In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 22-3221 UNITED STATES OF AMERICA, Plaintiff-Appellee, v.

CHRISTOPHER JOHNSON, Defendant-Appellant. ____________________

Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cr-00277-7 — John F. Kness, Judge. ____________________

ARGUED OCTOBER 30, 2023 — DECIDED JUNE 18, 2024 ____________________

Before EASTERBROOK, RIPPLE, and SCUDDER, Circuit Judges. PER CURIAM. Christopher Johnson purchased stolen data for thousands of credit cards. He then used this data to pro- duce counterfeit cards. He was indicted and pleaded guilty to wire fraud and to aggravated identity theft. At sentencing, the district court, when calculating the loss under U.S.S.G. § 2B1.1, deferred to the guidelines commentary and therefore assessed a $500 minimum loss for each card. Mr. Johnson ar- gued at sentencing and now contends on appeal that under 2 No. 22-3221

the standard articulated by the Supreme Court in Kisor v. Wilkie, 588 U.S. 558 (2019), the guidelines commentary is not entitled to deference as an interpretation of § 2B1.1. At the time of Mr. Johnson’s sentencing, we had not had occasion to address whether Kisor applies to guidelines commentary. We have since concluded that Kisor does not disturb the Supreme Court’s holding in Stinson v. United States, 508 U.S. 36, 38 (1993), that guidelines commentary is “authoritative unless it violates the Constitution or a federal statute, or is inconsistent with, or a plainly erroneous reading of” the guideline it inter- prets. The guidelines commentary assessing $500 minimum loss per credit card therefore remains binding under Stinson. Accordingly, we affirm the judgment of the district court. I BACKGROUND Between April 2017 and November 2019, Mr. Johnson reg- ularly purchased stolen credit card data from an online ven- dor. By January 1, 2019, he had purchased stolen data corre- sponding to at least 4,265 payment cards. 1 He also attempted to purchase the data for an additional 6,683 payment cards, but he did not complete these purchases after the website identified the data as invalid. Mr. Johnson created counterfeit credit cards by encoding the stolen data onto the magnetic strips of plastic payment cards embossed with other names

1 Law enforcement could not ascertain the number of cards Mr. Johnson

purchased between January and November 2019. No. 22-3221 3

and numbers. He then used these counterfeit cards to make routine purchases. Law enforcement authorities ultimately obtained fraudu- lent use information for 1,317 of the 4,265 payment card ac- counts traced to Mr. Johnson. Of these 1,317 accounts, 576 re- ported fraud. The fraudulent charges identified for these 576 cards totaled $87,570. This figure does not represent the total loss suffered by victims as a result of Mr. Johnson’s con- duct. Mr. Johnson was indicted for and pleaded guilty to wire fraud, in violation of 18 U.S.C. § 1343, and aggravated identity theft, in violation of 18 U.S.C. § 1028A(a)(1). The Presentence Investigation Report (“PSR”) placed Mr. Johnson’s total of- fense level at 24. This offense level included a 16-level en- hancement assessed under U.S.S.G. § 2B1.1(b)(1) based on a loss calculation of $2,132,500. In calculating this loss, the Pro- bation Office followed Application Note 3(F)(i) to § 2B1.1, which states: In a case involving any counterfeit access device or unauthorized access device, loss includes any unauthorized charges made with the counter- feit access device or unauthorized access device and shall be not less than $500 per access device. Each stolen payment card account purchased by Mr. Johnson is a counterfeit access device. The $500 minimum loss multi- plied by the 4,265 payment card accounts equaled $2,132,500. Based on Mr. Johnson’s offense level of 24 and a criminal his- tory category of I, the Probation Office calculated a guidelines range of 51–63 months on the wire fraud offense. The aggra- vated identity theft carried a mandatory sentence of two years 4 No. 22-3221

to be served consecutively to the term of imprisonment im- posed on the wire fraud conviction. 18 U.S.C. § 1028A(a)(1). Mr. Johnson objected to the PSR’s deference to Applica- tion Note 3(F)(i) in calculating the loss. He submitted that the Supreme Court’s 2019 decision in Kisor modified the standard set forth by the Court in Stinson that courts must defer to guidelines commentary so long as it is not inconsistent with the Guidelines. Under Kisor, Mr. Johnson contended, Appli- cation Note 3(F)(i) was not entitled to deference as an inter- pretation of § 2B1.1 because the term “loss” within § 2B1.1 un- ambiguously meant the actual loss suffered and was thus lim- ited to the identifiable actual loss of $87,570. Such a loss cal- culation would have corresponded to a 6-level, rather than a 16-level, enhancement. The district court denied Mr. Johnson’s objection to the $500 multiplier and applied the 16-level enhancement under § 2B1.1. The court determined that Kisor had “clarified the cir- cumstances under which deference is owed” to guidelines commentary. 2 It then held, however, that Application Note 3(F)(i) was still entitled to deference because “loss” in the con- text of § 2B1.1 is a genuinely ambiguous term and the mini- mum loss amount is a reasonable interpretation of that term. The district court further explained that even if it had not de- ferred to Application Note 3(F)(i), it would still have assessed a loss of $500 per card because the Sentencing Commission’s

2 Sent. Tr. at 18. No. 22-3221 5

reliance on data 3 provides a reasonable determination of the intended loss. The district court sentenced Mr. Johnson to a term of 58 months’ imprisonment: 34 months for wire fraud and the mandatory 24 months for aggravated identity theft. The dis- trict court found, when addressing the 18 U.S.C. § 3553(a) fac- tors, that the $500 per card figure was “a reasonable short- hand for identifying the harm of buying multiple cards, even if [Mr. Johnson] didn’t use them.” 4 It concluded that the loss and the harm suffered as a result of Mr. Johnson’s conduct

3 The Guidelines Manual has included a minimum-loss amount for stolen

credit cards since its inception. Commentary on the initial iteration of § 2B1.1 stated that “loss includes any unauthorized charges made with stolen credit cards, but in no event less than $100 per card.” U.S.S.G. § 2B1.1 n.4 (1987). In 2000, the Sentencing Commission amended the Guidelines to replace the $100 amount for stolen credit cards with a $500 minimum-loss amount extending to all unauthorized access devices. U.S.S.G. supp. app. C, 57 (amend. 596). This amendment sprung from a review of the Guidelines relating to identity theft charges prompted by the Wireless Telephone Protection Act, Pub. L. No. 105-172, § 2(e)(1), 112 Stat. 53, 55 (1998), and the Identity Theft and Assumption Deterrence Act, Pub. L. No. 105-318, § 4(a), 112 Stat. 3007 (1998). In conducting this review, the Commission chartered a study to compile and review loss data for credit card fraud and phone cloning. Econ. Crimes Pol’y Team, U.S. Sent’g Comm’n, Cellular Telephone Clon- ing Final Report (Jan. 27, 2000). Using the Commission’s own dataset of 109 credit card fraud cases, where the exact amount of charges was known, this team calculated the average loss to be $3,775 per credit card. Industry data, cited by the Treasury Department, indicated an average fraud loss of $1,040 per credit card in 1998 and an average fraud loss of $2,218 per credit card in 1999. Id. at 18. 4 Sent. Tr. at 75. 6 No. 22-3221

went beyond the traceable loss of $87,570 given the number of cards and the 30-month length of the scheme. Mr. Johnson appealed. II DISCUSSION Mr. Johnson challenges the district court’s deference to Application Note 3(F)(i) because he believes the Supreme Court’s decision in Kisor modified the Stinson standard for de- termining when courts must defer to guidelines commentary. Earlier this year, in United States v. White, 97 F.4th 532, 539 (7th Cir. 2024), we rejected that view and concluded that Kisor does not “unsettle” Stinson. Therefore, applying Stinson, we hold that Application Note 3(F)(i) is entitled to deference. In Stinson, the Supreme Court held that “commentary in the Guidelines Manual that interprets or explains a guideline is authoritative unless it violates the Constitution or a federal statute, or is inconsistent with, or a plainly erroneous reading of, that guideline.” 508 U.S. at 38. The Court derived this for- mulation from the deference due an agency’s interpretation of its own regulations under Bowles v. Seminole Rock & Sand Co., 325 U.S. 410, 414 (1945). 5 Accepting that “the analogy is not precise,” the Court reasoned in Stinson that guideline commentary should “be treated as an agency’s interpretation of its own legislative rule.” 508 U.S. at 44. In 2019, in Kisor, the Supreme Court reconsidered the def- erence afforded to an agency’s interpretations of its own rules. Although declining to overrule Seminole Rock, the Court

5 See Stinson v. United States, 508 U.S. 36, 45 (1993). No. 22-3221 7

identified elements that must be met for its deference to ap- ply. “First and foremost,” the regulation must be genuinely ambiguous after exhausting the traditional tools of construc- tion. Kisor, 588 U.S. at 574. Second, the agency’s interpretation of the regulation must be reasonable; it must “come within the zone of ambiguity the court has identified after employing all its interpretive tools.” Id. at 575–76. Third, “the character and context of the agency interpretation” must entitle it to “controlling weight.” Id. at 576. More precisely, to merit this controlling weight, the interpretation “must be the agency’s ‘authoritative’ or ‘official position,’” “implicate its substan- tive expertise,” and “reflect ‘fair and considered judgment.’” Id. at 577, 578, 579. 6 In White, we held that Kisor does not modify the deference owed to guidelines commentary. 7 We discussed two principal

6 Citing United States v. Mead Corp., 533 U.S. 218, 257–59 (2001) (Scalia, J.,

dissenting); Christopher v. SmithKline Beecham Corp., 567 U.S. 142, 155 (2012). 7 Our sister circuits are divided as to whether Kisor’s prerequisites for the

deference owed to agency interpretations also apply to the deference owed to guidelines commentary. Several circuits have held that Kisor does modify Stinson. United States v. Castillo, 69 F.4th 648, 656 (9th Cir. 2023); United States v. Dupree, 57 F.4th 1269, 1275 (11th Cir. 2023) (en banc); United States v. Nasir, 17 F.4th 459, 471 (3d Cir. 2021) (en banc); United States v. Riccardi, 989 F.3d 476, 485 (6th Cir. 2021). But the Courts of Appeals for the Fifth and Tenth Circuits have held that Kisor does not apply to guidelines commentary. United States v. Vargas, 74 F.4th 673, 683 (5th Cir. 2023) (en banc); United States v. Maloid, 71 F.4th 795, 807 (10th Cir. 2023). Panels in the Court of Appeals for the Fourth Circuit have reached both conclusions. United States v. Moses, 23 F.4th 347, 357 (4th Cir. 2022) (holding that Kisor does not apply to guidelines commentary); United States v. Campbell, 22 F.4th 438, 445 (4th Cir. 2022) (applying Kisor to guidelines commen- tary). 8 No. 22-3221

reasons for this conclusion. First, as the Supreme Court recog- nized in Stinson, the analogy of the Sentencing Commission to executive agencies is imperfect. The Commission “is an in- dependent commission within the judicial branch” with unique characteristics “that affect the deference calculus.” White, 97 F.4th at 538–39. Second, and “[p]erhaps more im- portantly, the [Supreme] Court said nothing in Kisor to sug- gest that it was altering Stinson.” Id. at 539. The Court has cau- tioned us against “find[ing] its decisions overruled by impli- cation.” Id. We thus apply Stinson undisturbed by Kisor. Under Stin- son, an application note interpreting a guideline “is binding authority ‘unless it violates the Constitution or a federal stat- ute, or is inconsistent with, or a plainly erroneous reading of, that guideline.’” United States v. Smith, 989 F.3d 575, 584 (7th Cir. 2021) (citing Stinson, 508 U.S. at 45). Here, as Mr. Johnson does not contend that the $500 minimum loss violates the Constitution or any federal statute, we are bound to apply Application Note 3(F)(i) as an “authoritative gloss[]” on § 2B1.1 unless it conflicts with the text of the Guideline. Id. (quoting United States v. Raupp, 677 F.3d 756, 759 (7th Cir. 2012)). Application Note 3(F)(i)’s requirement that at least $500 in loss be assessed per access device is not inconsistent with or a plainly erroneous reading of § 2B1.1. The text of § 2B1.1 nei- ther defines “loss” nor explains how loss should be assessed. It merely provides a scale of graduated offense levels based on loss amounts expressed in dollars. It thus does not limit “loss” to an exact accounting of the actual and traceable losses suffered by the victims. “The general rule is that the amount of loss is the greater of actual or intended loss.” United States No. 22-3221 9

v. King, 861 F.3d 692, 694 (7th Cir. 2017); U.S.S.G. § 2B1.1, n.3. A district court’s loss calculation “need only be a reasonable estimate of the loss.” United States v. Green, 648 F.3d 569, 583 (7th Cir. 2011); U.S.S.G. § 2B1.1, n.3(C). We have affirmed repeatedly sentences applying the $500- per-card minimum. In United States v. Moore, 788 F.3d 693, 695 (7th Cir. 2015), we held that the $500 minimum loss applied to all unauthorized access devices seized in a case, not only those “proven to have been tendered to a vendor in efforts to fraudulently acquire goods or services.” In United States v. Popovski, 872 F.3d 552, 554 (7th Cir. 2017), we held that the district court was “entitled to rely on the rule in Application Note 3(F)(i) without requiring card-by-card proof of function- ality while the scheme was in operation.” In King, 861 F.3d at 695, we rejected the argument that the statutory parsimony principle allowed a defendant to argue that a guideline calcu- lation made using the $500 per-device minimum should be lowered before the § 3553(a) analysis. Our holding that the application note is entitled to control- ling weight does not mean that the $500 minimum loss can never produce an unduly harsh sentence. “[A]ll sentences must be reasonable in light of the criteria in 18 U.S.C. § 3553(a), no matter what the Sentencing Guidelines say.” Popovski, 872 F.3d at 554 (citing United States v. Booker, 543 U.S. 220 (2005)). “If a calculation under Application Note 3(F)(i) overstates the seriousness of the offense, a district judge must adjust accordingly.” Id. However, this adjustment must come “after the district court has applied the Guidelines to deter- mine a final guideline range.” King, 861 F.3d at 696. 10 No. 22-3221

Conclusion For the reasons stated, Mr. Johnson’s sentence is affirmed. AFFIRMED