Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. McCormick

United States District Court, District of Columbia

November 25, 2019

UNITED STATES OF AMERICA
v.
THOMAS KENNEDY MCCORMICK, Defendant.

          MEMORANDUM OPINION

          JOHN D. BATES UNITED STATES DISTRICT JUDGE

         Before the Court are three pretrial motions filed by defendant Thomas Kennedy McCormick: (1) a motion to dismiss for preindictment delay; (2) a motion to suppress certain of his statements; and (3) a motion to dismiss counts 3-7 of the indictment. For the reasons that follow, the Court will deny each of the three motions.[1]

         Background

         Darkode was an invitation-only online forum that operated from approximately 2008 to December 2013. Tr. at 34; Indict. [ECF No. 8] ¶¶ 1, 29.[2] Darkode's primary purpose was to facilitate the creation, exchange, and sale of computer malware and exploit kits. Tr. at 34. Darkode members used the forum to post and discuss completed malware, solicit advice and recommendations as to unfinished malware, and coordinate sales of malware to non-members. Id. McCormick, under the online moniker “Fubar, ” began using Darkode in, at the latest, 2009, while he was a high-school student in Cambridge, MA. Id. at 65-66, 84, 89. Sometime in 2013, McCormick became an “administrator” of Darkode. Id. at 190-94; Indict. ¶ 84..

         The Federal Bureau of Investigation launched a criminal investigation into Darkode in 2008. Tr. at 35. As part of that investigation, in early 2010, an undercover FBI agent used Darkode to purchase malware named “Zeus” from Fubar. Id. at 38, 40. The Zeus malware was a “banking trojan” designed to steal banking credentials from unsuspecting victims. Id. at 75. At the time of the undercover purchase, the FBI did not know that Fubar was defendant McCormick. Id. at 38. Soon after the purchase, FBI agents began investigating the real-world identity of Fubar. Id. They eventually identified Fubar as McCormick in January 2011, and continued to look into his activities thereafter to develop a “fuller picture of the activities that [he was] engaged in.” Id. at 38-41, 55.

         On December 5, 2013, at about 6:15 a.m., FBI agents executed a search warrant on McCormick's dorm room at the University of Massachusetts, Amherst, where he was then a student. Id. at 52, 90. The agents were not authorized to arrest McCormick. Id. at 61. The warrant authorized seizure of “any digital electronic device, to include memory storage and physical computers, and potentially financial documentation associated with proceeds of the crime.” Id. at 52. According to the government, several digital devices were found in McCormick's room, including a USB drive containing over 30, 000 credit and debit card numbers associated with over 1, 600 separate financial institutions. Indict. ¶ 85. Subsequent investigation of the compromised accounts revealed that the financial institutions had reported at least $678, 993 in fraudulent activity relating to those accounts. Id. ¶ 35.

         Agents executing the search warrant also sought to interview McCormick. After giving McCormick a chance to compose himself and get dressed following the agents' entry into his dorm room, Special Agent David Hitchcock asked him if he would be “interested” in speaking with the agents in their unmarked FBI car parked outside the dorm. Tr. at 61. Hitchcock stressed that McCormick “wasn't under arrest, ” that the interview was “completely voluntary, ” and that “he could leave at any point in time.” Id. at 61-62. McCormick agreed to speak to Hitchcock and the other agents. Id. On the way to the FBI car, McCormick was allowed to use the restroom under the supervision of one of the agents. Id. at 63, 92-93. Once they arrived at the car, Hitchcock sat in the driver's seat, McCormick sat in the passenger seat, and another agent sat behind McCormick in the rear right seat. Id. at 63. The car was a traditional civilian sedan, with no identifying law-enforcement marks or plastic barrier between the front and rear seats. Id. at 63-64. When McCormick and the agents were situated in the car, the interview commenced. Id. at 64-65. The agents did not read McCormick any Miranda warnings. Id. at 61.

         During the interview, McCormick explained his involvement with Darkode, going into some detail about his own activity as well as that of other Darkode members. Id. at 65, 73. McCormick also told the agents that he “wanted to cooperate” and “help out, ” but was concerned about “screw[ing] himself.” Id. at 71, 73-74. At one point, McCormick asked the agents if he should get an attorney. Id. at 77. Hitchcock responded that McCormick needed to make that decision for himself, emphasizing then and again several other times throughout the interview that McCormick was “free to stop talking” and could leave at any time. Id. at 71, 77, 99. McCormick acknowledged that he understood but remained in the car and continued talking to the agents. Id. at 77. The interview concluded after approximately three hours, when McCormick stated that he would “really like to get back to preparing for [his] exams.” Id. at 80. At no point in the interview did the agents handcuff McCormick or restrict his movement, and when he said that he wanted to leave, he was allowed to do so. Id. at 78, 80-81.

         Several months later, with the assistance of an attorney, McCormick began participating in a series of voluntary debriefings with law enforcement that extended from 2013 to 2018. Id. at 175. Though a plea agreement was discussed at these meetings, a plea was never successfully negotiated. Id. at 197. On December 4, 2018-following the collapse of the plea negotiations- the government indicted McCormick and charged him with seven counts: one count of conspiracy to participate in a racketeering influenced corrupt organization in violation of 18 U.S.C. § 1962(d), one count of conspiracy to commit bank fraud and wire fraud in violation of 18 U.S.C. § 1349, and five counts of aggravated identity theft in violation of 18 U.S.C. § 1028A. See Indict. Three others were indicted along with McCormick, id., but to date are not in this country.

         These three pre-trial motions followed. The Court held a hearing on the motions on October 25, 2019.

         Analysis

         I. Motion to Dismiss for Preindictment Delay

         McCormick first moves to dismiss for preindictment delay. He argues that the government should have prosecuted him more quickly, and that its failure to do so prejudiced him by (1) depriving him of the protections of the Juvenile Delinquency Act (“JDA”), 18 U.S.C. § 5031, and (2) making it difficult for him to retrieve evidence as to the events of 2009 through 2013. Mot. to Dismiss for Preindict. Delay [ECF No. 36] at 6-8. McCormick also argues that any delay in prosecution was an intentional attempt to gain a tactical advantage. Id. at 8.

         Generally, the applicable “statute of limitations is the primary measuring stick to gauge whether a criminal charge is unduly stale.” United States v. Bridgeman, 523 F.2d 1099, 1112 (D.C. Cir. 1975). The Supreme Court has recognized, however, “that if preindictment delay is so substantial as to prejudice a defendant's right to a fair trial, the Due Process Clause of the Fifth Amendment may necessitate dismissal.” United States v. Mahoney, 698 F.Supp. 344, 346 (D.D.C. 1988) (citing United States v. Marion, 404 U.S. 307, 324 (1971)). To prevail on such a claim, a defendant must satisfy both parts of a two-part test. First, the delay must have “caused substantial prejudice to [the defendant's] rights to a fair trial.” Marion, 404 U.S. at 324. Second, the delay must have been “an intentional device to gain tactical advantage over the accused.” Id.

         Neither of McCormick's arguments as to prejudice are sufficient to satisfy the prejudice prong of this test. His first argument is that the government knew about some of his illegal conduct when he was under twenty-one, and that by waiting to indict him until after he was twenty-one, the government deprived him of the protections of the JDA. Mot. to Dismiss for Preindict. Delay at 5-6. Under the JDA, a juvenile court generally has jurisdiction over a defendant for acts of juvenile delinquency (that is, criminal conduct occurring before a defendant turns eighteen) until that defendant turns twenty-one. See 18 U.S.C. §§ 5031, 5032. McCormick turned eighteen on October 15, 2010, and twenty-one on October 15, 2013. Tr. at 121, 135-36. Thus, he would be entitled to the protections of the JDA only for prosecutions relating to offense conduct that occurred before October 15, 2010, and only then until he turned twenty-one in 2013.

         The only conduct charged in the original indictment that occurred before McCormick turned eighteen is his sale of Zeus malware to an undercover FBI agent. See Indict. ¶¶ 80-82. But the indictment alleges that this sale was merely an early act in what was a lengthy conspiracy that continued long after McCormick turned eighteen. Courts have unanimously concluded that prosecutors can charge a defendant with an adult conspiracy where he or she entered into the conspiracy as a juvenile but committed further overt acts as an adult. See, e.g., United States v. Delatorre, 157 F.3d 1205, 1209 (10th Cir. 1998) (“No circuit has applied the JDA to an adult conspiracy or racketeering prosecution simply because defendant's participation in the crimes began prior to his eighteenth birthday.”). Courts have simply required that there be “some demonstration of post-eighteen participation in such crimes.” Id. Here, for each count of the indictment, the government has alleged overt acts after McCormick turned eighteen on October 15, 2010, including at least one act for each subsequent year of the charged 2008-2013 bank fraud and RICO conspiracies. See, e.g., Indict. ¶ 78 (alleging that McCormick “advertised for sale on the Darkode Forum malware known as ngrBot” between February 13, 2011, and July 11, 2011); id. ¶ 83 (alleging that McCormick “intruded into a website called ziddu.com and ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.