight—it is not surprising that Toyota waited until the next

business day to disable his account. A reasonable jury could have found that Shahulhameed was

not authorized to access Toyota’s computer systems.

                                                C

       Shahulhameed intentionally caused damage to Toyota’s computer systems.             Dennis

Seibert testified that the configuration changes traced to Shahulhameed’s laptop on the morning

of August 24, 2012, included: (1) disabling load balancing between ToyotaSupplier.com servers,

which prevented users from accessing the systems; (2) changing letters in connector names,

which made it impossible for servers to communicate with each other, effectively shutting the

                                                4
Case No. 14-5718
United States v. Shahulhameed
servers down; and (3) adding unknown password requirements for access to administrative

consoles, which made it impossible to use the consoles. Based on this evidence, a reasonable

jury could discredit Shahulhameed’s claim of only trying to help Toyota close his projects or

transition them to others.

       The destructive nature of these changes betrays an intention to cause damage. Seibert

testified that in his opinion, the changes were not consistent with a business purpose. Some of

the changes were minute and difficult to detect without a specialized tool. In one instance, the

letter “S” was changed from uppercase to lowercase, and in another, the letter “O” was switched

with the number “0.” Adam Keown, a special agent with the FBI, testified that making these

subtle changes, without coordinating with colleagues, was harmful and inconsistent with a

legitimate business purpose.

       The attacker also used a touch command, which changes the timestamp for when the file

was last modified. Agent Keown testified that the touch command is commonly used by cyber-

attackers in an attempt to hide their changes. Justin Hall, an outside forensic investigator with

Cincinnati Bell Technology Solutions, testified that the attacker removed history files and

modified files in a way that “you wouldn’t do unless you were trying to hide something.”

       Shahulhameed contends that it would be irrational for him, an experienced professional

with family obligations, to commit such an easily-detectable crime intentionally. But emotions

can lead to rash decisions, and Shahulhameed’s attempts at hiding his tracks suggest that he may

well have thought that he could escape detection. A reasonable jury could have concluded that

Shahulhameed intentionally damaged Toyota’s computer systems.

                                               5
Case No. 14-5718
United States v. Shahulhameed
                                                 D

       Finally, the evidence shows that Shahulhameed’s conduct resulted in at least $5,000 of

damage in a one-year period. Agent Keown investigated the costs that Toyota incurred as a

result of the cyberattack. Toyota provided Keown with documentation showing that Toyota

employees spent 2,133 hours responding to the cyberattack between August 24 and October 30,

2012, with an estimated value of $152,070. Toyota also paid Cincinnati Bell Technology

Solutions for 200 hours of labor at $175 per hour between August 24 and September 30, 2012,

totaling $35,000. These figures were not challenged at trial. Contrary to Shahulhameed’s

argument, the prosecution demonstrated exactly how it calculated the damage that Toyota

suffered. Based on this evidence, a reasonable jury could have found that Shahulhameed caused

at least $5,000 of damage.

                                                III

       Shahulhameed cites United States v. White for the proposition that “evidence which

requires a leap of faith in order to support a conviction” is insufficient. 932 F.2d 588, 590 (6th

Cir. 1991) (per curiam). White held that the defendant’s mere awareness of a marijuana patch

growing behind his house was insufficient to establish possession or intent to distribute when:

(1) the marijuana patch was not on his property; (2) there was no testimony that he was ever seen

in the patch; (3) there was no path connecting his trailer home to the patch; (4) there was

overgrowth between his trailer and the patch; (5) the fertilizer in the patch did not match the

fertilizer in his trailer; (6) the police found no seeds, scales, or drug paraphernalia when they

searched his trailer; and (7) his physical disability suggested that he lacked the physical capacity

to grow a twenty foot by thirty foot marijuana patch. Ibid. Here, no leap of faith is required.

The cyber-attack came from a laptop assigned to Shahulhameed and in Shahulhameed’s

                                                 6
Case No. 14-5718
United States v. Shahulhameed
possession. It was launched from his password-protected account, just hours after he was fired.

The nature and extent of the damage and Shahulhamed’s attempts to cover his tracks could lead a

reasonable jury to believe that he intended to cause damage.

       A rational trier of fact could have found beyond a reasonable doubt that Shahulhameed

knowingly transmitted codes and commands that intentionally caused damage to Toyota’s

protected computers without authorization, resulting in at least $5,000 of damage in a one-year

period. Shahulhameed’s conviction is AFFIRMED.

                                                7