United States v. Nicolescu

• Decision Date: 09 November 2021
• Docket Number: Nos. 19-4247/4273,s. 19-4247/4273
• Citation: 17 F.4th 706
• Parties: UNITED STATES of America, Plaintiff-Appellee, v. Bogdan NICOLESCU (19-4247); Radu Miclaus (19-4273), Defendants-Appellants.
• Court: U.S. Court of Appeals — Sixth Circuit

17 F.4th 706

UNITED STATES of America, Plaintiff-Appellee,

v.Bogdan NICOLESCU (19-4247); Radu Miclaus (19-4273), Defendants-Appellants.

Nos. 19-4247/4273

United States Court of Appeals, Sixth Circuit.

Argued: March 3, 2021

Decided and Filed: November 9, 2021

ARGUED: David L. Doughten, Cleveland, Ohio, for Appellant in 19-4247. Catherine Adinaro Shusky, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Cleveland, Ohio, for Appellant in 19-4273. Laura McMullen Ford, UNITED STATES ATTORNEY'S OFFICE, Cleveland, Ohio, for Appellee. ON BRIEF: David L. Doughten, Cleveland, Ohio, for Appellant in 19-4247. Catherine Adinaro Shusky, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Cleveland, Ohio, for Appellant in 19-4273. Laura McMullen Ford, UNITED STATES ATTORNEY'S OFFICE, Cleveland, Ohio, for Appellee.

Before: WHITE, LARSEN, and NALBANDIAN, Circuit Judges.

WHITE, J., announced the judgment and delivered the opinion of the court in which she joined in all but Section III.D., and LARSEN and NALBANDIAN, JJ., joined in full. WHITE, J. (pp. 731–32), delivered a separate opinion dissenting from Part III.D. of the court's opinion.

AMENDED OPINION

HELENE N. WHITE, Circuit Judge

[Except as to Section III.D.]. For nine years, Defendants-Appellants Radu Miclaus and Bogdan Nicolescu ran a sophisticated, multimillion-dollar cyber-fraud ring out of Romania. They were extradited to the United States, and a federal jury in Ohio convicted them of wire fraud, conspiracy to commit wire fraud, conspiracy to commit computer fraud, aggravated identity theft, conspiracy to commit money laundering, and conspiracy to traffic in counterfeit service marks. The district court sentenced them to eighteen and twenty years’ imprisonment, respectively. On appeal, they raise several challenges to their convictions and sentences. We AFFIRM their convictions, VACATE their sentences, and REMAND for resentencing.

I.

Beginning around 2007, Nicolescu, Miclaus, and a handful of coconspirators began posting fake car auctions on eBay. Their group, dubbed "Bayrob" by the FBI (a combination of "eBay" and "robbery"), set up auctions that appeared to show vehicles for sale by US-based sellers. In reality, Bayrob had neither vehicles to sell nor a US address. Operating from in and around Bucharest, Romania, the group used various technologies to conceal its IP addresses, and employed US-based "money mules," (falsely described to victims as "eBay Escrow Agents") to collect payments from unsuspecting buyers. The money mules then wired the victims’ payments to various locations in Europe, where individuals associated with Bayrob collected the payments and brought them to Miclaus and Nicolescu in Romania. All told, the Bayrob group orchestrated the eBay fraud more than 1,000 times and reaped between $3.5 million and $4.5 million.

At some point in 2014, Bayrob began employing a custom-made trojan horse virus to facilitate new money-making schemes. Nicolescu, a skilled computer programmer, created the virus, which he embedded in links in the group's eBay auctions and in spam emails widely disseminated by Bayrob. Once a victim clicked the link and downloaded the virus onto the victim's computer, it ran quietly in the background until the unsuspecting victim tried to visit certain popular websites, including eBay, Facebook, PayPal, Gmail, Yahoo, and Walmart. At that point, instead of connecting to the real website, the virus discreetly redirected the victim's computer to a look-a-likewebsite created by Bayrob, which collected the victim's account credentials, identities, and credit-card information, and stored it all on Bayrob's servers in Romania. Bayrob collected more than 70,000 account credentials this way, including 25,000 stolen credit-card numbers. Bayrob used the stolen credit cards to pay its own expenses, including costs for server space, VPNs, and registering domain names, and it sold some of the stolen credit cards on AlphaBay, a website on the dark web frequented by criminals, for prices ranging from $1–$35.

Around the same time, Bayrob concocted a third money-making scheme. This time it harnessed the processing power of its network of 33,000 virus-infected computers to "mine" for cryptocurrency. Nicolescu's trojan horse virus worked by commandeering an infected computer's processor and forcing it to solve difficult mathematical equations that generate bitcoin, a process known as "cryptomining." With their computers’ processing power tied up generating bitcoin for Bayrob, the victims’ computers slowed to a crawl. Bayrob exchanged the bitcoins generated by its cryptomining activities for cash, generating approximately $10,000–$20,000 per month in 2014, and $30,000–$40,000 per month in 2015 and 2016.

The FBI caught on to Bayrob's activities in 2015 and executed a search warrant on the cell phone of Tiberiu Danet, a Bayrob member, as he traveled through the Miami airport. Using information obtained from Tiberiu's phone, the FBI and Romanian police executed a search warrant on Nicolescu's, Miclaus's, and Tiberiu's residences in Romania. The searches turned up a trove of servers, hard drives, and other computing equipment used by the group. The FBI was not able to decrypt much of the information on Bayrob's servers, but the cache of seized files the FBI was able to review included spreadsheets the group used to keep track of its victims and spreadsheets showing money Bayrob had moving through its money-mule network in the United States and Europe.

In 2016, Nicolescu and Miclaus were indicted for conspiracy to commit wire fraud, twelve counts of wire fraud, conspiracy to commit computer fraud, conspiracy to traffic in counterfeit service marks, five counts of aggravated identity theft, and conspiracy to commit money laundering. They were convicted on all counts after a two-and-a-half-week jury trial.¹

At Defendants’ sentencing hearing, FBI agent Ryan MacFarlane testified that the eBay scheme generated between $3.5 million and $4.5 million in losses. The FBI calculated that figure by reviewing spreadsheets Bayrob used to keep track of its victims and cross-referencing the information in the spreadsheets with victim complaints filed with the FBI's Internet Crime Complaint Center (ICCC). MacFarlane estimated that the true eBay loss figure was substantially higher than $3.5 to $4.5 million, since only 30–35% of victims filed complaints with the ICCC. According to MacFarlane, true losses may have been as high as $10 million to $30 million.

At the conclusion of the sentencing hearing, the district court calculated Nicolescu's and Miclaus's Guidelines range for the conspiracy-to-commit-money-laundering grouping (Counts 1–15 and 21). The district court added eighteen levels to their Guidelines calculation under U.S.S.G. § 2B1.1(b)(1)(J) for causing a loss between $3.5 and $9.5 million, two levels under U.S.S.G. § 2B1.1(b)(4) for being in the business of receiving and selling stolen property, two levels under U.S.S.G. § 2B1.1(b)(11)(B)(i) for trafficking unauthorized access devices, four levels under U.S.S.G. § 2B1.1(b)(19)(A)(ii) for having been convicted of an offense under 18 U.S.C. § 1030(a)(5)(A), and four levels under U.S.S.G. § 3B1.1(a) for being an organizer or leader of criminal activity, as well as other enhancements not at issue in this appeal. The result was an adjusted offense level of forty-three, which at criminal history category I produced a Guidelines range of life imprisonment. Since a life sentence exceeded the statutory twenty-year maximum on any of the offenses in the grouping, the parties agreed to (and the district court applied) a five-level reduction for an applied total offense level of thirty-eight. After the five-level reduction, Nicolescu's and Miclaus's Guidelines range was 235 to 293 months. They were sentenced to 216 and 192 months’ imprisonment, respectively, on Counts 1 through 13 and 21, concurrent sentences of sixty months on Count 14 and 120 months on Count 15, and mandatory twenty-four month sentences on Counts 16 through 20, to run concurrently with each other but consecutively to all the other sentences, for a total sentence of 240 (Nicolescu) and 216 (Miclaus) months’ imprisonment.

This appeal followed.

II.

Nicolescu and Miclaus each appeal one substantive count of conviction and the application of multiple sentencing enhancements. We consider the challenges to their substantive convictions first.

A.

Nicolescu contends the district court erred in denying his motion for acquittal based on insufficiency of the evidence on Count 14, which charges conspiracy to violate 18 U.S.C. § 1030(a)(5)(A) and two other statutes.

We review a district court's denial of a motion for judgment of acquittal de novo .

United States v. Howard , 947 F.3d 936, 947 (6th Cir. 2020). When reviewing the sufficiency of the evidence, we assess "whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt." Jackson v. Virginia , 443 U.S. 307, 319, 99 S.Ct. 2781, 61 L.Ed.2d 560 (1979).

The jury convicted Nicolescu and Miclaus on Count 14, which alleged a conspiracy with three objects:

(i) to intentionally access a computer without authorization, and thereby obtain information from a protected computer, and the offense was committed for purposes of commercial advantage and private financial gain, in violation of Title 18, United States Code, Section 1030(a)(2)(C) ; and

(ii) to intentionally access a computer without authorization and by means of such conduct furthered the intended fraud and obtained something of value, specifically, money, in excess of 3 to 4 million dollars, in violation of Title 18, United States Code, Section 1030(a)(4) ; and

(iii) to knowingly cause the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally cause damage without authorization to a protected computer, and the offense caused damage

...