Home confinement with electronic monitoring is a special condition of supervised release (I talked about the standard conditions in my previous post). The complete list of special conditions that were part of the judge's Judgment and Commitment order is attached to the bottom of this post as well as a copy of the monitoring agreement I had to sign.
At the risk of boring some of you, a little context may be useful. As a condition of supervised release, that means that home confinement is not considered prison; I am not under the custody of the Bureau of Prisons anymore, I am under the supervision of the Probation System. As explained at http://en.wikipedia.org/wiki/Federal_Probation, the Bureau of Prisons is part of the Department of Justice (Executive Branch) whereas the US Probation System is part of the Judicial System, serving the courts. They work very closely with judges.
A defendant's exposure to the Probation System begins when he is arraigned, if he is allowed out on bail and not remanded to prison pending trial. At this stage, his supervision is handled by the Pretrial Services System, which could also include home confinement with electronic monitoring as a condition of bail (I met several inmates who were already able to tell me about electronic monitoring because they did it before going to jail).
Once a defendant enters a plea or is found guilty at trial, the Probation System also prepares the infamous PreSentence Investigative Report (PSR or PSI), which is a part of the sentencing process that the public is not well aware of but plays a significant role in the sentence a defendant receives. Pretrial Services continues supervision until the defendant reports to the Bureau of Prisons.
Finally, upon leaving the Bureau of Prisons, the Probation System then takes over again, handling the supervised release part of the sentence, which is where I am for, potentially, the next 3 years (although, in all likelihood, it will be terminated after 1-2 years).
Home confinement does not mean I am locked in my house 24/7. Since a condition of probation is that I must maintain gainful employment, that generally cannot be done without leaving the house so a time window is provided for the probationer to go to work as well as perform other necessary errands or trips (e.g. doctor, lawyer, church).
Since I am self-employed, I do not need to leave the house to go to work per se, but I do have work-related errands I have to run. My PO has approved the following hours in which I am allowed to be off monitoring:
9a-6p Weekdays
10a-2p Saturday
9a-1p Sunday
When I am on monitoring, I basically can't leave the house. There is actually a small perimeter just outside the house that I could probably reach, but I intend to remain within the walls of my house just to be safe. That means I cannot even get the newspaper or mail or work in the yard outside the prescribed times. On the whole, though, I thought the times were pretty generous.
The electronic monitoring system I was hooked up with is called Home Guard 200 by BI Incorporated (there is a picture at this link as well as a description of how it works). The black unusually shaped base unit (receiver)which, like an answering machine, is situated between the phone outlet and a phone. That is, a phone line is connected from the wall phone jack to the base unit and then another phone line connects the base unit to a phone. I chose to place mine in the kitchen. The phone cannot have an answering machine, nor can the phone line have any special features (e.g. caller id, call forwarding, etc).
The electronic bracelet (transmitter) -- my new bling -- was attached to my right ankle as shown in the pictures below. (Click to enlarge)
As you can see, it is fitted loosely enough that I can work my sock in underneath the band, which is a heavier-duty rubber than I expected. I sleep with the sock on. Barring an emergency (such as a broken leg or sprained ankle) there should be no need to remove it. Even when I am off monitoring, the bracelet remains on. It is also waterproof so I had no problems wearing it in the shower.
I have to pay for the cost of the monitoring, which is $95.40/month or $286.20 for 3 months. I just mailed a cashier's check made out to BI for the full amount.
As fate would have it, my wife left yesterday morning before I had my bracelet installed for a 5-day family reunion in Chicago. That means I was left eating a TV dinner, although I did reward myself with Starbucks Java Chip ice cream for dessert! I am probably going to use a Takeout Taxi service to get dinners delivered until she returns.
Also, this morning, I could not get the newspaper until after 9a and I was not able to get the trash out by the required 7:30a without setting off the silent alarm so now the trash is going to have to pile up for another week.
My biggest concern is that I will totally forget I have the bracelet on and, without thinking, walk out in my yard or step out to the driveway to do something or, God forbid, actually get in my car and drive somewhere. After all, I have been unrestricted basically for the 12 days between my release (on June 28) and monitoring beginning yesterday (July 11) so I was starting to get used to being free again. If I were to go outside the boundary, there is no signal to me that I have done so; the alarm is a silent alert to the probation officer. It is not like an invisible fence for a pet where you get immediate feedback when you are approaching "out of bounds." I guess they decided not to "shock" probationers with electronic collars :)
I don't anticipate a lot of drama with the electronic monitoring phase of my sentence so there may not be much to blog about.
I intend to now finish posting the articles I wrote in prison (especially the more provocative ones that I was afraid to publish while I was there) as well as comment on related current events.
Click to enlarge image below listing the special conditions of supervised release. The home confinement is clearly the most significant. The fine and special assessment were paid before I reported to prison. See response to comment for discussion of restitution.
Click to enlarge monitoring agreement below.
11 comments:
The order states a fine of $ 10k and a special fine of $ 100, but what about restitution? damages to the victims etc....
Please discuss the cost of defense?, legal fees, were the private lawyers worth it? Your thoughts on the fees or tradeoff for time, ROI?
I reached a civil settlement agreement for $150K with the victim organization at the same time I entered into a plea agreement on Oct 13, 2006 (yes, Friday the 13th!). The plea agreement counted the civil settlement as restitution which is why the judge did not need to include it as part of the sentence.
I think anyone familiar with the case would agree that I was paying at least twice what the maximum claimed damages were and I doubt they would have got everything they claimed had we litigated the matter. Had I not been facing criminal charges also, the civil case would have played out differently.
As for legal fees, they were significant, no doubt about it. I was very fortunate to be at a place in my life where I could afford the best. I'm not sure I'm willing to announce the exact amount to the whole world but I will say it was well into the 6-figure range.
My case had many idiosyncracies that drove up my costs, including the fact that I initially retained a law firm in Charlotte, where I live, to deal with the prosecutor during the pre-indictment phase. Once the prosecutor chose to indict, I had to retain a law firm in Philadelphia since that is where the case was being charged.
I spent a lot of money on motions to suppress and dismiss that ended up not being submitted when I decided to take a plea. Preparation for sentencing was also extremely expensive. The government appealed my initial bail, which allowed me to travel to Europe while under indictment, which cost money.
Was it all worth it? How do you put a ROI on your freedom. My lawyers are very thorough, probably more than they had to be. They probably could have done 90% as much good for half the money but you have to be prepared for every possibility. There were many things we prepared for but never had to face (fortunately). You still have to pay. I am also a very engaged client... I want to know everything, and I make suggestions... which gets expensive.
The original plea deal offered would have put me in the 18-24 month range. I ended up taking a deal in the 10-16 month range, but which could have gone as high as 15-21 if the govt won their sentencing enhancements arguments, one of which was a longshot, the other more of a close call.
The judge rejected the govt's enhancements and furthermore gave me a below-guideline sentence (6 months split instead of 10 months split), which is rare. While we put forth a good case for straight probation or probation with home confinement, I basically thought I hit a triple, to use a baseball analogy.
Had the government offered, say, 6 months at the very beginning, I would have taken it and could have saved a LOT of money. Unfortunately, we couldn't get them to come down to where I needed them to be and was able to persuade the judge to mostly see things my way where I ended up getting less than I would have taken up front. Odd the way it played out.
So, would you spend half a million to save, say, a year in prison? There are a lot of guys I met in prison who would do a year in prison for half a million in heartbeat. On the other hand, I bet Martha Stewart would have paid 10 million to avoid her 5 months. While I hate the amount of money I spent, it did not bankrupt me or force me to sell my house or anything drastic. Each person's situation is different.
I think I would have ended up with 12-18 months if I had had a public defender. I met a lot of white collar guys in prison who either would not be in prison or would have got much less if they had had my lawyers. Some received very bad counsel (IMO) and others did things to really piss off the prosecutor, which is never a good strategy. You are playing poker with a stacked deck and the govt is playing with house money.... a very hard game to win.
While good lawyers can be important, sometimes it doesn't matter. Scooter Libby had the best lawyer and he still got hammered by the judge. (Fortunately, for him, he had a powerful friend to help him out.)
Here in Charlotte, Jim Black, former speaker of the state house, just got slammed for 63 months, despite having one of the best local lawyers.
I hope to go into more detail about the various stages of my case at a later time. See the document archive in the left margin for an outline of my plan. I really want people to understand the process and all that went into it so you understand what federal defendants go through long before they ever get to sentencing. The process is brutal.
Unfortunately, there is also a lot of strategy and attorney/client discussion that I will probably not be able to disclose, as interesting as it might be. At least, not until I have finished my probation. Don't want to piss anyone in the government off too much by saying the wrong thing.
Bill, One of the best presented comments/posts, this allows me to understand the process, I know you cant discuss strategy but IMO even good lawyers see you as a bank, so how do you stop the bleeding with no results anywhere in sight.....
Choosing a lawyer is hard... and a bit hit and miss.
Again, I was very lucky. In Charlotte, my business lawyers (who I called when the FBI raided my home in July, 2005) were able to refer me to a good criminal defense firm.
As for Philadelphia, I found a woman who was a former Supreme Court clerk who specialized in white collar defense who also had co-taught a cybercrime course with my prosecutor. I thought any existing good relationship between the two could only serve me well.
I have no doubt that both my Charlotte and Philadelphia lawyers were emotionally invested in my case and while they certainly got a lot of money out of me (and I let them know if I thought it was getting TOO ridiculous), I don't for one minute think they viewed me as a bank and in fact I think they were as sensitive as possible to the financial side of things.
How do you stop the bleeding with no end in sight? It is difficult to switch horses in the middle of the race. The only thing I can recommend is to raise your concerns with your lawyer to discuss how to approach your case more efficiently. Unfortunately, it may effect your strategy and increase your risks.
For example, in the Jim Black case I referred to in my previous comment, a friend quoted him as saying:
"I'm going to have to plead to some things I'm not guilty of, Harris recalled him saying. I don't want to, but ... I can't raise any more money and I don't want to put my family through what I would put them through any more."
I understand exactly what he means, as I suspect you do. I knew guys in prison who thought they were innocent but 1) didn't want to bankrupt themselves (and, by extension, their family) and 2) didn't want to risk a 4-5 times greater sentence by going to trial (vs a plea) and the stress that would put on their family. Therefore, they took the plea.
It's a brutal system.
Bill,
I've really enjoyed reading your blog these last couple of months. It's been entertaining and educational. I'm sorry you had to go through all that. It sounds like a completely crazy ordeal.
In any case, I'd be interested to know if the agency from which you gained "illegal" access had someone powerful on the inside that pressed the US Attorney's office to file criminal charges against you. After reading some of the prosecution documents online the whole case really does seem like a complete "reach", as I think you may have called it in an earlier entry. I agree this was not the best thing in the world to do. (and probably not the smartest thing, as I'm sure you would agree in hindsight) but this really does seem like a civil case to me on its face. What are the criteria for criminal prosecution for something like this? Gaining unauthrized access to a website seems like something that has happened quite often. Seems like a lot of others may be in line for prosecution as well?
Anyway, I hope you keep up the blog. It's a very interesting read. Best Wishes from a fellow North Carolinian.
Hmmm... this will require a very delicate response on my part. A complete answer would take too long so I will try to give the reader's digest version.
First, to make clear, I acknowledged publicly that what I did was wrong and caused the victim organization in this case a lot of distress. I understand why they were upset, even if I don't understand why they chose to pursue it they way they did. They did what they thought they had to do and I have no hard feelings about that as I hope they no longer have any hard feelings towards me, especially since I paid them $150K!
Having said that, I will answer your questions in reverse.
Yes, based on a strict reading of the law, there are a LOT of people who could be prosecuted for violating this statute. One only need gain "unauthorized" access to a computer to obtain "information" to violate it. If the information is obtained for profit or commercial advantage, it is a felony. In addition, damages are based on any "reasonable response" by the victim and the amount of damages affects the length of sentence.
In most cases like mine, there would really be no tangible damages as a matter of law. After all the information is "public" (i.e. not proprietary or copyrightable), it was not deleted or altered, the computers (hardware or software) were not harmed. Without damages, the base offense doesn't warrant enough points on the guideline scale to yield any prison time and the govt does not generally prosecute cases that they do not believe will result in prison time.
In my case, they were able to "construct" almost $70K in damages, mostly by spending $52K on a first class mailing to all 120K members informing them of the intrusion, even though they had all their members' email addresses.
In effect, the statute allows two different defendants who commit the exact same type of act to be sentenced completely differently based on how the victim chooses to "respond" to the intrusion. Simply, had the victim chosen to send an email instead of a letter, I would not have gone to jail. There is no nice way to say that is totally absurd. I guess I should be happy they didn't choose to send the letter FedEx overnight -- I might have spent 10 years in prison!
The law is a very bad law, written before the internet as we know it existed and designed to protect truly private information on private internal networks. However, the language is broad enough to encompass public websites, available to anyone in the world, with "member" sections containing purely public phone-directory type contact information protected by a trivial login mechanism that a 10-year old could hack. I understand their desire to control access to their member directory but it shouldn't be a criminal offense if someone else gains access, certainly not a federal felony, much less one involving prison time.
The breadth of the statute gives prosecutors a lot of discretion in who to prosecute. I doubt most prosecutors would have been interested in my case. I was surprised, to be quite honest with you, that they even gave it the time of day. Instead they chose to spend over two years and who knows how much govt resources to recover a contact list of physicians containing purely public information.
So why did they indeed choose to pursue it rather than tell the victim that this should be pursued civilly?
I think it was due, unfortunately for me, to the convergence of several factors.
First, the victim was very angry and distressed about what happened and pretty helpless to stop it or find me. In short, I was, to use the prosecutor's metaphor, engaged in a game of cyberchess with them... and I was winning. So they called in the "cavalry" for assistance.
Second, about the same time as my case, two highly public data security cases hit the news: LexisNexis and ChoicePoint. These cases involved the theft of millions of consumer records containing data that could be used for identity theft. Thus, computer intrusion cases had become a priority for the DOJ CyberCrime Division, behind only terrorism and child pornography. On the surface my case appeared similar and therefore was of interest.
Third, I think they were offended by... what shall I call it... the sheer brazen persistence of my conduct. Despite much effort on the other side to prevent me from doing this, I persisted. I really wanted the data. Even the judge later remarked on how much effort had gone into this (he didn't mean it as a compliment!).
Finally, I think it was a "sexy" case that required them to do a lot of interesting cyber-detective work that the special agent investigating the case enjoyed doing. It was fun to try and catch me.
I think to some degree, their interest waned as we approached sentencing. It became clear that my conduct was nothing like the other two highly public cases. All of the information I had obtained could have been legally obtained elsewhere, although with more difficulty. The prosecutor at sentencing even acknowledged that his thinking on the case had "evolved."
This was not a data theft or identity theft case, it was a mere computer trespass. Now, granted, it was loss of control over the information that was of most concern to the victim, not the trespass per se, but it was the trespass that provided the "hook" on which to prosecute me criminally. The copying of the information in and of itself, while an element of the crime, was not illegal. That is, they do not have a right to control the information; they only have a right to control access to their computer.
As to whther the organization had someone powerful on the inside that pressured the govt to pursue charges, I can only speculate. The organization is the largest specialty medical association in the country with 120,000 internal medicine doctors as members. The 7-story building that houses their headquarters in Philadelphia is one block away from the federal building.
Obviously they are a very influential organization and I am sure have very influential members who socialize in the same circles with lawyers and government officials.
Nonetheless, I think they called the FBI because they could not have caught me without government resources and authority (i.e. subpoenas and search warrants).
I think they just wanted to catch me to recover the data; I have no reason to believe it mattered to them whether I was prosecuted or not once they got their money. That is just a hunch, however. Maybe they really did want to bury me. I don't know. I have never spoken with anyone in their organization.
How did it occur to them to call the FBI in the first place (I thought it was a rather odd response at the time)? The special agent who headed the investigation works with a program called InfraGard, a concept that was developed to encourage the exchange of infrastructure protection information between the government and the private sector members. I suspect that the organization had participated in this program and thus had an existing relationship with this agent and knew to call him should a problem occur, not that they anticipated this particular problem.
So the result is that I ended up a federal felon with 3 months in prison for conduct that no one else has ever been prosecuted criminally for. I never made a penny off of the data and no one else has a copy of the data but it cost me a lot of money and I can only imagine how much the government spent.
Do you know if the procecutor was easy going or out to get you during the sentencing presentations infront of the judge? Your PSR should have given you an idea of what time you were looking before sentencing or rather what time they are recomeding? How was the PS Interview? any tips or advice?
On the whole, the prosecutor was pretty reasonable; he certainly could have been worse (based on some of the nightmare stories I heard in prison). By the time we got to sentencing, I think his basic disposition towards me had softened considerably and I did not get the same sense that he was out to get me as I did earlier in the case.
After sentencing (the only time I ever really talked to him), he had kind words for me and my family and I have no bitterness towards him although I think he misunderstood the basic nature of the case from the beginning. Had he known I would only end up with 3 months, I'm not sure he would have bothered with the case but that is just a guess.
Yes, the PSR gave us a sense of what to expect. The plea agreement put me at 12 points (10-16 months) with 2 sentencing enhancement issues to be argued before the judge that could have raised my guideline sentence to 15-21 months. The PSR agreed with us on the "sophisticated means" sentencing enhancement (a huge win) and took no position on the other (which we considered a real long shot for the govt). On the whole, we were pleased with the PSR. I expected to get a 10 month split sentence (5 mo prison, 5 mo home confinement). I got 6 (3 and 3), so it is hard to complain, although I hoped for probation.
The PreSentence Investigation Report (PSR or PSI) is huge. Perhaps no document in the criminal justice system is more important than the PSR.
Normally the probation office is in lockstep with the government. (Indeed, a lawyer in prison considered the PSR process to be the most corrupt aspect of the system because of its pro-prosecution bias.) That is why it is imperative that your lawyer make sure that every fact in your PSR is correct and that all govt "facts" are balanced with the defense's "facts."
Your lawyer must prepare you for every question you are going to be asked. I discussed the PSR at length with my lawyer on the phone (since she was in Philly and I was in Charlotte) and spent an entire morning going over answers to potential questions. It will be the most intrusive interview you ever go through. There is also a net worth worksheet that is more intrusive than any mortgage application you will ever fill out. You don't have to cooperate with either of these but be prepared to get slammed at sentencing if you don't.
At some point, I will post a blank PSR questionnaire as well as a redacted version of what mine looked like so people can understand better how intrusive it is. (There is a lot of personal details in a PSR, which is why it is not public record.)
I'm a bit late, but welcome home, Bill. :)
You broke into their computer system, stole data and then sold that data for a great deal of money.
You would be enraged if someone broke into your computer or web site.
Oh, but you couldn't watch the Master's Tournament.
I accessed a public website, gained access to the member directory available to over 120,000 members, and made a copy of public information that I did not make one penny off of. The data was never integrated into the list that I sold.
I was never charged with theft because you can't steal what can't be owned (i.e. public, non-copyrightable information). I was charged with gaining unauthorized access to a protected computer; in effect, hacking, although using a member login to access a directory of public facts is probably the most trivial form of hacking there is. This was an unprecedented prosecution. No one has ever been prosecuted for collecting non-private data from a website when no damage was otherwise done to the system; even the judge acknowledged that. The statute was stretched about as far as possible, probably beyond its intent.
Post a Comment