United States v. McCormick

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA
v. Crim. No. 18-0359 (JDB)
THOMAS KENNEDY MCCORMICK,

Defendant.

MEMORANDUM OPINION

Before the Court are three pretrial motions filed by defendant Thomas Kennedy

McCormick: (1) a motion to dismiss for preindictment delay; (2) a motion to suppress certain of

his statements; and (3) a motion to dismiss counts 3–7 of the indictment. For the reasons that

follow, the Court will deny each of the three motions. 1

Background

Darkode was an invitation-only online forum that operated from approximately 2008 to

December 2013. Tr. at 34; Indict. [ECF No. 8] ¶¶ 1, 29. 2 Darkode’s primary purpose was to

facilitate the creation, exchange, and sale of computer malware and exploit kits. Tr. at 34. Darkode

members used the forum to post and discuss completed malware, solicit advice and

recommendations as to unfinished malware, and coordinate sales of malware to non-members. Id.

McCormick, under the online moniker “Fubar,” began using Darkode in, at the latest, 2009, while

he was a high-school student in Cambridge, MA. Id. at 65–66, 84, 89. Sometime in 2013,

McCormick became an “administrator” of Darkode. Id. at 190–94; Indict. ¶ 84.

1
McCormick has also filed a motion to compel discovery. See Mot. to Compel Discovery [ECF No. 34].
The Court will continue to monitor discovery proceedings but does not think it necessary to rule on the motion at this
time. The parties are directed to submit a joint status update as to any remaining discovery issues by not later than
December 6, 2019.
2
All citations to “Tr.” refer to the official transcript from the evidentiary hearing held on October 25, 2019.
See Transcript of Proceedings [ECF No. 86].

1
 The Federal Bureau of Investigation launched a criminal investigation into Darkode in

2008. Tr. at 35. As part of that investigation, in early 2010, an undercover FBI agent used Darkode

to purchase malware named “Zeus” from Fubar. Id. at 38, 40. The Zeus malware was a “banking

trojan” designed to steal banking credentials from unsuspecting victims. Id. at 75. At the time of

the undercover purchase, the FBI did not know that Fubar was defendant McCormick. Id. at 38.

Soon after the purchase, FBI agents began investigating the real-world identity of Fubar. Id. They

eventually identified Fubar as McCormick in January 2011, and continued to look into his

activities thereafter to develop a “fuller picture of the activities that [he was] engaged in.” Id. at

38–41, 55.

On December 5, 2013, at about 6:15 a.m., FBI agents executed a search warrant on

McCormick’s dorm room at the University of Massachusetts, Amherst, where he was then a

student. Id. at 52, 90. The agents were not authorized to arrest McCormick. Id. at 61. The warrant

authorized seizure of “any digital electronic device, to include memory storage and physical

computers, and potentially financial documentation associated with proceeds of the crime.” Id. at

52. According to the government, several digital devices were found in McCormick’s room,

including a USB drive containing over 30,000 credit and debit card numbers associated with over

1,600 separate financial institutions. Indict. ¶ 85. Subsequent investigation of the compromised

accounts revealed that the financial institutions had reported at least $678,993 in fraudulent activity

relating to those accounts. Id. ¶ 35.

Agents executing the search warrant also sought to interview McCormick. After giving

McCormick a chance to compose himself and get dressed following the agents’ entry into his dorm

room, Special Agent David Hitchcock asked him if he would be “interested” in speaking with the

agents in their unmarked FBI car parked outside the dorm. Tr. at 61. Hitchcock stressed that

2
McCormick “wasn’t under arrest,” that the interview was “completely voluntary,” and that “he

could leave at any point in time.” Id. at 61–62. McCormick agreed to speak to Hitchcock and the

other agents. Id. On the way to the FBI car, McCormick was allowed to use the restroom under

the supervision of one of the agents. Id. at 63, 92–93. Once they arrived at the car, Hitchcock sat

in the driver’s seat, McCormick sat in the passenger seat, and another agent sat behind McCormick

in the rear right seat. Id. at 63. The car was a traditional civilian sedan, with no identifying law-

enforcement marks or plastic barrier between the front and rear seats. Id. at 63–64. When

McCormick and the agents were situated in the car, the interview commenced. Id. at 64–65. The

agents did not read McCormick any Miranda warnings. Id. at 61.

During the interview, McCormick explained his involvement with Darkode, going into

some detail about his own activity as well as that of other Darkode members. Id. at 65, 73.

McCormick also told the agents that he “wanted to cooperate” and “help out,” but was concerned

about “screw[ing] himself.” Id. at 71, 73–74. At one point, McCormick asked the agents if he

should get an attorney. Id. at 77. Hitchcock responded that McCormick needed to make that

decision for himself, emphasizing then and again several other times throughout the interview that

McCormick was “free to stop talking” and could leave at any time. Id. at 71, 77, 99. McCormick

acknowledged that he understood but remained in the car and continued talking to the agents. Id.

at 77. The interview concluded after approximately three hours, when McCormick stated that he

would “really like to get back to preparing for [his] exams.” Id. at 80. At no point in the interview

did the agents handcuff McCormick or restrict his movement, and when he said that he wanted to

leave, he was allowed to do so. Id. at 78, 80–81.

Several months later, with the assistance of an attorney, McCormick began participating in

a series of voluntary debriefings with law enforcement that extended from 2013 to 2018. Id. at

3
175. Though a plea agreement was discussed at these meetings, a plea was never successfully

negotiated. Id. at 197. On December 4, 2018—following the collapse of the plea negotiations—

the government indicted McCormick and charged him with seven counts: one count of conspiracy

to participate in a racketeering influenced corrupt organization in violation of 18 U.S.C. § 1962(d),

one count of conspiracy to commit bank fraud and wire fraud in violation of 18 U.S.C. § 1349,

and five counts of aggravated identity theft in violation of 18 U.S.C. § 1028A. See Indict. Three

others were indicted along with McCormick, id., but to date are not in this country.

These three pre-trial motions followed. The Court held a hearing on the motions on

October 25, 2019.

Analysis

I. Motion to Dismiss for Preindictment Delay

McCormick first moves to dismiss for preindictment delay. He argues that the government

should have prosecuted him more quickly, and that its failure to do so prejudiced him by (1)

depriving him of the protections of the Juvenile Delinquency Act (“JDA”), 18 U.S.C. § 5031, and

(2) making it difficult for him to retrieve evidence as to the events of 2009 through 2013. Mot. to

Dismiss for Preindict. Delay [ECF No. 36] at 6–8. McCormick also argues that any delay in

prosecution was an intentional attempt to gain a tactical advantage. Id. at 8.

Generally, the applicable “statute of limitations is the primary measuring stick to gauge

whether a criminal charge is unduly stale.” United States v. Bridgeman, 523 F.2d 1099, 1112

(D.C. Cir. 1975). The Supreme Court has recognized, however, “that if preindictment delay is so

substantial as to prejudice a defendant’s right to a fair trial, the Due Process Clause of the Fifth

Amendment may necessitate dismissal.” United States v. Mahoney, 698 F. Supp. 344, 346 (D.D.C.

1988) (citing United States v. Marion, 404 U.S. 307, 324 (1971)). To prevail on such a claim, a

4
defendant must satisfy both parts of a two-part test. First, the delay must have “caused substantial

prejudice to [the defendant’s] rights to a fair trial.” Marion, 404 U.S. at 324. Second, the delay

must have been “an intentional device to gain tactical advantage over the accused.” Id.

Neither of McCormick’s arguments as to prejudice are sufficient to satisfy the prejudice

prong of this test. His first argument is that the government knew about some of his illegal conduct

when he was under twenty-one, and that by waiting to indict him until after he was twenty-one,

the government deprived him of the protections of the JDA. Mot. to Dismiss for Preindict. Delay

at 5–6. Under the JDA, a juvenile court generally has jurisdiction over a defendant for acts of

juvenile delinquency (that is, criminal conduct occurring before a defendant turns eighteen) until

that defendant turns twenty-one. See 18 U.S.C. §§ 5031, 5032. McCormick turned eighteen on

October 15, 2010, and twenty-one on October 15, 2013. Tr. at 121, 135–36. Thus, he would be

entitled to the protections of the JDA only for prosecutions relating to offense conduct that

occurred before October 15, 2010, and only then until he turned twenty-one in 2013.

The only conduct charged in the original indictment that occurred before McCormick

turned eighteen is his sale of Zeus malware to an undercover FBI agent. See Indict. ¶¶ 80–82. But

the indictment alleges that this sale was merely an early act in what was a lengthy conspiracy that

continued long after McCormick turned eighteen. Courts have unanimously concluded that

prosecutors can charge a defendant with an adult conspiracy where he or she entered into the

conspiracy as a juvenile but committed further overt acts as an adult. See, e.g., United States v.

Delatorre, 157 F.3d 1205, 1209 (10th Cir. 1998) (“No circuit has applied the JDA to an adult

conspiracy or racketeering prosecution simply because defendant’s participation in the crimes

began prior to his eighteenth birthday.”). Courts have simply required that there be “some

demonstration of post-eighteen participation in such crimes.” Id. Here, for each count of the

5
indictment, the government has alleged overt acts after McCormick turned eighteen on October

15, 2010, including at least one act for each subsequent year of the charged 2008–2013 bank fraud

and RICO conspiracies. See, e.g., Indict. ¶ 78 (alleging that McCormick “advertised for sale on

the Darkode Forum malware known as ngrBot” between February 13, 2011, and July 11, 2011);

id. ¶ 83 (alleging that McCormick “intruded into a website called ziddu.com and discovered

vulnerabilities which allowed [him] to steal 4.8 million user email addresses and passwords” in

August 2012); id. ¶ 85 (alleging that McCormick possessed devices with stolen banking credentials

on December 5, 2013). Therefore, because none of the counts of this indictment charge

McCormick solely with pre-eighteen conduct, the JDA is inapplicable. 3

Moreover, the government has already agreed to strike the sale of the Zeus malware from

the indictment. See Order of September 9, 2019 [ECF No. 71] at 1. As a result, the indictment,

as it currently stands, does not even charge McCormick for his pre-eighteen involvement in the

conspiracies, making it still clearer that he is not and was not entitled to the protections of the JDA.

McCormick’s second argument is that the delay in prosecution resulted in unfair prejudice

because his memories of the events in question have faded and he was not able to “secure and

preserve” certain chat logs from the Darkode forum that may have been exculpatory. Mot. to

Dismiss for Preindict. Delay at 7. The problem with this argument is that both the D.C. Circuit

and the Supreme Court have unambiguously rejected allegations of prejudice resulting from “a

general dimming of memories and loss of evidence.” Bridgeman, 523 F.2d at 1112; see Marion,

404 U.S. at 325–26 (noting that the possibility that “memories will dim, witnesses [will] become

3
Nor does United States v. Hoo, 825 F.2d 667 (2d Cir. 1987), a case that McCormick repeatedly cites, help
him. The Hoo court explicitly stated that it “believe[s] that the due process clause does not require that decisions to
prosecute be subjected to pre-indictment judicial inquiry simply because the timing of the decision affects the
availability of juvenile procedures.” Id. at 671. The court also stated that “a rule . . . requiring in essence that
prosecutors bring charges against twenty-year-olds as soon as they are able to do so [] would ‘pressure prosecutors
into resolving doubtful cases in favor of early—and possibly unwarranted—prosecutions.’” Id. (quoting United States
v. Lovasco, 431 U.S. 783, 793 (1977)).

6
inaccessible, and evidence [will] be lost” is not in itself “enough to demonstrate that [defendant]

cannot receive a fair trial”). The “primary guarantee against . . . overly stale charges” is the

applicable statute of limitations, not the Fifth Amendment, and McCormick concedes that the

charges here were properly brought within the limitations period. See Mot. to Dismiss for

Preindict. Delay at 2. Ultimately, McCormick offers nothing more than an argument that the

delay “has unnecessarily increased the difficulty of mounting a defense in this case.” Mahoney,

698 F. Supp. at 346. Bridgeman and Marion preclude that argument.

Because both of McCormick’s contentions of prejudice fail to satisfy the first Marion

prong, the Court has no need to address whether any delay here was an “intentional device to gain

tactical advantage” under the second Marion prong. Marion, 404 U.S. at 324. The Court therefore

will deny McCormick’s motion to dismiss for preindictment delay.

II. Motion to Suppress

McCormick next moves to suppress all the statements he made during his interview with

FBI agents on December 5, 2013. Mot. to Suppress [ECF No. 35] at 1. In his view, this interview

was a custodial interrogation, and because he was never given Miranda warnings, any statements

he made are inadmissible under the Fifth Amendment. Id. at 2–3.

In order to use statements obtained during a “custodial interrogation” of a defendant, the

government must first give the defendant Miranda warnings. See United States v. Burden, 934

F.3d 675, 693 (D.C. Cir. 2019). It is undisputed that McCormick was not given Miranda warnings

before the statements at issue here were made. Tr. at 61. Accordingly, the question before the

Court is whether McCormick’s statements were given during a custodial interrogation.

A defendant is “in custody” for purposes of Miranda when a reasonable person in the

defendant’s position would have “felt he or she was not at liberty to terminate the interrogation

7
and leave.” Thompson v. Keohane, 516 U.S. 99, 112 (1995). The inquiry as to whether a

defendant was in custody is an objective one that must take into account all of the circumstances

of the interrogation. See Burden, 934 F.3d at 694. “Relevant factors include the location of the

questioning, its duration, statements made during the interview, the presence or absence of

physical restraints during the questioning, and the release of the interviewee at the end of the

questioning.” Howes v. Fields, 565 U.S. 499, 509 (2012) (internal citations omitted).

Here, a reasonable person in McCormick’s position would have understood that he was not

subject to “a formal arrest or restraint on freedom of movement of the degree associated with a

formal arrest,” Stansbury v. California, 511 U.S. 318, 322 (1994) (internal quotation marks

omitted), and would have felt free to terminate the interview and leave. A number of facts support

this conclusion. First, when FBI agents began talking to McCormick on the morning of December

5, 2013, they informed him that they were there to execute a search warrant, that they did not have

an arrest warrant, that an interview was not part of the search warrant, that speaking to the agents

was voluntary, and that he was free to leave at any time. Tr. at 61–62. McCormick stated that he

understood. Id. Over the course of the interview, the agents repeatedly reminded McCormick that

the interview was voluntary and that he was free to leave. Id. at 71, 79. Each time, McCormick

indicated that he understood that he was not under arrest, and that he wanted to cooperate with the

agents, so long as he didn’t “screw” himself. Id. at 71, 74, 79. McCormick thus had several

opportunities, from the very beginning of his encounter with the FBI agents, to simply decline to

be interviewed. Cf. United States v. Robinson, 256 F. Supp. 3d 15, 25 (D.D.C. 2017) (finding no

“custodial interrogation” based, in part, on the fact that the defendant could have declined to be

interviewed).

8
 Second, McCormick was not handcuffed or restrained at any point in the interview, nor

was he deprived of food or water or of the ability to use the restroom. Tr. at 63, 72, 78, 81.

Third, while the interview did take place in an unmarked FBI car, the car was parked in a

familiar location (McCormick’s campus), and given the cold weather in Massachusetts in

December, it is not surprising that the interview was conducted in the heated car rather than

outside. Id. at 61, 90, 94; cf. United States v. Ford, 401 F. App’x 852, 855–56 (4th Cir. 2010)

(concluding that interview in police vehicle had not been “custodial interrogation” because, in part,

conditions outside of the vehicle were not ideal for conducting interview). McCormick cites two

cases in an attempt to demonstrate that interviews in police cars are per se custodial interrogations.

See Figg v. Shroeder, 312 F.3d 625, 632 (4th Cir. 2002); United States v. Richardson, 949 F.2d

851, 856 (6th Cir. 1991). But even setting aside the fact that those cases addressed whether a

defendant has been seized under the Fourth Amendment, rather than whether he or she has been

subjected to a custodial interrogation (as is the relevant question here), in those cases officers told

the defendants that they were not free to leave; here, the agents repeatedly told McCormick that

he was free to leave. Cf. United States v. Dates, 752 F. App’x 570, 577–78 (10th Cir. 2018)

(concluding that a reasonable person, “after having entered a [police] vehicle of his own free will

to talk to federal agents, would understand that he was similarly free to terminate the conversation

and go about his day”).

Fourth, during the interview, McCormick informed the agents that he had an exam that

afternoon that he needed to prepare for. Tr. at 80. The agents kept McCormick apprised of the

time throughout the interview, and when McCormick stated that he needed to leave to study, the

agents allowed him to leave. Id. McCormick thus did in fact feel free to “terminate the

interrogation and leave,” Thompson, 516 U.S. at 112, since he did just that.

9
 For these reasons, the interview on December 5, 2013, was not a “custodial interrogation.”

Hence, the government’s failure to give McCormick Miranda warnings is not a basis to suppress

his statements. The Court will deny his motion to suppress.

III. Motion to Dismiss Counts 3–7

Finally, McCormick moves to dismiss counts 3–7 of the indictment, which are five separate

counts of aggravated identity theft under 18 U.S.C. § 1028A. These counts are based on

McCormick’s December 5, 2013 possession of expired credit-card numbers and associated

identification information of five District of Columbia residents. Indict. ¶¶ 93–94. McCormick

asserts that the relevant statutory scheme includes a requirement that credit-card numbers be

“usable,” and that because the cards here were expired, the government cannot satisfy this

requirement. Mot. to Dismiss Counts 3–7 [ECF No. 69] at 3.

The aggravated identity theft statute provides that “[w]hoever, during and in relation to any

felony violation enumerated in subsection (c),[4] knowingly transfers, possesses, or uses, without

lawful authority, a means of identification of another person shall, in addition to the punishment

provided for such felony, be sentenced to a term of imprisonment of 2 years.” 18

U.S.C. § 1028A(a)(1). A “means of identification” is defined, as relevant here, as “any name or

number that may be used, alone or in conjunction with any other information, to identify a specific

individual, including any . . . (D) telecommunication identifying information or access device.”

Id. § 1028(d)(7). And an “access device” is defined as

any card, plate, code, account number, electronic serial number, mobile
identification number, personal identification number, or other telecommunications
service, equipment, or instrument identifier, or other means of account access that
can be used, alone or in conjunction with another access device, to obtain money,

4
McCormick does not dispute that the RICO and bank fraud conspiracies charged in counts 1 and 2 of his
indictment fall under subsection (c).

10
 goods, services, or any other thing of value, or that can be used to initiate a transfer
of funds (other than a transfer originated solely by paper instrument).
Id. § 1029(e)(1). Also relevant is the statute’s definition of a limited subset of access devices,

“unauthorized access devices,” which includes “any access device that is lost, stolen, expired,

revoked, canceled, or obtained with intent to defraud.” Id. § 1029(e)(3).

The government argues that the credit-card numbers forming the basis of McCormick’s

five counts of aggravated identity theft are “access devices.” Gov’t’s Opp. to Def.’s Mot. to

Dismiss Counts 3–7 at 4. In response, McCormick homes in on the statutory language that an

access device is something “that can be used . . . to obtain money, goods, services, or any other

thing of value.” Id. § 1029(e)(1) (emphasis added). He contends that, because the credit-card

numbers all expired between 2008 and 2012, they could not be “used” as of December 5, 2013,

when the FBI discovered the numbers in McCormick’s possession. Mot. to Dismiss Counts 3–7

at 2–3.

Four circuits have addressed the question whether access devices must be usable. The

Ninth Circuit, in United States v. Onyesoh, 674 F.3d 1157 (9th Cir. 2012), held that access devices,

and the smaller subset of unauthorized access devices, “must be usable,” id. at 1159. In accordance

with this ruling, the court determined that in the context of expired credit cards, the government

must “prove the usability of the expired credit card numbers by a preponderance of the evidence,”

for instance by presenting “expert testimony to establish usability” or evidence that a defendant

“was prepared to use the numbers in combination with another device.” Id. at 1159–60. The

Onyesoh court concluded that the government had not adequately presented such evidence and

remanded to the district court to allow it “to hear evidence of usability.” Id. at 1160. Upon remand,

the government presented evidence that expired credit cards are usable, and the district court found

11
that this evidence established by a preponderance that the numbers were in fact “usable.” 5 United

States v. Onyesoh, 549 F. App’x 700, 701 (9th Cir. 2013). The Ninth Circuit affirmed this finding.

Id. at 702.

Three other circuits, however, have rejected Onyesoh’s conclusion that access devices must

be usable. In United States v. Carver, 916 F.3d 398 (4th Cir. 2019), the Fourth Circuit “decline[d]

to adopt Onyesoh’s usability standard,” id. at 402. The court based its conclusion on the fact that

unauthorized access devices, which include “expired, revoked, [or] canceled” cards, are a subset

of access devices, and so are also subject to the usability standard. Id. at 402–03. But the court

thought it obvious that such cards “cannot be used to obtain money,” and therefore the Onyesoh

usability standard was inconsistent with the full statutory scheme. See id. In the Fourth Circuit’s

view, a better reading was that the “general words ‘can be used’ signify a [congressional] intent to

expand the reach of the definition.” Id. at 403. As support for this “perfectly natural” reading, the

court used the following analogy:

A salesperson describing the features of a universal remote control might say, “This
can be used on any model of television we sell.” No one would think the
salesperson is representing that the remote control would be currently functional—
it might need batteries, reprogramming, or various other adjustments before it
would work. The promise is that it is the kind of thing that, under plausible
circumstances, could change channels, adjust volume, and so forth on televisions.
The same is true of a fraudulently altered card. Even if it could not complete a
transaction now, it is the type of thing that could do so, and was altered for precisely
that purpose.

5
The government’s evidence consisted of expert testimony that:
• Credit card account numbers do not change when they expire; rather, a new card is issued with the
same account number and a new expiration date.
• An expired credit card account number, in conjunction with the true account holder’s name,
address, and other personal identifiers, allows a person to obtain a duplicate card to make Internet
purchases, enter ATM transactions, and obtain cash advances.
• Identity thieves typically collect identity theft victim profiles, stolen mail, checks, SIM cards, and
credit reports for use in applying for new credit cards, all of which were found during a search of
defendant’s home.
Id. at 701.

12
Id. As a result, the court determined that prosecutors need not prove “an extra element of current

functionality,” but instead must show “only that [each device] was in principle the sort of thing

that people use to obtain money (like a credit card or bank number).” Id. The Sixth and Seventh

Circuits have adopted similar readings of the “can be used” language. See United States v.

Popovski, 872 F.3d 552, 553 (7th Cir. 2017) (concluding that § 1029(e)(1) “defines an ‘access

device’ according to its nature—the sort of thing that could in principle be used to get goods or

funds, whether or not it would work in practice”); United States v. Moon, 808 F.3d 1085, 1091

(6th Cir. 2015) (“We . . . reject [defendant’s] argument for a ‘usability’ requirement.”).

This Court concludes that the Fourth, Sixth, and Seventh Circuits have the better of the

argument. The Ninth Circuit’s usability requirement cannot be squared with the fact that “lost,

stolen, expired, revoked, [or] canceled” cards are also access devices, yet are unlikely to be able

to be “used” to obtain money. Hence, this Court concludes that there is no usability requirement

as described in Onyesoh. Instead, as the Fourth Circuit concluded, the government must show

“only that [each access device] was in principle the sort of thing that people use to obtain money.”

Carver, 916 F.3d at 403.

The basis for McCormick’s motion to dismiss counts 3–7, in essence, is that usability is an

element of the statute that the government, as a matter of law, could not satisfy at trial with respect

to expired credit credits. See Mot. to Dismiss Counts 3–7 at 1–2. Because the Court rejects that

view of the statute, the motion will be denied. 6

6
The Court notes that even if it had adopted Onyesoh’s view of the statute, the pretrial dismissal of counts
3–7, as McCormick requests, would still be inappropriate. Onyesoh merely requires the government to present, at
trial, evidence of usability. See Onyesoh, 674 F.3d at 1159–60.

13
 Conclusion

For the foregoing reasons, the Court will (1) deny McCormick’s motion to dismiss for

preindictment delay; (2) deny McCormick’s motion to suppress; and (3) deny McCormick’s

motion to dismiss counts 3–7. A separate order has been issued on this date.

/s/
JOHN D. BATES
United States District Judge
Dated: November 25, 2019

14