United States v. Soybel, No. 19-1936 (7th Cir. 2021)
Annotate this Case
Justia Opinion Summary
Want to stay in the know about new opinions from the Seventh Circuit US Court of Appeals?
Sign up for free summaries delivered directly to your inbox. Learn More ›
You already receive new opinion summaries from Seventh Circuit US Court of Appeals. Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
Grainger, the victim of cyberattacks against its computer systems, isolated the source of the intrusions to a single internet protocol (IP) address, coming from a high-rise apartment building where disgruntled former employee Soybel lived. Grainger reported the attacks to the FBI, which obtained a court order under the Pen Register Act, 18 U.S.C. 3121, authorizing the installation of pen registers and “trap and trace” devices to monitor internet traffic in and out of the building generally and Soybel’s unit specifically. The pen registers were instrumental in confirming that Soybel unlawfully accessed Grainger’s system. The district court denied Soybel’s motion to suppress the pen-register evidence.
The Seventh Circuit affirmed Soybel’s convictions under the Computer Fraud and Abuse Act. The use of a pen register to identify IP addresses visited by a criminal suspect is not a Fourth Amendment “search” that requires a warrant. IP pen registers are analogous in all material respects to the telephone pen registers that the Supreme Court upheld against a Fourth Amendment challenge in 1979. The connection between Soybel’s IP address and external IP addresses was routed through a third party, an internet service provider. Soybel has no expectation of privacy in the captured routing information. The court distinguished historical cell-site location information, which implicates unique privacy interests that are absent here. The IP pen register had no ability to track Soybel’s past movements.
Download PDF
In the United States Court of Appeals For the Seventh Circuit ____________________ No. 19-1936 UNITED STATES OF AMERICA, Plaintiff-Appellee, v. EDWARD SOYBEL, Defendant-Appellant. ____________________ Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 17 CR 796 — Matthew F. Kennelly, Judge. ____________________ ARGUED JUNE 3, 2020 — DECIDED SEPTEMBER 8, 2021 ____________________ Before SYKES, Chief Judge, and BAUER and ST. EVE, Circuit Judges. SYKES, Chief Judge. Industrial-supply company W.W. Grainger was the victim of a series of cyberattacks against its computer systems in 2016. Grainger isolated the source of the intrusions to a single internet protocol (“IP”) 2 No. 19-1936 address, which came from a high-rise apartment building where disgruntled former employee Edward Soybel lived.1 Grainger reported the attacks to the FBI. To confirm the source, the government sought and received a court order under the Pen Register Act, 18 U.S.C. §§ 3121 et seq., authorizing the installation of pen registers and “trap and trace” devices to monitor internet traffic in and out of the building generally and Soybel’s unit specifically. 2 Among the data collected, the pen registers recorded the IP addresses of the websites visited by internet users within Soybel’s apartment. The IP pen registers were instrumental in confirming that Soybel unlawfully accessed Grainger’s system. The district court denied Soybel’s motion to suppress the pen-register evidence and its fruits, and a jury convicted him of 12 counts of violating the Computer Fraud and Abuse Act. This appeal presents a constitutional issue of first impression for our circuit: whether the use of a pen register to identify IP addresses visited by a criminal suspect is a Fourth Amendment “search” that requires a warrant. We hold that it is not. IP pen registers are analogous in all material respects to the telephone pen registers that the Supreme Court upheld against a Fourth Amendment chal1 Every device connected to the internet has a unique IP address, typically consisting of a sequence of numbers. See United States v. Caira, 833 F.3d 803, 805 (7th Cir. 2016). An IP address “is used to route information between devices, for example, between two computers.” United States v. Ulbricht, 858 F.3d 71, 84 (2d Cir. 2017) (quotation marks omitted). 2 A pen register records certain outgoing electronic signals, whereas a trap-and-trace device records incoming ones. See 18 U.S.C. § 3127(3)–(4). For the sake of simplicity, we use the term “pen register” to refer to both devices. No. 19-1936 3 lenge in Smith v. Maryland, 442 U.S. 735 (1979). The connection between Soybel’s IP address and external IP addresses was routed through a third party—here, an internet-service provider. Soybel has no expectation of privacy in the captured routing information, any more than the numbers he might dial from a landline telephone. Soybel insists that this case is governed not by Smith but by Carpenter v. United States, 138 S. Ct. 2206 (2018). We disagree. Carpenter concerned historical cell-site location information (“CSLI”). The warrantless acquisition of that type of data implicates unique privacy interests that are absent here. Historical CSLI provides a detailed record of a person’s past movements, which is made possible so long as he carries a cell phone. In contrast, the IP pen register had no ability to track Soybel’s past movements. And Carpenter is also distinguishable based on the extent to which a person voluntarily conveys IP-address information to third parties. Accordingly, though our reasoning differs from the district judge’s, we hold that the suppression motion was properly denied. Soybel also challenges the sufficiency of the evidence on one of the 12 counts. We reject this argument and affirm the judgment in all respects. I. Background Edward Soybel worked as an IT contractor for Grainger’s KeepStock business unit from November 2014 until he was fired in February 2016. KeepStock provides Grainger customers with proprietary software and industrial equipmentdispensing machines to optimize their inventory management. Dispensing machines at customer sites across the 4 No. 19-1936 country connect to computer servers at Grainger’s Niles, Illinois facility, which also serves as the home base for the KeepStock IT helpdesk where Soybel worked. KeepStock stores information about its dispensing machines and its customers’ log-in credentials in large “database tables.” Helpdesk staff have their own KeepStock usernames and passwords, and when logged in to the KeepStock system, they could add and delete information in the tables. Performing the same functions remotely (outside the Grainger firewall) required access to the KeepStock “desktop client”—an application downloaded to a computer. In July 2016 Grainger discovered that over the course of a week, someone with Grainger log-in credentials had accessed KeepStock and deleted millions of records from the database tables. As a result, KeepStock was effectively shut down for Grainger employees and customers alike until IT personnel could restore the data. An internal investigation revealed that the culprit had deleted the records via the desktop client using the log-ins of several current KeepStock employees, including Soybel’s former supervisor. Further investigation led Grainger to believe that the intrusions all came from the same IP address outside of Grainger’s network. Grainger reported the IP address to the FBI, which then determined that the address came from a large apartment building in Chicago where Soybel lived with his mother. However, the FBI could not yet confirm that Soybel was responsible. The identified IP address came not from an individual unit but from the building’s “master router” that distributed internet service throughout the building. The No. 19-1936 5 master router was, in effect, the middleman between the individual units and the rest of the internet. Each unit in the building had its own unique private IP address, but when an individual user accessed a website, only the master router’s IP address would be visible to that website’s servers. At the same time, the master router knew to which private IP address it should relay that website’s traffic. The upshot is that when an internet user in the building connected to Grainger’s servers, only the master router could confirm the private IP address—and thus the specific apartment unit— that was responsible for the KeepStock attacks. To confirm its suspicions about Soybel, the government applied for an order under the Pen Register Act to install IP pen registers for the master router and Soybel’s unit for 60 days. The data to be recorded was highly technical. 3 For our purposes it’s enough to note that the government sought to collect (1) connections between the master router’s and the unit’s IP addresses on the one hand, and external IP addresses on the other; and (2) the time that the connections occurred. That is, the information from the pen registers would help the government determine whether and when Soybel tried to access KeepStock. At the same time, the government’s application specified that the pen registers would not record the content of any communications between IP addresses, an express limitation 3 The pen registers could “record and decode dialing, routing, addressing, and signaling information (including IP addresses, [Media Access Control] addresses, port numbers, packet headers, and packet size) for all electronic communications transmitted to or from the [target IP addresses], and [could] record the date, time, and duration of such transmissions.” 6 No. 19-1936 in the Pen Register Act. See 18 U.S.C. §§ 3121(c), 3127(3)–(4). The data the government would collect might show, for instance, that an internet user connected to a Google IP address. 4 But it could not reveal the specific Google website accessed (i.e., YouTube or Gmail), let alone what the user was doing within that website. A district judge granted the application in September 2016. The order was not based on a finding of probable cause. Instead, as required by the Act, the judge found that the government had included the requisite certification that the information to be obtained was “relevant to an ongoing criminal investigation” into computer crimes. Id. § 3122(b)(2) (including the certification among the required contents for a Pen/Trap application); id. § 3123(a)(1) (specifying this finding as a prerequisite for the order). The building’s internet-service provider then installed the pen registers in the building’s mechanical room without entering Soybel’s unit. While the master router’s pen register captured only internet connections to and from KeepStock’s IP addresses, Soybel’s pen register recorded all internet connections that came from that unit. Put differently, the pen register associated with his apartment recorded connections between his private IP address and the IP addresses of those websites that internet users in the apartment had visited. The pen registers revealed that Soybel’s private IP address— and only Soybel’s private IP address—attempted to connect to KeepStock 790 times between September and November 4 The IP addresses for some servers are publicly available. Some websites permit users to input a given IP address and obtain certain identifying information about its source, much like a virtual phonebook. No. 19-1936 7 2016. Grainger confirmed that these attempts came at the same time that the master router’s IP address tried to breach the KeepStock firewall. One of the recorded intrusions is particularly relevant for this appeal. In September 2016 Soybel changed the KeepStock password for Grainger business analyst Dan Hoehne in the middle of the night. Soybel clicked on a forgotten password option for Hoehne’s username and used his own Gmail account as the recovery email. He then changed Hoehne’s password to “1234” and temporarily locked Hoehne out of KeepStock. Though by this time Grainger had blocked the master router’s IP address from accessing its system, forensic examination of Soybel’s laptop later showed that he was able to change Hoehne’s password using the IP address of a nearby apartment building. A grand jury charged Soybel with 12 counts of violating the Computer Fraud and Abuse Act. See 18 U.S.C. § 1030. Count 10 related to the act of changing Hoehne’s password and alleged that Soybel knowingly caused “the transmission of a program, information, code, or command” to “intentionally cause[] damage without authorization[] to a protected computer.” Id. § 1030(a)(5)(A). Following Soybel’s indictment, the Supreme Court issued its decision in Carpenter, holding that the government must generally obtain a search warrant to access historical CSLI. 138 S. Ct. at 2220. The Court concluded that a court order under the Stored Communications Act is insufficient because it requires less than probable cause. Id. Soybel moved to suppress all evidence obtained as a result of the Pen/Trap order, arguing that Carpenter had broader Fourth Amendment implications beyond the CSLI context. 8 No. 19-1936 The judge denied the suppression motion. Though the judge was skeptical that Carpenter has any effect on pen registers, he declined to decide whether their use violates the Fourth Amendment. He instead denied Soybel’s motion based on the good-faith exception to the exclusionary rule. The judge held that suppression was inappropriate because the officers relied in good faith on a pre-Carpenter understanding of the Pen Register Act in seeking the order. In other words, regardless of whether the Pen/Trap order violated Soybel’s Fourth Amendment right to be free from unreasonable searches, the judge concluded that a reasonable officer could believe that compliance with the Act’s requirements was sufficient for a lawful order. Data obtained from the pen registers was front and center at Soybel’s trial. The government also presented forensic evidence from Soybel’s laptop, which showed—among other things—that Soybel had downloaded the KeepStock desktop client each time before he accessed the KeepStock system. As to Count 10, testimony showed that Hoehne was unable to access KeepStock until his password could be reset. And in closing argument the government emphasized that as a result of the breach, Hoehne could not provide necessary customer service. A jury convicted Soybel on all 12 counts and further found that the offenses caused either a loss to Grainger during a one-year period aggregating at least $5,000 or damage affecting ten or more protected computers during a one-year period. The judge denied Soybel’s motions for a judgment of acquittal and for a new trial, and Soybel appealed. No. 19-1936 9 II. Discussion Soybel contends that the use of the pen registers violated his Fourth Amendment right to be free from unreasonable searches. He also argues that insufficient evidence supported his conviction under Count 10. A. Fourth Amendment Challenge Soybel first argues that based on Carpenter, the judge should have excluded the IP pen-register evidence. We review this issue de novo, see United States v. Mojica, 863 F.3d 727, 731 (7th Cir. 2017), and conclude that the judge properly denied the suppression motion. Though the good-faith exception barred suppression here, we affirm because there was no Fourth Amendment violation in the first place. See United States v. Reaves, 796 F.3d 738, 741–42 (7th Cir. 2015) (explaining that we may affirm the denial of a motion to suppress “on any ground supported in the record”). The Fourth Amendment protects “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures,” and provides that “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” U.S. CONST. amend. IV. To conduct a “search” under the Fourth Amendment, an officer generally must obtain a warrant supported by probable cause. See Katz v. United States, 389 U.S. 347, 359 (1967). But not all investigative actions are “searches” subject to Fourth Amendment scrutiny. Under the privacy-based framework relevant here, a “Fourth Amendment search does not occur … unless the individual manifested a subjective expectation of privacy in 10 No. 19-1936 the object of the challenged search[] and society [is] willing to recognize that expectation as reasonable.” 5 Kyllo v. United States, 533 U.S. 27, 33 (2001) (quotation marks omitted) (alteration in original). The government installed the pen registers not based on a finding of probable cause but rather under a court order supported by a lesser showing of relevance as provided in the Pen Register Act. See §§ 3122(b)(2), 3123(a)(1). Soybel argues that the Fourth Amendment demands more. The government, on the other hand, maintains that the Fourth Amendment provides no protection because the pen registers did not entail a “search.” This issue turns on the application of the third-party doctrine. A core principle of Katz is that “[w]hat a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection.” 389 U.S. at 351. A person generally “has no legitimate expectation of privacy in information he voluntarily turns over to third parties,” subjective expectations notwithstanding. Smith, 442 U.S. at 743–44 (collecting cases); see also United States v. Miller, 425 U.S. 435, 442 (1976) (finding no “legitimate expectation of privacy concerning the information kept in bank records” that a person “voluntarily convey[s] to [a] bank[] and expose[s] to [his] employees in the ordinary course of business”). Where the third-party doctrine applies, “the [g]overnment is typically free to obtain such information from the recipient without triggering Fourth Amendment protections.” Carpenter, 138 S. Ct. at 2216. 5 Soybel does not suggest that the pen register intruded on any propertybased interests. No. 19-1936 11 Smith is the foundational case for the use of pen registers. At the request of the police, a telephone company installed a pen register at its central office that recorded outgoing phone numbers dialed on the defendant’s landline phone. Smith, 442 U.S. at 745–46. The defendant moved to suppress the pen-register evidence because officers had not obtained a search warrant prior to the installation. Id. at 737. The Supreme Court held that no warrant was necessary because the officers had not conducted a Fourth Amendment search. Id. at 745–46. Critically, the pen register had only “limited capabilities,” capturing the numbers dialed but not the identity of the caller, any sound, or even whether the call had been completed. Id. at 741–42. The case was thus distinguishable from Katz, where officers overheard the substance of the conversation via a listening device attached to a phone booth. 389 U.S. at 349–50. The dialed phone numbers in Smith fit squarely within the emerging third-party doctrine. When a subscriber placed a call, the phone company’s “switching equipment” routed the call and the phone company could make a permanent record of the number a subscriber dialed. 442 U.S. at 742. The Court noted that Smith “voluntarily conveyed numerical information to the telephone company and ‘exposed’ that information to its equipment in the ordinary course of business” and thus “assumed the risk that the company would reveal to police the numbers he dialed.” Id. at 744. So Smith had no reasonable expectation of privacy “in the phone numbers he dialed” even though he dialed them from his home. Id. at 745–46. The IP pen registers in this investigation are a new breed of pen registers compared to the one at issue in Smith. When 12 No. 19-1936 Soybel’s IP address contacted Grainger’s IP addresses (by way of the third-party internet-service provider and the master router), the pen registers recorded the fact and time of the connections. But technological differences don’t necessarily beget constitutional ones. Before Carpenter the Second Circuit considered the use of an IP pen register under the Pen Register Act and held that under the logic of Smith, no search warrant is necessary. See United States v. Ulbricht, 858 F.3d 71, 97 (2d Cir. 2017) (“The recording of IP address information and similar routing data, which reveal the existence of connections between communications devices without disclosing the content of the communications, are precisely analogous to the capture of telephone numbers at issue in Smith.”). And more generally, the circuits to have considered the question pre-Carpenter were in accord that the third-party doctrine extends to an individual’s own IP address or the IP addresses of the websites he visits. See, e.g., id. (destination IP addresses); United States v. Wheelock, 772 F.3d 825, 829 (8th Cir. 2014) (own IP address); United States v. Christie, 624 F.3d 558, 574 (3d Cir. 2010) (own IP address); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (destination IP addresses). Soybel responds that Carpenter changed the Fourth Amendment calculus. Carpenter refined the third-party doctrine for a specific type of digital data: historical location information as revealed by CSLI. See 138 S. Ct. at 2211–12 (explaining that “[e]ach time [a] phone connects to a cell site, it generates a time-stamped record” stored by a wireless carrier). The officers in Carpenter obtained historical CSLI based on an order under the Stored Communications Act. Similar to the Pen Register Act, an order under the Stored Communications Act may be issued based on less than No. 19-1936 13 probable cause; the government need only “offer[] specific and articulable facts showing that there are reasonable grounds to believe” that the records sought “are relevant and material to an ongoing criminal investigation.” 18 U.S.C. § 2703(d). The Court held that this lesser showing is not enough; the officers had “invaded Carpenter’s reasonable expectation of privacy in the whole of his physical movements” by obtaining historical CSLI without a warrant supported by probable cause. Carpenter, 138 S. Ct. at 2219. Soybel contends that after Carpenter he has a reasonable expectation of privacy in his “personal [i]nternet traffic data.” We disagree. As three of our sister circuits have recognized, Carpenter has no bearing on the government’s collection of IP-address data from a suspect’s internet traffic. See United States v. Trader, 981 F.3d 961, 967–69 (11th Cir. 2020); United States v. Hood, 920 F.3d 87, 92 (1st Cir. 2019); United States v. Contreras, 905 F.3d 853, 857 (5th Cir. 2018). For starters, the Court in Carpenter stressed that its decision was a “narrow one.” 138 S. Ct. at 2220. Carpenter thus was not a wholesale repudiation of Smith or the third-party doctrine generally. To the contrary, the Court emphasized that it did not “disturb the application of Smith and Miller or call into question conventional surveillance techniques and tools.” Id. Instead, the Court merely “decline[d] to extend Smith and Miller to cover the[] novel circumstances” presented by historical CSLI. Id. at 2217. On this point Carpenter was “novel” both as to the instrumentality of the search and in the information captured. Given the extent to which people “compulsively carry cell phones with them all the time,” a cell phone has become “almost a feature of human anatomy.” Id. at 2218 (quotation 14 No. 19-1936 marks omitted). And because a cell phone “faithfully follows its owner” wherever he goes, the location information “provides an all-encompassing record of the holder’s whereabouts,” including his entry into “private residences, doctor’s offices, political headquarters, and other potentially revealing locales.” Id. at 2217–18. When the phone is powered on, the result is “near perfect surveillance.” Id. at 2218. The Court explained that the privacy concern is magnified by the data’s “retrospective quality” because historical CSLI gives “police access to a category of information otherwise unknowable.” Id. Obtaining historical CSLI without a warrant would allow the government to effectively “travel back in time to retrace a person’s whereabouts, subject only to the retention polices of the wireless carriers.” Id. The “detailed chronicle of a person’s physical presence compiled every day, every moment, over several years,” the Court held, “implicates privacy concerns far beyond those considered in Smith and Miller.” Id. at 2220. The unique features of historical CSLI are absent for IP-address data. The pen register was stationary and could not capture the whole of Soybel’s physical movements. Cf. Hood, 920 F.3d at 92 (explaining that whereas CSLI captures the approximate “location of the cell phone user who generates that data simply by possessing the phone,” IP-address data “is merely a string of numbers associated with a device that had, at one time, accessed a wireless network”). As was true in Smith, a recorded connection at most incidentally revealed when Soybel may have been in his apartment. But even that’s not a given because the data was impersonal. A recording of “the existence of connections between communications devices” shows only that someone in Soybel’s unit No. 19-1936 15 was using the internet. Ulbricht, 858 F.3d at 97. It could not reveal the identity of the user—whether it be Soybel, his mother, or an unidentified guest. Cf. Carpenter, 138 S. Ct. at 2219 (noting that the “telephone call logs [in Smith] reveal little in the way of ‘identifying information’”). The same cannot be said for CSLI, unless the cell phone’s owner takes the unusual step of giving it to someone else. Moreover, routing information obtained via a pen register isn’t retrospective. The government could not effectively “travel back in time” by using an IP pen register. A pen register is only forward-looking; its usefulness extends only so far as it is installed and no further. And here, the government would have had to seek a renewal of the 60-day order if it needed data beyond that point. CSLI, in contrast, is continuously collected and available for the government’s ready use so long as the cell carrier retains the records, which could be up to five years. Id. at 2218 (noting that a suspect would be “effectively … tailed every moment of every day for five years”). Perhaps recognizing that the IP-address information did not reveal much about his physical movements, Soybel contends that it provided an unwanted glimpse into his mind. He notes that the pen registers captured visits to Credit Karma and Match.com, so he argues that the pen register might provide an “intimate window” into his “familial, political, professional, religious, and sexual associations.” Id. at 2217 (quotation marks omitted). But the same is true for telephone pen registers like the one the Court approved in Smith; by obtaining the numbers that a suspect dials, law enforcement could likewise determine whether he had called a bank, a political headquarters, a church, or a 16 No. 19-1936 romantic partner. And for each type of pen register, any intrusion on these interests is minimized by the fact that the government did not—and under the Pen Register Act, could not—intercept the content of the communications. See §§ 3121(c), 3127(3)–(4). Differences in the data collected aside, Carpenter is also distinguishable on the extent to which Soybel assumed the risk by voluntarily communicating with third parties. The Court explained in Carpenter that CSLI “is not truly ‘shared’ as one normally understands the term” because “carrying [a cell phone] is indispensable to participation in modern society” and a cell-phone user opens himself up to tracking “without any affirmative act on the part of the user beyond powering up.” 138 S. Ct. at 2220. We do not discount the importance of the internet in 2021. But it’s not the case that Soybel created the data “without any affirmative act … beyond powering up.” Id. An internet user creates connection data by “making the affirmative decision to access a website,” just as the user of a landline generates a telephonenumber record solely by choosing to dial it. Hood, 920 F.3d at 92 (explaining that “an [i]nternet user generates the IP address data … only by making the affirmative decision to access a website or application”). And here, Soybel took the affirmative step of downloading the desktop client and connecting to Grainger’s servers remotely. In short, this case bears the hallmarks of Smith, not Carpenter. And under Smith Soybel has no reasonable expectation of privacy in the routing information collected by the pen registers. Accordingly, we hold that an IP pen register is analogous in all material respects to a traditional telephone pen register. An IP address operates much like a phone No. 19-1936 17 number, and “[l]ike telephone companies, internet service providers require that identifying information be disclosed in order to make communication among electronic devices possible.” Ulbrecht, 858 F.3d at 97. Though a person does not “dial” another’s IP address in the ordinary sense, information was routed through a third party to complete the connection between the computer in Soybel’s unit and the destination IP addresses. See id. at 96. In this respect, the master router—which directed internet traffic to and from Soybel’s own IP address—is not unlike the telephone switchboard in Smith. And Soybel assumed the risk that by connecting to Grainger servers, the fact of the connection would be revealed to law enforcement. Soybel therefore has no reasonable expectation of privacy in this data. Because the government did not conduct a Fourth Amendment search in this case, it need not have done more than obtain an order under the Pen Register Act. Even were we to hold to the contrary, suppression is unwarranted under the good-faith exception to the exclusionary rule. Under one variant of the good-faith exception, suppression is not the proper remedy for “evidence seized pursuant to a statute subsequently declared unconstitutional.” Illinois v. Krull, 480 U.S. 340, 352–53. (1987). The “sole purpose” of the exclusionary rule, after all, “is to deter future Fourth Amendment violations.” Davis v. United States, 564 U.S. 229, 236–37 (2011). We have applied the Krull principle to permit the admission of CSLI evidence obtained based on a pre-Carpenter understanding of the Stored Communications Act. See United States v. Curtis, 901 F.3d 846, 849 (7th Cir. 2018). The same conclusion follows for a pre-Carpenter understanding 18 No. 19-1936 of the Pen Register Act, for which no court of appeals has suggested that the absence of probable cause is constitutionally suspect. “Penalizing [an] officer for the [legislature’s alleged] error, rather than his own, cannot logically contribute to the deterrence of Fourth Amendment violations.” Krull, 480 U.S. at 350 (quotation marks omitted). For this additional reason, suppression was properly denied. B. Sufficiency of the Evidence for Count 10 Finally, Soybel contends that insufficient evidence supports his conviction for changing Hoehne’s password. Count 10 charged Soybel with violating § 1030(a)(5)(A), which requires that the government prove that he “knowingly cause[d] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally cause[d] damage without authorization[] to a protected computer.” Soybel does not contest that he issued a command to change Hoehne’s password. Nor does he challenge the special-verdict findings regarding the number of computers affected by the intrusion over a one-year period. He does dispute, however, that he caused “damage” when he changed Hoehne’s password. We review de novo the denial of a motion for judgment of acquittal and consider the evidence in the light most favorable to the jury’s verdict. United States v. Kelerchian, 937 F.3d 895, 907 (7th Cir. 2019). We overturn a conviction only if the record contains no evidence from which a reasonable jury could determine guilt beyond a reasonable doubt. United States v. Durham, 645 F.3d 883, 892 (7th Cir. 2011). Soybel has not overcome this high bar. Consistent with the statutory definition, the judge instructed the jury that No. 19-1936 19 “damage” means “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8) (emphasis added). Soybel did not argue below, nor does he claim on appeal, that the judge should have done more to guide the jury. Instructed this way, a reasonable jury could find that the password reset caused “damage” as the terms in the definition are ordinarily understood. To “impair” is to “damage or make worse … by diminishing in some material aspect.” Impair, MERRIAM-WEBSTER’S COLLEGIATE DICTIONARY (11th ed. 2003). And to be “available” is to be “present or ready for immediate use.” Available, id. The government presented evidence that the password reset locked Hoehne out of KeepStock and temporarily prevented him from servicing his customers. At the very least, a reasonable jury could find that Soybel’s actions “impair[ed] … the … availability of … [the] system” by temporarily diminishing its readiness for Hoehne’s immediate use. Soybel counters that his actions caused no data loss and that KeepStock remained functional for other users. And he emphasizes that Grainger was able to quickly rectify the issue. Neither point is relevant under § 1030(e)(8). The broad definition of “damage” covers any impairment. It makes no difference that the problem was a quick fix on Grainger’s end, nor does it matter that Soybel did not dismantle all or part of KeepStock more broadly. The evidence was sufficient to convict Soybel on Count 10. AFFIRMED
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
