THE CONDOR BRIEF

The law is clear: if a defendant in federal court has stolen millions of dollars in money or property, or simply transported the stolen goods across state lines, he or she must be sentenced to years in federal prison; up to a decade for a multiple repeat offender, depending on the amount stolen. This would, no doubt, be of great interest to someone who has committed such a crime. It should be of no interest to Kevin Mitnick, however. Because, even based on the factual allegations of his loudest critics, "America's Most Wanted Cyberthief" did not steal anything.

The details of Mitnick's conduct remain murky, and some of the accusations initially leveled against him by the government and members of the press have since been substantially discredited. However, there can be no legal discussion without a factual starting point. So we'll assume, arguendo, the following "facts."

A. Overview

The Computer Fraud and Abuse Act of 1986 made it illegal to access a computer without authorization to obtain anything of value. This clearly applies to Kevin Mitnick. So why would prosecutors want to charge him with anything else?

The answer to that question lies within the United States Sentencing Guidelines (U.S.S.G.). The guideline for all frauds, including computer fraud, uses the monetary value of the victim's loss as its primary "offense characteristic"; the greater the loss, the more severe the sentence. See U.S.S.G. §2F1.1(b)(1). But several courts, including the Ninth Circuit, have held that if there was no tangible loss to the victim, it is not appropriate to simply substitute the offender's gain. See III(C) infra. The problem this poses for the government in Mitnick's case is obvious: if Mitnick only copied his victims' software, without depriving them of it, then there was no tangible loss. Without a loss, Mitnick's sentencing exposure would be minimal. Until the Sentencing Commission sees fit to create a special enhancement for defendants who have been on the front page of the New York Times, prosecutors must look beyond the fraud statutes to give relatively benign trespassers like Mitnick prison sentences commensurate with their media exposure.

The theft guideline also uses "loss" as an offense characteristic. U.S.S.G. §2B1.1(b)(1). But in theft cases, unlike fraud, the value of whatever property the defendant gained from the theft may be used as a substitute for loss. See III(C) infra. This is, after all, consistent with the basic concept of theft: the offender's gain is the victim's loss. So if prosecutors could convict Mitnick of a crime covered by §2B1.1 instead of, or in addition to, fraud, then at sentencing they could focus on the value of the software Mitnick copied and bypass the somewhat trickier question of what exactly his victims lost in the process.

Paul Dowling began as an innocent collector of Elvis Presley recordings. But sometime around 1976 he began manufacturing and selling unauthorized "bootleg" copies of unpublished Elvis performances, collected from studio outtakes, live concerts, television broadcasts, and other sources. He shipped his phonorecords through an interstate trucking company. Dowling was eventually charged and convicted of Interstate Transportation of Stolen Property (18 U.S.C. §2314) on the theory that he had stolen the intellectual property of the music's copyright holders when he copied and sold the music, and when shipping his copies he had transported that intellectual property across state lines. Dowling v. United States, 473 U.S. 207, 150 S.Ct. 3127, 87 L.Ed.2d 152 (1985).

The statute states, in relevant part:

Whoever transports, transmits, or transfers in interstate or foreign commerce any goods, wares, merchandise, securities or money, of the value of $5,000 or more, knowing the same to have been stolen, converted or taken by fraud ...

Shall be fined under this title or imprisoned not more than ten years, or both.

The Supreme Court acknowledged that Dowling was guilty of copyright infringement. "It is less clear, however, that the taking that occurs when an infringer arrogates the use of another's protected work comfortably fits the terms associated with physical removal employed by §2314. The infringer ... does not assume physical control over the copyright; nor does he wholly deprive its owner of its use. " Dowling, 473 U.S. at 217. (emphasis added)

Congress, when enacting §2314, contemplated its use only in cases involving physical property. Other laws were specifically crafted to deal with copyright infringement. Dowling, 473 U.S. at 218-226.

In rejecting the government's theory, and striking down Dowling's §2314 conviction, the court made an observation that would prove prophetic:

The broad consequences of the Government's theory, both in the field of copyright and in kindred fields of intellectual property law, provide a final and dispositive factor against reading §2314 in the manner suggested. ... [Tlhe field of copyright does not cabin the Government's theory, which would as easily encompass the law of patents and other forms of intellectual property.

The Dowling ruling may have cut-short the government's attempt to redefine theft, but it didn't keep prosecutors from trying again. And the Neidorf case, U.S. v. Riggs, 739 F.Supp. 414 (N.D.III. 1990) presented the government with a more receptive audience for its "copying is theft" argument in the form of U.S. District Court Judge Bua.

Robert Riggs had gained unauthorized access to a Bell South computer, and copied a document that the government claimed was both valuable and proprietary. Riggs then gave a copy of the document to co-defendant Craig Neidorf, who in turn copied it from his computer in Missouri to another computer in Lockport, Illinois. This last action led to a charge of Interstate Transportation of Stolen Property against Neidorf; the same §2314 charge thrown-out in Dowling. Neidorf moved to dismiss the count, arguing that under Dowling §2314 did not apply to intangible intellectual property. Judge Bua denied the motion, first comparing the Bell South document to stolen money transported in a wire-transfer, then to a colorless, odorless anesthetic gas:

If this gas is stored in a tank in Indiana, and a trucker hooks up to the tank, releases the valuable gas into a storage tank on his truck, and then takes the gas to Illinois to sell it for profit, is there no violation of §2314 simply because the gas is not technically tangible?

The physical existence of anesthetic gas would presumably be more apparent to a surgery patient then it is to Judge Bua. But this proves academic; because Judge Bua, after deciding that money and anesthesia are not "technically tangible", goes on to make a finding of fact that Bell South's secrets are tangible. Id. at 422. As for the Supreme Court, Judge Bua disposes of Dowling easily: "This case involves the transfer of confidential, proprietary business information, not copyrights". Riggs, 739 F.Supp at 422.

A more thoughtful, if less surreal, analysis of the same issue was made by the Tenth Circuit in U.S. v. Brown, 925 F.2d 1301 (10th Cir. 1991). Brown was a computer programmer who was found in possession of copies of the source code version of software owned by a former employer, a company that Brown had once worked for in another state. The government claimed that the source code (which had taken "15 years" to develop and was written for IBM compatible 386 machines) had never been released outside the company, and that Brown had not been authorized to access it even when he was in the company's employ. Id. 925 F.2d 1308. The District Court, following Dowling, dismissed a §2314 charge against Brown, and the government appealed.

On appeal, the government attempted to distinguish Dowling by emphasizing that Dowling involved recordings made from public sources, while the software Brown transported was "removed [sic] from things that the victim thought they had protected ... ." Id. 925 F.2d at 1305. The Appellate Court, however, held that the intangible nature of the software was dispositive regardless of its source. The court cited Dowling on §2314:

"[Tlhe provision seems clearly to contemplate a physical identity between the items unlawfully obtained and those eventually transported, and hence some prior physical taking of the subject goods." 473 U.S. at 216, 105 S.Ct at 3132. This essential ingredient of the statute- the involvement of physical "goods, wares, [or] merchandise" that were themselves "stolen, converted, or taken by fraud"-was missing in Dowling and is likewise missing here.

As for Judge Bua and his gas, "we feel that the Riggs interpretation of the statute is in error ... . The element of physical 'goods, wares, or merchandise' in §§2314 and 2315 [Sale or Receipt of Stolen Goods] is critical. The limitation which this places on the reach of the [statute] is imposed by the statute itself, and must be observed." Brown, 925 F.2d at 1308 - 1309. (emphasis added)

"We hold that the computer program itself is an intangible intellectual property, and, as such, it alone cannot constitute goods, wares, or merchandise withing the meaning of §§2314 or 2315." Id. at 1307-1308.

If prosecutors cannot apply 18 U.S.C. §2314 in Mitnick's case, then that leaves them with the Computer Fraud and Abuse Act, which reads, in relevant part:

(a)Whoever- ...

(4) knowingly and with intent to defraud, accesses a Federal interest computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer;

...

shall be punished as provided in subsection (c) of this section.

(e) As used in this section - ...

(2) the term "Federal interest computer" means a computer - ...

(B) which is one of two or more computers used in committing the offense, not all of which are located in the same state; 18 U.S.C. §1030.

This certainly seems to apply in Mitnick's case. Mitnick reached across state lines, gained unauthorized access to various computers, and obtained his own personal copy of software source code that presumably had some value; at least to Mitnick. When applying the statute, the question of what loss, if any, Mitnick caused his victims is immaterial. At sentencing, though, "loss" takes center stage. Under the United States Sentencing Guidelines (U.S.S.G.), a higher amount of victim loss in a fraud case can translate to years of prison time for the defendant. See U.S.S.G. §2Fl.l(b)(l), sentencing table. It's not surprising, then, that the courts have given much consideration to the calculus of loss. And more than once this consideration has focused on the differences between fraud and theft.

A man hot-wires a car, drives it to Mexico, and sells it. A bank officer wire-transfers a quarter-million dollars of someone else's money to his own account in the Cayman islands. A trucker makes off with a valuable gas.

All of these crimes are thefts. Real thefts. Common law larceny. Mala in se. The Eighth Commandment. In each case the thief acquires the victim's property, and the victim is left without it. Without its use; without its value. In such cases determining the loss to the victim, and consequently the sentence for the perpetrator, is simple and straightforward.

But what about a case where, rather than stealing a car and selling it, the offender rents a car with a fraudulent credit card, drives it cross-country, and abandons it in another state, to be recovered by the rental agency later? Is the victim's loss in this case the full value of the car, or only the uncollected rental fee? Or a case in which the defendant obtains a loan with a false application, but repays it in full? What is the loss to the bank, and what crime has been committed?

This is the issue the Ninth Circuit wrestled with in U.S. v. Harper, 32 F.3d 1387 (9th Cir. 1994). Harper was a con-man who ran a complex equity skimming operation in which he targeted homeowners who were behind on their mortgage payments and facing foreclosure on their homes. Harper convinced the homeowners that if they sold their homes to him, they would no longer be obligated on the mortgages, and their credit histories would not show that they had been foreclosed upon. This proposition was attractive to the homeowners because their equity in the properties at the time was nothing, or even negative.

After gaining possession of the properties, Harper then rented them back to the original owners, on the pretext that this would allow them to continue to occupy the homes for an extended period of time. The mortgage holders quickly foreclosed on the homes anyway, and Harper made off with the rent he had collected.

At sentencing, the government sought to enhance Harper's sentence under U.S.S.G. §2F1.1(b)(1), based on a loss of $6,160,000, a figure they arrived at by estimating the total fair market value of the homes, $6,000,000, and then adding the amount Harper had collected in rent. Although only this second sum, $160,000, reflected Harper's actual profits from the scam, the District Court followed the government's recommendation and Harper appealed.

The appellate court questioned the government's approach in including the value of the homes in the total loss, asking if someone like Harper "who acquires an overencumbered property by fraud with no intention of making good on his promises, should be treated exactly like a thief who has stolen the property?" Harper, 32 F.3d at 1390.

To answer this question, the court turned first to the commentary to §2F1.1. Here, loss is defined as "the value of the money, property, or services unlawfully taken." The valuation need not be precise, and may consist of a "reasonable estimate" based on the information available. U.S.S.G. §2F1.1, comment. (n. 7-8).

This estimate, for example, may be based on the approximate number of victims and an estimate of the average loss to each victim, or on more general factors, such as the nature and duration of the fraud and the revenues generated by similar operations. The offender's gain from committing the fraud is an alternative estimate that ordinarily will underestimate the loss.

The commentary then refers the reader to the commentary to the theft guideline, §2B1.1, for a fuller discussion of loss valuation. The §2Bl.l commentary emphasizes the amount "taken" from the victims as the primary measure of loss.

"Loss" means the value of the property taken, damaged, or destroyed. Ordinarily, when property is taken or destroyed the loss is the fair market value of the particular property at issue. Where the market value is difficult to ascertain or inadequate to measure harm to the victim, the court may measure loss in some other way, such as reasonable replacement cost to the victim. When property is damaged, the loss is the cost of repairs, not to exceed the loss had the property been destroyed.

Regarding the §2B1.1 commentary, the court observed:

This approach works rather well in cases of theft and outright destruction of property. It is an excellent indicator of the harm to the victim and of the gain to the offender. Similarly, if the victim was relieved of cash, it is often easy to see that the amount of cash is the value of what was taken, whether it was taken by theft, destruction or fraud.

The court noted it would be simple to compute the loss in Harper's case the same way a theft loss would be computed: "Thus, one would only need to calculate the fair market value of the property taken and, perhaps, consider other losses that naturally flowed from the wrongdoing. As we have said, this is a simple approach, but we think it is unacceptable." Id. at 1392.

The straight theft argument does not properly examine the actual facts. Nor does it examine the wrongdoing, both intended and actual. It assumes a loss to the victim that is not realistic. Harper did not set out to take the fair market value of the homes away from the victims, nor did he do so.

The court found that the actual loss in Harper's case was limited to the $160,000 Harper collected in rent.

In reaching its decision, the Ninth Circuit relied primarily on two earlier cases: U.S. v. Kopp, 951 F.2d 521 (3rd Cir. 1991) and U.S. v. Haddock, 12 F.3d 950 (10th Cir. 1993). An examination of these cases sheds even more light on the distinction between theft and fraud.

In Kopp the defendant pled guilty to procuring a bank loan by fraudulent misrepresentations. The sentencing judge, following the government's recommendation, calculated loss as the full face value of the loan. The loan, however, was secured by property, and the bank's actual losses after selling that property were considerably lower than the face value of the loan. Kopp appealed.

The government's position was based on the first line of the §2Bl.1 commentary, which equates "loss" with the value "taken." But the analysis is not so simple. Even the theft guideline is not entirely perpetrator-oriented. The Commentary to U.S.S.G. §2B1.1 focuses significantly on the victim's loss, as well as the perpetrator's gain." Kopp, 951 F.2d at 528.

"More basically, however, U.S.S.G. §2B1.1 is, by definition, a theft guideline, and fraud differs from theft." Id. at 528. (emphasis added). All thefts involve an intent to deprive the victim of the value of the property taken; the same is not always true for fraud. Id. at 529.

The appellate court vacated the judgement of sentence and remanded the case for resentencing. Id. at 536.

The same issue came up later in U.S. v. Haddock, 12 F.3d 950 (10th Cir. 1993). Like Kopp, the defendant in Haddock obtained secured loans through misrepresentation. Like Kopp, Haddock was enhanced based on the full face value of the loans. Like Kopp, Haddock was remanded for resentencing by the appellate court. "[Wlhatever the court uses to estimate the loss, the estimate must be 'reasonable.' If gain to the defendant does not correspond to any actual, intended or probable loss, the defendant's gain is not a reasonable estimate of loss." Id. at 961 (emphasis added). See also U.S. v. Maurello, 76 F.3d 1304 (3rd Cir. 1996) (holding that "loss" in the case of disbarred lawyer who continued to practice under a false name is limited to the amount collected from clients who were unsatisfied with his representation); U.S. v. Smith, 951 F.2d 1164, 1166-69 (10th Cir. 1991) (holding that no loss enhancement was appropriate for agent who misrepresented buyer's down payment, resulting in a bank loan that did not default); U.S v. Schneider, 930 F.2d 555 (7th Cir. 1991) (holding that no loss enhancement was appropriate where there was no actual or intended loss even though defendants would have profited from fraudulently obtained contracts); U.S. v. Whitehead, 912 F.2d 448 (10th Cir. 1990) (holding that the entire value of a house may not be used in loss calculation when the defendant used false documents to obtain an option to purchase the house, but had not exercised the option).

Finally, the defendant in U.S. v. Moore, 55 F.3d 1500 (10th Cir. 1995) used credit card numbers retrieved from trash bins to rent two cars and a Chevrolet pickup truck. After using the vehicles, he abandoned them, and they were later recovered by the rental agencies. The sentencing judge calculated loss by adding up the full market values of the vehicles rented. The 10th Circuit, following Smith and Whitehead, reversed and remanded: "[Tlhe government presented no evidence of actual losses sustained by the owners of the rented vehicles." Moore, 55 F.3d at 1503.

It's amusing to consider what the 10th Circuit's reaction would have been if Mitnick had been a defendant in Moore, and the government had claimed a loss, not just of the retail value of the cars, but of the full cost of developing them; from drafting table to assembly line.

The opinions in Dowling, Kopp, and the cases that followed them isolate key elements in the concept of theft: Theft deprives the victims of the value of their property. Theft deprives the victims of use of their property. Mitnick did neither, and is therefore not a thief.

But by gaining unauthorized access to his victims' computers, Mitnick did commit Computer Fraud (18 U.S.C. §1030). When applying the fraud sentencing guideline (U.S.S.G. §2F1.1) the question that must be answered is, what exactly did Mitnick defraud his victims out of? And did it have a monetary value?

The Supreme Court has held that owners of an intellectual property, as with most property, have a right to exclude others from using that property. Depriving an owner of that right can be fraud, even if there was no monetary loss. Carpenter v. United States, 484 U.S. 19, 108 S.Ct. 316, 98 L.Ed.2d 275 (1987). This seems to be the case here.

But deprivation of an owner's right to exclude also characterizes the conduct in Harper and its antecedents. In these cases the monetary value of the property involved could not be considered loss for sentencing purposes, because the property was not stolen: the owners were not deprived of the value of the property. See III(C) supra. In Mitnick's case, not only were the owners not deprived of the value of the property, they were never deprived of its use. The monetary loss, intended and actual, is zero. "Since loss is described in terms of dollar amounts, it must be inferred that only economic loss may be considered under [U.S.S.G. §2F1.1(b)(1)]." U.S. v. Hughes, 775 F.Supp. 348 (E.D.Cal. 1991). The development costs of the software are irrelevant, because Mitnick's victims were not deprived of the software, only of their right to exclude Mitnick from using it.

Now for the actual number-crunching: fraud carries a base offense level of 6. U.S.S.G. §2F1.1(a). "More than minimal planning" adds 2 levels. §2F1.1(b)(2). Monetary loss of $2,000 or less, in this case $0, yields no enhancement under §2F1.1(b)(1). Incidental or consequential losses can not be included. U.S. v. Wilson, 993 F.2d 214 (11th Cir. 1993).

Assuming that Mitnick committed five or more separate offenses that are not groupable under §3D1.2, i.e., that do not involve "substantially the same harm," another 5 levels is added. This gives Mitnick a final offense level of 13. The sentencing court could consider a departure above or below that level if it finds aggravating or mitigating circumstances not adequately taken into consideration in the Guidelines. U.S.S.G. §5K2.0. If Mitnick accepts a guilty plea, he would likely receive a two level reduction for "acceptance of responsibility." §3E1.1.

Mitnick's one prior adult prison term gives him 2 criminal history points. He gets another 2 points if he committed his crimes while on Supervised Release, for a total of 4. §4A1.1. Four criminal history points places Mitnick in criminal history category III.

An offense level of 13, with a criminal history category of III, yields a sentencing range of 18-24 months. U.S.S.G. sentencing table (1995-96).

This brief is not intended as a defense of computer trespassing or copyright infringement. It is intended as a defense of rationality and common sense. Copying something, whether it's a book, an audio-recording, or a computer program, is not the same as stealing it. It may be infringement; at times even a type of fraud. But it is not theft. The belief that it is has become the popular superstition of the information age; the modern equivalent of the belief that photographing a person is the same as stealing that person's soul.

It is certainly possible that an intellectual property might be stolen. Take, for example, the hypothetical case of a burglar who steals a computer disk that happens to contain the only existing copy of a computer program that was developed by the victim. In that case the offender has deprived the victim of more than the right to exclude: he has also deprived the victim of the right to use the software, and he had deprived the victim of the value of the software. In such a case the development costs of the program, in addition to the value of the disk, might reasonably be considered "loss." What is certain is that the victim of such a crime would be in a perfect position to appreciate the difference between unauthorized copying and theft.

The value of an intellectual property is also relevant in cases of criminal copyright infringement. If an infringer sells copies of his victim's software, rather than simply using the software himself, he is likely causing his victim financial harm in the form of lost revenue. The law recognizes this by making the marketing of infringing products a crime. 17 U.S.C. §506; 18 U.S.C. §2319. The Guideline for criminal infringement cases imposes a sentence proportional to the value of the infringing product. U.S.S.G §2B5.3.

It is by no means a "loophole" that the Sentencing Guidelines call for a lower sentence for someone like Mitnick, who copied software for his own amusement, than for a criminal infringer or a thief. The Guidelines were created, in part, to impose proportionality in sentencing: to see that more serious crimes are punished more severely. U.S.S.G. §1A3. As a practical matter, Mitnick will probably receive a longer sentencing than the 18-24 months set by the Guidelines. The difference between his actual sentence and the Guideline sentence will reflect the difference between the ideal of fair and just sentencing, and the reality of the power of superstition and fear.

In the end, even those who are unconcerned with fairness to a criminal defendant should balk at the redefinition of "theft". Capricious use of the charge of theft in cases where no property was taken away from the victim does a disservice to crime victims who have actually lost some property. The definition of theft cannot be widened without being made more shallow.