On January 9, 2018, the Second Circuit (Kearse, Cabranes, Wesley) rejected a request by ex-AOL Inc. employee Jason Smathers to junk the restitution component of his sentence, which requires him to recompense the online service provider for the losses it incurred after Smathers sold 92 million AOL screen names to spammers in the early 2000s—one of the earliest large-scale data security breaches of the Internet age. Smathers argued that his restitution award should be offset by damages later obtained by AOL in litigation against Smathers’s co-conspirators.
In its decision, the Second Circuit affirmed that defendants bear “the full burden” of proving that a victim has been fully compensated for the losses they caused before they can obtain a modification of a restitution order under the Mandatory Victims Restitution Act (“MVRA”), 18 U.S.C. §§ 3663A, 3664, and concluded that Smathers had failed to demonstrate other recoveries by AOL should eliminate his restitution obligation. Defendants must show that there are appropriate offsets to restitution. It is not the government’s obligation to disprove such claims. This decision strengthens the position of victims of crime who have sustained financial losses as a result of defendants’ actions.
Factual Background & Procedural History
In 2003, while employed at AOL, Smathers stole a list containing the usernames of millions of AOL customers. Smathers sold the list for $28,000 to individuals who used it to spam customers with unwanted advertisements an estimated 7 billion times over the next year. Aside from the annoyance to consumers, these spam e-mails cost AOL over $300,000 to process. Smathers pleaded guilty to conspiracy, theft, and e-mail fraud charges in 2005, and the district court sentenced Smathers to a 15-month term of imprisonment and ordered him to pay restitution to AOL under the MVRA. Although Smathers’s plea agreement stated that AOL’s losses were $300,000, and the district court’s judgment so ordered this as the “total loss,” the judge only imposed a restitution award of $84,000, believing that a greater amount would result in a windfall to AOL.
Meanwhile, AOL initiated civil litigation against the spammers, including one of the individuals who purchased the customer list that Smathers misappropriated. Although the record from the civil litigation is largely sealed, the public docket disclosed that AOL eventually obtained a default judgment against some of the culpable parties in excess of $12 million and including—at least according to news sources—a Hummer automobile. A parallel criminal case against one of Smathers’s co-conspirators also resulted in a restitution award to AOL. After learning of this, Smathers filed several letters with the district court over the course of the next decade seeking to have the court modify his $84,000 restitution award on the grounds that AOL’s recovery in the other litigation fully satisfied the restitution Smathers owed.
On February 24, 2016, Smathers formally filed a pro se brief in district court styled as a Motion to Compel Proper Enforcement of Restitution Order and Injunction, renewing his claim that the other payments to AOL stemming from the spamming scheme were sufficient to extinguish Smathers’s restitution obligation. Smathers submitted no evidence in support of his motion. The district court ordered the government to respond, and the U.S. Attorney’s Office took the position that it had no duty to disprove Smathers’s contentions, and that Smathers was not entitled to relief unless, to the contrary, he offered “[a]ffidavits and competent proof” that the damages paid to AOL eliminated his restitution obligation. The district court agreed with the government and denied Smathers’s motion, finding that “the recoveries by AOL in [the other] cases were not necessarily, and do not appear to be for the same loss caused by . . . Smathers. . . . The fact that AOL has recovered from other spammers does not reduce Smathers’[s] obligation, and his motion is denied.”
The Second Circuit’s Decision
The Second Circuit began its analysis with the text of the MVRA, a federal statute intended to “provide full compensation to victims of . . . crimes.” Slip Op. 8. Consistent with its compensatory purpose, the Court noted that the MVRA does not authorize a victim to recover more in restitution than necessary to compensate it for its losses. Slip Op. 9 (citing 18 U.S.C. § 3664(j)(2)). Specifically, the MVRA states that “[a]ny amount paid to a victim under an order of restitution shall be reduced by any amount later recovered as compensatory damages for the same loss by the victim [in another proceeding].” 18 U.S.C. § 3664(j)(2) (emphasis added). The MVRA also commits the decision of which party bears the burden of proof in disputes regarding modifications to an existing restitution award to the court in its discretion “as justice requires.” Slip Op. 11–12 (quoting 18 U.S.C. § 3664(e)).
Smathers’s principal argument on appeal is that the district court erroneously placed the burden on him to prove that AOL’s recoveries were “for the same loss” he caused, and that those recoveries equaled or exceeded the loss he caused.[1] Slip Op. 11 (quoting 18 U.S.C. § 3664(j)(2)). The Second Circuit observed that “the burden of proof as to a given issue is normally placed on the party that has an affirmative goal and presumptive access to proof.” Slip Op. 12. In restitution-offset cases, the defendant has historically carried the burden of proof. Slip Op. 12 (accumulating cases). Here, the Second Circuit reasoned that Smathers “unquestionably has the strongest incentive to establish that he is entitled to a reduction of his remaining restitution obligation.” Slip Op. 13. Because neither Smathers nor the government was a party to the civil litigation, neither one of them has greater access to the evidence from that case Smathers would need to prove that AOL’s recovery was for the same harm his theft caused. Slip Op. 13. The Court thus concluded that the district court was well within its discretion to hold that justice required Smathers—the individual seeking relief from his obligation to pay restitution for injuries he caused to AOL—to bear the burden of proving that AOL had been fully compensated. Slip Op. 14. The district court rejected the remainder of Smathers’s pleas for relief. As the Court explained, “Smathers unquestionably has the strongest incentive to establish that he is entitled to a reduction of his remaining restitution obligation.”
Commentary
The subject of restitution and other financial penalties continues to give rise to frequent litigation before the Circuit. In this case, the Court reviewed the district court’s construction of the MVRA, both in formulating Smathers’s restitution obligation and in considering his request for a reduction. This exercise required the district court to grapple with the difficulty of valuing the harms of cybersecurity crimes like hacking. The district court tried to figure out the actual expense to AOL, neither including overhead expenses to AOL caused by the crime, nor merely basing restitution on the amount of money received by Smathers for selling the information. Today, courts might also include the victim’s costs of investigation as part of the restitution owed by the defendant. See, e.g., United States v. Amato, 540 F.3d 153 (2d Cir. 2008).
At any rate, neither the district court nor the Second Circuit found any room for ambiguity in assigning the full responsibility for compensating AOL for its losses—and for finding out if compensation already had been paid—to Smathers. Crime victims who benefit from MVRA restitution awards are not parties to the criminal cases in which their injuries are prosecuted. Therefore, the Second Circuit needed to decide only whether it was fair for Smathers or the government to bear the burden of proving whether AOL had been compensated for Smathers’s crimes.
Companies who are victims of hacking likely owe fiduciary obligations to their shareholders to vigorously recover money and good-will lost in a cybersecurity breach, so companies may have an independent interest in seeking compensation from wrongdoers outside of the MVRA’s restitution channels. Nevertheless, the Second Circuit’s opinion makes clear that defendants cannot simply point to companies’ efforts to recoup losses in order to excuse their requirement to pay restitution for their crimes. Restitution is based on principles of equity, and the Second Circuit’s decision seems eminently equitable under the circumstances here, where Smathers expected to avoid paying up by asking the government to do the leg work for him.
Defendants have strong incentives to do this leg work, given that restitution awards can be high, and they do not expire until 20 years after release from imprisonment, and the unpaid obligation can be sought from the defendant’s estate. See 18 U.S.C. § 3613(b), (f). The government can refute the defendant’s evidence where appropriate, such as where the victim has not actually received the compensation identified by the defendants. See, e.g., United States v. Yalincak, 853 F.3d 629, 636 (2d Cir. 2017). This decision seems likely to increase such post-sentencing litigation in the future.
