United States of America, Plaintiff-appellant, v. Kenneth Steven Bailey, Defendant-appellee, 41 F.3d 413 (9th Cir. 1994)

Appellant United States of America (the "government") appeals the acquittal of Kenneth Steven Bailey ("Defendant") of charges involving production of, and trafficking in, counterfeit access devices in violation of 18 U.S.C. § 1029(a). We have jurisdiction pursuant to 28 U.S.C. § 1291 and reverse the district court.

A cellular phone places a call by transmitting its permanently assigned identification number (known as the electronic serial number or "ESN"), its assigned phone number (the Mobile Identification Number or "MIN"), and the number being called to a nearby antenna or "cell." For a local customer, the local network confirms that the ESN and MIN match before completing the call.

To accommodate customers out of their service area, local cellular networks permit phones other than those subscribing to the local service to complete calls in "roaming" mode. At the time of Defendant's activities, roaming mode was more vulnerable to fraud than was the service to local subscribers. When a call was placed by a phone with an out-of-area MIN, the local service would first determine whether there was a roaming agreement between the local carrier and the carrier responsible for the MIN (the "distant carrier"); if there was, the local carrier would connect the call unless the ESN was found in a list of invalid ESNs, known as the "negative file." In roaming mode, the local carrier could not confirm that the ESN and the MIN matched.

Defendant modified cellular telephones so as to fool the local network into permitting calls placed by those phones to be completed in roaming mode, even though the call could never be billed. This sort of scheme is known in the industry as "tumbling the ESN." The process involves altering the programming embedded in the hardware of the telephone to cause the phone to send out random ESNs. By changing the MIN in the phone to one in another area, the user could force the phone to place calls in roaming mode. Then, by transmitting any ESN not listed in the negative file, the user could trick the local carrier into connecting the call. The liability of the distant carrier for calls by "tumbler" phones is not entirely clear.¹  We assume solely for the sake of argument that the local carrier is not reimbursed by the distant carrier for such calls because the local carrier cannot establish that the call was made by a valid subscriber to the distant carrier's service.

Defendant read the program in the phone and rewrote it so that it randomly changed the ESN. He then encoded the program ("burned" it) into new chips ("EPROMs") that could replace the chips in the phones. Defendant was arrested after selling five of the modified chips to an undercover Secret Service agent. Defendant consented to a search of his motel room, which produced materials and equipment used to produce the chips, including extra chips, computer software, a data erase clip used to erase chips, and a receipt for purchase of Mitsubishi cellular phones. He admitted that he had produced and sold some 150 chips with his program to override the internal security program of the phone. The chips sold to the Secret Service agent contained modified versions of the original programs on the chips installed in Mitsubishi phones.

Defendant was indicted on January 22, 1991, for manufacturing and trafficking in counterfeit access devices, in violation of 18 U.S.C. § 1029(a) (1), and possession of equipment to make such devices, in violation of 18 U.S.C. § 1029(a) (4). A superseding indictment also charged attempted manufacture of, and traffic in, counterfeit access devices in count one. During trial, Defendant moved for acquittal on the ground that the computer chips in question were not "counterfeit access devices" within the meaning of the statute. The motion was denied. On June 1, 1992, a jury convicted Defendant of both counts. Defendant made a Rule 29 motion for a judgment of acquittal on the same basis as his earlier motion. The district court granted that motion on November 9, 1992. The government timely appeals, joined by two amici, the Cellular Telecommunications Industry Association and the Communications Fraud Control Association, and challenges the district court's interpretation of the statute.

We review de novo the district court's interpretation of section 1029. United States v. Brannan, 898 F.2d 107, 109 (9th Cir.), cert. denied, 498 U.S. 833, 111 S. Ct. 100, 112 L. Ed. 2d 71 (1990). That statute provides that " [w]hoever ... knowingly and with intent to defraud produces, uses or traffics in one or more counterfeit access devices" is guilty of an offense if it affects interstate commerce. 18 U.S.C. § 1029(a) (1). "Access device" is defined as "any card, plate, code, account number or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument)." 18 U.S.C. § 1029(e) (1). " ' [C]ounterfeit access device' means any access device that is counterfeit, fictitious, altered, or forged, or an identifiable component of an access device or a counterfeit access device." 18 U.S.C. § 1029(e) (2).

The district court decided that Defendant's handiwork did not constitute an "access device" within the meaning of the statute. The court explained its conclusion by stating that

[w]hat legislative history there is indicates that the purpose of this legislation was to prevent access to accounts.... [I]f you follow the Government's line of reasoning then even a crowbar could be an access device because you could use it to pry open an ATM machine. I mean that's a line of--that's a conclusion if you follow the Government's line of thinking, anything that you can use to get into a system that has accounts is an access device. And a crowbar would fit that definition perfectly as much as an EPROM.

The district court seemed persuaded by the idea that there was no evidence that the distant carrier ever suffered a direct accounting loss (i.e., had to disburse funds) due to the tumbling. It seemed to believe that the inability to bill for the calls was just a failure to collect additional revenue from potential customers, and that there was no additional cost to providing the additional calls. That characterization of the transaction apparently led the court to follow United States v. McNutt, 908 F.2d 561 (10th Cir. 1990), cert. denied, 498 U.S. 1084, 111 S. Ct. 955, 112 L. Ed. 2d 1043 (1991).

McNutt involved the sale of satellite TV descramblers that used electronic addresses "cloned" from a legitimate unit to allow decryption of pay television services. The Tenth Circuit ruled that such activity did not violate Sec. 1029 because the cloned descramblers did not actually debit the accounts of legitimate subscribers and the statute did not protect against indirect economic harms caused by "free riding." 908 F.2d at 564. More recently, the Tenth Circuit itself has relied on McNutt to hold that the modification of cellular phones to permit "tumbling" is not violative of Sec. 1029. United States v. Brady, 13 F.3d 334 (10th Cir. 1993).

We disagree with the conclusion of the district court. The district court erred at two points in its conclusion. First, the phones do access an account, and it is irrelevant that no third party ever ended up footing the bill. Second, its characterization of the transaction was incorrect (there was a cost), and McNutt is properly distinguished.

On appeal, Defendant argues that no "account" was involved because the ESNs broadcast by his invention did not correspond to accounts of real customers. The government responds that the statute was not meant to be so narrowly construed. The statute, unfortunately, does not define "account." The McNutt court looked to the dictionary and came up with a definition: "a formal record of debits and credits." 908 F.2d at 563 (quoting Random House Dictionary of the English Language 13 (2d ed. 1987)). We feel that definition does not really capture the meaning of the word as used in the statute. After all, it seems unlikely that Congress was worried about the literal numbers on a ledger; instead, the purpose of the statute is to deal with the abuse of new technologies that increasingly allow individuals and businesses access to goods and services without immediate payment by cash or familiar, paper instruments. When the statute refers to "account access," it evidently means access to the privileges permitted by virtue of the maintenance of an account. An alternative dictionary definition provides a better starting point for our purposes. " [A] formal business arrangement providing for regular dealings or services (as banking, advertisement, or store credit) and involving the maintenance of an account." Webster's Ninth New Collegiate Dictionary 50 (1984). See also Black's Law Dictionary 18 (6th ed. 1990) ("A detailed statement of the mutual demands in the nature of debit and credit between parties, arising out of contracts or some fiduciary relation."). In other words, an account is a contractual relationship that makes possible the provision of goods, services, or money based on payment, or the expectation of payment, at some later point in time, as described by the entry of credits and debits in a formal record.

The district court's holding turns on the idea that no account was accessed because the fabricated ESNs did not correspond to any particular customer's account for cellular service. Two other circuits, however, have decided that Sec. 1029 reaches access to unassigned accounts. In United States v. Brewer, 835 F.2d 550 (5th Cir. 1987), the Fifth Circuit held that unassigned but functioning long distance access codes, discovered by a trial-and-error process, were "access device [s]" within the meaning of Sec. 1029. The court observed that the legislative history of the statute indicated that Congress intended that the definition be broad enough to encompass technological advances. 835 F.2d at 553. The Fifth Circuit was apparently unconcerned that "accounts" to which the defendants charged calls did not result in any customer being billed. United States v. Taylor, 945 F.2d 1050 (8th Cir. 1991), involved a defendant who had discovered a method for determining valid, but unassigned, American Express card numbers. He was convicted of use of an unauthorized access device. The Eighth Circuit held that " [t]he method used here falls within section 1029. The unauthorized use of an account number covering a valid, but unassigned account, constitutes an access device by which the fraud was perpetrated." 945 F.2d at 1051. Once again, the fact that the credit card company had no recourse against actual customers was not a bar to application of the statute.

We agree with those cases that actual or potential recourse by the provider of the goods or services against the party for whose benefit the account is maintained is not a necessary element of "account access" under Sec. 1029. It matters only that the user of the access device be able to obtain goods or services from which he would otherwise be excluded.

As for the claim that no actual account was implicated by defendant's activities, we need not worry about whether or not the ESNs broadcast by the tumbling phones correspond to valid or assigned customer accounts (or whether any such condition is imposed by the statute) because we find that there unquestionably was a valid, preexisting "account" between the local and distant carriers. Contra Brady, 13 F.3d at 339 (dismissing accounts between carriers as "no more than a list of unmatched telephone calls, which are not billable"). The statute nowhere implies that the only "account" protected against improper "access" is one maintained by an end consumer. In this case, services were provided by the local carrier to the users of the tumbling phones with the expectation of repayment by the distant carrier. That account was invoked by the MIN. The ever-changing ESN played the role of a password to go along with the MIN, and is therefore a component of the access device. The local carrier received and relied upon those numbers in providing the service, and did so because of the expectation that it would receive payment for those services upon settlement of the account with the distant carrier. Whatever the status of accounts of individual customers, the tumbling phones were intended, and used, fraudulently to access the benefits of the account between the local and distant carriers.

McNutt is distinguishable on this point. The code numbers used to construct the descramblers were not represented to the broadcasters in an attempt to obtain services on account. Instead, the signal was openly broadcast, and anyone could receive it. In deciding to provide the signal, the broadcaster never relied on any representation of the existence of an account. In effect, it was not the signal that was sold; instead, the descramblers were rented to make that signal useable. In the case of cellular carriers, on the other hand, the sale of "air time" is the primary good sold; cellular carriers frequently have nothing to do with the production or sale of the phones themselves. Contrary to Defendant's arguments, the ESN and MIN are not just part of an after-the-fact billing device; they are part of a system designed to permit access only by those so entitled because of an account.

The fact that the "cloning" of descramblers is prohibited by a separate statutory scheme is also indicative of the differences involved. The Electronic Communications Privacy Act prohibits the manufacture, possession, or sale of devices "primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications," including cloned satellite television descramblers. 18 U.S.C. §§ 2512(1); see United States v. Lande, 968 F.2d 907, 909-911 (9th Cir. 1992), cert. denied, --- U.S. ----, 113 S. Ct. 1299, 122 L. Ed. 2d 689 (1993). Defendant's activities were more than just surreptitious interception of cellular phone signals. A call on a tumbling phone includes the representation of a falsified MIN and ESN to the carrier in an attempt to induce the carrier to connect the call to the desired number and to broadcast the desired signals. Such a transmission constitutes an attempt to defraud the cellular carrier, and intent to defraud is an element, along with the involvement of an "access device," of any violation of 18 U.S.C. § 1029. We see no reason why the construction and sale of "tumbling" phones should not fall within the proscriptions of Sec. 1029.

C. "Free Riding"

The defendant nevertheless attempts to analogize his devices to those in McNutt by claiming that he is merely "piggybacking" onto an an existing system and getting a "free ride" without actually imposing any costs on anyone. The Tenth Circuit accepted that characterization in extending the holding of McNutt to tumbling the ESN. Brady, 13 F.3d at 340 (holding that Sec. 1029 does not apply to "free riding" on the cellular system in part because the use did not result in "direct accounting losses"). The district court also seems to have been swayed by that argument. We will leave for another day the question about whether or not "free riding" is a defense to prosecution under section 1029, because we conclude that Defendant's activities imposed a real and legally significant cost. In McNutt the receipt of the scrambled signal in no way diminished the usefulness of the signal to other customers. In this case, however, it is apparent that the use of the tumbling phones does impose a cost upon the suppliers, and ultimately the consumers, of cellular phone service. Beyond possible direct costs such as fees to long distance carriers and local exchanges, the calls placed by phones such as those modified by defendant impose an additional burden on the cellular system. Even if a particular call could be placed without any additional hardware or labor, the fraudulent call imposes an opportunity cost. Fewer additional paying calls may be carried on the existing system before enhancement becomes necessary. It is not necessary to show that the local carrier actually paid out dollars to establish that it has suffered a cost beyond the loss of the opportunity to sell the service for that call. We therefore reject defendant's and the Tenth Circuit's characterization of the use of tumbling phones as "free riding" and find misplaced the attempted analogy to unauthorized descrambling of broadcast signals.

We disagree with the district court's, and the Tenth Circuit's conclusion in Brady, that the practice of "tumbling" the ESN is beyond the reach of 18 U.S.C. § 1029. We hold that the placement of a cellular phone call by such means accesses an account in order fraudulently to obtain services. While we make no comment on the propriety of the holding of McNutt, we find the activities involved in that case are properly distinguished from those in this case. The judgment of acquittal entered by the district court is VACATED. We REMAND the case with instructions to reinstate the jury's verdict, and for such further proceedings as may be appropriate.