22‐1799 USA v. Cuomo

1 UNITED STATES COURT OF APPEALS

2 FOR THE SECOND CIRCUIT

3 ‐‐‐‐‐‐

4 August Term, 2023

5 (Argued: February 12, 2024 Decided: January 3, 2025)

6 Docket No. 22‐1799

7 _________________________________________________________

8 UNITED STATES OF AMERICA,

9 Appellee, 10 11 ‐ v. ‐

12 GUY CUOMO, a.k.a. John Monaco,

13 Defendant‐Appellant.* 14 _________________________________________________________

15 Before: KEARSE, PARK, and PÉREZ, Circuit Judges.

* The Clerk of Court is instructed to amend the official caption to conform with the above. 1 Appeal from a judgment entered in the United States District Court for

2 the Northern District of New York, following a jury trial before Thomas J. McAvoy,

3 Judge, and sentencing by Mae A. DʹAgostino, Judge, convicting defendant of

4 conspiracy to commit computer fraud, in violation of

(b),

5 1030(a)(2)(C), and 1030(c)(2)(B)(iii); accessing a protected computer and obtaining

6 information without authorization, in violation of

(a)(2)(C) and

7 1030(c)(2)(B)(i); two counts of aggravated identity theft, in violation of 18 U.S.C.

8 § 1028A(a)(1); misuse of a social security number, in violation of 42 U.S.C.

9 § 408(a)(7)(B); and conspiracy to misuse social security numbers, in violation of 18

; and sentencing him principally to a total of 45 monthsʹ imprisonment,

11 to be followed by a total of three yearsʹ supervised release. On appeal, defendant

12 contends principally that his convictions should be reversed on the grounds that his

13 conduct did not violate the Computer Fraud and Abuse Act,

, and

14 Social Security Act § 206,

; that the courtʹs instructions to the jury were

15 deficient with respect to the counts relating to computer fraud and social‐security‐

16 number misuse; and that the evidence was insufficient to support his convictions

17 relating to identity theft and social‐security‐number misuse. Finding no merit in

18 these contentions, or in his challenges to the calculation of his sentence, we affirm.

2 1 STEVEN D. CLYMER, Assistant United States Attorney, 2 Syracuse, New York (Carla B. Freedman, United 3 States Attorney for the Northern District of New 4 York, Joshua R. Rosenthal, Assistant United States 5 Attorney, Syracuse, New York, on the brief), for 6 Appellee.

7 ANDREW LEVCHUK, Amherst, Massachusetts, for 8 Defendant‐Appellant.

9 KEARSE, Circuit Judge:

10 Defendant Guy Cuomo appeals from a judgment entered in the United

11 States District Court for the Northern District of New York, following a jury trial

12 before Thomas J. McAvoy, Judge, and sentencing by Mae A. DʹAgostino, Judge,

13 convicting him of conspiracy to commit computer fraud, in violation of 18 U.S.C.

14 §§ 1030(b), 1030(a)(2)(C), and 1030(c)(2)(B)(iii) (Count 1); accessing a protected

15 computer and obtaining information without authorization, in violation of 18 U.S.C.

16 §§ 1030(a)(2)(C) and 1030(c)(2)(B)(i) (Count 2); aggravated identity theft, in violation

17 of 18 U.S.C. § 1028A(a)(1) (Counts 7 and 18); misuse of a social security number, in

18 violation of

(a)(7)(B) (Count 13); and conspiracy to misuse social

19 security numbers, in violation of

(Count 12); and sentencing him

20 principally to a total of 45 monthsʹ imprisonment, to be followed by a total of three

3 1 yearsʹ supervised release. On appeal, Cuomo contends principally that his

2 convictions should be reversed on the grounds that his conduct did not violate the

3 Computer Fraud and Abuse Act,

, and Social Security Act § 206,

4

; that the courtʹs instructions to the jury were deficient with respect to

5 the counts relating to computer fraud and social‐security‐number misuse; and that

6 the evidence was insufficient to support his convictions relating to identity theft and

7 social‐security‐number misuse. He also contends that the court erred in calculating

8 his sentence. Finding no merit in any of his contentions, we affirm.

9 I. BACKGROUND

10 The present prosecution had its origin in investigations by the United

11 States Department of Laborʹs Office of the Inspector General (ʺDOL‐OIGʺ) into

12 suspected crimes involving unemployment insurance (or ʺUIʺ) programs. DOL‐OIG

13 Special Agents zeroed in on conduct from 2015 through April 2018 by Cuomo who,

14 along with codefendant Jason ʺJ.R.ʺ Trowbridge, operated both a ʺskip tracingʺ

15 company called Paymerica Corporation and a sister company called Ameripay

16 Corporation (ʺAmeripayʺ) that ostensibly engaged in debt collection but also

4 1 performed skip tracing. ʺSkip tracingʺ (or ʺskiptracingʺ) refers generally to a process

2 of finding information about a person‐‐often a debtor‐‐such as his or her address,

3 telephone number, and place of employment (or ʺPOEʺ).

4 The trial evidence leading to Cuomoʹs conviction of the above offenses,

5 taken in the light most favorable to the government, is described in detail in a

6 Decision and Order of the district court dated July 13, 2022 (ʺD.Ct. Op.ʺ), denying

7 motions by Cuomo for a judgment of acquittal. (See Cuomo brief on appeal at 3 (ʺThe

8 district court, as required by law, summarized the facts in the light most favorable to

9 the verdicts.ʺ (footnote omitted)).) Under the same standard, we summarize the

10 evidence as follows.

11 A. The Evidence of Deceptive Practices

12 Paymerica Corporation and Ameripay shared office space and had

13 substantial financial and employee overlap; here, as in the district court proceedings,

14 they will generally be referred to collectively as ʺPaymerica,ʺ D.Ct. Op. at 5‐6. In

15 their skip tracing operations, ʺPaymerica employees obtained debtorsʹ POE

16 information by impersonating the debtorsʺ in commencing for them ʺonline

5 1 applications for unemployment insurance (ʹUIʹ) in the states where the debtors lived.ʺ

2

.

3 [W]hen Paymericaʹs customers provided [Paymerica] with the 4 names, social security numbers, and addresses of debtors whose 5 POE information the customers sought to purchase, Paymerica 6 employees initially verified this personal‐identifying 7 information‐‐including social security numbers‐‐for the debtors by 8 using TLO, a commercial database. From there, Paymerica 9 employees obtained the requested POE information for the debtors from 10 state workforce agencies by starting false UI applications in each debtorʹs 11 name and with each debtorʹs personal‐identifying information. 12 Among other things, Paymerica employees created online accounts for 13 the debtors with the states‐‐for instance, a NY.gov account in New 14 York‐‐and then used the online accounts to start fraudulent UI 15 applications in the debtorsʹ names by submitting, inter alia, the 16 debtorʹs name, date of birth, and social security number.

17

(record citations omitted) (emphases added). In addition,

18 Paymerica employees routinely created and used fraudulent email 19 accounts . . . to circumvent identity‐verification measures implemented 20 by New York and other state governments. Four cooperating 21 witnesses . . . testified that the entire process was about impersonating 22 debtors. According to the witnesses, this was done so that the 23 states would falsely recognize Paymerica employees as the target 24 debtors and provide restricted POE information meant only for 25 those debtors to Paymerica.

26

at 6‐7 (record citations omitted) (emphases added); see

(the ʺ[f]our

27 cooperating witnessesʺ were ʺPaymerica employees who . . . admittedly commit[ed]

28 Computer Fraud, Misuse of a Social Security Number, or Aggravated Identity Theftʺ).

6 1 ʺPaymerica employees took steps to avoid detection and cover up their

2 actions. . . . The skip tracers always used aliases when making verification calls to

3 victimsʹ places of employment.ʺ

(record citations omitted). Cuomo himself,

4 ʺfor his skiptracing activities,ʺ used the alias ʺJohn Monaco.ʺ (Trial Transcript (ʺTr.ʺ)

5 328‐29.)

6 Cuomo also ʺpersonally impersonated numerous debtor‐victims [in

7 starting] New York State UI applications, including C.C. and S.A., the respective

8 victims of the [identity theft] counts against [him].ʺ D.Ct. Op. at 8. In March 2018,

9 Cuomo logged on to the New York State UI website and initiated unemployment

10 insurance applications in the names of C.C. and S.A. in order to learn their POEs; in

11 response to the website requests for personal information to identify the person

12 inquiring, Cuomo provided C.C.ʹs and S.A.ʹs respective social security numbers,

13 which Paymerica had been given by its customers, see, e.g.,

. C.C. and S.A.

14 testified that they did not apply for unemployment insurance in March 2018, had not

15 heard of Paymerica, did not know Cuomo or Trowbridge, and had ʺnever authorized

16 anyone to use their names or social security numbers to apply for unemployment

17 insurance for them.ʺ D.Ct. Op. at 23‐24.

7 1 In addition to the use of aliases, impersonations, and ʺphony email

2 accounts,ʺ

3 Paymerica employees employed other means to evade the statesʹ 4 security measures. For example, when the state governments 5 blocked an internet protocol (ʺIPʺ) address associated with 6 Paymericaʹs offices, Paymerica employees used a virtual private 7 network (ʺVPNʺ) to mask their true IP address. They also used 8 untraceable, internet‐based phone systems that were paid for with 9 anonymous retail gift cards to further conceal their true identities. In 10 addition, when the states added additional identity verification 11 questions in response to Paymericaʹs fraudulent activities, the skip 12 tracers used information from TLO to answer highly personal questions 13 about the debtors they impersonated.

14

at 7‐8 (record citations omitted) (emphases added).

15 Cuomo performed skip tracing himself, and when Trowbridge was not

16 available he supervised the other Paymerica employees, including those engaged in

17 skip tracing. See

. Cuomo also administered and maintained the TLO

18 account‐‐a subscription to a database maintained by TransUnion that contained

19 public, proprietary, and personal information. Trowbridge could not be associated

20 with that account because he had a prior felony conviction. See

Cuomo ʺwas . . .

21 aware that Trowbridge and other[ Paymerica employees] used VPNs and other

22 measures to avoid detection by law enforcement.ʺ

(citing Tr. 559‐60 (DOL‐OIG

23 Special Agentʹs testimony as to Cuomoʹs description to interviewing agents of his

8 1 co‐conspiratorsʹ use of various measures ʺʹto hide from the statesʹʺ (other record

2 citations omitted))). (See Part II.A.2. below with respect to confidentiality measures

3 taken by New York State.)

4 There was no evidence that Cuomo or his coconspirators actually filed

5 an unemployment insurance application for any debtor they impersonated. They

6 initiated applications because merely starting that process gave them access to the

7 debtorʹs most recent employer; none of the applications was completed. See D.Ct. Op.

8 at 11‐12.

9 ʺOnce [Paymerica] obtained[] the POE information[, it] was sold to the

10 requesting third parties for approximately $90 per debtor.ʺ

at 7 (citing Tr. 595‐97).

11 Paymerica had received requests from customers to research approximately 200,000

12 persons, and all 50 states were represented in those requests. (See Tr. 597.) In the

13 period from mid‐December 2015 to early April 2018, for its largest customer,

14 Paymerica found POE information on some 11,294 individuals, for which it billed the

15 customer $1,013,220. (See

at 595‐97.)

9 1 B. The Verdict and Judgment

2 The jury found Cuomo guilty of accessing a protected computer and

3 obtaining information, in violation of

(a)(2)(c) and (c)(2)(B)(i), and

4 of conspiracy to commit computer fraud, in violation of

(b),

5 (c)(2)(B)(i), and (c)(2)(B)(iii), and found that those offenses had been committed ʺfor

6 purposes of commercial advantage or private financial gain.ʺ (Verdict Form at 1‐2.)

7 It found that the value of the information thereby obtained exceeded $5,000. (See id.)

8 The jury also found Cuomo guilty of misuse of a social security number, in violation

9 of

(a)(7)(B); conspiring to misuse social security numbers, in violation

10 of

; and two counts of aggravated identity theft (victimizing C.C. and

11 S.A.), in violation of 18 U.S.C. § 1028A(a)(1).

12 Cuomo was sentenced principally to a total of 45 monthsʹ imprisonment.

13 On Counts 1, 2, 12, and 13 (relating to computer fraud and misuse of social security

14 numbers), he received four 21‐month prison terms to be served concurrently with

15 each other, based on calculations under the advisory Sentencing Guidelines

16 (ʺGuidelinesʺ). (See Part III below.) On Counts 7 and 18 (aggravated identity theft),

17 Cuomo was sentenced‐‐as mandated by 18 U.S.C. § 1028A(a)(1)‐‐to prison terms of

18 24 months, to be served consecutively to the 21‐month prison terms on Counts 1, 2,

10 1 12, and 13. As allowed by § 1028A(b), the court ordered that the two 24‐month terms

2 for aggravated identity theft be served concurrently with each other.

3 II. CUOMOʹS CHALLENGES TO HIS CONVICTIONS

4 On appeal, Cuomo contends principally that his convictions should be

5 reversed on the grounds that his conduct did not violate either the Computer Fraud

6 and Abuse Act of 1986 (ʺCFAAʺ) or the Social Security Act. He also argues that the

7 trial courtʹs instructions on the counts charging violations of those statutes were

8 erroneous or deficient, and that the evidence was insufficient to support his

9 convictions of aggravated identity theft and misuse of, or conspiracy to misuse, social

10 security numbers.

11 As to issues of statutory interpretation, our standard of review is de novo.

12 See, e.g., United States v. Gu,

(2d Cir. 2021) (ʺGuʺ), cert. denied,

1186 (2022). And although we review de novo the ultimate legal question of

14 sufficiency of the evidence to support a conviction, our ʺstandard of review is

15 exceedingly deferential to the juryʹs apparent determinationsʺ of facts. United States

16 v. Flores,

(2d Cir. 2019) (ʺFloresʺ) (internal quotation marks omitted),

11 1 cert. denied,

(2020); see Gu,

. We view the evidence in the

2 light most favorable to the government, crediting every credibility determination and

3 every inference that could have been drawn in favor of the government. See, e.g.,

4 Flores,

; Gu,

. ʺA sufficiency challenge must fail if ʹany

5 rational trier of fact could have found the essential elements of the crime beyond a

6 reasonable doubt.ʹʺ Flores,

(quoting Jackson v. Virginia,

,

7 319 (1979) (emphasis in Jackson)).

8 We also review de novo challenges to the propriety of the trial courtʹs

9 instructions to the jury, if those challenges have been properly preserved. See, e.g.,

10 United States v. Botti,

(2d Cir. 2013) (ʺBottiʺ); United States v. Bahel, 662

(2d Cir. 2011). Unpreserved challenges to instructions are reviewed only

12 for plain error. See, e.g., Fed. R. Crim. P. 30(d) and 52(b). Under plain‐error review,

13 we have ʺdiscretion to reverse only if the instruction contains ʹ(1) error, (2) that is

14 plain, and (3) affect[s] substantial rightsʹʺ; and if these three conditions are met, we

15 may ʺexercise [our] discretion to correct the error only if the error ʹseriously affect[ed]

16 the fairness, integrity, or public reputation of judicial proceedings.ʹʺ Botti,

(quoting Johnson v. United States,

(1997)).

12 1 A. The CFAA

2 Cuomo contends that his convictions on Counts 1 and 2‐‐computer fraud

3 and conspiracy to commit computer fraud‐‐should be reversed, arguing that his

4 conduct did not violate the CFAA, that the evidence was insufficient to show that he

5 accessed the computer without authorization, and that the district court erroneously

6 instructed the jury as to the meaning of ʺwithout authorization.ʺ We reject all of these

7 contentions.

8 1. Statutory Construction

9 The CFAA, dealing with fraud and related activity in connection with

10 computers, provides in part that it is unlawful for a person (a) to ʺintentionally access[]

11 a computer without authorization or exceed[] authorized access, and thereby obtain[] . . .

12 information from any protected computer,ʺ or (b) to ʺconspire[]ʺ to do so. 18 U.S.C.

13 §§ 1030(a)(2)(C) and (b) (emphases added). The CFAA defines ʺprotected computerʺ

14 in part as a computer ʺwhich is used in or affecting interstate or foreign commerce or

15 communication.ʺ Id. § 1030(e)(2)(B). ʺ[T]he term ʹexceeds authorized accessʹ means

16 to access a computer with authorization and to use such access to obtain or alter

13 1 information in the computer that the accesser is not entitled so to obtain or alter.ʺ Id.

2 § 1030(e)(6).

3 The word ʺauthorizationʺ is not defined in the CFAA, and we have

4 viewed it as ʺa word of ʹcommon usage, without any technical or ambiguous

5 meaning,ʹʺ United States v. Valle,

(2d Cir. 2015) (ʺValleʺ) (quoting

6 United States v. Morris,

(2d Cir.) (ʺMorrisʺ), cert. denied,

7 (1991)). It thus suggests ʺʹpermission or power granted by authority.ʹʺ Valle,

at 524 (quoting Random House Unabridged Dictionary 139 (2001)). Both Valle and Morris

9 were prosecutions for alleged violation of the ʺexceeds authorized accessʺ clause, by

10 defendants who concededly had authorization to access the relevant computer but

11 did so for improper purposes.

12 The Supreme Court has treated the CFAAʹs ʺwithout authorizationʺ and

13 ʺexceeds authorized accessʺ clauses as coordinated elements of ʺthe computer‐context

14 understanding of access as entry.ʺ Van Buren v. United States,

(2021).

15 It reasoned that the ʺgates‐up‐or‐downʺ statutory structure ʺtreats the ʹwithout

16 authorizationʹ and ʹexceeds authorized accessʹ clauses consistently,ʺ as ʺwithout

17 authorizationʺ refers to whether ʺone either can or cannot access a computer system,ʺ

18 and ʺexceeds authorized accessʺ refers to whether ʺone either can or cannot access

14 1 certain areas within the system.ʺ

(emphases added). The Court suggested

2 that such ʺgatesʺ might consist of ʺa specific type of authorization‐‐that is,

3 authentication, which turns on whether a userʹs credentials allow him to proceed past

4 a computerʹs access gate, rather than on other, scope‐based restrictions.ʺ

at 390 n.9

5 (internal quotation marks omitted).

6 2. Sufficiency of the Evidence

7 Cuomo contends chiefly that his (and his cohortsʹ) computer searches for

8 debtorsʹ POEs were not ʺwithout authorizationʺ within the meaning of § 1030(a)

9 because he (and they) used a website that is available to the public:

10 To obtain place‐of‐employment information, Paymerica 11 employees used ny.gov. All that was needed to create an account 12 was a username and email address. Any member of the public 13 could create a ny.gov account. . . .

14 Ny.gov could be used to access a host of services, including 15 searching for jobs, creating a JobZone profile, getting assistance 16 with employment‐related activities, like resume writing, cover 17 letters, and interview skills; or exploring careers, training 18 opportunities, apprenticeship opportunities, and other job seeker 19 resources, and accessing services for veterans. . . . These services 20 were available to any member of the public and off limits to no 21 one. There was no gate blocking entry to ny.gov.

15 1 (Cuomo brief on appeal at 18‐19 (emphasis added).) These arguments do not,

2 however, reflect the scope of the CFAA or the structure of the gates on ny.gov.

3 First, Cuomoʹs argument mistakenly conflates websites and computers.

4 Section § 1030(a)(2) refers to accessing ʺcomputer[s],ʺ not accessing websites. As

5 explained at trial by an Information Technology Services manager who had helped

6 to design and develop the New York State process for filing online applications for

7 unemployment insurance (ʺNYS‐ITS Managerʺ), the website is not the computer itself.

8 The computer ʺhost[s]ʺ the website; information on a website is housed on a

9 computer; and on the website, a person can ʺlook[] at something thatʹs been compiled

10 by a computer and displayed forʺ a ʺcustomer to look at.ʺ (Tr. 146; see id. at 144‐47.)

11 The ʺwebsite is just a[n] interfaceʺ between the user and the computer (id. at 146); ʺthe

12 website cannot exist without a computerʺ (id. at 157); if the computer were turned off,

13 ʺthe website would disappearʺ (id. at 146).

14 Second, some parts of websites are ʺoutward facing,ʺ i.e., ʺthey are

15 exposed to the publicʺ (id. at 145); but other parts are not (see, e.g., id. at 155). See

16 generally hiQ Labs, Inc. v. LinkedIn Corp.,

(9th Cir. 2022)

17 (ʺ[A] defining feature of public websites is that their publicly available sections lack

18 limitations on access; instead, those sections are open to anyone with a web browser.ʺ

16 1 (emphasis added)). When the websiteʹs host computer introduces ʺgatesʺ for areas

2 of the website that require authorization to access, those parts of the website and the

3 computer or computers hosting them are not freely available to the public. See

4 at 1198‐99, 1199 n.17.

5 While Van Buren left open the question of whether the ʺgates‐up‐or‐down

6 inquiryʺ into authorization ʺturns only on technological (or ʹcode‐basedʹ) limitations on

7 access, or instead also looks to limits contained in contracts or policies,ʺ

8 n.8 (emphases added), we need not resolve that question because the gate at issue

9 here is code‐based. The NYS‐ITS Manager testified that in 2017‐2018, users could

10 obtain information as to an individualʹs place of employment through ny.gov by

11 taking two steps. To begin, users would have to create an ny.gov account, which

12 merely required them to provide a name and a verifiable email address. (See Tr. 147.)

13 To continue, the user could start an application for unemployment insurance; but in

14 order to proceed further‐‐and obtain information from the mainframe‐‐the user was

15 ʺrequired to put in a valid social security number and an address, mailing address[,]

16 to verify they are who they say they are.ʺ (Id. at 151 (emphasis added); see id. at 161 (a

17 person ʺha[s] to enter . . . specific information to access specific portions of the mainframeʺ

18 (emphasis added))). ʺWhen you fill out that application with the unemployment

17 1 insurance area, it would go to the mainframe to actually pull records out for work

2 history of a person if they put in the proper social and address for that person.ʺ (Id. at 152

3 (emphasis added).)

4 In sum, the trial record includes evidence that ʺ[t]he mainframes at issue

5 [in the NYS] Department of Laborʺ ʺhost a lot of data. Thereʹs no publicly facing

6 website,ʺ but it performs ʺa lot ofʺ services including ʺproviding data to someone who

7 requests itʺ (id. at 158 (emphasis added))‐‐and shows authorization to get it:

8 [Y]ou can get into a web page but you might not have access to 9 records unless you [have] actually proven who you say you are. . . . 10 When you fill out that application with the unemployment 11 insurance area, it would go to the mainframe to actually pull 12 records out for work history of a person if they put in the proper 13 social and address for that person.

14 (Tr. 151‐52 (emphases added).) These controls were ʺput into place to prevent people

15 from seeing records of other people.ʺ (Id. at 156.)

16 This evidence as to the New York State computer gates, along with the

17 evidence described in Part I.A. above‐‐as to Cuomoʹs and other Paymerica employeesʹ

18 impersonations and subterfuges to circumvent those gates and obtain POE

19 information for Paymerica customers‐‐was sufficient to support the juryʹs findings

20 that Cuomo, in violation of

(a)(2) and (b), accessed, and conspired

18 1 to access, a computer without authorization and thereby obtained information from

2 a protected computer ʺfor purposes of . . . private financial gain.ʺ

3 3. The CFAA Instruction as to ʺAuthorizationʺ

4 On appeal, Cuomo argues that the trial court gave the jury an erroneous

5 instruction as to the meaning of ʺwithout authorizationʺ in

(a)(2). He

6 challenges the following instruction:

7 ʺA computerʹs user accesses a computer without authorization if 8 the user bypasses an authentication requirement that requires the 9 user to demonstrate that the user is a person authorized to access 10 the information [on] another computer. A password is an 11 example of an authentication requirement but authentication 12 requirements may take other forms.ʺ

13 (Cuomo brief on appeal at 31‐32 (quoting Tr. 722).) Cuomo contends that this was

14 erroneous because it ʺfailed to acknowledge that Cuomo had a valid ny.gov accountʺ

15 (Cuomo brief on appeal at 32), and allowed the jury to believe ʺit could convict based

16 onʺ ʺterms of service or contractual limitations imposed by a websiteʺ (id. at 32, 33),

17 and that ʺ[t]he jury should have been instructed, consistent with Valle, that to find that

18 Cuomo acted without authorization, it had to find that Cuomo had no permission at

19 all to access the ny.gov siteʺ (id. at 33 (emphasis in original)).

19 1 Cuomo made no objection in the district court to the instructions on the

2 CFAA counts. (See, e.g., Tr. 747‐58.) Thus, his present challenge to this instruction is

3 reviewable only for plain error. He cannot meet that test because, inter alia, the

4 instruction given by the court was not erroneous.

5 First, his complaint that the instruction did not acknowledge that he ʺhad

6 a valid ny.gov accountʺ again conflates the computer with the website. Cuomoʹs

7 access to the public‐facing aspects of the website did not give him authorization to

8 access the private POE information, stored on the mainframe, which he sought to

9 obtain for Paymericaʹs customers.

10 Nor has Cuomo shown error or plain error by arguing that the jury

11 should have been instructed that in order to find that he accessed the computer

12 without authorization in violation of the CFAA, it needed to find that he had no

13 permission at all to access the ny.gov site. In fact, the instruction fragment challenged

14 by Cuomo as erroneous was preceded by the more appropriate instruction‐‐omitted

15 by Cuomo‐‐that ʺ[a]ccess without authorization means to access a computer without the

16 permission of the computerʹs owner.ʺ (Tr. 722 (emphases added).)

17 Finally, as discussed in Part II.A.1. above, Van Buren indicated that

18 identity ʺauthentication, which turns on whether a userʹs credentials allow him to

20 1 proceed past a computerʹs access gate,ʺ constitutes ʺa specific type of authorization.ʺ

2

n.9 (internal quotation marks omitted (emphasis ours)). The

3 instruction here that a user who accesses a computer by bypassing the authentication

4 requirement can be found to have accessed the computer ʺwithout authorizationʺ was

5 not error, much less an error that was ʺplain.ʺ

6 B. Social‐Security‐Number Misuse

7 Cuomo contends that his convictions on counts 13 and 12‐‐misuse of a

8 social security number and conspiracy to misuse social security numbers,

9 respectively‐‐should be reversed on the grounds that the district court gave an

10 erroneous instruction as to the elements of such misuse and erred in failing to instruct

11 the jury as to the theory of his defense, and that under his proposed instructions the

12 evidence was insufficient to support his convictions on those charges. These

13 arguments are meritless.

14 The Social Security Act,

et seq., makes it a felony for any

15 person to, inter alia,

16 for the purpose of obtaining anything of value from any person, 17 or for any other purpose‐‐

21 1 ....

2 (B) with intent to deceive, falsely represent[] a number to 3 be the social security account number assigned by the 4 Commissioner of Social Security to him or to another person, 5 when in fact such number is not the social security account 6 number assigned by the Commissioner of Social Security to him 7 or to such other person.

8

(a)(7)(B) (emphases added). The district court instructed the jury that

9 the government was required to prove beyond a reasonable doubt that Cuomo, inter

10 alia, ʺknowingly represented to New York State that the social security number described

11 inʺ Count 13 ʺhad been assigned to him by the Commissioner of Social Security.ʺ

12 (Tr. 738 (emphasis added).) As to the ʺintent to deceiveʺ element, the court instructed

13 that

14 [t]o act with intent to deceive means to act with the intention of 15 misleading or giving false information. However, it is not 16 necessary for the government to prove that anyone was actually deceived 17 or misled.

18 (Id. at 740 (emphasis added).)

19 Cuomo objected to these instructions; he had requested that the jury be

20 instructed that it needed to find that his claimed ownership and use of the debtorʹs

21 social security number constituted a misrepresentation to ʺsomeoneʺ‐‐presumably a

22 live person (see generally Cuomo brief on appeal at 36‐37). His proposed change to the

22 1 ʺrepresented to New York Stateʺ part of the courtʹs instruction would have replaced

2 ʺNew York Stateʺ with ʺsomeoneʺ; and as to the ʺintent to deceiveʺ element, his

3 proposed substitute would have told the jury that it needed to find that Cuomo

4 ʺintended to deceive someone for any purpose,ʺ and that ʺ[t]o ʹact with intent to

5 deceiveʹ simply means to act deliberately for the purpose of misleading someone.ʺ

6 (Cuomoʹs Proposed Jury Charge at 4 (emphases added); see Tr. 755‐58.)

7 Cuomoʹs rationale is that these changes would have supported his

8 ʺdefense theory,ʺ which was ʺthat the intent to defraud required by Section 408 must

9 be directed at someone, a victim deceived by the fraudʺ (Cuomo brief on appeal at 36

10 (emphasis added)), a ʺvictimʺ who was a natural person. Thus, Cuomo argued to the

11 district court that he was entitled to his proposed ʺsomeoneʺ language because the

12 government had ʺbrought no one in who said I worked for the department of labor

13 as a claim examiner and I was looking at thisʺ (Tr. 757). And his attorney in

14 summation pursued this line, asking ʺʹwho is Mr. Cuomo intending to deceive? The

15 website? The computer? That was not his intention. His intention was to get the

16 POE information and sell it.ʹʺ (Cuomo brief on appeal at 36 (quoting Tr. 817).)

17 A defendant is not entitled to have the court give his proposed

18 instruction to the jury unless it is, inter alia, legally correct. See, e.g., United States v.

23 1 Prawl,

(2d Cir. 1999). Cuomoʹs proposed language would not have

2 been a correct instruction.

3 To begin with, his theory that to violate § 408 there must have been ʺa

4 victim deceived by the fraudʺ (Cuomo brief on appeal at 36 (emphasis added)) finds no

5 support in the language of the statute. Section 408(a)(7)(B) does not require that the

6 defendantʹs social‐security‐number misuse with ʺintent to deceiveʺ have been

7 successful. The courtʹs instruction that ʺit was not necessary for the government to

8 prove that anyone was actually deceived or misledʺ was correct.

9 Second, Cuomoʹs repeated proposed references to ʺsomeoneʺ‐‐along with

10 defense counselʹs rhetorical questions ʺwho is Mr. Cuomo intending to deceive? The

11 website? The computer?ʺ (Tr. 817), and his request to omit the reference to ʺNew

12 York Stateʺ‐‐were apparently intended to imply that one could not be prohibited

13 from, or punished for, acting with intent to deceive or defraud a government. Such

14 an implication would have been misleading and of course is fallacious, see generally

15

(prohibiting frauds, or conspiracy to defraud, the United States

16 Government); see also United States v. Yermian,

, 73 n.12 (1984) (to ʺ[d]eceive

17 is to cause to believe the false or to misleadʺ (internal quotation marks omitted)); N.Y.

18 Penal Law § 195.20(a)(i) (McKinney 2024) (prohibiting schemes to defraud the State

24 1 of New York or any of its political subdivisions or instrumentalities by means of, inter

2 alia, ʺfalse . . . pretenses [or] representationsʺ). The district court was not required to

3 instruct the jury in accordance with Cuomoʹs erroneous legal theories.

4 Nor, with § 408(a)(7)(B) properly interpreted, as it was by the court, is

5 there any merit in Cuomoʹs contention that the evidence was insufficient to support

6 his convictions with respect to social‐security‐number misuse. As described in Part

7 II.A.2. above, New York State required that a user seeking to access employment

8 records stored on the New York State computer provide the userʹs own social security

9 number; the gate was ʺput into place to prevent people from seeing records of other

10 peopleʺ (Tr. 156; see id. at 151‐52; see also id. at 278 (Paymerica employees skip traced

11 in some 15‐20 states, all of which required user‐identity verification through social

12 security numbers).) As described in Part I.A. above, to circumvent New Yorkʹs

13 identity verification requirement, Cuomo falsely created ny.gov accounts in the

14 names of debtors whose POE information he wanted to get for his customers; and

15 when, as the user, he was asked for his social security number he entered not his own

16 social security number but the numbers of the debtors. (See id. at 582‐92.) And, as

17 Cuomoʹs attorney summarized at trial, Cuomoʹs ʺʹintention was to get the POE

25 1 information and sell it.ʹʺ (Cuomo brief on appeal at 36 (quoting Tr. 817 (his attorneyʹs

2 summation).)

3 In sum, the evidence was ample to allow the jury to find that Cuomo,

4 with intent to deceive state governments, provided debtorsʹ social security numbers,

5 falsely claiming they were his own‐‐and conspired to do so‐‐in order to obtain access

6 to and sell debtorsʹ POE information to Paymericaʹs customers, in violation of

7

(a)(7)(B) and

.

8 C. Aggravated Identity Theft

9 Cuomo was convicted on two counts (Counts 7 and 18) of aggravated

10 identity theft under 18 U.S.C. § 1028A(a). That subsection provides, in relevant part,

11 that any person who

12 during and in relation to any felony violation enumerated in subsection 13 (c), knowingly . . . uses, without lawful authority, a means of 14 identification of another person shall, in addition to the punishment 15 provided for such felony, be sentenced to a term of imprisonment 16 of 2 years.

17 18 U.S.C. § 1028A(a)(1) (emphases added). Subsection (c) defines the predicate

18 ʺfelony violation[s]ʺ to include two categories applicable to Cuomoʹs conduct:

19 ʺsection 208 . . . of the Social Security Act (

[)],ʺ see 18 U.S.C.

26 1 § 1028A(c)(11), and most provisions in Chapter 47 of Title 18 ʺrelating to fraud,ʺ

2 which include §§ 1030(a)(2) and (b), see 18 U.S.C. § 1028A(c)(4).

3 Cuomo contends that the evidence was insufficient to support his

4 convictions for aggravated identity theft, arguing principally that there was

5 insufficient evidence of the predicate felonies, i.e., of computer fraud in violation of

6

for Count 7, and of social‐security‐number misuse in violation of

7

for Count 18. These contentions lack merit. As discussed in Parts II.A.

8 and B. above, the evidence to support the verdicts that Cuomo engaged in,

9 respectively, computer‐fraud offenses in violation of §§ 1030(a) and (b), and offenses

10 relating to social‐security‐number misuse in violation of

(a)(7)(B) and

11

, was ample.

12 We are unpersuaded by Cuomoʹs contention that a different result is

13 required by the Supreme Courtʹs recent decision in Dubin v. United States,

(2023). Dubin involved an aggravated‐identity‐theft prosecution premised on the

15 defendantʹs ʺʹus[ing]ʹ a patientʹs means of identification ʹin relation toʹ healthcare

16 fraud,ʺ a federal offense under

. Dubin, 599 U.S. at 116‐17. The fraud,

17 however, was that the defendant claimed Medicaid reimbursement for psychological

18 testing by a licensed psychologist when the employee who actually performed the

27 1 testing was only a licensed psychological associate. The Supreme Court held that this

2 fraud was not a proper predicate for aggravated identity theft under § 1028A(a)(1)

3 because the

4 use of the patientʹs name was not at the crux of what made the 5 underlying overbilling fraudulent. The crux of the healthcare 6 fraud was a misrepresentation about the qualifications of 7 [defendantʹs] employee. The patientʹs name was an ancillary 8 feature of the billing method employed.

9

. ʺ[W]ith fraud or deceit crimes like the one in this case, the means of

10 identification specifically must be used in a manner that is fraudulent or deceptive.ʺ

11 at 131‐32 (emphases added).

12 This interpretation of 18 U.S.C. § 1028A(a)(1) and its appropriate felony

13 predicates affords no relief for Cuomo, whose use of the social security numbers of

14 debtors was both fraudulent and deceptive: As ʺcooperating witnesses . . . testified[,]

15 . . . the entire process was about impersonating debtors,ʺ and ʺwas done so that the

16 states would falsely recognize Paymerica employees as the target debtors and provide

17 [to Paymerica] restricted POE information meant only for those debtors,ʺ D.Ct. Op.

18 at 6‐7.

19 In sum, Cuomoʹs contentions provide no basis for setting aside the juryʹs

20 verdicts.

28 1 III. SENTENCING CHALLENGES

2 As indicated in Part I.B. above, Cuomoʹs sentence to 45 monthsʹ

3 imprisonment included 21 months for the computer‐related and social‐security‐

4 number‐misuse counts. In calculating the Guidelines‐recommended sentences for

5 these offenses, the district court adopted the fact descriptions and recommendations

6 of the presentence report (ʺPSRʺ) for several increases in his Guidelines offense level.

7 (See Sentencing Transcript, August 11, 2022 (ʺS.Tr.ʺ), at 3.) Cuomoʹs base offense level

8 was 6. His total offense level was 16, resulting from (A) three enhancements for

9 specific offense characteristics, i.e., (1) two steps under § 2B1.1(b)(2)(A)(i) because the

10 offense involved 10 or more victims, (2) two steps under § 2B1.1(b)(10)(C) because it

11 involved sophisticated means, and (3) two steps under § 2B1.1(b)(18) because it

12 involved an intent to obtain personal information, and (B) a four‐step upward

13 adjustment under § 3B1.1(a) because of his leadership role in the criminal activity. On

14 appeal, Cuomo challenges the increases with respect to personal information and

15 leadership role.

16 We review the ʺreasonableness of sentencing decisions for abuse of

17 discretion, a standard incorporat[ing] de novo review of questions of law, including

29 1 . . . interpretation of the Guidelines, and clear error review of questions of fact.ʺ

2 United States v. Taylor,

(2d Cir. 2020) (internal quotation marks

3 omitted).

4 A. Cuomoʹs Role

5 The Guidelines recommend a four‐step increase in offense level for a

6 ʺdefendant [who] was an organizer or leader of a criminal activity that involved five

7 or more participants,ʺ Guidelines § 3B1.1(a)‐‐including the defendant, see, e.g., United

8 States v. Paccione,

(2d Cir.) (ʺPaccioneʺ), cert. denied,

9 (2000). ʺWhether a defendant is considered a leader depends upon the degree of

10 discretion exercised by him, the nature and degree of his participation in planning or

11 organizing the offense, and the degree of control and authority exercised over the

12 other members of the conspiracy.ʺ United States v. Beaulieau,

, 379‐80 (2d

13 Cir. 1992). A defendant may be a leader of a crime even if it was planned, financed,

14 and orchestrated by another participant. See, e.g., United States v. Williams,

629, 635 (2d Cir.), cert. denied,

(1994).

16 We review the district courtʹs conclusion that a defendant met the criteria

17 for ʺa leadership enhancement under U.S.S.G. § 3B1.1(a) de novo, but review the

30 1 courtʹs findings of fact supporting its conclusion for clear error.ʺ See, e.g., Paccione, 202

2 F.3d at 624. Sentencing judges are ʺgiven latitude concerning their supervisory role

3 findings, even when their findings were not as precise as they might have been,ʺ

4 United States v. Napoli,

(2d Cir. 1999) (ʺNapoliʺ) (internal quotation marks

5 omitted), cert. denied,

(2000), so long as their findings are sufficient to

6 permit meaningful appellate review, see, e.g., United States v. Ware,

,

7 451‐52 (2d Cir. 2009), cert. denied,

(2010).

8 The district court, in addressing Cuomoʹs role, stated as follows:

9 Iʹve looked at the nature and scope of the illegal activity, the 10 degree with which this defendant oversaw this illegal conspiracy. 11 And I find that based upon the fact that this defendant incorporated 12 and was president of Ameripay; that this defendant established the 13 account with TLO which allowed him to get information about 14 debtors and that this defendant used both Ameripay and Paymerica to 15 get the identity of debtors; also that he managed co‐conspirators . . . ; 16 that his employees characterize this defendant as a manager when Mr. 17 Trowbridge was not present; . . . [and] this defendant was very involved 18 with a number of these supposed debtors.

19 (Sentencing Tr. 6‐7 (emphases added).)

20 Cuomo challenges the sufficiency of the courtʹs findings, stating

21 principally that the TLO account was a ʺlegitimate business expense for anyone

22 involved in pursuing judgment debtors,ʺ that ʺ[t]he employees were not Cuomoʹs

31 1 employees,ʺ and that ʺ[t]here were no ʹsupposed debtorsʹ in this case. Ameripay

2 pursued debtors who had court judgments against them.ʺ (Cuomo brief on appeal

3 at 42 (emphasis in original).) He also argues that the district court ignored ʺample

4 evidence that Trowbridge was the sole manager and leader.ʺ (Id.) These arguments

5 are wide of the mark.

6 The test for reviewing the courtʹs findings is not whether there were

7 legitimate aspects of the business of Ameripay and Paymerica, or whether the

8 individuals who did most of the skip‐tracing were employees of Cuomo personally,

9 rather than of the company he incorporated and its affiliate, or even whether there

10 was evidence from which the court could have ruled differently. Rather, the

11 ʺsentencing courtʹs findings as to the defendantʹs role in the offense will be

12 overturned only if they are clearly erroneous.ʺ Napoli,

(internal

13 quotation marks omitted). And ʺ[w]here there are two permissible views of the

14 evidence, the factfinderʹs choice between them cannot be clearly erroneous.ʺ Anderson

15 v. City of Bessemer City,

(1985).

16 The district courtʹs findings that Cuomo was Ameripayʹs founder and

17 president and that he managed other coconspirators are supported by testimony and

18 documents in the trial record. Ameripayʹs corporate documents showed Cuomo as

32 1 its founder and president. Multiple witnesses who worked at Paymerica also testified

2 that Cuomo was ʺsecond in commandʺ to Trowbridge (e.g., Tr. 354, 389), and that

3 Cuomo supervised the skiptracers (id. at 460), ʺauditedʺ their time and attendance (id.

4 at 559) and the quality of their performance (id. at 463), and reported to Trowbridge

5 on their productivity or on their ʺgoofing offʺ (id. at 433). As summarized in the PSR,

6 whose factual descriptions the sentencing judge expressly adopted, Paymerica

7 employees characterized Cuomo as being in charge when Trowbridge was not

8 present, and Trowbridge traveled ʺa lot.ʺ

9 We see no clear error in the sentencing courtʹs findings as to Cuomoʹs

10 leadership role in the conspiracy, which demonstrate that Cuomo was intimately

11 involved in organizing and planning the conspiracy and that he exercised direct

12 authority over most of his coconspirators. We thus affirm the imposition of the four‐

13 step enhancement based on Cuomoʹs leadership role.

14 B. Personal Information

15 The Guidelines recommend a two‐step increase in offense level if ʺthe

16 defendant was convicted of an offense under

, and the offense

33 1 involved an intent to obtain personal information.ʺ Guidelines § 2B1.1(b)(18)(A).

2 ʺʹPersonal informationʹʺ is defined to

3 mean[] sensitive or private information involving an identifiable 4 individual (including such information in the possession of a third 5 party), including (A) medical records; (B) wills; (C) diaries; (D) 6 private correspondence, including e‐mail; (E) financial records; (F) 7 photographs of a sensitive or private nature; or (G) similar 8 information.

9 Guidelines § 2B1.1, Application Note 1 (emphasis added).

10 Cuomo contends that ʺ[t]his enhancement is inapplicableʺ because

11 ʺplaces of employment are not listed in the definition.ʺ (Cuomo brief on appeal at 44.)

12 But we need not reach this issue. ʺAn error in Guidelines calculation is harmless if

13 correcting the error would result in no change to the Guidelines offense level and

14 sentencing range.ʺ United States v. Cramer,

(2d Cir. 2015). The

15 Guidelines provide that appropriate offense‐characteristic enhancements are to be

16 applied before the application of adjustments on account of the defendantʹs role, see

17 Guidelines § 1B1.1(a); and without the personal‐information enhancement, the two‐

18 step increases for each of the other two offense‐characteristic enhancements (number

19 of victims and sophisticated means) would have increased Cuomoʹs offense level

20 from 6 to level 10. However, the guideline establishing the sophisticated‐means

34 1 enhancement‐‐whose applicability Cuomo does not challenge on appeal‐‐(see

2 Government brief on appeal at 75; Cuomo reply brief on appeal at 21)‐‐while initially

3 providing for a two‐step enhancement, dictates that ʺ[i]f the resulting offense level is

4 less than level 12, increase to level 12,ʺ see Guidelines § 2B1.1(b)(10)(C) (emphasis

5 added). Accordingly, even if Cuomoʹs challenge to the application of the personal‐

6 information enhancement were successful, the sophisticated‐means enhancement

7 would increase his enhanced offense level to level 12. The four‐step adjustment for

8 his leadership role increases his offense level to level 16, leaving his total offense level

9 and sentencing range unchanged.

10 CONCLUSION

11 We have considered all of Cuomoʹs contentions on this appeal and have

12 found them to be without merit. The judgment of the district court is affirmed.

35