Today -- July 21 -- is the 4 year anniversary of when it all began. Now that I am off supervised release, I can talk more freely about the facts of my case.
At 6a on a Thu morning, I was asleep in bed upstairs (see picture of house below) when I heard a loud male voice: "Mr. Bailey, this is the FBI. Show yourself at the top of the stairs."
I was groggy, not quite sure of what I heard, when a few moments later, I heard the same voice: "Mr. Bailey, this is the FBI. Show yourself at the top of the stairs."
My wife was not next to me, having awoken 30 minutes earlier to work in her office downstairs. I rolled out of bed and walked to the door to the landing at the top of the stairs. The stairs begin in the downstairs foyer at the entrance of the house and rise toward a landing in the back of the house on the second floor. The bedroom is immediately to the right.
Before stepping onto the landing, I realized that I was not wearing ANY clothes. I shouted down "I'm not wearing anything" to which the agent replied "I don't care!"
I stepped out of my bedroom at the top of the stairs and saw a group of people in the foyer below including my wife and 2 other females, one of whom immediately turned her head away.
I immediately began to step back into my room only to be instructed to keep my hands clear. I stepped back onto the landing, turned around and placed my hands up against the wall. I recall yelling to my wife that someone must be loose in the neighborhood and the FBI is going home to home. I then asked if they had a search warrant. The man who appeared to be the lead agent (I later found out that one of the women was actually the signature on the warrant, which I think officially makes it her "search") said he had a warrant, then climbed the stairs, escorted me into the bedroom and then closet so I could put some shorts and a t-shirt on. He also asked if there were any guns or weapons in the house which there weren't.
By the time I stepped back out of my bedroom, several other agents had ascended the stairs and entered my office to disconnect the computers. At this point, I had a sneaky suspicion this must have something to do with my business activities but not sure exactly WHAT. Nor could I imagine what line I could have crossed that would be so significant that it would interest the FBI. Surely they have better things to do, I thought.
As it turns out, there were 6 FBI agents (4 men, 2 women) and a deputy sheriff (who was the only one in uniform, which I think was his primary purpose... to look official). I was surprised that, other than the deputy sheriff who looked in his 50s, all of the agents were young... maybe 25-35. Several plain cars plus the sheriff vehicle were parked on the road in front of my house.
I was handed a copy of the
search warrant (note: the download contains not only the warrant but the receipt of items seized as well as the affidavit supporting the search warrant, which was sealed until the following Monday, but at the time of the search the only document I saw was the search warrant itself which was only three pages long pp. 5-7), and escorted down the stairs, where I noticed my wife seated in the living room beginning to be questioned by the agent who she later said had questioned her very aggressively. My wife had been in the dining room/office when the cars drove up right at 6a (the earliest the search warrant permitted them to execute the warrant). She opened the door before they reached it, which explained why I never heard a knock or door bell.
I was taken to the sun room in the back of the house where I had an opportunity to review the search warrant. At that point, I kind of knew what was up, but I was incredulous that the FBI was interested in something so seemingly petty. I was convinced there had to be more than met the eye here. Surely, in a world of terrorism, child pornography, credit card fraud, identity theft, computer viruses and spam, the FBI had better things to do than go after someone who had made a copy of the membership directory of a medical association. Some of the references in the search warrant were to companies or people I had no knowledge of. Perhaps, I thought, this is all part of a larger investigation and once they realize that all I did was make a copy of a membership directory, then they will drop it.
In any case, after a few minutes, the female agent in charge (an attractive bleach blond with shortish-cropped hair and more piercings than I would expect for an FBI agent) appeared. She asked if I was Bill Bailey which I confirmed. She then asked if I was the owner of dr-411.com, which I also confirmed. Next, she asked if I had ever heard of the American College of Physicians. At this point, I did a very smart thing. I said, "I'm not going to answer any more questions until I talk to my lawyer."
(Note: The American College of Physicians
http://www.acponline.org/ is the largest medical specialty -- internal medicine --organization in the country, second only to the American Medical Association among all medical associations. It is located in Philadelphia which is where the investigation, and therefore, jurisdiction was located.)
Immediately, she got up and left the room and the other female agent stayed and "babysat" me while the search of my home continued. The warrant was a search warrant, not an arrest warrant, so I was not technically being detained, although it felt like it. I later learned that I was actually free to go as I wished at any time but it was clear they preferred I stay there.
The agent who was monitoring me was very pleasant. She said she normally works on the child pornography team but they needed an extra body for this search. I don't recall the whole conversation but I recall mentioning that, based on the search warrant, the facts they were implying didn't seem like that big of a deal. She said that "computer intrusions" were the FBI's 3rd highest priority, after terrorism and child pornography. Hmmm... so what I did was a "computer intrusion?"
I also expressed concern that seizing my computers was going to create a serious hardship for my business and asked how long the FBI would need to keep them. She said that they would turn them around as fast as possible. She even called Matthew Fine (the special agent in Philadelphia in charge of the case) and reported that he said that I would have the computers back within 10 days. Yeah, right.
During this time, they continued to question my wife in the living room. She later said she was very intimidated by the line of questioning and didn't realize that she could have declined to answer at any time. Not that she had any specific knowledge of any crime I might have committed, but they tried to make her feel stupid for not knowing certain things about my business practices.
I asked if I could call my lawyer which they allowed (not that they had any legal right to disallow it). I stepped out into the driveway off the kitchen on the left side of the house. One of the male agents followed me but maintained his distance. I remember commenting to him that the deputy sherrif's car out front for all the neighbors to see as the left for work was a really nice touch.
The only law firm I had a relationship with was
Wishart, Norris, Henninger, and Pittman who handle my business law stuff.... articles of incorporation, annual reports, advice on business structure and asset protection, etc. I called Eric and Gary. It is amazing how quickly a law firm will clear their schedule for an immediate meeing when you tell them the FBI is currently at your house seizing all your stuff. They said they would get back to me right away. Shortly thereafter, they called back having scheduled a conference call with two lawyers at
James, McElroy, and Diehl at I believe 10:30 or 11:00 that morning.
I went back into the house to see what was going on. I couldn't believe all the stuff they were bringing downstairs. The list of all the items seized is on page 2 of the
Search Warrant and Affidavit document, which included 4 or 5 computers as well as my router and cable modem and miscellaneous disks and documents. While I was standing in the kitchen, I saw my cell phone and protested that I needed that for my business. They relented and simply recorded the list of recent calls and let me keep it.
They also were seizing tax and other financial documents which I protested and, as it turns out, they had to return later since they were not items included in the search warrant.
At one point, I had a testy exchange with the apparent spokesman for the group (the same agent who woke me up). I told him I thought the search was getting a little too intrusive. He replied that I was lucky they were not cutting open my walls (!), which I thought was an odd thing to say. I guess he was trying to communicate that I don't know HOW intrusive they can actually be.
I continued to question the breadth and intrusiveness of the search. He said "I thought you said you didn't want to talk" (referring to my earlier statement in declining to answer questions).
I replied that I didn't say I didn't want to talk, but that I didn't want to answer any of their questions. However, I had questions for them. After all, they were in my house, taking my stuff, and I hadn't even been told why.
He replied that I was accused of a crime. I said "What crime? No one has told me about any crime. You just showed up at my house with a search warrant to take my stuff."
He replied that the crime was listed on the search warrant. I said no it wasn't. They retrieved the warrant from the counter. It was only 2 pages and, sure enough, the warrant did not list any statute I was accused of violating. He glanced at the female agent in charge of the search (the one who was responsible for obtaining the warrant) and she simply looked back. At that point, I knew they had screwed up... search warrants are required to list the crime that the search is investigating. And my warrant showed nothing. (You can read it yourself on one of the search warrant links above).
Finally, as they wrapped things up that morning somewhere around 9a I believe. The receipt lists either 7:15 or 9:15, I can't tell... they may have timestamped it when they opened the receipt or when they completed the search.
They asked me to hold a copy of the receipt and took a photo of me, which in hindsight was stupid... I am under no requirement to permit that. In fact, I was under no requirement to even be present. Just another example of how agents use the intimidation of their presence to coerce people into doing things they are not required to do. Since I was not under arrest, they were not required to read me my rights. They can simply question me without telling me that I don't have to talk to them. I knew I didn't have to talk to them (and didn't) but my wife didn't and was traumatized by the whole experience.
As special agent Linda Engstrom (the one in charge of the search warrant) left, she handed me a small sheet of paper with
USC 1030(a)(2) written on it. This is the statute I was accused of violating that she forgot to include on the search warrant. I guess she was hoping this would remedy her oversight.
After they left and I had an opportunity to catch my breath and assess what had just happened, I met my lawyers at their office in preparation for the conference call with the lawyers from James, McElroy and Diehl. Fred Williams and Ed Hinson from JMD would become my primary criminal defense lawyers for the next 9 months until the prosecutor in Philadelphia decided to indict me in April 2006 at which time I needed to retain a lawyer in Philadelphia.
Once I explained the facts of my case, it was clear to them what the criminal violation was although they were not familiar with any case with facts this minor ever being prosecuted.
Basically, federal law says that 1) unauthorized access of a 2) protected computer to 3) obtain information is a misdemeanor. If it is done for 4) commercial advantage, it is a felony.
At a later time, I will go into more detail about the vagaries of this statute and how the breadth of its language gives significant discretion to prosecutors (e.g. it is not clear what constitutes "unauthorized access"). Suffice it to say for now that the PURPOSE of the statute was to protect private information on private networks, not to protect otherwise public information on websites. And, in fact, no case had ever been prosecuted under this statute unless one of two things were true:
1. Damage to computer hardware or deletion of valuable data or programs (this typical scenario is a disgruntled former employee)
2. Theft of private information
In my case, I gained access to the membership directory of the American College of Physicians (ACP) which they had intended to be accessible only by their members. The information in the membership directory is ordinary contact and resume information. Since the directory was accessible by over 120K members, it obviously did not contain private information.
The login mechansim used by the ACP was very trivial making it easy to login to the system using one of the member's logins. I then wrote a program that "harvested" most of the membership information, which I intended to incorporate into the physician list that I sold on my website.
Because this conduct involved
1. Unauthorized access (i.e. using someone else's login)
2. Protected computer (any website is considered a protected computer)
3. Obtaining information (member contact and resume data)
4. Profit motive
I was in felony violation of 1030(a)(2) as read literally.
However, in order to get a sentence beyond probation (the FBI will not prosecute cases that they do not expect to get prison time out of), they have to demonstrate damages.
In my case, no damage was done to the ACP website and they were not harmed economically because they do not not sell the data so I was not competing with them for customers. Indeed it is hard to see how any tangible damage was done.
So, at this point in my converstation with my lawyers, it was clear that my conduct technically violated the law. But it was equally clear that no damage had been done and since they needed to at least achieve a threshold of $5000 in damages to realistically go forward with the case, I felt pretty good.
(For those familiar with
US Sentencing Guidelines, the base offense in my case is 6 pts with 2 pts added for "special skill" however I could earn 2 pts for acceptance of responsibility. This would leave me at 6 pts, which is 0-6 months. In my case, it would virtually be a slam dunk probation sentence.)
Furthermore, I had reason to believe that the FBI may have thought that I had collected MORE than just ordinary contact information. According to
this story on a local TV website (I'll tell that story later):
"The government claims Bailey hacked into the American College of Physicians Web site thousands of times to access records and downloading files with confidential information on doctors."
Ignoring the fact that I did not "hack" into the website "thousands" of times, I don't know about you, but I don't think of name, address, phone, fax, email, medical schools, graduation year, and medical specialties as "confidential information." (It is because of the tabloid nature in which my case was reported in the media that I no longer trust the way crimes are reported in the press... they are always described in the most damning language designed to generate the most negative inferences.)
As a result of this story, however, I thought the govt was accusing me of something more serious, such as accessing financial data. I knew I had not done that (and in fact wouldn't even know HOW to do that, as it is not available to members logging into the website, which is the only access I had). If so, then when the govt examined my computers and realized that I had only obtained member directory information, then maybe they would decide not to pursue the case. (This obviously turned out not to be the case.)
Our initial strategy however was to get the search thrown out and have my computers returned.
The fourth amendment as it applies to computer searches is very awkward. In normal searches, you perform the search and seize the items. In computer searches, you seize the items and then perform the search of the computers for the incriminating data. In other words, the search/seizure steps are reversed for computer searches.
Search warrants typically expire after 10 days. Our claim was that the search warrant only allowed the search for and seizure of the computers. It does not authorize a subsequent search of the computers and in any case that search must be done within the 10 days allowed by the warrant. Othewise, the govt must obtain another warrant describing what is to be searched for on the computers.
However, to implement this strategy, we first had to wait 10 days to see if they completed the search within the terms of the warrant.
I agreed to meet with Fred and Ed on Friday morning to go over my case in more detail.
That afternoon I needed to take steps to get myself back online. First I went to Time Warner Cable to get a new cable modem. How do you explain that you need a new modem because the FBI took your other one??? I simply said that I had temporarily "misplaced" my modem and needed another. She didn't ask questions. Whew!
Then I went to CompUSA and bought the cheapest computer I could find, thinking I just needed something to get me by until my other computers were returned (which didn't occur until the first week of September, some 6-7 weeks later).
I returned home and spent the rest of the evening setting everything up... network connections, installing software, etc. Fortunately, I had all the logins for my various accounts. My business website was hosted offsite and continued to run throughout the day without interruption so basically except for the aggravation and the temporary loss of many of my programs and computer records, I was not dramatically affected business-wise.
At this point in the process, I suspect I was like most white-collar defendants. I was in denial and I was in a fighting mood. It is a MASSIVE psychological adjustment to envision the possibility of prison for conduct I didn't even think was illegal. In some ways, it is like beginning the
5 stages of grief:
1. Denial
2. Anger
3. Bargaining
4. Depression
5. Acceptance
I can clearly identify with each of those stages in my experience and certainly denial and anger covered the first 10-12 months.
On this first day, I couldn't believe this was happening to me (denial) and I couldn't believe someone would be so petty and obtuse as to actually try to destroy my life over this (anger). It seemed to me that a simple phone call would have been sufficient :)
I had so, so much to learn about this process I have labelled "The Rabbit Hole."
Most of this blog has documented the END of my journey -- prison -- which corresponds to the "Acceptance" phase. I haven't documented the earlier stages I went through which in some ways are more bizarre than the prison stage.
I hope -- when I can find time! -- to further document these pre-prison stages. You will be shocked -- as I was -- to find out how the system really works.
