Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 1 of 9 1 DAVID R. CALLAWAY (CABN 121782) Attorney for the United States, Acting Under 2 Authority Conferred by 28 U.S.C. § 515 Chief, Criminal Division 3 SUSAN KNIGHT (CABN 209013) 4 Assistant United States Attorney 150 Almaden Boulevard, Suite 900 San Jose, California 95113 Telephone: (408) 535-5061 FAX: (408) 535-5061 E-Mail: Susan.Knight@usdoj.gov 5 6 7 8 Attorneys for United States of America 9 10 UNITED STATES DISTRICT COURT 11 NORTHERN DISTRICT OF CALIFORNIA 12 SAN JOSE DIVISION 13 UNITED STATES OF AMERICA, Plaintiff, 14 15 v. 16 SANFORD WALLACE, 17 Defendant. ) ) ) ) ) ) ) ) ) ) No. CR 11-00456 EJD UNITED STATES’ SENTENCING MEMORANDUM Date: June 13, 2016 Time: 1:30 p.m. Court: Honorable Edward J. Davila 18 19 20 INTRODUCTION On August 24, 2015, defendant Sanford Wallace (hereinafter Athe defendant@) entered a guilty 21 plea pursuant to a plea agreement to Count Three of an Indictment charging him with Fraud and Related 22 Activity in Connection with Electronic Mail, in violation of 18 U.S.C. § 1037(a)(1), and Count Ten of 23 an Indictment charging him with Criminal Contempt, in violation of 18 U.S.C. § 401(3). Pursuant to 24 Criminal Local Rule 32-5(b), the United States respectfully submits this memorandum in order to 25 discuss the applicable Sentencing Guidelines (“Guidelines”) calculations and to advise the Court of its 26 sentencing recommendation, taking into account the sentencing factors in 18 U.S.C. § 3553(a). The 27 government recommends that, consistent with the Plea Agreement and the Guidelines, the Court impose 28 a sentence of 36 months’ imprisonment, five years of supervised release, and restitution in the amount of U.S. SENTENCING MEMO. CR 11-00456 EJD Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 2 of 9 1 $310,628.55. The Probation Office has recommended a sentence of 30 months’ imprisonment, five 2 years of supervised release, and restitution. The defendant’s conduct caused significant damage to Facebook’s network and compromised 3 4 approximately 500,000 Facebook user accounts. He also used the identities of several individuals 5 without their permission to register domain names involved in his spamming activities. Furthermore, the 6 defendant repeatedly disregarded orders issued by the Honorable Jeremy Fogel, who was the United 7 States District Court Judge for the Northern District of California assigned to Facebook’s civil lawsuit 8 against the defendant. Therefore, the government believes that a three year sentence is an appropriate 9 punishment and achieves the goals of sentencing laid out in 18 U.S.C. § 3553(a). DISCUSSION 10 11 I. The Legal Framework for Sentencing. 12 The Ninth Circuit has provided the courts with the basic framework for engaging in the 13 sentencing process. In United States v. Carty, 520 F.3d 984, 991 (9th Cir. 2008), the Court explained 14 that “[t]he overarching statutory charge for a district court is to ‘impose a sentence sufficient, but not 15 greater than necessary’ to reflect the seriousness of the offense, promote respect for the law, and provide 16 just punishment; to afford adequate deterrence; to protect the public; and to provide the defendant with 17 needed educational or vocational training, medical care, or other correctional treatment. 18 U.S.C. § 18 3553(a) and (a)(2).” The starting place in the sentencing process is the determination of the applicable sentencing 19 20 guideline range. Id. “While the Guidelines are to be respectfully considered, they are one factor among 21 the § 3553(a) factors that are to be taken into account in arriving at an appropriate sentence.” Id. “The 22 district court should then consider the § 3553(a) factors to decide if they support the sentence suggested 23 by the parties.” Id. The district court “may not presume that the Guidelines range is reasonable,” and 24 “must an individualized determination based on the facts.” Id. As discussed below, the government has followed this framework in arriving at its sentencing 25 26 recommendation in this case. 27 // 28 // U.S. SENTENCING MEMO. CR 11-00456 EJD 2 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 3 of 9 1 II. The Applicable Sentencing Guidelines. 2 The government has reviewed the Presentence Report (“PSR”) and has no objection to the 3 contents of the report. In the plea agreement, the government listed a loss of more than $400,000, but 4 less than $1,000,000, for purposes of calculating the Sentencing Guidelines, and the defendant reserved 5 the right to argue that the loss was more than $10,000, but less than $30,000. See Plea Agreement, Dkt. 6 No. 78. The parties have reached an agreement that the loss is approximately $320,000, which, under 7 the amended Guidelines, results in a 12-point enhancement pursuant to Section 2B1.1(b)(1)(G). The 8 Probation Officer agrees with the parties’ recommendation on loss, which results in the following 9 guidelines calculation in the PSR: 10 CountThree: Fraud and Related Activity in Connection with Electronic Mail (Group One) 11 a. Base Offense Level: (U.S.S.G. ' 2B1.1(a)(2)) 6 b. Specific Offense Characteristics 12 13 14 Amount of Loss: (Loss is more than $250,000 but less than $550,000 pursuant to U.S.S.G. §2B1.1(b)(1)(G)) +12 (U.S.S.G. ' 2B1.1(b)(2)(A)(ii) Offense committed through mass marketing) +2 (U.S.S.G.' 2B1.1(b)(6) Convicted of 18 U.S.C. ' 1037) +2 Offense Level: 22 15 16 17 18 c. 19 20 Count Ten – Criminal Contempt (Group Two) 21 d. Base Offense Level: (U.S.S.G. ' 2J1.1 - refers to ' 2X5.1 obstruction guideline U.S.S.G ' 2J1.2(a)) 14 e. Offense Level: 14 22 23 24 Combined Offense Level 25 f. U.S.S.G. ' 3D1.4(a) – no enhancement 0 26 g. Acceptance of Responsibility: -3 27 h. Total Offense Level: 20 28 PSR ¶¶ 38-59. U.S. SENTENCING MEMO. CR 11-00456 EJD 3 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 4 of 9 An adjusted offense level of 20, when indexed with Criminal History Category I, results in an 1 2 advisory guideline sentence of 33 to 41 months’ imprisonment in Zone D. However, any sentence for 3 criminal contempt is at the discretion of the Court. The Probation Officer has recommended a sentence 4 of 30 months’ imprisonment, five years of supervised release, and restitution. PSR, Addendum, page 1. 5 III. The Government’s Sentencing Recommendation 6 After considering the Sentencing Guidelines and factors outlined in 18 U.S.C. § 3553(a), 7 the government believes that a sentence of 36 months imprisonment is a reasonable and appropriate 8 sentence. 9 A. Factors to Be Considered in Imposing Sentence 10 1. The Nature and Circumstances of the Offense 11 The defendant committed a serious offense by engaging in a spamming campaigns using 12 Facebook’s network. His conduct was calculated and spanned over a year. The defendant’s scheme began in approximately November 2008, when he established a fake 13 14 Facebook profile under the name “David Frederix” and started testing spam messages. He demonstrated 15 his intent to harm Facebook when he sent his friend Walter Rines a private message though Facebook 16 stating verbatim: “did you like my newest creation GayestProfile.com hehe – ps. I think im done with 17 myspace --- its time for . . . . facebook!!0.” PSR ¶ 11. He tested his spamming messages to bypass 18 Facebook’s filtering system using an automated scripting process and registered thousands of domain 19 names using other individuals’ names. To further conceal his identity, the defendant used techniques, 20 such as onion routing, for his scheme. PSR ¶¶ 15-16. From November 2008 to approximately March 2009, the defendant launched numerous spam 21 22 campaigns designed to trick Facebook user’s into clicking on domains using bait such as “our system 23 indicates that a photo from your ip address has been uploaded to this site within the past 48 hours.” 24 Once the user clicked on the domain, the defendant, using an automated scripting process, retrieved a 25 list of all of the user’s friends, and then post a spam message to each of the friend’s Facebook walls. The 26 defendant was paid by affiliate advertising agencies for each click on the spam website. The defendant 27 compromised 500,000 Facebook accounts and distributed over 14 million spam messages. PSR ¶¶ 17, 28 19-20. U.S. SENTENCING MEMO. CR 11-00456 EJD 4 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 5 of 9 1 The defendant’s actions had severe consequences on Facebook because it had to determine the 2 extent of the intrusion, which took away time and resources from their day-to-day business activities. As 3 Facebook explained in its March 7, 2013 letter: 4 5 6 7 Once detected, [the defendant] did not stop his illegally activities. Instead, he implemented aggressive countermeasures to maintain his phishing and spamming campaign, including the use of varied spam links that were designed to evade Facebook filters, changes to his Internet Service Providers to avoid Facebook’s blocking mechanisms, and a change to image-based spam, which made it extremely costly and challenging to defeat [the defendant’s] scheme. Facebook was required to commit significant technical and legal resources in order to identify, combat and remediate the damage [the defendant] inflicted on Facebook. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 PSR ¶ 31. Besides the harm to Facebook, the defendant’s harmed victim A.A.’s and Scott S.’s reputations when he used their identities to register domain names linked to the spamming campaigns. Both individuals were named in Facebook’s February 2009 civil lawsuit, and eventually dropped from the lawsuit. A.A. told the FBI that he did not authorize the defendant to use his name, and had to explain to his employer why he was involved in a lawsuit by Facebook. Fortunately, he was able to prove to his manager that he was not involved in the Facebook scheme and kept his job. PSR ¶ 33. Finally, the defendant’s aggravated conduct is compounded by the fact that he disobeyed Judge Fogel’s order not to access Facebook. In February 2009, Facebook sued the defendant for computer hacking in violation of federal and state law. (Facebook, Inc. v. Wallace et al, No. C-09-00798-JF). On March 24, 2009, Judge Fogel granted a temporary restraining order prohibiting the defendant from access or attempting to access Facebook in any way, or maintaining Facebook information obtained by legitimate or illegitimate means. On March 24, 2009 Judge Fogel issued an order granting a preliminary injunction and on September 18, 2009, he issued a permanent injunction. The defendant was served with each order. PSR ¶ 21. Despite being served with three orders from Judge Fogel, the defendant brazenly disregarded them and accessed Facebook’s network over 100 times. 1 See Attachment A, Declaration of Alex Rice. 26 1. Facebook filed Mr. Rice’s declaration in support of their motion for contempt. The FBI case agent examined the logs provided by Facebook to confirm Mr. Rice’s findings. The PSR includes the 28 fact that the defendant opened and maintained a fictitious Facebook profile from January 26, 2011 through February 12, 2011. PSR ¶ 28. 27 U.S. SENTENCING MEMO. CR 11-00456 EJD 5 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 6 of 9 1 The defendant’s conduct had severe consequences for Facebook, victims A.A. and Scott S., and 2 the 500,000 Facebook users whose accounts were compromised. This behavior warrants a significant 3 custodial sentence. 4 2. The History and Characteristics of the Defendant 5 Although this is the defendant’s first criminal offense, numerous lawsuits resulting in judgments 6 totaling hundreds of millions of dollars have not stopped him from illegally accessing computer 7 networks. PSR ¶¶ 8-10, 62. As detailed in the PSR, the defendant has been sued by, among others, the 8 Federal Trade Commission and America On Line, and owes millions of dollars in default judgments for 9 his spamming and phishing schemes. Prior to the Facebook scheme, he devised a scheme against 10 MySpace with his partner Walter Rinee to illegally access over 320,000 MySpace accounts and sent 11 more than 890,000 comments and 400,000 messages. In 2007, MySpace sued the defendant and Rines in 12 the Central District of California, and was awarded a $230 million judgment. PSR ¶ 10. Despite the 13 huge judgment against him, the defendant went on to use the same techniques against Facebook. 14 The defendant also has a disobeyed a court order in another case. In September 2008, the 15 Federal Trade Commission asked the Chief United States District Judge in the District of New 16 Hampshire to hold the defendant and Rines in contempt for their MySpace activities, and they were 17 ordered to pay $555,000. PSR ¶ 10. 18 The defendant’s history demonstrates that he has yet to suffer a consequence – other than a 19 default judgment that cannot be collected -- for his spamming activities. A sentence of 36 months’ 20 imprisonment will impress upon the defendant the seriousness of his actions and deter him from 21 engaging in similar conduct again. 22 23 24 25 26 27 28 3. The Need for the Sentence to Reflect the Seriousness of the Offense, Promote Respect for the Law, and Provide Just Punishment for the Offense “The § 3553(a)(2)(A) consideration is the ‘just deserts’ concept, which carries the need for retribution, the need to make the punishment fit the crime, and the need not just to punish but to punish justly.” United States v. Irey, 612 F.3d 1160, 1206 (11th Cir. 2010) (rejecting below-guidelines sentence as substantively unreasonable). A sentence of 36 months would reflect the seriousness of the defendant’s conduct, promote respect for the law, and provide just punishment for the offense. U.S. SENTENCING MEMO. CR 11-00456 EJD 6 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 7 of 9 1 4. The Need for the Sentence to Afford Adequate Deterrence 2 18 U.S.C. § 3553(a)(2)(B) requires that a sentencing court evaluate both specific deterrence (to 3 defendant) and general deterrence (to other potential criminals). See United States v. Musgrave, 761 4 F.3d 602 (6th Cir. 2014) (rejecting below-guidelines sentence as substantively unreasonable). 2 A 5 custodial sentence of 36 months would serve as an important deterrent not only to the defendant but also 6 to individuals who are currently involved in illegally accessing computer networks, or are considering 7 committing such an offense. Computer attacks like the defendant’s impose enormous costs on U.S. 8 businesses. See James Griffiths, Cybercrime costs the average U.S. firm $15 million a year, CNN 9 (October 8, 2015), http://money.cnn.com/2015/10/08/technology/cybercrime-cost-business. The Court’s 10 evaluation of this sentencing factor should focus on ensuring that other hackers know and consider that 11 federal sentences for attacking U.S. companies will be significant before embarking on similar conduct. 12 See United States v. Martin, 455 F.3d 1227 (11th Cir. 2006) (noting that general deterrence is 13 particularly important in white collar crimes and rejecting sentence in part because it failed to provide 14 deterrence); see also S. REP. 98-225, 76, 1984 U.S.C.C.A.N. 3182, 3259 (“the second purpose of 15 sentencing is to deter others from committing the offense”). 16 5. The Need to Protect the Public from Further Crimes of the Defendant 17 The government is concerned that the defendant spends a significant amount of his income on 18 gambling, has not been treated for his mental health issues, and has not addressed his alcohol and 19 substance abuse issues. PSR ¶¶ 76 -78, 80-81. If the defendant does not deal with these serious 20 problems, he is likely to re-offend. Therefore, the government agrees with the Probation Officer’s 21 recommendations that the defendant participate in testing and treatment programs for substance abuse 22 and mental health, and abstain from alcohol and gambling. PSR, Addendum, pages 4-5. 23 6. The Need to Provide the Defendant with Educational or Vocational Training 24 The defendant reported to the Probation Officer that he works as a nightclub promoter and that 25 2. Some courts have concluded that the analysis under 18 U.S.C. § 3553(a)(2)(B) should focus on general deterrence, leaving the specific deterrence analysis for consideration under 18 U.S.C. 27 § 3553(a)(2)(C) (“protect the public from further crimes of the defendant”). See United States v. Edwards, 595 F.3d 1004, 1021 (9th Cir. 2010) (Bea, C.J., concurring in part and dissenting in part). Either way, it is clear that this Court should consider general deterrence in fashioning an appropriate 28 sentence. 26 U.S. SENTENCING MEMO. CR 11-00456 EJD 7 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 8 of 9 1 “he has been self-employed his whole life.” PSR ¶ 84. According to the PSR, the defendant earns 2 between $4,000 and $8,000 a month, has a substantial history of federal tax liens, and does not have any 3 assets. PSR ¶ 87. He might benefit from financial classes to help him with his tax and other financial 4 issues. 5 IV. Restitution 6 The Mandatory Victim Restitution Act (“MVRA”) states that courts “shall order” those 7 convicted of certain crimes to “make restitution” to their victims. 18 U.S.C. § 3663A(a)(1). The Ninth 8 Circuit has interpreted the MVRA to mean that those convicted of applicable crimes must pay restitution 9 to any victim “directly and proximately harmed as a result of the commission of [the] offense.” United 10 States v. Waknine, 543 F.3d 546, 555 (9th Cir. 2008) (citing Section 3663A(a)(2)). The MVRA goes on 11 to state that restitution orders “shall require” convicted defendants to pay restitution for offenses 12 “resulting in damage to or loss or destruction of property of the victim,” 18 U.S.C. § 3663A(b)(1), and 13 to “reimburse the victim for lost income . . . and other expenses incurred during participation in the 14 investigation or prosecution of the offense or attendance at proceedings related to the offense.” Id. § 15 3663A(b)(4). Facebook submitted two letters documenting that the company spent approximately $600,000 to 16 17 identify the extent of the defendant’s intrusion into computer network and remedy the damage. 3 18 Specifically, Facebook gave a detailed explanation concerning the following expenses: $21,995.05 on 19 pre-litigation investigation of the defendant; $40,409 in legal fees to obtain a temporary restraining 20 order, $138,224.50 in additional legal fees; and $110,000 in domain take down fees. All of these fees, 21 which total $310,628.55, were directly related to the defendant’s intrusion into Facebook’s network. In 22 addition, Facebook stated in its correspondence that it spent approximately $290,000 in engineering 23 salaries. Facebook did not provide a detailed explanation of its engineering costs, and therefore, the 24 government is unable to prove by a preponderance of the evidence that the costs were related to the 25 intrusion. The government recommends that the Court exclude the engineering costs in its restitution 26 order. 27 28 3. The government will file both letters under seal. The government previously provided defense counsel and the Probation Officer with the letters. U.S. SENTENCING MEMO. CR 11-00456 EJD 8 Case 5:11-cr-00456-EJD Document 90 Filed 06/06/16 Page 9 of 9 CONCLUSION 1 2 In full consideration of the defendant’s history and characteristics together with the other goals 3 of sentencing, the government respectfully requests that the Court sentence the defendant to 36 months’ 4 imprisonment followed by five years supervised release, and $310,628.55 in restitution to Facebook. 5 The defendant does not have the ability to pay a fine, and therefore, the government requests that the 6 Court not impose one. PSR ¶ 88. The Court is required to impose a $200.00 special assessment. 7 DATED: 6/6/16 Respectfully submitted, 8 DAVID R. CALLAWAY Attorney for the United States, Acting Under Authority Conferred by 28 U.S.C. § 515 9 10 ___/s/_________________________ SUSAN KNIGHT Assistant United States Attorney 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 U.S. SENTENCING MEMO. CR 11-00456 EJD 9