United States of America v. Todd A. Willis
476 F.3d 1121
In the United States Court of Appeals for the Tenth Circuit
Case Number 06-6009
Before Chief Circuit Judge Tacha, Senior Circuit Judge Seymour, and District Judge Robinson
Decided on February 16, 2007

Relevancy of the Case: Appeal against conviction in a case involving aiding and abetting access to a protected system by sharing username and password

Statutes and Provisions Involved

• The Computer Fraud and Abuse Act, 18 U.S.C. § 1030
• The United States Sentencing Commission Guidelines Manual

Relevant Facts of the Case

• The defendant worked for Credit Collections, Inc. This company obtained information on individuals for debt collection through accurint.com, a financial information services website. LexisNexis is the owner of this website.
• Accurint maintained information containing names, addresses, social security numbers, dates of birth, phone numbers, and other property data on individuals.
• As part of his employment responsibilities, the defendant was responsible for granting Credit Collections’ employees access to the Accurint website. When an employee resigned, he would deactivate that account. Moreover, employees could not access personal information from the website.
• While investigating two persons for identity theft, police officers discovered sheets printed from the accurint.com website that clearly identified multiple individuals.
• It was found that the information was accessed using the username “Amanda Diaz”. The defendant initially claimed there was no way to find out who accessed the website after deactivating a user account.
• Later, he admitted to providing a pair of username and password to his drug dealer in exchange for methamphetamine.
• Further, he also claimed to have met Ms Fischer through his drug dealer and began giving her information from the Accurint website. Subsequently, he provided the username and password for “Amanda Diaz” so Fischer could access the website independently.
• The District Court convicted him for aiding and abetting unauthorised access to a protected computer. He received a 41-month prison sentence, as per the Sentencing Guidelines. He has appealed both his conviction and sentence.

Prominent Arguments by the Counsels

The defendant’s counsel:

• He submitted that there was no indication that the defendant was aware that Ms Fischer planned to commit identity theft using the information from the Accurint website. The evidence clearly shows that he was assisting her in obtaining information on persons who owed her money.
• Congress could not have intended for a person who intentionally aided another in gaining authorised access to a protected computer to be charged with a felony if the information obtained by a third party has a value of more than $5,000.
• He further argued that subsection (a)(4) specifies the components necessary to prove a violation of subsection (a)(2)(C). The court should decide the defendant’s conviction under subsection (a)(4), which requires an intent to defraud.
• The District Court should have advised the jury that the Government must prove that the defendant “knew or intended that the information gained as a result of unauthorised access exceeded $5,000 in value” to convict him of aiding and abetting.
• He submitted that the enhancement, per Sentencing Guidelines, did not apply to him. It was neither predictable nor intended that a loss would arise from his activities.

Opinion of the Bench

• The court rejected the defendant’s objections on subsection (a)(2)(C) and concluded that it does not require proof of intent to defraud. It does not require proof that the defendant knew the value of the information obtained. Subsections (a)(2)(C) and (a)(4) have distinct penalties.
• No distinct purpose or knowledge is required for the penalty clause under CFAA. There is no reason to precisely judge the defendant under subsection (a)(4).
• The intention criterion does not apply to the value of the information gathered. The District Court did not make an error in issuing the jury instructions.
• The evidence on record supports the District Court’s finding that he knew the information collected by Ms Fischer would be worth $10,000 to $30,000. However, he only learned about the identity theft incidents when he read about them in a newspaper.

Final Decision

• The court upheld the defendant’s conviction but vacated his sentence and remanded the case to the District Court for resentencing.