Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Hutchins

United States District Court, E.D. Wisconsin

February 11, 2019




         1. INTRODUCTION

         Defendant Marcus Hutchins is a hacker who received considerable attention for disabling a North Korean malware called WannaCry. He has a reputation as a “white hat” hacker, which implies a hacker who works for the benefit of the public. Hutchins has nevertheless been indicted for various crimes related to his activity with two forms of malware, “Kronos” and “UPAS Kit.”

         On March 30, 2018, Hutchins filed a motion to suppress the statement that he made to Federal Bureau of Investigation (“FBI”) agents immediately following his arrest, as well as any evidence the government may have obtained as a result. (Docket #55). On July 13, 2018, Hutchins also filed three motions to dismiss various counts in the superseding indictment. (Docket #92, #95, and #96).[1] Magistrate Judge Nancy Joseph issued a report and recommendation in which she recommended denying all motions. (Docket #109). Hutchins timely objected, and each party has fully briefed the issues. The Court will address each of the motions below. In accord with Magistrate Joseph's analyses, all motions will be denied. The Court will overrule Hutchins's objections and adopt Magistrate Joseph's recommendation in large measure.

         2. LEGAL STANDARD

         When reviewing a magistrate's recommendation, this Court is obliged to analyze de novo “those portions of the report or specified proposed findings or recommendations to which objection is made.” 28 U.S.C. § 636(b)(1)(C). The Court can “accept, reject, or modify, in whole or in part, the findings or recommendations made by the magistrate.” Id. The Court's review encompasses both the magistrate's legal analysis and factual findings. Id.; see also Fed. R. Crim. P. 59(b).

         3. RELEVANT FACTS

         Hutchins, a citizen of the United Kingdom, is a coder and hacker of considerable repute. He is most well-known for finding the kill-switch to a North Korean malware called WannaCry in May 2017. According to the superseding indictment, several years ago, Hutchins developed two types of malware, UPAS Kit and Kronos (a “banking trojan”).

         The superseding indictment alleges that Hutchins developed UPAS Kit and, in 2012, sold it to Individual A, who then sold it to an individual in the Eastern District of Wisconsin. At some point before July 2014, Hutchins allegedly developed Kronos and provided it to Individual A, intending for Individual A to advertise, promote, and sell it. Hutchins used a YouTube video to demonstrate how Kronos worked, and referred prospective customers to Individual A. In December 2014, Hutchins hacked and analyzed a malware that competed with Kronos, and published a blog post describing the competing malware's vulnerability. In February 2015, Hutchins allegedly updated the Kronos malware, and distributed it to Individual B, who was located in California and was known to be involved in cyber-based criminal activities.

         On July 11, 2017, a grand jury indicted Hutchins on various counts related to his activity with the malware. He was charged with conspiracy, fraud, and unlawfully intercepting communications. (Docket #1). On June 5, 2018, the government filed a superseding indictment with additional charges. (Docket #86). In Count One, the superseding indictment charges Hutchins with conspiring to violate the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, and the Electronic Communications Privacy Act (“Wiretap Act”), 18 U.S.C. § 2510 et seq., in violation of 18 U.S.C. § 371. Counts Two and Three charge Hutchins with disseminating, aiding, and abetting an attempt to advertise the malware, in violation of the Wiretap Act. Counts Four and Five charge Hutchins with aiding and abetting the distribution of the malware, in violation of the Wiretap Act. Count Six charges Hutchins with using, or getting others to use, the malware to intercept communications in violation of the Wiretap Act. Count Seven charges Hutchins with causing, aiding, and abetting the transmission of malware in violation of the CFAA. Count Eight charges Hutchins with aiding and abetting the intentional access and damage to protected computers for the purpose of private financial gain, in violation of the CFAA. Count Nine charges Hutchins with lying to the FBI about whether he knew that his computer code was part of Kronos, in violation of 18 U.S.C. § 1001(a)(2). Finally, Count Ten charges Hutchins with conspiring to commit fraud in connection with his malware activities, in violation of 18 U.S.C. §§ 1343, 1349.

         In the summer of 2017, Hutchins spent a week in Las Vegas to attend “Defcon, ” which is a conference for hackers. On August 2, 2017, Hutchins was about to embark on his journey back to the U.K. Hutchins was waiting in a lounge at the Las Vegas airport when a federal agent and two Customs and Border Patrol (“CBP”) officials approached him. Unbeknownst to him, FBI Special Agents Lee Chartier (“Chartier”) and Jamie Butcher (“Butcher”) had been monitoring Hutchins's whereabouts all morning, and had followed him to the airport, through security, and to his lounge. Although the FBI had originally planned to arrest Hutchins as he boarded the flight, they opted to arrest him earlier in order to ensure that he did not consume any alcoholic beverages that might affect his ability to answer questions in an interrogation. Indeed, Hutchins had spent much of the week partying, which included ingesting various intoxicating substances. He had had very little sleep the night before. There are no allegations, however, that Hutchins was intoxicated whilst at the airport-only exhausted and, it can be assumed, terribly hungover.

         Thus, at approximately 1:17 p.m., Hutchins was approached in the airport lounge by two CBP officers and a plainclothes FBI agent, Chartier. These officials escorted Hutchins to a stairwell, whereupon he was handcuffed. Chartier informed Hutchins that he was under arrest pursuant to a federal warrant. The officials then led Hutchins to an interview room, where Butcher was waiting. The agents observed Hutchins to be alert, engaged, and not visibly intoxicated or disoriented. Hutchins verbally confirmed that he was able to answer questions and was not drunk. Hutchins received his Miranda rights orally. He was also given an advisement of rights form. He listened to his rights and signed the advisement form in the presence of both agents. There is a dispute as to what time he signed it, but the Court does not find this to be material for reasons that will be explained below.

         Hutchins then proceeded to respond to the questions asked by the agents, and gave consent for them to search his phones, laptops, backpacks, and USB drives. He did not request a lawyer or invoke his right to remain silent, although he did ask “what this is all about.” The agents told him they would explain eventually, but continued questioning him. In total, Hutchins was questioned for approximately 105 minutes. He was offered food, an opportunity to use the restroom, and-eventually-allowed to contact his mother. He was not shown a copy of the arrest warrant until over an hour into the interrogation.[2]

         Hutchins showed every indication of being voluntarily cooperative with the agents, but was also clearly confused about the nature of the interrogation. The interrogation began with broad questions about his career and his online activities, but about ten minutes in, the questions focused on Hutchins's involvement with malware. Hutchins acknowledged that when he was younger, he had written some code that ultimately ended up in malware, but denied that he developed malware. About eleven minutes into the interrogation, after looking at a string of code, Hutchins asked if they were looking for the developer of Kronos. Hutchins stated that he did not develop Kronos, and he had “gotten out” of writing code for malware before he was eighteen. Thirteen minutes in, he said that he had feared that law enforcement authorities would come after him, instead of the actual developer, because pieces of his code appeared in Kronos. Thus, Hutchins was aware that the criminal investigation was, at least in part, about Kronos, and that he was implicated in the investigation, although he expressed confusion about why he was being detained throughout the interrogation. Almost eighty minutes into the recorded interrogation, the agents finally provided him with the warrant, and told him that it had “nothing to do with WannaCry.” The interrogation continued for about twenty minutes after that. Throughout the remainder of the interrogation, Hutchins tried to be helpful but noted that he had been “out” of so-called “black hat” hacking for so long that he did not have any helpful connections.

         Hutchins was taken to a jail, where he proceeded to make two phone calls, which were recorded. Prior to making the phone calls, Hutchins was informed that the phone calls were subject to monitoring and recording. In the calls, Hutchins also made incriminating statements.

         4. ANALYSIS

         4.1 Motion to Suppress

         Hutchins seeks to suppress his post-arrest statements and any evidence that may have been obtained as a result of his statements. He argues that he did not waive his Miranda rights, (Docket #55 at 6-9), and submits that the government has not met its burden in rebutting the presumption against waiver, (Docket #111 at 13). Hutchins calls into question whether (1) he received notice of his rights at all; and (2) whether he was able to voluntarily waive his rights due to his intoxication, his limited understanding of the American criminal procedural system, and the deceptive nature of the interrogation.

         It is axiomatic that law enforcement officers must inform suspects of their Miranda rights before a custodial interrogation. United States v. Thurman, 889 F.3d 356, 364 (7th Cir. 2018). “If the suspect invokes his rights, the officers must cease their questioning.” Id. However, before officers must cease their questioning, the burden is on the suspect to assert his Miranda rights in a “clear and unambiguous” fashion. Id. (quoting United States v. Lee, 413 F.3d 622, 625 (7th Cir. 2005)). Hutchins did not make any statements regarding his intent to invoke his Miranda rights; therefore, his rights were not invoked in a clear and unambiguous fashion. The interrogation properly proceeded.

         However, “[e]ven if a suspect does not invoke his Miranda rights, his self-incriminating statements cannot be used against him in court unless the Government shows by a preponderance of the evidence that he voluntarily waived these rights.” Thurman, 889 F.3d at 364 (citing Berghuis v. Thompkins, 560 U.S. 370, 382-84 (2010); United States v. Brown, 664 F.3d 1115, 1118 (7th Cir. 2011)). Indeed, the Court must “indulge in every reasonable presumption against waiver.” Brewer v. Williams, 430 U.S. 387, 404 (1977). In order to rebut the presumption, the government must show that Hutchins's decision to give up his rights was “the product of a free and deliberate choice. . .made with a full awareness of both the nature of the right being abandoned and the consequences of the decision to abandon it.” Berghuis, 560 U.S. at 382-83 (internal quotations and citations omitted).

         Voluntariness, or free and deliberate choice, is assessed in view of the totality of the circumstances. Brown, 664 F.3d at 1118. The Court will consider, among other things, a defendant's age, level of education, and prior experience with law enforcement, as well as the conditions of the interrogation itself and the attitude of the interrogating officials. Thurman, 889 F.3d at 364-65; Brown, 664 F.3d at 1118; United States v. Shabaz, 579 F.3d 815, 820 (7th Cir. 2009). “The law can presume that an individual who, with a full understanding of his or her rights, acts in a manner inconsistent with their exercise has made a deliberate choice to relinquish the protection those rights afford.” Berghuis, 560 U.S. at 385; Thurman, 889 F.3d at 364-65 (finding waiver despite refusal to sign a waiver form because the defendant understood his rights, the interrogation was “low key and informal, ” and defendant engaged in the interrogation); United States v. Smith, 218 F.3d 777, 781 (7th Cir. 2000) (finding waiver despite refusal to sign waiver form where a suspect “immediately began talking to the agents…[and] never requested an attorney and never asked that the questioning be stopped.”).

         4.1.1 Adequate Receipt of Miranda Rights

         Hutchins argues that there is insufficient evidence that he received notice of his Miranda rights. This argument is a non-starter, in part because Hutchins acknowledges that he was read his rights. (Docket #55 at 5-6) (“[T]here seems to be little doubt that the agents-in some unspecified fashion, at an uncertain time-advised Mr. Hutchins of his rights under Miranda.”). Hutchins makes much about the fact that there is no proof that he received his rights at the beginning of the interrogation, but he does not suggest when else they may have been given. Additionally, both agents have testified, under oath and in non-contradictory terms, that the rights were given at the beginning of the interrogation. Moreover, in the recorded portion of the interrogation, Butcher provided Hutchins with a consent form to search his computers and said, “because we're the government, there's a form for that, too, ” implying that Hutchins had previously received other consent forms. The Court sees no reasonable basis to conclude that Hutchins did not receive notice of his rights before the interrogation.

         Additionally, it does not actually matter when Hutchins signed the advisement of rights form, so long as he was apprised of his Miranda rights prior to questioning. “[T]he rigidity of Miranda does not extend to the precise formulation of the warnings given a criminal defendant. . .[and] no talismanic incantation is required to satisfy its strictures.” Duckworth v. Eagen, 492 U.S. 195, 202-03 (1989) (quoting California v. Prysock, 453 U.S. 355, 359 (1981)) (internal quotation marks omitted). Courts merely look to whether the law enforcement officers “fully conveyed” the rights. Prysock, 453 U.S. at 361; In re Terrorist Bombing of U.S. Embassies in E. Africa, 552 F.3d 177, 209 (2d Cir. 2008) (oral warnings sufficient to satisfy Miranda regardless of any alleged deficiencies in the advisement of rights form). In light of Hutchins's admission that he received his Miranda rights, and in light of the agents' corroborating testimony that this occurred before the interrogation, as well as the lack of any indication of when else he may have received them, the Court finds that Hutchins was sufficiently apprised of his rights before the interrogation.

         4.1.2 Voluntariness of Waiver

         The waiver of Hutchins's Miranda rights must have been “voluntary in the sense that it was the product of a free and deliberate choice rather than intimidation, coercion, or deception.” Moran v. Burbine, 475 U.S. 412, 421 (1986). Hutchins must also have waived his rights with “a full awareness of both the nature of the right being abandoned and the consequences of the decision to abandon it.” Id. Hutchins argues he did not voluntarily waive his Miranda rights because he was intoxicated, unsure about American criminal procedure, and deceived by the questioning agents as to the nature of his arrest. These factors will be assessed in turn.

         In assessing the validity of a Miranda waiver, courts may consider intoxication, lack of sleep, or other physical discomfort as they affect a defendant's susceptibility to coercion. See United States v. Brooks, 125 F.3d 484, 491 (7th Cir. 1997) (finding voluntary waiver despite the fact that defendant was high on crack, sleep deprived, and in pain). However, “intoxication. . .by itself-without some showing of coercion by the government-will not negate voluntariness.” United States v. Chrimson, 965 F.2d 1465, 1469 (7th Cir. 1992); Anderson v. Thieret, 903 F.2d 526, 530-31 (7th Cir. 1990) (noting that impairment is unlikely where approximately 19 hours had elapsed between the defendant's last drink and his confession). Additionally, “mental state alone cannot make [a defendant's] confession involuntary. . .[I]t is relevant only to the extent it made him more susceptible to mentally coercive police tactics.” Id. at 530 n.1 (citing Colorado v. Connelly, 479 U.S. 157, 163-67 (1986)).

         It is unlikely that Hutchins's alleged impairment significantly factored into his ability to give a voluntary waiver or made him more susceptible to deceptive interrogation tactics. The agents monitored Hutchins from the beginning of the day to ensure that he was sober when he was arrested. They ensured that he was in custody before he had the opportunity to drink at the airport. They walked him to two separate locations (first, the stairwell; second, the interview room) and engaged him in conversation, which gave them opportunity to evaluate whether Hutchins appeared to be somehow impaired by an intoxicant. Hutchins appeared to be alert, engaged, coordinated, and coherent. There is no evidence in the record to the contrary. There is also no evidence, nor does Hutchins claim, that he was under the influence of drugs that day-only that he was exhausted. But a terrible hangover alone does not, as a matter of law, render someone unable to exercise or waive their Miranda rights. This factor does not weigh in Hutchins's favor.
 Intelligent Waiver

         Hutchins next argues that he did not appreciate the nature of his Miranda rights, or the consequences of waiving them, because he was confused by the purpose of the interrogation, and believed, based on U.K. criminal procedure, that it would ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.