U.S.A v. Watt, Crim. No. 08cr10318-NG.

707 F.Supp.2d 149

UNITED STATES of America,v.Stephen WATT, Defendant.

Crim. No. 08cr10318-NG.

United States District Court D. Massachusetts.

April 27, 2010.

Stephen P. Heymann, United States Attorney's Office, Boston, MA, for United States of America.

Michael C. Farkas, New York, NY, Robert M. Goldstein, Boston, MA, for Defendant.

SENTENCING MEMORANDUM

GERTNER, District Judge.

This case concerns what is reported to be the largest conspiracy to commit identity theft in American history. The defendant, Stephen Watt (“Watt”), played a unique role in the conspiracy, unique, that is, for run of the mill fraud crimes before the advent of the Internet. He adapted certain software that enabled the principals of the conspiracy to extract information from a number of companies, but he received no money for his work. He did it for the challenge, for the thrill of besting large institutions. But whatever the motive, however childish, morally irresponsible, not to mention legally culpable, it resulted in millions of victims and substantial losses.

To focus in sentencing on the man yields one result: He is a first offender with a supportive family and, by all accounts, a brilliant future. To focus on the crime yields another calculus. It was an extraordinary offense in scope and sophistication. This kind of dilemma is not unusual in a white collar case-most are first offenders pulling off or trying to pull off a fraud-but it is particularly stark here.

Watt, 25 years old, was charged in a one-count information with conspiracy, in violation of 18 U.S.C. § 371. He waived indictment and pled guilty pursuant to a plea agreement on December 22, 2008. He was released on a $100,000 secured bond. He has been in substantial compliance with his conditions of release since that time.¹

This Court held sentencing hearings over two days. At the initial hearing, the Court expressed concern that related cases ² were in front of other judges at different stages of litigation, which could result in disparate treatment of similarly-situated offenders. No one judge could see the entire picture. And without a global view, the Court could not comply with 18 U.S.C. § 3553(a)(6)'s direction, calling for “avoid[ing] unwarranted sentence disparities among defendants with similar records who have been found guilty of similar conduct.” When counsel at the first hearing also indicated that Watt made no money from his participation in the offense, the Court had new concerns-what motivated him to participate, what brand of sociopathy, if any, did he suffer from-and requested additional information about Watt. ³

The parties could not have been further apart on sentencing. Defense counsel urged probation for a sentence of six months or less. The government pressed for the maximum sentence of five years. The Guidelines were of no help; if not for the statutory maximum, the Guidelines for an offense level 43 and criminal history I would have called for a sentence of life imprisonment.

I rejected the defendant's proposal as being unduly lenient. Substantial punishment was plainly called for because of what Watt did and why, as I describe below. But at the same time, I rejected the government's recommendation as too severe for a first offender under the circumstances. Accordingly, I sentenced Watt to 24 months of custody, three years of supervised release, and a substantial order of restitution, amounting to $171.5 million.

I. OFFENSE

From 2004 to 2007, Albert Gonzalez (“Gonzalez”) and his associates stole over 40 million credit and debit card numbers from major retailers, including TJX companies, DSW, and BJ's Wholesale Club. The group tapped into the corporations' networks and lifted financial data using sophisticated computer programs. Gonzalez then sold millions of these numbers overseas to third parties. Losses total $171.5 million for TJX,⁴ between $6.5 and $9.5 million for DSW, and between $11 and $13 million for BJ's. According to the presentence report-and uncontested-the victims also include the thousands of banks who have had to cover the losses and the millions of individuals whose financial information was stolen. PSR ¶¶ 2, 5

A. The Gonzalez-Scott Conspiracy

From 2003 to 2006, Gonzalez and Christopher Scott (“Scott”) hacked into computer networks for bizrate.com, panduck.com, fortunecity.com, and Florida International University. The two then hacked into BJ's through wireless access points located near the actual retail stores. Gonzalez stole and subsequently sold off 300,000 to 400,000 credit card numbers that Scott helped him obtain from BJ's. PSR ¶ 10.⁵

Scott then hacked into Office Max's system, captured debit card information, and gave this information to Gonzalez. PSR ¶ 12. Gonzalez sold some of these to co-conspirator Maksym Yastremskiy, and “cash[ed] out” others at ATMs through co-conspirator Jonathan Williams. PSR ¶ 13.

During the same period, Gonzalez was collaborating with Damon Patrick Toey (“Toey”) to “cash out” payment card numbers and selling “dumps” of them. (“Dumps” are stolen track 2 data, the data encoded on the magnetic strips on the backs of credit cards read by ATM machines and credit card readers.) ⁶ PSR ¶ 7 & n. 2.

B. Watt's Role-TJX incursion

Beginning in the summer of 2005, Scott and Gonzalez hacked into TJX Companies, assisted by James. But their work was substantially improved when they used a wireless access point, together with a VPN (virtual private network), a program that allowed Gonzalez to access the TJX system without being in close physical proximity to a retail store. PSR ¶ 16.

Gonzalez used a “sniffer program” that allowed him to seek out the data he wanted, a program that Watt had adapted. PSR ¶¶ 16-16a. Sniffer programs are used both legally and illegally to monitor traffic in a computer network. They represent a class of applications that captures any type of data that travels across a communications network. PSR ¶ 16.

Instant message chat sessions between Watt and Gonzalez from February 24, 2005, until April 10, 2006, the year immediately preceding Watt's role in supplying the sniffer program, are significant to understand Watt's role and motivation. While it is difficult to evaluate whether these sessions reflect Watt's bravado and his stunning immaturity or what one psychologist calls the “online disinhibition effect,” ⁷ they do make clear that he understood that he was remotely compromising software vulnerabilities on network systems, as well as utilizing stolen account credentials. And he plainly knew that Gonzalez was selling payment card numbers and making a substantial profit. At the same time, there is no persuasive evidence that Watt had access to the information being stolen, or participated in selling it. Indeed, as noted above, Watt received no money for his efforts.⁸

C. Gonzalez-Scott-Toey

The Gonzalez conspiracy not only predated Watt's participation, it also postdated it, operating between 2004 and 2007. In the fall of 2007, for example, Toey helped Gonzalez break into Target's computer system, using a high powered wireless antenna. PSR ¶ 17. He also assisted Gonzalez in breaking into Forever 21's system, now using a web-based attack. PSR ¶ 19. This approach involved gaining access to the companies' databases using vulnerabilities in its programming. PSR ¶ 18-19. Toey also set up computer servers for Gonzalez in Latvia and the Ukraine on which millions of payment numbers were stored. PSR ¶ 20. Scott used a server in California for TJX data. PSR ¶ 16.

Watt's “sniffer program” was on the Latvian server, but that file was independent from the locations where stolen credit cards where stored. PSR ¶ 20. There is no indication that Watt had access to the portions of the server on which data was stored. Cf. Transcript, December 22, 2009, p. 26, 47; PSR ¶ 20. In addition during the execution of the search warrant at Watt's apartment, the IP address for the server on which TJX data was stored “was written on a piece of paper found in the closet where Watt's computer was set up.” PSR ¶ 16a. But again, I cannot say by a fair preponderance of the evidence that Watt ever accessed the data on that server.

D. Watt's Employment

While Watt spent time online with Gonzalez, he also had full time employment. He first did demolition work for a contractor between December 2003 and April 2004, while he was looking for a professional job. PSR ¶ 100. Then, between May 3, 2004, and February 17, 2007, he worked at Morgan Stanley as a software engineer. PSR ¶ 98. Next, between February 2007 and April 13, 2008, he worked at Imagine Software “as a software engineer, writing codes for financial products and developing a real-time trading system for financial companies.” PSR ¶ 97. The defendant was terminated from his employment after federal agents executed a search warrant at his office. PSR ¶ 97. One thing seems clear: His role in this conspiracy was plainly not his life.

E. Payments and Profits

Gonzalez was the clear and undisputed leader of the conspiracy. He made well over $1 million from the scheme. He paid substantial sums of money to Scott, Toey, and the others. Again, however important the government contends Watt's role was in the TJX incursions, it has no evidence that he was ever paid for his efforts. In that regard, he stands alone.

II. GUIDELINE CALCULATION

The Guidelines calculation is:

Total Offense Level: 43

6 Base level for unlawful access to computers/access device fraud, § 2B1.1(a)(2)

+30 Loss over $400 million (here, $20 billion based on over 40 million credit cards stolen at $500 per card, Application Note 3(F)(i) to § 2B1.1), § 2B1.1(b)(1)(P)

+6 More than 250 victims, § 2B1.1(b)(2)(C)

+2 Use of sophisticated means, § 2B1.1(b)(9)(C)

+2 Trafficking of unauthorized access devices, § 2B1.1(b)(10)(B)(i)

+2 Use of special skill, § 3B1.3

-2 Minor role, § 3B1.2(b)(2)

-3 Acceptance of responsibility, § 3E1.1(a), (b)

Criminal History: 0 points, Category I

The defendant disputed (a) the amount of loss...