726

AMENDMENT 726

Amendment: Section 2B1.1(b) is amended by redesignating subdivisions (15) and (16) as subdivisions (16) and (17); and by inserting after subdivision (14) the following:

"(15) If (A) the defendant was convicted of an offense under 18 U.S.C. § 1030, and the offense involved an intent to obtain personal information, or (B) the offense involved the unauthorized public dissemination of personal information, increase by 2 levels.".

Section 2B1.1(b) is amended in subdivision (16), as redesignated by this amendment, by striking "(I)" after "involved"; by striking "; or (II) an intent to obtain personal information" after "security"; and by striking "(i)" after "(5)(A)".

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 1 by inserting after the paragraph that begins "‘Foreign instrumentality’" the following:

"‘Means of identification’ has the meaning given that term in 18 U.S.C. § 1028(d)(7), except that such means of identification shall be of an actual (i.e., not fictitious) individual, other than the defendant or a person for whose conduct the defendant is accountable under §1B1.3 (Relevant Conduct).";

and by inserting after the paragraph that begins "‘National cemetery’" the following:

"‘Personal information’ means sensitive or private information involving an identifiable individual (including such information in the possession of a third party), including (i) medical records; (ii) wills; (iii) diaries; (iv) private correspondence, including e-mail; (v) financial records; (vi) photographs of a sensitive or private nature; or (vii) similar information.".

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 3(C) in subdivision (i) by inserting ", copied," after "taken"; by redesignating subdivisions (ii) through (v) as subdivisions (iii) through (vi); and by inserting after subdivision (i) the following:

"(ii) In the case of proprietary information (e.g., trade secrets), the cost of developing that information or the reduction in the value of that information that resulted from the offense.".

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 4 by adding at the end the following:

"(E) Cases Involving Means of Identification.—For purposes of subsection (b)(2), in a case involving means of identification ‘victim’ means (i) any victim as defined in Application Note 1; or (ii) any individual whose means of identification was used unlawfully or without authority.".

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 9(A) by striking the paragraph that begins "‘Means of identification’" as follows:

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 13 by striking "(15)" and inserting "(16)" each place it appears; by striking the paragraph that begins "‘Personal information’" as follows:

"‘Personal information’ means sensitive or private information (including such information in the possession of a third party), including (i) medical records; (ii) wills; (iii) diaries; (iv) private correspondence, including e-mail; (v) financial records; (vi) photographs of a sensitive or private nature; or (vii) similar information.";

and by inserting "(A)" before "(iii)" each place it appears.

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 14 by striking "(b)(16)" and inserting "(b)(17)" each place it appears.

The Commentary to §2B1.1 captioned "Application Notes" is amended in Note 19(B) by striking "(15)" and inserting "(16)(A)".

The Commentary to §2B1.1 captioned "Background" is amended by inserting after the paragraph that begins "Subsection (b)(14)(B)(i)" the following:

" Subsection (b)(15) implements the directive in section 209 of Public Law 110–326.";

and in the paragraph that begins "Subsection (b)(15)" by striking "(15)" and inserting "(16)" each place it appears.

The Commentary to §2H3.1 captioned "Application Notes" is amended in Note 4 by striking "Definitions.—For purposes of subsection (b)(2)(B):" and inserting "Definitions.—For purposes of this guideline:"; and by inserting after the paragraph that begins "‘Interactive computer service’" the following:

‘Personal information’ means sensitive or private information involving an identifiable individual (including such information in the possession of a third party), including (i) medical records; (ii) wills; (iii) diaries; (iv) private correspondence, including e-mail; (v) financial records; (vi) photographs of a sensitive or private nature; or (vii) similar information.".

The Commentary to §2H3.1 captioned "Application Notes" is amended in Note 5(i) by inserting "personal information, means of identification," after "offense involved"; and by inserting a comma before "or tax".

The Commentary to §3B1.3 captioned "Application Notes" is amended in Note 2(B) by inserting ", transfer, or issue" after "in order to obtain".

Reason for Amendment: This multi-part amendment responds to the directive in section 209 of the Identity Theft Enforcement and Restitution Act of 2008, Title II of Pub. L. 110–326 (the "Act"), and addresses other related issues arising from case law. Section 209(a) of the Act directed the Commission to—

review its guidelines and policy statements applicable to persons convicted of offenses under sections 1028, 1028A, 1030, 2511, and 2701 of title 18, United States Code, and any other relevant provisions of law, in order to reflect the intent of Congress that such penalties be increased in comparison to those currently provided by such guidelines and policy statements.

The Act further required the Commission, in determining the appropriate sentence for the above referenced offenses, to consider the extent to which the guidelines and policy statements adequately account for 13 factors listed in section 209(b) of the Act.

In response to the congressional directive, the amendment increases penalties provided by the applicable guidelines and policy statements by adding a new enhancement and a new upward departure provision. In addition, the amendment expands both the definition of "victim" and the factors to be considered in the calculation of loss; each of these expansions may, in an appropriate case, increase penalties in comparison to those provided prior to the amendment.

First, the amendment adds a new two-level enhancement in §2B1.1 (Larceny, Embezzlement, and Other Forms of Theft; Offenses Involving Stolen Property; Property Damage or Destruction; Fraud and Deceit; Forgery; Offenses Involving Altered or Counterfeit Instruments Other than Counterfeit Bearer Obligations of the United States). The new enhancement, which addresses offenses involving personal information, is at subsection (b)(15). An existing enhancement, which addresses offenses under 18 U.S.C. § 1030 (i.e., computer crimes), was at subsection (b)(15) but has been redesignated as subsection (b)(16).

The new enhancement for offenses involving personal information applies if (A) the defendant was convicted of an offense under 18 U.S.C. § 1030 and the offense involved an intent to obtain personal information, or (B) the offense involved the unauthorized public dissemination of personal information. The "(A)" prong of the new personal information enhancement had been a prong of the existing computer crime enhancement, but the tiered structure of that enhancement was such that if a computer crime involved both an intent to obtain personal information and another harm (such as an intrusion into a government computer, an intent to cause damage, or a disruption of a critical infrastructure), only the greatest applicable increase would apply. The amendment responds to concerns that a case involving those other harms is different in kind from a case involving an intent to obtain personal information. Moving the intent to obtain personal information prong out of the computer crime enhancement and into the new enhancement ensures that a defendant convicted under section 1030 receives an incremental increase in punishment if the offense involved both an intent to obtain personal information and another harm addressed by the computer crime enhancement. The "(B)" prong of the new personal information enhancement ensures that any defendant, regardless of the statute of conviction, receives an additional incremental increase in punishment if the offense involved the unauthorized public dissemination of personal information. This prong accounts for the greater harm to privacy caused by such an offense.

Second, the amendment amends the Commentary to §2B1.1 to provide that, for purposes of the victims table in subsection (b)(2), an individual whose means of identification was used unlawfully or without authority is considered a "victim." The Commentary to §2B1.1 in Application Note 1 defines "victim" in pertinent part to mean "any person who sustained any part of the actual loss determined under subsection (b)(1)". An identity theft case may involve an individual whose means of identification was taken and used but who was fully reimbursed by a third party (e.g., a bank or credit card company). Some courts have held that such an individual is not counted as a "victim" for purposes of the victims table at §2B1.1(b)(2). See United States v. Kennedy, 554 F.3d 415 (3d Cir. 2009) (discussing various cases addressing this issue, including United States v. Armstead, 552 F.3d 769 (9th Cir. 2008); United States v. Abiodun, 536 F.3d 162 (2d Cir. 2008); United States v. Connor, 537 F.3d 480 (5th Cir. 2008); United States v. Icaza, 492 F.3d 967 (8th Cir. 2007); United States v. Lee, 427 F.3d 881 (11th Cir. 2005); and United States v. Yagar, 404 F.3d 967 (6th Cir. 2005)). The Commission determined that such an individual should be considered a "victim" for purposes of subsection (b)(2) because such an individual, even if fully reimbursed, must often spend significant time resolving credit problems and related issues, and such lost time may not be adequately accounted for in the loss calculations under the guidelines. The Commission received testimony that the incidence of data breach cases, in which large numbers of means of identification are compromised, is increasing. This new category of "victim" for purposes of subsection (b)(2) is appropriately limited, however, to cover only those individuals whose means of identification are actually used.

Third, the amendment makes two changes to Application Note 3(C) regarding the calculation of loss. The first change specifies that the estimate of loss may be based upon the fair market value of property that is copied. This change responds to concerns that the calculation of loss does not adequately account for a case in which an owner of proprietary information retains possession of such information, but the proprietary information is unlawfully copied. The amendment recognizes, for example, that a computer crime that does not deprive the owner of the information in the computer nonetheless may cause loss inasmuch as it reduces the value of the information. The amendment makes clear that in such a case the court may use the fair market value of the copied property to estimate loss. The second change adds a new provision to Application Note 3(C) specifying that, in a case involving proprietary information (e.g., trade secrets), the court may estimate loss using the cost of developing that information or the reduction in the value of that information that resulted from the offense. The new provision responds to concerns that the guidelines did not adequately explain how to estimate loss in a case involving proprietary information such as trade secrets.

Fourth, the amendment moves the definitions of "means of identification" and "personal information" to Application Note 1, and clarifies that for information to be considered "personal information," it must involve information of an identifiable individual.

Fifth, the amendment amends §2H3.1 (Interception of Communications; Eavesdropping; Disclosure of Certain Private or Protected Information) to provide that an upward departure may be warranted in a case in which the offense involved personal information or means of identification of a substantial number of individuals. As a conforming change, in Application Note 4 the amendment adds definitions of "means of identification" and "personal information" that are identical to the definitions of those terms in §2B1.1. The departure provision responds to concerns that the guideline may not adequately account for the rare wiretapping offense that involves a substantial number of victims.

Sixth, the amendment clarifies Application Note 2(B) of §3B1.3 (Abuse of Position of Trust or Use of Special Skill). The first sentence of Application Note 2(B) specifies that an adjustment under §3B1.3 shall apply to a defendant who exceeds or abuses his or her authority to "obtain" or "use" a means of identification. The second sentence then provides, as an example of such a defendant, an employee of a state motor vehicle department who exceeds or abuses his or her authority by "issuing" a means of identification. To make the two sentences consistent, the amendment clarifies the first sentence so that it expressly applies not only to obtaining or using a means of identification, but also to issuing or transferring a means of identification.

Finally, the amendment makes several technical changes. In particular, it corrects several places in the Guidelines Manual that erroneously refer to subsection "(b)(15)(iii)" of §2B1.1; the reference should be to subsection (b)(15)(A)(iii) (redesignated by the amendment as (b)(16)(A)(iii)). Also, it conforms a statutory reference in §2B1.1(b)(15)(A)(ii) (redesignated by the amendment as (b)(16)(A)(ii)), which refers to 18 U.S.C. § 1030(a)(5)(A)(i); the Act redesignated this statute as 18 U.S.C. § 1030(a)(5)(A).

The Commission determined that certain factors listed in the directive are adequately accounted for by existing provisions in the Guidelines Manual. See, e.g., §§2B1.1(b)(1), (b)(9)(C), (b)(13), (b)(16) (as redesignated by the amendment); 2B2.3(b)(1), (b)(3); 2B3.2(b)(3)(B); 2H3.1(b)(1)(B); and 3B1.4 (Using a Minor To Commit a Crime)).

Effective Date: The effective date of this amendment is November 1, 2009.

Sign Up for Email Updates