Opinion
CRIMINAL ACTION NO. 5:12-CR-118-KKC-REW
01-08-2018
UNITED STATES OF AMERICA, Plaintiff, v. IBRAHIMSHAH SHAHULHAMEED, Defendant.
OPINION & ORDER
*** *** ***
This matter is before the Court on a report and recommendation (DE 144) from Magistrate Judge Robert E. Wier. For the following reasons, defendant Shahulhameed's objections (DE 147) are DENIED and the Court follows the recommended disposition (DE 144).
I. BACKGROUND
Prior to August 23, 2012, Shahulhameed worked for GlobalSource IT as a contractor in the IT department of Toyota, providing general support to Toyota's IT infrastructure. On the evening of August 23, 2012, Shahulhameed was fired. (DE 131 at 1). During the early hours of August 24, 2012, "Toyota experienced a cyberattack that rendered several of its computer servers inoperable." (DE 131 at 1). Toyota claimed, and it was later corroborated by the FBI and an independent investigator, that the attack came from Shahulhameed's Toyota-owned laptop and username. "Toyota employees spent 2,133 hours responding to the cyberattack between August 24 and October 30, 2012," costing the company an estimated $152,070 to respond. (DE 131 at 6).
Shahulhameed was charged with violating 18 U.S.C. § 1030(a)(5), by knowingly transmitting and intentionally causing damage without authorization to a protected computer. (DE 1). At trial, a jury convicted Shahulhameed of the sole count. (DE 95). On June 4, 2014, this Court sentenced Shahulhameed to a total prison sentence of 48 months followed by a 3-year term of supervised release. (DE 111). Shahulhameed appealed and the United States Court of Appeals for the Sixth Circuit affirmed. (DE 131).
Shahulhameed timely submitted the current § 2255 petition on August 8, 2016. After receiving arguments from both parties, Magistrate Judge Robert E. Wier issued a report and recommendation to this Court. (DE 144). The Magistrate Judge determined that Shahulhameed had failed to show any basis for relief, and recommended this Court reject all claims. Shahulhameed's objections to the Magistrate Judge's findings are reviewed below.
II. ANALYSIS
A. Legal Standards
For relief under 28 U.S.C. § 2255, Shahulhameed "must allege as a basis for relief: (1) an error of constitutional magnitude; (2) a sentence imposed outside the statutory limits; or (3) an error of fact or law that was so fundamental as to render the entire proceeding invalid." Pough v. United States, 442 F.3d 959, 964 (6th Cir. 2006) (quoting Mallett v. United States, 334 F.3d 491, 496-497 (6th Cir. 2003)). In making a § 2255 motion, a movant generally bears the burden of proving factual assertions by a preponderance of the evidence. See McQueen v. United States, 58 F.App'x 73, 76 (6th Cir. 2003) (per curiam).
This Court makes a de novo determination of those portions of a recommended disposition to which objections are made. See 28 U.S.C. § 636(b)(1)(c). In this case, Shahulhameed has made objections to the Magistrate Judge's finding that this Court had subject-matter jurisdiction over the indicted offence, and that his retained counsel was not ineffective for failing to offer various pieces of evidence. See (DE 133-2). The Court reviews these objections below.
B. Subject-Matter Jurisdiction
In his original habeas petition, Shahulhameed argues that the Computer Fraud and Abuse Act (CFAA), under which he was convicted, does not apply to his conduct. (DE 133-1 at 3). Shahulhameed posits that the Act only applies to hacking, and not employee misappropriation. Id. Shahulhameed's argument is as follows:
If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action. "Because the CFAA is anti-hacking statute, not an employee misappropriation statute [a]nd because the 18 § U.S.C. 1030(g) statute guidelines clarifying clearly no action under this subsection for Designer/computer/software or hardware or firmware manufacture's negligent design."
(DE 133-1 at 3) (as in original).
For several reasons, the Magistrate Judge found that this argument lacked merit. (DE 144 at 6-9). Shahulhameed now objects to that finding. After de novo review, the Court finds subject-matter jurisdiction existed, and adopts the opinion of the Magistrate Judge.
In federal criminal matters, the question of jurisdiction is straightforward. See United States v. Hutsell, 2015 WL 1810679, No. 5:10-cr-78-JMH-CJS (E.D. Ky. Apr. 21, 2015). Federal district courts have subject-matter jurisdiction over all offenses against the laws of the United States. 18 U.S.C. § 3231. Generally, the jurisdiction power of § 3231 is invoked when an indictment charges that the defendant committed a crime described in Title 18 or in one of the other statutes defining federal crimes, and the indictment uses similar language to the underlying statute. See United States v. Scruggs, 714 F.3d 258, 262 (5th Cir. 2013). Here, the Indictment charged Shahulhameed with violating Title 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)(i), and tracked the language of those sections. (DE 14 at 1). Thus, subject-matter jurisdiction plainly existed.
Shahulhameed's argument that he could not be charged under the CFAA because the Act only targets hacking, rather than employee misappropriation, does not change the result. The Court notes that Shahulhameed's argument invokes the language of 18 U.S.C. 1030(g), a subsection of the Act that provides for a civil right of action. The language limiting actions in cases of negligent design invoked by Shahulhameed only limits "actions brought under this subsection," and does not purport to affect the criminal liability provisions of the CFAA. See 18 U.S.C. 1030(g). Therefore, it has no bearing on the criminal prosecution of Shahulhameed in this case, and his argument that the subsection extends immunity to his actions is rejected. (DE 147 at 2). Further, to the extent Shahulhameed's argument asks this Court to vacate his sentence because he lacks the culpability required by the statute—essentially he argues that his conduct was negligent rather than intentional—his culpability argument has been addressed and rejected on direct appeal to the Sixth Circuit. See (DE 131 at 4-5) ("Shahulhameed intentionally caused damage to Toyota's computer systems"). Neither in his objections to the Magistrate Judge's recommendation, nor in his original arguments, does Shahulhameed show that he warrants habeas relief regarding subject-matter jurisdiction.
C. Ineffective Assistance of Counsel
As another basis for relief, Shahulhameed claims that his counsel acted ineffectively at trial. A defendant claiming ineffective assistance of counsel must show (1) that counsel's performance was deficient and (2) that counsel's deficient performance prejudiced the defendant. Strickland v. Washington, 466 U.S. 668, 687 (1984).
To establish deficient performance, a person challenging a conviction must show that counsel's representation fell below an objective standard of reasonableness. A court considering a claim of ineffective assistance must apply a strong presumption that counsel's representation was within the wide range of reasonable professional assistance. The challenger's burden is to show that counsel made errors
so serious that counsel was not functioning as the 'counsel' guaranteed the defendant by the Sixth Amendment.
Harrington v. Richter, 562 U.S. 86, 104 (2011) (internal quotations and citations omitted). Further, in order to prove prejudice, a movant "must show that there is a reasonable probability that, but for counsel's unprofessional errors, the result of the proceeding would have been different." Strickland, 466 U.S. at 694.
In this case, the Magistrate Judge found that Shahulhameed failed to show either deficient performance or prejudice through his various critiques of his retained counsel. This Court reviews a habeas petitioner's specific, rather than general, objections to the Magistrate Judges recommended disposition—simply re-arguing the merits of a position, without specifying an issue of contention with how the Magistrate Judge previously reviewed that position, does not qualify as a specific objection. See Miller v. Currie, 50 F.3d 373, 380 (6th Cir. 1995); see also Scott v. LaRose, 2015 WL 1400558, No. 1:13-cv-000648 (N.D. Oh. Mar. 26, 2015). To the extent Shahulhameed lodges specific objections, see (DE 147 at 5), they are reviewed de novo by this Court.
At the outset, it should be noted that the Sixth Circuit has previously rejected Shahulhameed's argument that there was insufficient evidence to support his conviction. (DE 131 at 2). The Sixth Circuit found that, on the record in this case, a reasonable jury could have found that Shahulhameed knowingly transmitted computer codes and commands to a protected computer; he did so without authorization from Toyota; he did so with the intention to cause damage to Toyota's computer systems; and the damage caused was at least $5,000. (DE 131). A canvassing of the trial transcript shows that Shahulhameed's retained counsel mounted an aggressive defense in the face of very complex and technical evidence. "The fact that a different or better result may have been obtained if a different decision had been made, does not mean that the defendant has not had the effective assistance of counsel." O'Malley v. United States, 285 F.2d 733, 734 (6th Cir. 1961) (citing United States v. Duhart, 269 F.2d 113, 115 (2nd Cir. 1959)).
i. Authorized Access
Shahulhameed posits that his attorney acted ineffectively by failing to offer specific documents purportedly showing that specific changes were authorized, showing the specific timing of changes made, and showing he had not been fired on the night of August 23, 2012. (DE 147 at 4). The Magistrate Judge found Shahulhameed's critiques of counsel to be baseless accusations and, after review of each document submitted by Shahulhameed, the documents to be of dubious relevance with no effect on the verdict. (DE 144 at 13-23). The Magistrate Judge found that the decisions by trial counsel, including counsel's treatment of the submitted documents, were not deficient or prejudicial under Strickland. See (DE 144 at 10-12). Similar to the critique of his lawyer, Shahulhameed now critiques the Magistrate Judge by pointing, sometimes incorrectly, to issues not discussed by the Magistrate Judge, but issues that nonetheless have no relevance to the ineffective assistance of counsel analysis. Therefore, this Court rejects each of Shahulhameed's objections.
First, Shahulhameed contends that the Magistrate Judge did not "address the issue of which code/program, defendant's used authorized access (retained through contract) to perform unauthorized changes." (DE 147 at 5) (as in original). But in fact, the Magistrate Judge points out that it was through Shahulhameed's unique laptop and username that Toyota's servers were accessed (DE 144 at #); the difference between accessing non-production and client-facing servers in the context of the documents proffered by Shahulhameed (DE 144 at 15); and whether the "VI Editor" software was used to edit files in the Toyota system (DE 144 at 29-31). Regardless, Shahulhameed does not, and cannot, show that a perceived failure by the Magistrate Judge to discuss the specific code used to hack Toyota has any bearing on the ineffective assistance of counsel analysis. Put simply, Shahulhameed offers nothing to show that further discussion in this area by the Magistrate Judge would reveal that Shahulhameed's trial counsel was deficient or prejudicial under Strickland. As such, the objection is denied.
Second, Shahulhameed argues that his counsel was deficient for failing to offer a specific document as evidence that the "VI Editor" program was not used to edit files, contrary to an assumption by the Government's expert Justin Hall. (DE 147 at 9; DE 133-2 at 47-49). But the Magistrate Judge points to specific instances in which Shahulhameed's counsel furthered this argument during cross-examination. (DE 144 at 28-31). During that examination, Hall admitted that, while there was evidence of a "VI" command, evidence that the program had been opened did not in fact mean that any edits had occurred. (DE 127 at 153-154). Shahulhameed's counsel elicited agreement from Mr. Hall that he had no proof whatsoever that any edits had occurred. Id. Counsel was further able to show that Shahulhameed did not have explicitly granted root access, and had at least some limitation on his access capabilities. (DE 126 at 28). Given this evidence, the Magistrate Judge found that Shahulhameed's counsel aggressively advanced the very arguments Shahulhameed now claims he did not argue, and that the document itself has only fleeting relevance to these arguments. (DE 144 at 31). In response, and other than conclusory statements that he was prejudiced, Shahulhameed fails to show this Court that the document would have been anything but cumulative, or that failure to introduce the document constituted deficient performance, given the testimony elicited at trial.
Third, Shahulhameed argues that the Magistrate Judge "did not address defendant's issue of when authorized changes...becomes unauthorized," or whether the changes were made in the course of his normal employment. (DE 147 at 5; DE 147 at 8). This contention belies the record, as the Magistrate Judge spent a full 10-pages refuting Shahulhameed's arguments that his actions were authorized, and his attorney was ineffective in arguing such. (DE 144 at 13-23). The Magistrate Judge considered each document offered by Shahulhameed as proof of ineffective assistance of counsel, and rejected them. Now, Shahulhameed offers no new analysis, assertion, or evidence showing that his counsel's attack on authorization was deficient and prejudicial. There is simply no indication, other than previously rejected arguments or conclusory statements by Shahulhameed, that habeas relief is warranted as to this objection.
In his habeas petition, Shahulhameed argues that his counsel was ineffective for failing to introduce documents purportedly showing that the changes were made to Toyota's systems prior to August 23, 2012, and thus were made with authorization. (DE 133-1 at 42-43, 46-48). Now, Shahulhameed objects to the Magistrate Judge's recommendation because it, "does not address the fundamental issues raised in Motion §2255 on above, how these changes happened in February 2012, echoed on Toyota reports as if it occurred on August 23rd/24th." (DE 147 at 5, 7-8). This is untrue, as the Magistrate Judge specifically addressed allegations of timing inaccuracies in his recommendation. (DE 144 at 27-28). The Magistrate Judge pointed out that, while the specific documents now proffered by Shahulhameed were not introduced, "defense counsel indisputably and forcefully raised these issues." Id. In support, the Magistrate Judge pointed out that defense counsel cross-examined the Government's forensic expert on multiple instances showing discrepancies as to when the system was accessed, albeit focused on discrepancies nearer to the event in question than Shahulhameed now argues. Id. It is clear that defense counsel pursued this strategy, and despite Shahulhameed's objection, it remains unclear that failure to introduce his proffered documents was outside the realm of sound trial strategy. See Strickland, 466 U.S. at 689.
Fourth, Shahulhameed argues that the Magistrate Judge failed to consider his various arguments allegedly proving that his employment contract was improperly terminated, meaning he retained authorization to make changes in Toyota's system. (DE 147 at 6). This is incorrect, as the Magistrate Judge specifically refutes Shahulhameed's argument using the text of his proffered contract. (DE 144 at 22). Having done no more than allege that the Magistrate Judge did not consider his argument, and being incorrect in that allegation, Shahulhameed's objection is denied.
ii. Various Other Objections
Shahulhameed objects to the Magistrate Judge's analysis of his evidence of ToyotaSupplier.com's availability on the morning of August 24, 2012. (DE 147 at 6). Specifically, Shahulhameed seems to claim that the Magistrate Judge did not consider evidence of the "browser cache," and instead improperly focused on "Web Servers." Id. This is incorrect, as the Magistrate Judge acknowledged that Shahulhameed was arguing "that counsel did not introduce certain web server logs and browser logs purporting to show that the website was operational." (DE 244 at 24) (emphasis added). The Magistrate Judge goes on to detail how defense counsel substantially used this evidence at trial, pointing to counsel's use of a coinciding document on cross-examination. Id. Shahulhameed does not attack this analysis, but simply, and incorrectly, states that the Magistrate Judge did not consider the argument. The objection is therefore unfounded.
Shahulhameed also challenged the jury finding that his actions caused at least $5,000 of damage, as required by the CFAA, on direct appeal and his argument was rejected. (DE 131 at 6). In his habeas petition, Shahulhameed contends that his counsel was ineffective for not challenging the Government's calculation of damages. The Magistrate Judge rejected this argument, as does this Court. Given that the estimation was extremely detailed by both Toyota and the Government, and resulted in a damage value of over $150,000, trial counsel's decision to focus on other elements of the crime does not fall outside the realm of sound trial strategy. See Strickland, 466 U.S. at 689. Shahulhameed's objection argues that he "is not contesting the hourly rate but contesting that employees had not worked on repairing damages, Toyota calculation(s) includes only investigation hours and does not include repair hours." (DE 147 at 6). However, Toyota specifically provided documentation showing that Toyota employees spent 2,133 hours responding to the cyberattack, and hired Cincinnati Bell Technology Solutions for 200 hours of additional labor. (DE 131 at 6). Other than a bald allegation, Shahulhameed provides no evidence that these assertions are false. His objection to the Magistrate Judge's opinion is denied.
Further, Shahulhameed argues that the Magistrate Judge failed to consider that others may have been at fault, either through changes they made independently or through fraudulent use of his user account. (DE 147 at 5, 7). This is incorrect, as the Magistrate Judge specifically rejected the notion that someone other than Shahulhameed made the changes in Toyota's system. (DE 144 at 31-33). Further, Shahulhameed critiques his attorney for "failing to establish that defendant's id/password was tampered to produce evidences against defendant when he knew that other people was at the time's established on record and did no more investigation on the issue." (DE 147 at 7) (as in original). Besides this conclusory allegation, Shahulhameed points to no evidence, within the record or without, showing that such a position was capable of being proven, or that his attorney's conduct was deficient. Quite the opposite, the Magistrate Judge points out that Shahulhameed's counsel aggressively sought more information regarding the underlying Toyota record (DE 127 at 161, 169); counsel criticized the quality of the investigative record at trial (DE 127 at 42, 216); and there is no plausible proof indicating that other users were involved on this record. (DE 144 at 33). In response, Shahulhameed has not set forth facts which entitle him to relief on this objection. See O'Malley v. United States, 285 F.2d 733, 735 (6th Cir. 1961) ("When a motion is made to vacate or set aside a judgment under Section 2255, the movant must set forth facts which entitle him to relief. Conclusions, not substantiated by allegations of fact with some probability of verity, are not sufficient to [even] warrant a hearing").
D. Request For Evidentiary Hearing
Shahulhameed requests an evidentiary hearing on his pending Motion. (DE 133 at 8). This Court conducted the original trial, has reviewed the extensive transcript of that proceeding, and has been familiar with this case's subsequent stages. Here, no evidentiary hearing is necessary because the record conclusively demonstrates that Shahulhameed is not entitled to relief. See Arredondo v. United States, 178 F.3d 778, 782 (6th Cir. 1999).
E. Miscellaneous Requests
Shahulhameed has filed two other motions in addition to objecting to the Magistrate Judge's recommendation. See (DE 149, 150). Docket Entry 149 asks the Court to consider arguments made in Shahulhameed's previous motion for new trial in conjunction with his § 2255 motion. (DE 149 at 1). Shahulhameed's motion for new trial was previously rejected (DE 148), and the current motion was not filed until well after the time for filing objections to the Magistrate Judge's recommended disposition had run. See (DE 149); 28 U.S.C. § 636(b)(1). Nonetheless, review of the arguments filed in Shahulhameed's motion for new trial shows that the evidence therein was also included in Shahulhameed's § 2255 motion and has already been considered by the Magistrate Judge. See also (DE 149 at 2) ("Defendant did not raise new argument in Federal Rules of Criminal procedure33 (a) which all raised as part of motion § 2255") (as in original). Objections to the Magistrate Judge's analysis have been addressed within this opinion. Therefore, Docket Entry 149 is denied as moot.
Shahulhameed also files a "motion for final order adverse to the applicant based on Rule 11, Rules Governing Section." (DE 150) (as in original). Shuhulhameed asks the Court for relief based on a lack of subject-matter jurisdiction and due to ineffective assistance of counsel. (DE 150 at 2). The Court finds no "Rule 11" that offers such relief at this procedural posture. Nonetheless, the subject-matter jurisdiction and ineffective assistance of counsel arguments have already been filed with the Magistrate Judge, they were the thrust of Shahulhameed's § 2255 motion, and they have already been considered as objections to the Magistrate Judge's recommendation above. Therefore, Docket Entry 150 is also denied as moot.
F. Certificate of Appealability
In the case of a § 2255 petition, a certificate of appealability may issue "only if the applicant has made a substantial showing of the denial of a constitutional right." 28 U.S.C. § 2253(c)(2). The Supreme Court has further explained that the standard of § 2253(c)(2) is met when "reasonable jurists could debate whether (or, for that matter, agree that) the petition should have been resolved in a different manner." Welch v. United States, 136 S.Ct. 1257, 1263 (2016) (quoting Slack v. McDaniel, 529 U.S. 473, 484 (2000)). In this case, the issues presented are not adequate enough to deserve encouragement to proceed further, and no reasonable jury could find that Shahulhameed's claims that his counsel acted ineffectively could be resolved in a different manner. See Miller-El v. Cockrell, 537 U.S. 322, 336 (2003). As such, the recommendation of the Magistrate Judge is adopted, and no certificate of appealability shall issue.
III. CONCLUSION
For the foregoing reasons, and with the Court being otherwise sufficiently advised, it is HEREBY ORDERED that:
1) The recommended disposition (DE 144) is ADOPTED as the Court's opinion;
2) Defendant Shahulhameed's objection to the recommended disposition (DE 147) is DENIED;
3) Defendant Shahulhameed's motion under 28 U.S.C. § 2255 to vacate, set aside, or correct a sentence by a person in federal custody and request for evidentiary hearing (DE 133) is DENIED;Dated January 8, 2018.
4) Defendant Shahulhameed's motion to include supplemental evidence originally filed in his motion for new trial (DE 149) is DENIED;
5) Defendant Shahulhameed's motion for final order adverse to the applicant based on Rule 11 (DE 150) is DENIED;
6) A certificate of appealability SHALL NOT ISSUE because Defendant has failed to make a substantial showing of the denial of a constitutional right; and
7) A separate judgment shall issue.
/s/
KAREN K. CALDWELL, CHIEF JUDGE
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF KENTUCKY