United States District Court, District of Columbia
D. BATES UNITED STATES DISTRICT JUDGE
the Court are three pretrial motions filed by defendant
Thomas Kennedy McCormick: (1) a motion to dismiss for
preindictment delay; (2) a motion to suppress certain of his
statements; and (3) a motion to dismiss counts 3-7 of the
indictment. For the reasons that follow, the Court will deny
each of the three motions.
was an invitation-only online forum that operated from
approximately 2008 to December 2013. Tr. at 34; Indict. [ECF
No. 8] ¶¶ 1, 29. Darkode's primary purpose was to
facilitate the creation, exchange, and sale of computer
malware and exploit kits. Tr. at 34. Darkode members used the
forum to post and discuss completed malware, solicit advice
and recommendations as to unfinished malware, and coordinate
sales of malware to non-members. Id. McCormick,
under the online moniker “Fubar, ” began using
Darkode in, at the latest, 2009, while he was a high-school
student in Cambridge, MA. Id. at 65-66, 84, 89.
Sometime in 2013, McCormick became an
“administrator” of Darkode. Id. at
190-94; Indict. Â¶ 84..
Federal Bureau of Investigation launched a criminal
investigation into Darkode in 2008. Tr. at 35. As part of
that investigation, in early 2010, an undercover FBI agent
used Darkode to purchase malware named “Zeus”
from Fubar. Id. at 38, 40. The Zeus malware was a
“banking trojan” designed to steal banking
credentials from unsuspecting victims. Id. at 75. At
the time of the undercover purchase, the FBI did not know
that Fubar was defendant McCormick. Id. at 38. Soon
after the purchase, FBI agents began investigating the
real-world identity of Fubar. Id. They eventually
identified Fubar as McCormick in January 2011, and continued
to look into his activities thereafter to develop a
“fuller picture of the activities that [he was] engaged
in.” Id. at 38-41, 55.
December 5, 2013, at about 6:15 a.m., FBI agents executed a
search warrant on McCormick's dorm room at the University
of Massachusetts, Amherst, where he was then a student.
Id. at 52, 90. The agents were not authorized to
arrest McCormick. Id. at 61. The warrant authorized
seizure of “any digital electronic device, to include
memory storage and physical computers, and potentially
financial documentation associated with proceeds of the
crime.” Id. at 52. According to the
government, several digital devices were found in
McCormick's room, including a USB drive containing over
30, 000 credit and debit card numbers associated with over 1,
600 separate financial institutions. Indict. ¶ 85.
Subsequent investigation of the compromised accounts revealed
that the financial institutions had reported at least $678,
993 in fraudulent activity relating to those accounts.
Id. ¶ 35.
executing the search warrant also sought to interview
McCormick. After giving McCormick a chance to compose himself
and get dressed following the agents' entry into his dorm
room, Special Agent David Hitchcock asked him if he would be
“interested” in speaking with the agents in their
unmarked FBI car parked outside the dorm. Tr. at 61.
Hitchcock stressed that McCormick “wasn't under
arrest, ” that the interview was “completely
voluntary, ” and that “he could leave at any
point in time.” Id. at 61-62. McCormick agreed
to speak to Hitchcock and the other agents. Id. On
the way to the FBI car, McCormick was allowed to use the
restroom under the supervision of one of the agents.
Id. at 63, 92-93. Once they arrived at the car,
Hitchcock sat in the driver's seat, McCormick sat in the
passenger seat, and another agent sat behind McCormick in the
rear right seat. Id. at 63. The car was a
traditional civilian sedan, with no identifying
law-enforcement marks or plastic barrier between the front
and rear seats. Id. at 63-64. When McCormick and the
agents were situated in the car, the interview commenced.
Id. at 64-65. The agents did not read McCormick any
Miranda warnings. Id. at 61.
the interview, McCormick explained his involvement with
Darkode, going into some detail about his own activity as
well as that of other Darkode members. Id. at 65,
73. McCormick also told the agents that he “wanted to
cooperate” and “help out, ” but was
concerned about “screw[ing] himself.”
Id. at 71, 73-74. At one point, McCormick asked the
agents if he should get an attorney. Id. at 77.
Hitchcock responded that McCormick needed to make that
decision for himself, emphasizing then and again several
other times throughout the interview that McCormick was
“free to stop talking” and could leave at any
time. Id. at 71, 77, 99. McCormick acknowledged that
he understood but remained in the car and continued talking
to the agents. Id. at 77. The interview concluded
after approximately three hours, when McCormick stated that
he would “really like to get back to preparing for
[his] exams.” Id. at 80. At no point in the
interview did the agents handcuff McCormick or restrict his
movement, and when he said that he wanted to leave, he was
allowed to do so. Id. at 78, 80-81.
months later, with the assistance of an attorney, McCormick
began participating in a series of voluntary debriefings with
law enforcement that extended from 2013 to 2018. Id.
at 175. Though a plea agreement was discussed at these
meetings, a plea was never successfully negotiated.
Id. at 197. On December 4, 2018-following the
collapse of the plea negotiations- the government indicted
McCormick and charged him with seven counts: one count of
conspiracy to participate in a racketeering influenced
corrupt organization in violation of 18 U.S.C. §
1962(d), one count of conspiracy to commit bank fraud and
wire fraud in violation of 18 U.S.C. § 1349, and five
counts of aggravated identity theft in violation of 18 U.S.C.
§ 1028A. See Indict. Three others were indicted
along with McCormick, id., but to date are not in
three pre-trial motions followed. The Court held a hearing on
the motions on October 25, 2019.
Motion to Dismiss for Preindictment Delay
first moves to dismiss for preindictment delay. He argues
that the government should have prosecuted him more quickly,
and that its failure to do so prejudiced him by (1) depriving
him of the protections of the Juvenile Delinquency Act
(“JDA”), 18 U.S.C. § 5031, and (2) making it
difficult for him to retrieve evidence as to the events of
2009 through 2013. Mot. to Dismiss for Preindict. Delay [ECF
No. 36] at 6-8. McCormick also argues that any delay in
prosecution was an intentional attempt to gain a tactical
advantage. Id. at 8.
the applicable “statute of limitations is the primary
measuring stick to gauge whether a criminal charge is unduly
stale.” United States v. Bridgeman, 523 F.2d
1099, 1112 (D.C. Cir. 1975). The Supreme Court has
recognized, however, “that if preindictment delay is so
substantial as to prejudice a defendant's right to a fair
trial, the Due Process Clause of the Fifth Amendment may
necessitate dismissal.” United States v.
Mahoney, 698 F.Supp. 344, 346 (D.D.C. 1988) (citing
United States v. Marion, 404 U.S. 307, 324 (1971)).
To prevail on such a claim, a defendant must satisfy
both parts of a two-part test. First, the delay must
have “caused substantial prejudice to [the
defendant's] rights to a fair trial.”
Marion, 404 U.S. at 324. Second, the delay must have
been “an intentional device to gain tactical advantage
over the accused.” Id.
of McCormick's arguments as to prejudice are sufficient
to satisfy the prejudice prong of this test. His first
argument is that the government knew about some of his
illegal conduct when he was under twenty-one, and that by
waiting to indict him until after he was twenty-one,
the government deprived him of the protections of the JDA.
Mot. to Dismiss for Preindict. Delay at 5-6. Under the JDA, a
juvenile court generally has jurisdiction over a defendant
for acts of juvenile delinquency (that is, criminal conduct
occurring before a defendant turns eighteen) until that
defendant turns twenty-one. See 18 U.S.C.
§§ 5031, 5032. McCormick turned eighteen on October
15, 2010, and twenty-one on October 15, 2013. Tr. at 121,
135-36. Thus, he would be entitled to the protections of the
JDA only for prosecutions relating to offense conduct that
occurred before October 15, 2010, and only then
until he turned twenty-one in 2013.
only conduct charged in the original indictment that occurred
before McCormick turned eighteen is his sale of Zeus malware
to an undercover FBI agent. See Indict. ¶¶
80-82. But the indictment alleges that this sale was merely
an early act in what was a lengthy conspiracy that continued
long after McCormick turned eighteen. Courts have unanimously
concluded that prosecutors can charge a defendant with an
adult conspiracy where he or she entered into the conspiracy
as a juvenile but committed further overt acts as an adult.
See, e.g., United States v. Delatorre, 157
F.3d 1205, 1209 (10th Cir. 1998) (“No circuit has
applied the JDA to an adult conspiracy or racketeering
prosecution simply because defendant's participation in
the crimes began prior to his eighteenth birthday.”).
Courts have simply required that there be “some
demonstration of post-eighteen participation in such
crimes.” Id. Here, for each count of the
indictment, the government has alleged overt acts after
McCormick turned eighteen on October 15, 2010, including at
least one act for each subsequent year of the charged
2008-2013 bank fraud and RICO conspiracies. See,
e.g., Indict. ¶ 78 (alleging that McCormick
“advertised for sale on the Darkode Forum malware known
as ngrBot” between February 13, 2011, and July 11,
2011); id. ¶ 83 (alleging that McCormick
“intruded into a website called ziddu.com and