U.S. v. Segal

cyber security case reporter

UNITED STATES of America
v.
Michael SEGAL, Daniel Watkins, and Near North Insurance Brokerage, Inc.
No. 02 CR 112.
United States District Court, N.D. Illinois, Eastern Division.
January 20, 2004.

MEMORANDUM OPINION AND ORDER

        Near North Insurance Brokerage, Inc. ("Near North") and Segal seek an evidentiary hearing to determine whether five cooperating witnesses were government agents who violated their Fourth Amendment rights. Three of these cooperating witnesses, Matt Walsh, Dana Berry and Tim Gallagher, provided the Government with information they received from David Cheley, a former Near North employee who hacked into Near North's computer network.1 Tom McNichols and David Watkins, two more cooperating witnesses, provided the Government with documents that they personally obtained from Near North's office. For the reasons provided below, we deny Near North and Segal's motion for an evidentiary hearing. (R. 166-1.)

RELEVANT FACTS2

        I. David Cheley's Contacts with Matt Walsh, Dana Berry and Tim Gallagher

        David Cheley first contacted Matt Walsh via email on September 21, 2001. (R. 168, Defs.' App., Tab 5, email.) Following this email, Walsh and Cheley spoke on the phone for thirteen minutes. (Id., Tab 8, phone record.) Five days later, Walsh gave Cheley phone numbers for Dana Berry and Tim Gallagher as well as Berry's office fax number. (Id., Tab 9, email.) On October 1, 2001, Walsh received an anonymous email from "Lisa Chen," which he responded to with a request that the email be resent "with the original larger file." (Id., Tab 13, email.) In or about March 2002, Berry received an anonymous email from "Lisa Fisher," which he responded to with a request not to receive any more emails. (Id., Tab 22, Barry Aff. ¶¶ 5, 8.) Berry stated that he only received one anonymous email, but Defendants assert that he received a second anonymous email on February 28, 2002. (R. 188, Defs.' Reply, Tab 33, Cheley screenshot.)

        II. Government's Knowledge of David Cheley

        Joshua Buchman, former outside counsel to Near North, stated in an affidavit that an FBI agent "recalled an occasion in the fall of 2001 when a cooperating witness ... had received an unsolicited e-mail communication from an unidentified sender that appeared to have originated from Near North's email system."3 (R. 146, Defs.' Mot, Ex. A, Buchman Aff. ¶ 8.) In the same affidavit, Buchman also stated that: (1) "the FBI and the cooperating witness decided to send a responsive e-mail that instructed the sender of the confidential email to `cease and desist;'" (2) an FBI agent told him "at the time they learned of these email interceptions in the fall of 2001 and the spring of 2002, it did not occur to [him] that the emails sent to Walsh and Berry were obtained through illegal activity, such as computer hacking;" and (3) the FBI agent did not make "any statement that indicated the government possessed information that emails sent to Walsh and Berry may have been obtained through computer hacking performed by David Cheley." (Id. ¶¶ 11, 15, 16.)

        A January 14, 2002, notation made by an FBI agent, states that Cheley was sending anonymous emails to the three cooperating witnesses including an email stating that Near North was "out of trust," (R. 168, Defs.' App., Tab 12, FBI notes), and a September 19, 2002, notation made by an FBI agent states that Walsh "had met w/[Cheley] once re," (id., Tab 10, FBI notes).

        III. Tom McNichols and Daniel Watkins

        Tom McNichols is Near North's former Chief Financial Officer who began cooperating with the Government in October 2001 before he left Near North. On October 25, 2001, an FBI report indicates that McNichols gave the Government a document titled "Near North Insurance Brokerage, Petty Cash Reimbursement-2001." (Id. Tab 31, FBI 302 Report.) Daniel Watkins, a co-Defendant and Near North accountant, began cooperating with the Government on November 24, 2001. On December 4, 2001, an FBI agent recorded a conversation with Watkins during which Watkins gave McNichols Near North petty cash receipts for July (year unstated). (R. 180, Defs.' Mem. at 3-4.) During this conversation the FBI agent stated that he would like Watkins to retrieve petty cash receipts for as many months as he could. Id.

LEGAL STANDARDS

        The decision to hold an evidentiary hearing is left to this Court's discretion. See Torres, 191 F.3d at 811. We will grant an evidentiary hearing if a defendant provides "definite, specific, detailed, and non-conjectural" facts that demonstrate a disputed issue of material fact. Id. When determining whether a private party acted as a government agent, this Court considers: (1) whether the Government knew of and acquiesced in the intrusive conduct; (2) whether the private party's purpose in conducting the search was to assist law enforcement; and (3) whether the Government requested the action or offered the private actor a reward. United States v. Crowley, 285 F.3d 553, 558 (7th Cir.2002). A private search can be converted into a governmental search "only where there is some exercise of governmental power over the private entity, such that the private entity may be said to have acted on behalf of the government rather than for its own, private purposes." United States v. Shahid, 117 F.3d 322, 325 (7th Cir.1997) (citing United States v. Koenig, 856 F.2d 843 (7th Cir.1988)) (internal quotations omitted). Thus, "[a] private party cannot be deemed a government agent unless it was induced to act by some government action." Id. at 325-26. Finally, a government agent only violates the Fourth Amendment when he invades a defendant's subjective expectation of privacy that society is prepared to recognize as legitimate and objectively reasonable. Oliver v. United States, 466 U.S. 170, 177, 104 S.Ct. 1735, 80 L.Ed.2d 214 (1984).

ANALYSIS

        I. Matt Walsh, Dana Berry and Tim Gallagher

        In order to determine whether an evidentiary hearing is warranted regarding whether Walsh, Berry and Gallagher, acted as government agents when they obtained information from Cheley, this Court considers the "definite, specific, detailed, and nonconjectural" facts submitted by Defendants that demonstrate a disputed issue of material fact. Torres, 191 F.3d at 811. As a preliminary matter, we note that Defendants have provided no evidence that Gallagher obtained any information directly from Cheley; thus our analysis focuses on Walsh and Berry.

        The first consideration is whether the Government knew of and acquiesced to the receipt and solicitation of hacked information by the cooperating witnesses. The evidence presented to this Court indicates that the Government knew of Cheley's activities as early as January 14, 2002. On this date, an FBI agent noted that Cheley was sending hacked information to the cooperating witnesses. The FBI agent who took these notes was apparently unfamiliar with Cheley; he did not know how to spell Cheley's name and punctuated his notes with two question marks. Defendants assert that the Government was aware of Cheley's activities in the fall of 2001, yet they have provided this Court with no evidence that supports their assertion. They rely heavily on an affidavit by Joshua Buchman, former outside counsel for Near North, in which Buchman stated that the Government represented that it was aware in the fall of 2001 that the cooperating witnesses were receiving anonymous emails. Buchman, however, also stated that the Government did not represent that it was aware that Cheley was the source of these emails.

        The second consideration is whether the Government requested the private party's assistance or induced it by offering a reward. Defendants have offered no facts demonstrating that the Government requested that the cooperating witnesses obtain the hacked information from Cheley. To the contrary, Defendants provided this Court with Buchman's affidavit in which he stated that the Government represented that they asked a cooperating witness to send a "cease and desist" email to whomever was sending the anonymous emails. Defendants assert that instead of directly requesting assistance, the Government induced the cooperating witnesses to obtain information from Cheley by providing them with "extraordinary" treatment. The alleged "extraordinary" treatment boils down to the following five facts: (1) the Government has maintained a hostile attitude toward Near North's civil suit against the cooperating witnesses; (2) the Government provided them with advance notice of the Government's investigation; (3) the Government apparently provided their lawyer with an unsigned copy of the first superseding indictment the same day it was entered on the Court's docket; (4) the Government has not charged Cheley or the cooperating witnesses with any crime related to Cheley's hacking; and (5) the Government apparently provided the cooperating witnesses with immunity from prosecution. These facts, however, are either speculative — Defendants acknowledge that two of the facts may not even be true — or quite ordinary, especially when considering, as Defendants concede, that the Government has a legitimate interest in protecting cooperating witnesses. Thus, this consideration indicates that the cooperating witnesses were not acting as government agents.

        The third consideration is the cooperating witnesses' motivation. In our earlier opinion we explained that Segal's arguments were inconsistent because he was arguing on the one hand that the cooperating witnesses were motivated by an improper business-related motive and on the other hand that they were motivated to assist the Government. Defendants now assert that these motives are consistent because "the more the cooperating witnesses helped the government bury Segal and Near North, the more the witnesses stood to gain financially." The crux of this argument, nonetheless, is that the cooperating witnesses were personally motivated to obtain information from Cheley. See Shahid, 117 F.3d at 326 ("A private citizen might decide to aid in the control and prevention of criminal activity out of his or her own moral conviction, concern for his or her employer's public image or profitability, or even desire to incarcerate criminals, but even if such private purpose should happen to coincide with the purposes of the government, `this happy coincidence does not make a private actor an arm of the government.'") Thus, this consideration indicates that the cooperating witnesses were not government agents.

        After considering all of these facts,4 we find that Defendants are not entitled to an evidentiary hearing to determine whether these cooperating witnesses were government agents. At the most, they have presented evidence demonstrating that in the fall of 2001 Walsh took affirmative steps to obtain information from Cheley and that in January 2002 the Government was aware that Cheley was the source of the anonymous emails. These facts fall far short of establishing that these cooperating witnesses were government agents.

        II. Tom McNichols and David Watkins

        We next consider whether an evidentiary hearing is warranted regarding McNichols and Watkins. Defendants claim that these cooperating witnesses violated their Fourth Amendment rights when they provided documents to the Government. The general rule is that "what employees 'observe in their daily functions is undoubtedly beyond the employer's reasonable expectation of privacy,' and thus if disclosed by an employee, is beyond the protection of the Fourth Amendment." United States v. Miller, 800 F.2d 129, 134 (7th Cir.1986) (quoting Marshall v. Barlow's Inc., 436 U.S. 307, 315, 98 S.Ct. 1816, 56 L.Ed.2d 305 (1978)); United States v. Ziperstein, 601 F.2d 281, 289 (7th Cir. 1979).

        Defendants allege that McNichols, at the Government's request, initiated a conversation with Watkins in order to obtain a document titled "Near North Insurance Brokerage, Petty Cash Reimbursement-2001" that was unrelated to his job duties. The Government counters that McNichols obtained this document as a direct result of his job duties, specifically as part of an internal investigation he was conducting into potential petty cash misuse at Near North. Neither side has supported its assertions with any concrete evidence. It is noteworthy that Defendants possess a transcript of the conversation in which McNichols obtains this document from Watkins but declined to provide this Court with any portion of that conversation. If McNichols was truly searching for information that was outside the scope of his job duties, this conversation should contain some evidence that he was acting inappropriately. It is Defendants' burden to present competent evidence demonstrating that there is a disputed issue of material fact. They have failed to meet their burden, so an evidentiary hearing is not warranted.

        Defendants also assert that the Watkins violated the Fourth Amendment when he turned over petty cash receipts to the Government. Defendants have presented compelling evidence that Watkins provided these receipts to the Government at their request. They concede, however, that Watkins had access to the seized records in the course of his job duties and argue instead that Watkins lacked actual or apparent authority to disclose the receipts to third parties. Defendants assert that the Government was aware, or at least should have been aware, that Watkins was only authorized to disclose the receipts to Near North's outside accountants. We disagree and find that Watkins did not invade Defendants' constitutionally reasonable expectation of privacy when he provided the petty cash receipts to the Government.

        When Defendants gave Watkins access to these documents, they assumed the risk that he would provide them to third parties. See United States v. Basinski, 226 F.3d 829, 834 (7th Cir.2000); see also United States v. Matlock, 415 U.S. 164, 171 n. 7, 94 S.Ct. 988, 39 L.Ed.2d 242 (1974) (stating that third-party consent depends on whether the third-party had "the right to permit the inspection in his own right and that the others have assumed the risk that one of their number might permit the common area to be searched"). An employer can minimize this risk by limiting an employee's actual authority, but an employer cannot completely insulate himself from the risk that an employee will disclose information to the Government during an investigation. See Miller, 800 F.2d at 135 (declining to recognize an employer's express instruction that an employee hide documents from the authorities). A general instruction not to provide documents to third parties may prevent a court from finding that an employer assumed the risk that the employee would provide the documents to a competitor or to the media, but it does not eliminate the risk that an employee will provide information to the Government if he suspects wrongdoing. See 3 LaFave, Wayne R., Search and Seizure § 8.3(c) (3d ed. 1996) ("If it may be said that certain risks are assumed when there is joint use of or access to certain property because of a familial or real property relationship, then it may also be said that an employer runs some necessary risks that his employees will permit a search — even if such permission is not strictly within their authority as an agent of the employer."). Accordingly, Defendants' expectation that Watkins would not provide any documents to the Government was not reasonable.

CONCLUSION

        For the reasons provided above, Near North and Segal's renewed motion for an evidentiary hearing is denied in its entirety. (R. 166-1.)
---------------
Notes:

1. On August 7, 2003, this Court denied Segal's request for an evidentiary hearing to determine whether these cooperating witnesses were government agents. We did, however, permit him to renew the motion if he "outlines specific evidence that he seeks to suppress and the legal and factual grounds upon which he relied." (R. 123, Aug. 7, 2003 Order.)

2. As Defendants are seeking an evidentiary hearing, this section is limited to the "definite, specific, detailed, and nonconjectural" facts presented by Defendants that demonstrate a disputed issue of material fact. United States v. Torres, 191 F.3d 799, 811 (7th Cir.1999). Defendants' briefs include many speculative facts and unsworn allegations, but we have not included these facts in this section in order to properly determine whether an evidentiary hearing is warranted.

3. Both Walsh and Berry acknowledge that they forwarded anonymous emails to the FBI. For example, on February 8, 2002, Walsh forwarded an email to an FBI agent stating "[a]s noted in the past, from time to time I receive these anonymously." (R. 188, Defs.' Reply, Tab 20, email), and in March 2002 Berry forwarded a redacted version of an anonymous email to the FBI, (Id., Tab 22, Barry Aff. ¶¶ 5, 8).

4. Indeed, we note that instead of providing concrete facts, Defendants present a complicated and convoluted "wink-and-a-nudge" theory that is based on poor Government record-keeping. Defendants assert that the Government's failure to memorialize certain conversations and events warrants an evidentiary hearing to determine what the Government knew about Cheley. We agree that the Government's investigation, particularly its communications with the cooperating witnesses, have not been well-documented. This Court, as well as Defendants, would prefer to have a complete record of the Government's investigation, but the Government is under no legal duty to document every phone call and conversation. In hindsight, it is apparent that the Government should have been more thorough and definitely should have pro-actively counseled its cooperating witnesses not to obtain or receive information from Cheley. Yet the Government's shortcomings in this regard do not justify an evidentiary hearing.

State
Case Type
Case Division