Opinion
CR19-159-RSL
03-21-2022
UNITED STATES OF AMERICA, Plaintiff, v. PAIGE THOMPSON, Defendant.
ORDER GRANTING MOTION TO COMPEL CAPITAL ONE DATA
ROBERT S. LASNIK UNITED STATES DISTRICT JUDGE
This matter comes before the Court on defendant's “Motion to Compel Capital One Data in the Possession of the Government” (Dkt. # 127). Capital One filed an intervening “Motion Pursuant to 18 U.S.C. § 3771” (Dkt. # 147) asserting that the Crime Victims' Rights Act (“CVRA”), 18 U.S.C. § 3771, gives it the right to intervene and expressing its objection to defendant's motion. Defendant further filed a “Motion to File Overlength Reply in Support of Defense Motion to Compel Production of Capital One Data” (Dkt. # 154). Having reviewed the submissions of defendant, the government, and Capital One, and the remainder of the record, the Court finds as follows:
I. Defendant's Motion to File Overlength Reply
As a threshold matter, the Court grants defendant's motion to file an overlength reply (Dkt. # 154). Defendant may file a nine-page reply.
II. Capital One's CVRA Motion
The parties dispute whether the Court should consider Capital One's CVRA motion. For the reasons explained below, the Court will consider Capital One's CVRA motion in its analysis of defendant's motion to compel Capital One data.
A. Background
On December 22, 2021, counsel for Capital One filed its “Letter from Aravind Swaminathan” (Dkt. # 130). This letter requested that the Court deny defendant's motion to compel Capital One data, provided a brief supporting argument on the merits, and requested that the Court set a briefing schedule to hear Capital One's arguments. See Dkt. # 130.
On December 31, 2021, without the Court first addressing its letter, Capital One filed its CVRA motion setting forth its arguments in more detail. See Dkt. # 147. On January 10, 2022, the Court granted the parties' “Stipulated Motion to Extend Noting Date” (Dkt. # 157) regarding Capital One's CVRA motion.
B. Propriety of Capital One's CVRA Motion
Capital One argues that the Court has jurisdiction over its CVRA motion because Capital One is a victim under the CVRA, and the CVRA allows crime victims to enforce their rights enumerated in its subsection (a) by filing a motion in the district court where the defendant is being prosecuted. Dkt. # 147 at 5 (citing 18 U.S.C. §§ 3771(d), (e)(2)(A)). Capital One asserts that its motion is to protect its rights enumerated in CVRA subsections (a)(1) and (a)(8), respectively, “to be reasonably protected from the accused, ” and “to be treated with fairness and with respect for the victim's dignity and privacy.” Dkt. # 188 at 2 (quoting 18 U.S.C. §§ 3771(a)(1), (a)(8)).
Defendant counterargues that the Court should strike Capital One's CVRA motion and related letter because (i) the CVRA does not grant Capital One the right to intervene in a pending criminal discovery dispute between the defense and government, but rather grants victims only “the right to be reasonably heard at any public proceeding in the district court involving release, plea, sentencing, or any parole proceeding, ” Dkt. # 172 at 1, 3-4 (quoting 18 U.S.C. § 3771(a)(4)); (ii) the motion was filed without obtaining the Court's prior authorization, and the letter makes substantive arguments, Dkt. # 172 at 1, 2-3; and (iii) Capital One's intervention violates defendant's Sixth Amendment rights, Dkt. # 172 at 4.
Capital One is correct that the CVRA permits it to file a motion with this Court to assert its rights to be “reasonably protected from the accused” and “treated with fairness and with respect for [its] dignity and privacy.” 18 U.S.C. §§ 3771(a)(1), (a)(8), (d)(3). The Ninth Circuit has tacitly recognized that victims may file motions (and petition for writs of mandamus) to enforce CVRA rights, and these enforcement mechanisms are not limited to the right to be heard in public proceedings in the district court involving release, plea, sentencing, or parole. See e.g., In re K.K., 756 F.3d 1169 (9th Cir. 2014) (reviewing petition for writ of mandamus under the CVRA regarding motions to quash two subpoenas duces tecum); In re Her Majesty the Queen in Right of Canada, 785 F.3d 1273, 1275-77 (9th Cir. 2015) (tacitly recognizing that the CVRA allowed Canada to file a motion for restitution in the district court, to the extent a foreign sovereign could be a CVRA victim). Other district courts have recognized that a victim's right to dignity and privacy as enumerated in subsection (a)(8) of the CVRA includes its interest in preventing disclosure of private information. See, e.g., United States v. Madoff, 626 F.Supp.2d 420, 425-27 (S.D.N.Y. 2009) (applying “dignity and privacy” provision of CVRA to victims' emails); United States v. Bradley, 2011 WL 1102837, at *1 (S.D. Ill. 2011) (finding that subpoenas duces tecum requesting victim's schooling, juvenile court, and mental health records were a “blatant violation” of victim's CVRA right to be treated with respect for his dignity and privacy). Capital One was therefore within its rights to file its CVRA motion.
The right to restitution is recognized in subsection (a)(6) of the CVRA and is therefore separate from subsection (a)(4)'s right to be heard at public proceedings involving release, plea, sentencing, or parole. See 18 U.S.C. §§ 3771(a)(4), (6).
Regarding defendant's second counterargument, defendant points to no authority supporting the proposition that Capital One was required to obtain leave of the Court prior to filing its CVRA motion. Given that the CVRA explicitly authorizes victims to file motions in the district court to assert their rights, see 18 U.S.C. §§ 3771(d)(1), (3), the Court will not strike Capital One's letter and motion on this ground.
Regarding defendant's third counterargument, defendant's Sixth Amendment right to confrontation is inapplicable here. The Sixth Amendment's Confrontation Clause provides, “In all criminal prosecutions, the accused shall enjoy the right . . . to be confronted with the witnesses against him.” U.S. Const. amend. VI. “[T]he principal evil at which the Confrontation Clause was directed was the civil-law mode of criminal procedure, and particularly its use of ex parte examinations as evidence against the accused.” Crawford v. Washington, 541 U.S. 36, 50 (2004). The Confrontation Clause “applies to ‘witnesses' against the accused-in other words, those who ‘bear testimony.' ‘Testimony,' in turn, is typically ‘a solemn declaration or affirmation made for the purpose of establishing or proving some fact.'” Id at 51 (quoting 2 N. Webster, An American Dictionary of the English Language (1828)). Adjudication of this motion does not rest on the Court's resolution of any factual disputes. The Confrontation Clause is therefore not invoked.
The Court will therefore consider Capital One's CVRA motion as it looks to the merits of defendant's motion to compel Capital One data.
III. Defendant's Motion to Compel Capital One Data
The Capital One data include the personal identifying information (“PII”) of more than 100 million Capital One customers, including names, addresses, dates of birth, and, for many fewer individuals, bank account numbers and unencrypted social security numbers. The data were seized from defendant. Dkts. # 145 at 3, # 147 at 1-2, # 155 at 3.
Defendant moves to compel disclosure of Capital One data in the government's possession pursuant to Fed. R. Crim. P. 16(a)(1)(E). The government and Capital One both object to defendant's motion and request that the Court exercise its discretion pursuant to Fed. R. Crim. P. 16(d)(1) to conclude that the government need not provide the defense with a copy of the Capital One data.
The Court first considers whether defendant has met her burden to obtain production under Fed. R. Crim. P. 16(a)(1)(E), and then considers whether the government or Capital One has shown good cause to avoid the requested production of a copy of the data pursuant to Fed. R. Crim. P. 16(d)(1).
A. Fed. R. Crim. P. 16 (a)(1)(E)
Fed. R. Crim. P. 16(a)(1)(E) states:
Upon a defendant's request, the government must permit the defendant to inspect and to copy or photograph books, papers, documents, data, photographs, tangible objects, buildings or places, or copies or portions of any of these items, if the item is within the government's possession, custody, or control and:
It is undisputed that the Capital One data are in the possession of the FBI, and therefore within the government's possession. Dkts. # 127 at 4, # 145 at 1. See United States v. Bryan, 868 F.2d 1032, 1036 (9th Cir. 1989) (“The prosecutor will be deemed to have knowledge of and access to anything in the possession, custody or control of any federal agency participating in the same investigation of the defendant.”).
(i) the item is material to preparing the defense;
(ii) the government intends to use the item in its case-in-chief at trial; or
(iii) the item was obtained from or belongs to the defendant.
The first prong is met because defendant has shown materiality. Materiality is a low threshold; it is satisfied so long as the information would have helped defendant prepare a defense. United States v. Hernandez-Meza, 720 F.3d 760, 768 (9th Cir. 2013) (quoting United States v. Doe, 705 F.3d 1134, 1151 (9th Cir. 2013)). As defendant explains, the Capital One data goes to numerous allegations contained in the indictment, including that (i) the object was “to use the stolen credentials to access and copy other data stored by the customers on Cloud Computing [Company] servers, including data containing valuable personal identifying information, ” Dkt. # 127 at 4 (quoting Dkt. # 102 at ¶ 11); (ii) the data include the PII of approximately 100 million Capital One customers, (iii) the data are valued at over $5,000;
Defendant cites to the first superseding indictment (Dkt. # 102), while the second superseding indictment (Dkt. # 166) now controls. However, this allegation is also included in the second superseding indictment. See Dkt. # 166 at ¶ 11.
(iv) defendant attempted to utilize subsets of the data to create counterfeit credit and debit cards; and (v) defendant possessed unlawfully the names and PII of millions of people, Dkt. # 155 at 2 (citing Dkt. # 102 at ¶¶ 19, 24, 32, 34). That allegations in the indictment rest on the contents of the data is sufficient to show that the data may help defendant to prepare a defense.
The allegations in list items (ii) through (v) are also included in the second superseding indictment. See Dkt. # 166 at ¶¶ 19, 25, 33, 35.
The second prong is met because the government acknowledges it will use a subset of the data in its case-in-chief at trial, see Dkt. # 145 at 7, particularly as the defense indicates that the government has failed to identify what this subset will be or provide defendant with such subset, see Dkt. # 155 at 1.
The third prong is met because the data were obtained from the defendant via seizure. This alone entitles the defense to the data.
Capital One argues that the data should be treated as “contraband” and therefore not turned over to the defense despite that the data were seized from the defendant. Dkts. # 147 at 8-9, # 188 at 5-6. In support of this position, Capital One cites to United States v. Benzer, No. 213-CR-00018-JCMGWF, 2015 WL 9200365, at *7 (D. Nev. 2015), United States v. Husband, 246 F.Supp.2d 467, 469 (E.D. Va. 2003), United States v. Jafari, No. 1:19-0078-SCJ-LTW, 2020 WL 7090698, at *9 (N.D.Ga. 2020), and the definition of “contraband” in Black's Law Dictionary (11th ed. 2019).
The Court does not find Capital One's argument to be persuasive. First, none of these sources are binding on this Court. Second, none of these sources compel a conclusion that the data should be made available only for inspection.
The Benzer court considered whether personal and private information previously made available for defense inspection under a protective order should be disclosed to a third-party newspaper, not whether the defense was entitled to the information. See Benzer, 2015 WL 9200365, at *7. Inspection, rather than copying, was stipulated between the government and defense. See id at * 1-2. Benzer therefore does not stand for the proposition that the Court should order inspection over the defense's objection.
In Husband, the court exercised its discretion under Fed. R. Crim. P. 16(d)(1) and declined to order the government to turn over a tape containing child pornography that it found was contraband subject to forfeiture. Instead, the court allowed the government to arrange inspection without identification of defendant's expert. See Husband, 246 F.Supp.2d at 469. Child pornography is very different from data such as names, addresses, dates of birth, bank account numbers, and social security numbers, as such data are only made contraband by the method of acquisition and use to which they are put. Further, Husband does not stand for a general proposition that “contraband” cannot be provided in copy to the defense, but rather illustrates that a court may exercise its discretion. Accord United States v. Hill, 322 F.Supp.2d 1081, 1091 (CD. Cal. 2004), aff d on other grounds, 459 F.3d 966 (9th Cir. 2006) (“The government argues that since child pornography is contraband, defense counsel and his expert should be required to examine the images in the controlled environment of the government facility. The cases cited by the government, though, all involve appeals from district court decisions denying a defendant's motion to compel production. They do not hold that a district court would abuse its discretion if it were to order the government to produce copies of the materials.”).
Finally, Jafari concerns a defendant's request for a copy of all data from a third party's cell phone. The Jafari court rejected defendant's conclusory statement that the phone was material to defendant's defense and stated that defendant was required to “point to specific information and demonstrate how that evidence would be relevant to his defense.” Jafari, 2020 WL 7090698, at *9. This makes sense, given that there was no indication that the third party's cell phone was obtained from the defendant. However, Jafari is inapposite to the case at hand, as it is undisputed that the Capital One data were obtained from the defendant.
The Court therefore concludes that defendant is entitled to a copy of the Capital One data pursuant to Fed. R. Crim. P. 16(a)(1)(E).
The government and Capital One argue that the Court should conclude that making the Capital One data available for the defense's inspection at the FBI's offices is sufficient to fulfill the government's Fed. R. Crim. P. 16 obligations. For good cause shown, the Court may “deny, restrict, or defer discovery or inspection, or grant other appropriate relief.” Fed. R. Crim. P. 16(d)(1). The government and Capital One primarily argue that production should be limited (i) in recognition of the privacy interests of the victims, including Capital One and the individuals whose PII is included in the records, and (ii) due to the increased risk of dissemination stemming from allowing the Office of the Federal Public Defenders to possess a copy of the Capital One data.
The Court is sensitive to the victims' privacy concerns, particularly in light of their rights to be “reasonably protected from the accused” and “treated with fairness and with respect for [their] dignity and privacy” afforded by the CVRA. 18 U.S.C. §§ 3771(a)(1), (a)(8). However, the Court is unpersuaded that restricting the defense team's access to the Capital One data to the FBI's office is the correct approach. As was the case in almost every relevant example cited by the government or Capital One, a protective order or redaction (which the government does not offer here) is an appropriate solution that respects the victims' rights to protection, dignity, and privacy. See, e.g., United States v. Garcia, 625 F.2d 162, 165 (7th Cir. 1980) (redacting prison informant's name); Haber v. Evans, 268 F.Supp.2d 507, 512-13 (E.D. Pa. 2003) (in context of third-party access request from newspaper, amending protective order to require redaction of PII of victims, witnesses, confidential informants, and others); United States v. Patkar, Cr. No. 06-00450 JMS, 2008 WL 233062, at *5 (D. Haw. 2008) (in context of third-party access request from Associated Press, upholding protective order preventing disclosure of emails comprising the basis of extortion); United States v. Gatewood, No. CR 11-08074-PCT-JAT, 2012 WL 2286999, at *2 (D. Ariz. 2012) (approving redacted production of victim and witness personal information, particularly given the government's cooperation with all specific and justified requests); United States v. Jenkins, No. 207CR00080RCJPAL, 2009 WL 10678771, at *2 (D. Nev. 2009) (holding that the government did not have care, custody, or control of the documents and therefore could not produce them, and also noting that the court was not persuaded that defendants were entitled to review the victim's private and sensitive banking records to determine ownership of allegedly defrauded funds); United States v. Dixon, 355 F.Supp.3d 1, 4-9 (D.D.C. 2019) (issuing protective order that allowed defense counsel, but not defendant, to review video footage related to armed robbery); United States v. Torres, No. 20-CR-00418, 2020 WL 4500046, at *5 (D.N.J. 2020) (issuing protective order whereby information including sexually explicit images of victims and witnesses would be produced only to defense counsel and not to defendant, and victims' last names would be redacted).
Both the government and Capital One rely on United States v. Pac. Gas & Electric Co., No. 14-CR-00175-TEH, 2015 WL 3958111 (N.D. Cal. 2015), for the proposition that inspection alone is sufficient. The court there found that allowing inspection of the government's witness interview notes and providing the defense copies of only those notes that it intended to use at trial properly balanced the sensitivity of the notes with the defendant's need to have the notes to prepare for trial. However, as the government concedes, Pac. Gas & Electric Co. was decided under Fed. R. Crim. P. 16(a)(1)(B), a provision that explicitly authorizes “inspection, copying, or photographing, ” Fed. R. Crim. P. 16(a)(1)(B) (emphasis added), while the matter at hand is governed by Fed. R. Crim. P. 16(a)(1)(E), which states that the government must permit the defendant “to inspect and to copy or photograph, ” Fed. R. Crim. P. 16(a)(1)(E) (emphasis added). That the court allowed inspection in Pac. Gas & Electric Co. is therefore unpersuasive, as this was unquestionably in line with the governing rule.
In response to Capital One's concerns that defendant herself previously threatened to distribute the data and may do so again, the Court notes that both the government and Capital One protective orders currently in place prevent defendant from accessing the data. Access will be limited to the “Defense Team” as defined in the orders. See Dkts. # 66 (government protective order), # 87 (Capital One protective order).
Regarding the increased risk of dissemination, the Court is unpersuaded that this risk is sufficiently grave to merit limiting the defense team's access to the data so long as the data is held on a computer that is both not connected to the internet (“air-gapped”) and in a secure location.
The Court notes that the article cited by the government regarding the possibility of “Air-Fi” attacks on air-gapped computers states that such attacks are “slow and badly suited for exfiltrating large volumes of data, ” such as the Capital One data. The article also indicates that Air-Fi attacks require proximity to the air-gapped computer. See Ben Dickson, ‘Air-Fi' Attack Renders Air-Gapped Computers Open to Data Exfiltration Through WiFi Signals, The Daily Swig (Dec. 23, 2020, updated June 29, 2021), https://portswigger.net/daily-swig/air-fi-attack-renders-air-gapped-computers-open-to-data-exfiltration-through-wifi-signals. The government's concerns regarding “Air-Fi” attacks should be largely addressed by a requirement that the air-gapped computer be held in a secure room.
IV. Conclusion
For all of the foregoing reasons, IT IS HEREBY ORDERED that:
1. Defendant's motion to compel Capital One data (Dkt. # 127) is GRANTED.
The government shall immediately provide the defense with one copy of the Capital One data on a hard drive (or other agreed technology) provided to the government by the defense or shall otherwise allow the defense to access the Capital One data at the FBI headquarters and create a copy. The defense shall house the copy of the Capital One data on an air-gapped computer in a secure room at the Federal Public Defender's Office in Seattle. For the avoidance of doubt, the Capital One data shall be subject to the existing protective orders, including the provision that defendant herself shall not access the Capital One data. See Dkts. # 66, # 87.
2. Capital One's motion pursuant to 18 U.S.C. § 3771 (Dkt. # 147) is DENIED; and
3. Defendant's motion to file overlength reply (Dkt. # 154) is GRANTED.