United States v. Cuomo

22‐1799
USA v. Cuomo
UNITED STATES COURT OF APPEALS 1
FOR THE SECOND CIRCUIT 2
‐ ‐ ‐ ‐ ‐ ‐ 3
August Term, 2023 4
(Argued: February 12, 2024 Decided: January 3, 2025) 5
Docket No. 22‐1799 6
_________________________________________________________ 7
UNITED STATES OF AMERICA, 8
Appellee, 9
10
‐ v. ‐ 11
GUY CUOMO, a.k.a. John Monaco, 12
Defendant‐Appellant. *
13
_________________________________________________________ 14
Before: KEARSE, PARK, and PÉREZ, Circuit Judges. 15
* The Clerk of Court is instructed to amend the official caption to conform with the
above.

-- 1 of 35 --

Appeal from a judgment entered in the United States District Court for 1
the Northern District of New York, following a jury trial before Thomas J. McAvoy, 2
Judge, and sentencing by Mae A. DʹAgostino, Judge, convicting defendant of 3
conspiracy to commit computer fraud, in violation of 18 U.S.C. §§ 1030(b), 4
1030(a)(2)(C), and 1030(c)(2)(B)(iii); accessing a protected computer and obtaining 5
information without authorization, in violation of 18 U.S.C. §§ 1030(a)(2)(C) and 6
1030(c)(2)(B)(i); two counts of aggravated identity theft, in violation of 18 U.S.C. 7
§ 1028A(a)(1); misuse of a social security number, in violation of 42 U.S.C. 8
§ 408(a)(7)(B); and conspiracy to misuse social security numbers, in violation of 18 9
U.S.C. § 371; and sentencing him principally to a total of 45 monthsʹ imprisonment, 10
to be followed by a total of three yearsʹ supervised release. On appeal, defendant 11
contends principally that his convictions should be reversed on the grounds that his 12
conduct did not violate the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and 13
Social Security Act § 206, 42 U.S.C. § 408; that the courtʹs instructions to the jury were 14
deficient with respect to the counts relating to computer fraud and social‐security‐ 15
number misuse; and that the evidence was insufficient to support his convictions 16
relating to identity theft and social‐security‐number misuse. Finding no merit in 17
these contentions, or in his challenges to the calculation of his sentence, we affirm. 18
2

-- 2 of 35 --

STEVEN D. CLYMER, Assistant United States Attorney, 1
Syracuse, New York (Carla B. Freedman, United 2
States Attorney for the Northern District of New 3
York, Joshua R. Rosenthal, Assistant United States 4
Attorney, Syracuse, New York, on the brief), for 5
Appellee. 6
ANDREW LEVCHUK, Amherst, Massachusetts, for 7
Defendant‐Appellant. 8
KEARSE, Circuit Judge: 9
Defendant Guy Cuomo appeals from a judgment entered in the United 10
States District Court for the Northern District of New York, following a jury trial 11
before Thomas J. McAvoy, Judge, and sentencing by Mae A. DʹAgostino, Judge, 12
convicting him of conspiracy to commit computer fraud, in violation of 18 U.S.C. 13
§§ 1030(b), 1030(a)(2)(C), and 1030(c)(2)(B)(iii) (Count 1); accessing a protected 14
computer and obtaining information without authorization, in violation of 18 U.S.C. 15
§§ 1030(a)(2)(C) and 1030(c)(2)(B)(i) (Count 2); aggravated identity theft, in violation 16
of 18 U.S.C. § 1028A(a)(1) (Counts 7 and 18); misuse of a social security number, in 17
violation of 42 U.S.C. § 408(a)(7)(B) (Count 13); and conspiracy to misuse social 18
security numbers, in violation of 18 U.S.C. § 371 (Count 12); and sentencing him 19
principally to a total of 45 monthsʹ imprisonment, to be followed by a total of three 20
3

-- 3 of 35 --

yearsʹ supervised release. On appeal, Cuomo contends principally that his 1
convictions should be reversed on the grounds that his conduct did not violate the 2
Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and Social Security Act § 206, 3
42 U.S.C. § 408; that the courtʹs instructions to the jury were deficient with respect to 4
the counts relating to computer fraud and social‐security‐number misuse; and that 5
the evidence was insufficient to support his convictions relating to identity theft and 6
social‐security‐number misuse. He also contends that the court erred in calculating 7
his sentence. Finding no merit in any of his contentions, we affirm. 8
I. BACKGROUND 9
The present prosecution had its origin in investigations by the United 10
States Department of Laborʹs Office of the Inspector General (ʺDOL‐OIGʺ) into 11
suspected crimes involving unemployment insurance (or ʺUIʺ) programs. DOL‐OIG 12
Special Agents zeroed in on conduct from 2015 through April 2018 by Cuomo who, 13
along with codefendant Jason ʺJ.R.ʺ Trowbridge, operated both a ʺskip tracingʺ 14
company called Paymerica Corporation and a sister company called Ameripay 15
Corporation (ʺAmeripayʺ) that ostensibly engaged in debt collection but also 16
4

-- 4 of 35 --

performed skip tracing. ʺSkip tracingʺ (or ʺskiptracingʺ) refers generally to a process 1
of finding information about a person‐‐often a debtor‐‐such as his or her address, 2
telephone number, and place of employment (or ʺPOEʺ). 3
The trial evidence leading to Cuomoʹs conviction of the above offenses, 4
taken in the light most favorable to the government, is described in detail in a 5
Decision and Order of the district court dated July 13, 2022 (ʺD.Ct. Op.ʺ), denying 6
motions by Cuomo for a judgment of acquittal. (See Cuomo brief on appeal at 3 (ʺThe 7
district court, as required by law, summarized the facts in the light most favorable to 8
the verdicts.ʺ (footnote omitted)).) Under the same standard, we summarize the 9
evidence as follows. 10
A. The Evidence of Deceptive Practices 11
Paymerica Corporation and Ameripay shared office space and had 12
substantial financial and employee overlap; here, as in the district court proceedings, 13
they will generally be referred to collectively as ʺPaymerica,ʺ D.Ct. Op. at 5‐6. In 14
their skip tracing operations, ʺPaymerica employees obtained debtorsʹ POE 15
information by impersonating the debtorsʺ in commencing for them ʺonline 16
5

-- 5 of 35 --

applications for unemployment insurance (ʹUIʹ) in the states where the debtors lived.ʺ 1
Id. at 6. 2
[W]hen Paymericaʹs customers provided [Paymerica] with the 3
names, social security numbers, and addresses of debtors whose 4
POE information the customers sought to purchase, Paymerica 5
employees initially verified this personal‐identifying 6
information‐‐including social security numbers‐‐for the debtors by 7
using TLO, a commercial database. From there, Paymerica 8
employees obtained the requested POE information for the debtors from 9
state workforce agencies by starting false UI applications in each debtorʹs 10
name and with each debtorʹs personal‐identifying information. 11
Among other things, Paymerica employees created online accounts for 12
the debtors with the states‐‐for instance, a NY.gov account in New 13
York‐‐and then used the online accounts to start fraudulent UI 14
applications in the debtorsʹ names by submitting, inter alia, the 15
debtorʹs name, date of birth, and social security number. 16
Id. (record citations omitted) (emphases added). In addition, 17
Paymerica employees routinely created and used fraudulent email 18
accounts . . . to circumvent identity‐verification measures implemented 19
by New York and other state governments. Four cooperating 20
witnesses . . . testified that the entire process was about impersonating 21
debtors. According to the witnesses, this was done so that the 22
states would falsely recognize Paymerica employees as the target 23
debtors and provide restricted POE information meant only for 24
those debtors to Paymerica. 25
Id. at 6‐7 (record citations omitted) (emphases added); see id. at 6 (the ʺ[f]our 26
cooperating witnessesʺ were ʺPaymerica employees who . . . admittedly commit[ed] 27
Computer Fraud, Misuse of a Social Security Number, or Aggravated Identity Theftʺ). 28
6

-- 6 of 35 --

ʺPaymerica employees took steps to avoid detection and cover up their 1
actions. . . . The skip tracers always used aliases when making verification calls to 2
victimsʹ places of employment.ʺ Id. at 7 (record citations omitted). Cuomo himself, 3
ʺfor his skiptracing activities,ʺ used the alias ʺJohn Monaco.ʺ (Trial Transcript (ʺTr.ʺ) 4
328‐29.) 5
Cuomo also ʺpersonally impersonated numerous debtor‐victims [in 6
starting] New York State UI applications, including C.C. and S.A., the respective 7
victims of the [identity theft] counts against [him].ʺ D.Ct. Op. at 8. In March 2018, 8
Cuomo logged on to the New York State UI website and initiated unemployment 9
insurance applications in the names of C.C. and S.A. in order to learn their POEs; in 10
response to the website requests for personal information to identify the person 11
inquiring, Cuomo provided C.C.ʹs and S.A.ʹs respective social security numbers, 12
which Paymerica had been given by its customers, see, e.g., id. at 12. C.C. and S.A. 13
testified that they did not apply for unemployment insurance in March 2018, had not 14
heard of Paymerica, did not know Cuomo or Trowbridge, and had ʺnever authorized 15
anyone to use their names or social security numbers to apply for unemployment 16
insurance for them.ʺ D.Ct. Op. at 23‐24. 17
7

-- 7 of 35 --

In addition to the use of aliases, impersonations, and ʺphony email 1
accounts,ʺ 2
Paymerica employees employed other means to evade the statesʹ 3
security measures. For example, when the state governments 4
blocked an internet protocol (ʺIPʺ) address associated with 5
Paymericaʹs offices, Paymerica employees used a virtual private 6
network (ʺVPNʺ) to mask their true IP address. They also used 7
untraceable, internet‐based phone systems that were paid for with 8
anonymous retail gift cards to further conceal their true identities. In 9
addition, when the states added additional identity verification 10
questions in response to Paymericaʹs fraudulent activities, the skip 11
tracers used information from TLO to answer highly personal questions 12
about the debtors they impersonated. 13
Id. at 7‐8 (record citations omitted) (emphases added). 14
Cuomo performed skip tracing himself, and when Trowbridge was not 15
available he supervised the other Paymerica employees, including those engaged in 16
skip tracing. See id. at 8. Cuomo also administered and maintained the TLO 17
account‐‐a subscription to a database maintained by TransUnion that contained 18
public, proprietary, and personal information. Trowbridge could not be associated 19
with that account because he had a prior felony conviction. See id. Cuomo ʺwas . . . 20
aware that Trowbridge and other[ Paymerica employees] used VPNs and other 21
measures to avoid detection by law enforcement.ʺ Id. (citing Tr. 559‐60 (DOL‐OIG 22
Special Agentʹs testimony as to Cuomoʹs description to interviewing agents of his 23
8

-- 8 of 35 --

co‐conspiratorsʹ use of various measures ʺʹto hide from the statesʹʺ (other record 1
citations omitted))). (See Part II.A.2. below with respect to confidentiality measures 2
taken by New York State.) 3
There was no evidence that Cuomo or his coconspirators actually filed 4
an unemployment insurance application for any debtor they impersonated. They 5
initiated applications because merely starting that process gave them access to the 6
debtorʹs most recent employer; none of the applications was completed. See D.Ct. Op. 7
at 11‐12. 8
ʺOnce [Paymerica] obtained[] the POE information[, it] was sold to the 9
requesting third parties for approximately $90 per debtor.ʺ Id. at 7 (citing Tr. 595‐97). 10
Paymerica had received requests from customers to research approximately 200,000 11
persons, and all 50 states were represented in those requests. (See Tr. 597.) In the 12
period from mid‐December 2015 to early April 2018, for its largest customer, 13
Paymerica found POE information on some 11,294 individuals, for which it billed the 14
customer $1,013,220. (See id. at 595‐97.) 15
9

-- 9 of 35 --

B. The Verdict and Judgment 1
The jury found Cuomo guilty of accessing a protected computer and 2
obtaining information, in violation of 18 U.S.C. §§ 1030(a)(2)(c) and (c)(2)(B)(i), and 3
of conspiracy to commit computer fraud, in violation of 18 U.S.C. §§ 1030(b), 4
(c)(2)(B)(i), and (c)(2)(B)(iii), and found that those offenses had been committed ʺfor 5
purposes of commercial advantage or private financial gain.ʺ (Verdict Form at 1‐2.) 6
It found that the value of the information thereby obtained exceeded $5,000. (See id.) 7
The jury also found Cuomo guilty of misuse of a social security number, in violation 8
of 42 U.S.C. § 408(a)(7)(B); conspiring to misuse social security numbers, in violation 9
of 18 U.S.C. § 371; and two counts of aggravated identity theft (victimizing C.C. and 10
S.A.), in violation of 18 U.S.C. § 1028A(a)(1). 11
Cuomo was sentenced principally to a total of 45 monthsʹ imprisonment. 12
On Counts 1, 2, 12, and 13 (relating to computer fraud and misuse of social security 13
numbers), he received four 21‐month prison terms to be served concurrently with 14
each other, based on calculations under the advisory Sentencing Guidelines 15
(ʺGuidelinesʺ). (See Part III below.) On Counts 7 and 18 (aggravated identity theft), 16
Cuomo was sentenced‐‐as mandated by 18 U.S.C. § 1028A(a)(1)‐‐to prison terms of 17
24 months, to be served consecutively to the 21‐month prison terms on Counts 1, 2, 18
10

-- 10 of 35 --

12, and 13. As allowed by § 1028A(b), the court ordered that the two 24‐month terms 1
for aggravated identity theft be served concurrently with each other. 2
II. CUOMOʹS CHALLENGES TO HIS CONVICTIONS 3
On appeal, Cuomo contends principally that his convictions should be 4
reversed on the grounds that his conduct did not violate either the Computer Fraud 5
and Abuse Act of 1986 (ʺCFAAʺ) or the Social Security Act. He also argues that the 6
trial courtʹs instructions on the counts charging violations of those statutes were 7
erroneous or deficient, and that the evidence was insufficient to support his 8
convictions of aggravated identity theft and misuse of, or conspiracy to misuse, social 9
security numbers. 10
As to issues of statutory interpretation, our standard of review is de novo. 11
See, e.g., United States v. Gu, 8 F.4th 82, 86 (2d Cir. 2021) (ʺGuʺ), cert. denied, 142 S. Ct. 12
1186 (2022). And although we review de novo the ultimate legal question of 13
sufficiency of the evidence to support a conviction, our ʺstandard of review is 14
exceedingly deferential to the juryʹs apparent determinationsʺ of facts. United States 15
v. Flores, 945 F.3d 687, 710 (2d Cir. 2019) (ʺFloresʺ) (internal quotation marks omitted), 16
11

-- 11 of 35 --

cert. denied, 141 S. Ct. 375 (2020); see Gu, 8 F.4th at 86. We view the evidence in the 1
light most favorable to the government, crediting every credibility determination and 2
every inference that could have been drawn in favor of the government. See, e.g., 3
Flores, 945 F.3d at 710; Gu, 8 F.4th at 86. ʺA sufficiency challenge must fail if ʹany 4
rational trier of fact could have found the essential elements of the crime beyond a 5
reasonable doubt.ʹʺ Flores, 945 F.3d at 710 (quoting Jackson v. Virginia, 443 U.S. 307, 6
319 (1979) (emphasis in Jackson)). 7
We also review de novo challenges to the propriety of the trial courtʹs 8
instructions to the jury, if those challenges have been properly preserved. See, e.g., 9
United States v. Botti, 711 F.3d 299, 307 (2d Cir. 2013) (ʺBottiʺ); United States v. Bahel, 662 10
F.3d 610, 634 (2d Cir. 2011). Unpreserved challenges to instructions are reviewed only 11
for plain error. See, e.g., Fed. R. Crim. P. 30(d) and 52(b). Under plain‐error review, 12
we have ʺdiscretion to reverse only if the instruction contains ʹ(1) error, (2) that is 13
plain, and (3) affect[s] substantial rightsʹʺ; and if these three conditions are met, we 14
may ʺexercise [our] discretion to correct the error only if the error ʹseriously affect[ed] 15
the fairness, integrity, or public reputation of judicial proceedings.ʹʺ Botti, 711 F.3d 16
at 308 (quoting Johnson v. United States, 520 U.S. 461, 467 (1997)). 17
12

-- 12 of 35 --

A. The CFAA 1
Cuomo contends that his convictions on Counts 1 and 2‐‐computer fraud 2
and conspiracy to commit computer fraud‐‐should be reversed, arguing that his 3
conduct did not violate the CFAA, that the evidence was insufficient to show that he 4
accessed the computer without authorization, and that the district court erroneously 5
instructed the jury as to the meaning of ʺwithout authorization.ʺ We reject all of these 6
contentions. 7
1. Statutory Construction 8
The CFAA, dealing with fraud and related activity in connection with 9
computers, provides in part that it is unlawful for a person (a) to ʺintentionally access[] 10
a computer without authorization or exceed[] authorized access, and thereby obtain[] . . . 11
information from any protected computer,ʺ or (b) to ʺconspire[]ʺ to do so. 18 U.S.C. 12
§§ 1030(a)(2)(C) and (b) (emphases added). The CFAA defines ʺprotected computerʺ 13
in part as a computer ʺwhich is used in or affecting interstate or foreign commerce or 14
communication.ʺ Id. § 1030(e)(2)(B). ʺ[T]he term ʹexceeds authorized accessʹ means 15
to access a computer with authorization and to use such access to obtain or alter 16
13

-- 13 of 35 --

information in the computer that the accesser is not entitled so to obtain or alter.ʺ Id. 1
§ 1030(e)(6). 2
The word ʺauthorizationʺ is not defined in the CFAA, and we have 3
viewed it as ʺa word of ʹcommon usage, without any technical or ambiguous 4
meaning,ʹʺ United States v. Valle, 807 F.3d 508, 524 (2d Cir. 2015) (ʺValleʺ) (quoting 5
United States v. Morris, 928 F.2d 504, 511 (2d Cir.) (ʺMorrisʺ), cert. denied, 502 U.S. 817 6
(1991)). It thus suggests ʺʹpermission or power granted by authority.ʹʺ Valle, 807 F.3d 7
at 524 (quoting Random House Unabridged Dictionary 139 (2001)). Both Valle and Morris 8
were prosecutions for alleged violation of the ʺexceeds authorized accessʺ clause, by 9
defendants who concededly had authorization to access the relevant computer but 10
did so for improper purposes. 11
The Supreme Court has treated the CFAAʹs ʺwithout authorizationʺ and 12
ʺexceeds authorized accessʺ clauses as coordinated elements of ʺthe computer‐context 13
understanding of access as entry.ʺ Van Buren v. United States, 593 U.S. 374, 390 (2021). 14
It reasoned that the ʺgates‐up‐or‐downʺ statutory structure ʺtreats the ʹwithout 15
authorizationʹ and ʹexceeds authorized accessʹ clauses consistently,ʺ as ʺwithout 16
authorizationʺ refers to whether ʺone either can or cannot access a computer system,ʺ 17
and ʺexceeds authorized accessʺ refers to whether ʺone either can or cannot access 18
14

-- 14 of 35 --

certain areas within the system.ʺ Id. at 390 (emphases added). The Court suggested 1
that such ʺgatesʺ might consist of ʺa specific type of authorization‐‐that is, 2
authentication, which turns on whether a userʹs credentials allow him to proceed past 3
a computerʹs access gate, rather than on other, scope‐based restrictions.ʺ Id. at 390 n.9 4
(internal quotation marks omitted). 5
2. Sufficiency of the Evidence 6
Cuomo contends chiefly that his (and his cohortsʹ) computer searches for 7
debtorsʹ POEs were not ʺwithout authorizationʺ within the meaning of § 1030(a) 8
because he (and they) used a website that is available to the public: 9
To obtain place‐of‐employment information, Paymerica 10
employees used ny.gov. All that was needed to create an account 11
was a username and email address. Any member of the public 12
could create a ny.gov account. . . . 13
Ny.gov could be used to access a host of services, including 14
searching for jobs, creating a JobZone profile, getting assistance 15
with employment‐related activities, like resume writing, cover 16
letters, and interview skills; or exploring careers, training 17
opportunities, apprenticeship opportunities, and other job seeker 18
resources, and accessing services for veterans. . . . These services 19
were available to any member of the public and off limits to no 20
one. There was no gate blocking entry to ny.gov. 21
15

-- 15 of 35 --

(Cuomo brief on appeal at 18‐19 (emphasis added).) These arguments do not, 1
however, reflect the scope of the CFAA or the structure of the gates on ny.gov. 2
First, Cuomoʹs argument mistakenly conflates websites and computers. 3
Section § 1030(a)(2) refers to accessing ʺcomputer[s],ʺ not accessing websites. As 4
explained at trial by an Information Technology Services manager who had helped 5
to design and develop the New York State process for filing online applications for 6
unemployment insurance (ʺNYS‐ITS Managerʺ), the website is not the computer itself. 7
The computer ʺhost[s]ʺ the website; information on a website is housed on a 8
computer; and on the website, a person can ʺlook[] at something thatʹs been compiled 9
by a computer and displayed forʺ a ʺcustomer to look at.ʺ (Tr. 146; see id. at 144‐47.) 10
The ʺwebsite is just a[n] interfaceʺ between the user and the computer (id. at 146); ʺthe 11
website cannot exist without a computerʺ (id. at 157); if the computer were turned off, 12
ʺthe website would disappearʺ (id. at 146). 13
Second, some parts of websites are ʺoutward facing,ʺ i.e., ʺthey are 14
exposed to the publicʺ (id. at 145); but other parts are not (see, e.g., id. at 155). See 15
generally hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1199 (9th Cir. 2022) 16
(ʺ[A] defining feature of public websites is that their publicly available sections lack 17
limitations on access; instead, those sections are open to anyone with a web browser.ʺ 18
16

-- 16 of 35 --

(emphasis added)). When the websiteʹs host computer introduces ʺgatesʺ for areas 1
of the website that require authorization to access, those parts of the website and the 2
computer or computers hosting them are not freely available to the public. See id. 3
at 1198‐99, 1199 n.17. 4
While Van Buren left open the question of whether the ʺgates‐up‐or‐down 5
inquiryʺ into authorization ʺturns only on technological (or ʹcode‐basedʹ) limitations on 6
access, or instead also looks to limits contained in contracts or policies,ʺ 593 U.S. at 390 7
n.8 (emphases added), we need not resolve that question because the gate at issue 8
here is code‐based. The NYS‐ITS Manager testified that in 2017‐2018, users could 9
obtain information as to an individualʹs place of employment through ny.gov by 10
taking two steps. To begin, users would have to create an ny.gov account, which 11
merely required them to provide a name and a verifiable email address. (See Tr. 147.) 12
To continue, the user could start an application for unemployment insurance; but in 13
order to proceed further‐‐and obtain information from the mainframe‐‐the user was 14
ʺrequired to put in a valid social security number and an address, mailing address[,] 15
to verify they are who they say they are.ʺ (Id. at 151 (emphasis added); see id. at 161 (a 16
person ʺha[s] to enter . . . specific information to access specific portions of the mainframeʺ 17
(emphasis added))). ʺWhen you fill out that application with the unemployment 18
17

-- 17 of 35 --

insurance area, it would go to the mainframe to actually pull records out for work 1
history of a person if they put in the proper social and address for that person.ʺ (Id. at 152 2
(emphasis added).) 3
In sum, the trial record includes evidence that ʺ[t]he mainframes at issue 4
[in the NYS] Department of Laborʺ ʺhost a lot of data. Thereʹs no publicly facing 5
website,ʺ but it performs ʺa lot ofʺ services including ʺproviding data to someone who 6
requests itʺ (id. at 158 (emphasis added))‐‐and shows authorization to get it: 7
[Y]ou can get into a web page but you might not have access to 8
records unless you [have] actually proven who you say you are. . . . 9
When you fill out that application with the unemployment 10
insurance area, it would go to the mainframe to actually pull 11
records out for work history of a person if they put in the proper 12
social and address for that person. 13
(Tr. 151‐52 (emphases added).) These controls were ʺput into place to prevent people 14
from seeing records of other people.ʺ (Id. at 156.) 15
This evidence as to the New York State computer gates, along with the 16
evidence described in Part I.A. above‐‐as to Cuomoʹs and other Paymerica employeesʹ 17
impersonations and subterfuges to circumvent those gates and obtain POE 18
information for Paymerica customers‐‐was sufficient to support the juryʹs findings 19
that Cuomo, in violation of 18 U.S.C. §§ 1030(a)(2) and (b), accessed, and conspired 20
18

-- 18 of 35 --

to access, a computer without authorization and thereby obtained information from 1
a protected computer ʺfor purposes of . . . private financial gain.ʺ 2
3. The CFAA Instruction as to ʺAuthorizationʺ 3
On appeal, Cuomo argues that the trial court gave the jury an erroneous 4
instruction as to the meaning of ʺwithout authorizationʺ in 18 U.S.C. § 1030(a)(2). He 5
challenges the following instruction: 6
ʺA computerʹs user accesses a computer without authorization if 7
the user bypasses an authentication requirement that requires the 8
user to demonstrate that the user is a person authorized to access 9
the information [on] another computer. A password is an 10
example of an authentication requirement but authentication 11
requirements may take other forms.ʺ 12
(Cuomo brief on appeal at 31‐32 (quoting Tr. 722).) Cuomo contends that this was 13
erroneous because it ʺfailed to acknowledge that Cuomo had a valid ny.gov accountʺ 14
(Cuomo brief on appeal at 32), and allowed the jury to believe ʺit could convict based 15
onʺ ʺterms of service or contractual limitations imposed by a websiteʺ (id. at 32, 33), 16
and that ʺ[t]he jury should have been instructed, consistent with Valle, that to find that 17
Cuomo acted without authorization, it had to find that Cuomo had no permission at 18
all to access the ny.gov siteʺ (id. at 33 (emphasis in original)). 19
19

-- 19 of 35 --

Cuomo made no objection in the district court to the instructions on the 1
CFAA counts. (See, e.g., Tr. 747‐58.) Thus, his present challenge to this instruction is 2
reviewable only for plain error. He cannot meet that test because, inter alia, the 3
instruction given by the court was not erroneous. 4
First, his complaint that the instruction did not acknowledge that he ʺhad 5
a valid ny.gov accountʺ again conflates the computer with the website. Cuomoʹs 6
access to the public‐facing aspects of the website did not give him authorization to 7
access the private POE information, stored on the mainframe, which he sought to 8
obtain for Paymericaʹs customers. 9
Nor has Cuomo shown error or plain error by arguing that the jury 10
should have been instructed that in order to find that he accessed the computer 11
without authorization in violation of the CFAA, it needed to find that he had no 12
permission at all to access the ny.gov site. In fact, the instruction fragment challenged 13
by Cuomo as erroneous was preceded by the more appropriate instruction‐‐omitted 14
by Cuomo‐‐that ʺ[a]ccess without authorization means to access a computer without the 15
permission of the computerʹs owner.ʺ (Tr. 722 (emphases added).) 16
Finally, as discussed in Part II.A.1. above, Van Buren indicated that 17
identity ʺauthentication, which turns on whether a userʹs credentials allow him to 18
20

-- 20 of 35 --

proceed past a computerʹs access gate,ʺ constitutes ʺa specific type of authorization.ʺ 1
593 U.S. at 390 n.9 (internal quotation marks omitted (emphasis ours)). The 2
instruction here that a user who accesses a computer by bypassing the authentication 3
requirement can be found to have accessed the computer ʺwithout authorizationʺ was 4
not error, much less an error that was ʺplain.ʺ 5
B. Social‐Security‐Number Misuse 6
Cuomo contends that his convictions on counts 13 and 12‐‐misuse of a 7
social security number and conspiracy to misuse social security numbers, 8
respectively‐‐should be reversed on the grounds that the district court gave an 9
erroneous instruction as to the elements of such misuse and erred in failing to instruct 10
the jury as to the theory of his defense, and that under his proposed instructions the 11
evidence was insufficient to support his convictions on those charges. These 12
arguments are meritless. 13
The Social Security Act, 42 U.S.C. § 301 et seq., makes it a felony for any 14
person to, inter alia, 15
for the purpose of obtaining anything of value from any person, 16
or for any other purpose‐‐ 17
21

-- 21 of 35 --

. . . . 1
(B) with intent to deceive, falsely represent[] a number to 2
be the social security account number assigned by the 3
Commissioner of Social Security to him or to another person, 4
when in fact such number is not the social security account 5
number assigned by the Commissioner of Social Security to him 6
or to such other person. 7
42 U.S.C. § 408(a)(7)(B) (emphases added). The district court instructed the jury that 8
the government was required to prove beyond a reasonable doubt that Cuomo, inter 9
alia, ʺknowingly represented to New York State that the social security number described 10
inʺ Count 13 ʺhad been assigned to him by the Commissioner of Social Security.ʺ 11
(Tr. 738 (emphasis added).) As to the ʺintent to deceiveʺ element, the court instructed 12
that 13
[t]o act with intent to deceive means to act with the intention of 14
misleading or giving false information. However, it is not 15
necessary for the government to prove that anyone was actually deceived 16
or misled. 17
(Id. at 740 (emphasis added).) 18
Cuomo objected to these instructions; he had requested that the jury be 19
instructed that it needed to find that his claimed ownership and use of the debtorʹs 20
social security number constituted a misrepresentation to ʺsomeoneʺ‐‐presumably a 21
live person (see generally Cuomo brief on appeal at 36‐37). His proposed change to the 22
22

-- 22 of 35 --

ʺrepresented to New York Stateʺ part of the courtʹs instruction would have replaced 1
ʺNew York Stateʺ with ʺsomeoneʺ; and as to the ʺintent to deceiveʺ element, his 2
proposed substitute would have told the jury that it needed to find that Cuomo 3
ʺintended to deceive someone for any purpose,ʺ and that ʺ[t]o ʹact with intent to 4
deceiveʹ simply means to act deliberately for the purpose of misleading someone.ʺ 5
(Cuomoʹs Proposed Jury Charge at 4 (emphases added); see Tr. 755‐58.) 6
Cuomoʹs rationale is that these changes would have supported his 7
ʺdefense theory,ʺ which was ʺthat the intent to defraud required by Section 408 must 8
be directed at someone, a victim deceived by the fraudʺ (Cuomo brief on appeal at 36 9
(emphasis added)), a ʺvictimʺ who was a natural person. Thus, Cuomo argued to the 10
district court that he was entitled to his proposed ʺsomeoneʺ language because the 11
government had ʺbrought no one in who said I worked for the department of labor 12
as a claim examiner and I was looking at thisʺ (Tr. 757). And his attorney in 13
summation pursued this line, asking ʺʹwho is Mr. Cuomo intending to deceive? The 14
website? The computer? That was not his intention. His intention was to get the 15
POE information and sell it.ʹʺ (Cuomo brief on appeal at 36 (quoting Tr. 817).) 16
A defendant is not entitled to have the court give his proposed 17
instruction to the jury unless it is, inter alia, legally correct. See, e.g., United States v. 18
23

-- 23 of 35 --

Prawl, 168 F.3d 622, 626 (2d Cir. 1999). Cuomoʹs proposed language would not have 1
been a correct instruction. 2
To begin with, his theory that to violate § 408 there must have been ʺa 3
victim deceived by the fraudʺ (Cuomo brief on appeal at 36 (emphasis added)) finds no 4
support in the language of the statute. Section 408(a)(7)(B) does not require that the 5
defendantʹs social‐security‐number misuse with ʺintent to deceiveʺ have been 6
successful. The courtʹs instruction that ʺit was not necessary for the government to 7
prove that anyone was actually deceived or misledʺ was correct. 8
Second, Cuomoʹs repeated proposed references to ʺsomeoneʺ‐‐along with 9
defense counselʹs rhetorical questions ʺwho is Mr. Cuomo intending to deceive? The 10
website? The computer?ʺ (Tr. 817), and his request to omit the reference to ʺNew 11
York Stateʺ‐‐were apparently intended to imply that one could not be prohibited 12
from, or punished for, acting with intent to deceive or defraud a government. Such 13
an implication would have been misleading and of course is fallacious, see generally 14
31 U.S.C. § 3729 (prohibiting frauds, or conspiracy to defraud, the United States 15
Government); see also United States v. Yermian, 468 U.S. 63, 73 n.12 (1984) (to ʺ[d]eceive 16
is to cause to believe the false or to misleadʺ (internal quotation marks omitted)); N.Y. 17
Penal Law § 195.20(a)(i) (McKinney 2024) (prohibiting schemes to defraud the State 18
24

-- 24 of 35 --

of New York or any of its political subdivisions or instrumentalities by means of, inter 1
alia, ʺfalse . . . pretenses [or] representationsʺ). The district court was not required to 2
instruct the jury in accordance with Cuomoʹs erroneous legal theories. 3
Nor, with § 408(a)(7)(B) properly interpreted, as it was by the court, is 4
there any merit in Cuomoʹs contention that the evidence was insufficient to support 5
his convictions with respect to social‐security‐number misuse. As described in Part 6
II.A.2. above, New York State required that a user seeking to access employment 7
records stored on the New York State computer provide the userʹs own social security 8
number; the gate was ʺput into place to prevent people from seeing records of other 9
peopleʺ (Tr. 156; see id. at 151‐52; see also id. at 278 (Paymerica employees skip traced 10
in some 15‐20 states, all of which required user‐identity verification through social 11
security numbers).) As described in Part I.A. above, to circumvent New Yorkʹs 12
identity verification requirement, Cuomo falsely created ny.gov accounts in the 13
names of debtors whose POE information he wanted to get for his customers; and 14
when, as the user, he was asked for his social security number he entered not his own 15
social security number but the numbers of the debtors. (See id. at 582‐92.) And, as 16
Cuomoʹs attorney summarized at trial, Cuomoʹs ʺʹintention was to get the POE 17
25

-- 25 of 35 --

information and sell it.ʹʺ (Cuomo brief on appeal at 36 (quoting Tr. 817 (his attorneyʹs 1
summation).) 2
In sum, the evidence was ample to allow the jury to find that Cuomo, 3
with intent to deceive state governments, provided debtorsʹ social security numbers, 4
falsely claiming they were his own‐‐and conspired to do so‐‐in order to obtain access 5
to and sell debtorsʹ POE information to Paymericaʹs customers, in violation of 6
42 U.S.C. § 408(a)(7)(B) and 18 U.S.C. § 371. 7
C. Aggravated Identity Theft 8
Cuomo was convicted on two counts (Counts 7 and 18) of aggravated 9
identity theft under 18 U.S.C. § 1028A(a). That subsection provides, in relevant part, 10
that any person who 11
during and in relation to any felony violation enumerated in subsection 12
(c), knowingly . . . uses, without lawful authority, a means of 13
identification of another person shall, in addition to the punishment 14
provided for such felony, be sentenced to a term of imprisonment 15
of 2 years. 16
18 U.S.C. § 1028A(a)(1) (emphases added). Subsection (c) defines the predicate 17
ʺfelony violation[s]ʺ to include two categories applicable to Cuomoʹs conduct: 18
ʺsection 208 . . . of the Social Security Act (42 U.S.C. § 408[)],ʺ see 18 U.S.C. 19
26

-- 26 of 35 --

§ 1028A(c)(11), and most provisions in Chapter 47 of Title 18 ʺrelating to fraud,ʺ 1
which include §§ 1030(a)(2) and (b), see 18 U.S.C. § 1028A(c)(4). 2
Cuomo contends that the evidence was insufficient to support his 3
convictions for aggravated identity theft, arguing principally that there was 4
insufficient evidence of the predicate felonies, i.e., of computer fraud in violation of 5
18 U.S.C. § 1030 for Count 7, and of social‐security‐number misuse in violation of 6
42 U.S.C. § 408 for Count 18. These contentions lack merit. As discussed in Parts II.A. 7
and B. above, the evidence to support the verdicts that Cuomo engaged in, 8
respectively, computer‐fraud offenses in violation of §§ 1030(a) and (b), and offenses 9
relating to social‐security‐number misuse in violation of 42 U.S.C. § 408(a)(7)(B) and 10
18 U.S.C. § 371, was ample. 11
We are unpersuaded by Cuomoʹs contention that a different result is 12
required by the Supreme Courtʹs recent decision in Dubin v. United States, 599 U.S. 110 13
(2023). Dubin involved an aggravated‐identity‐theft prosecution premised on the 14
defendantʹs ʺʹus[ing]ʹ a patientʹs means of identification ʹin relation toʹ healthcare 15
fraud,ʺ a federal offense under 18 U.S.C. § 1347. Dubin, 599 U.S. at 116‐17. The fraud, 16
however, was that the defendant claimed Medicaid reimbursement for psychological 17
testing by a licensed psychologist when the employee who actually performed the 18
27

-- 27 of 35 --

testing was only a licensed psychological associate. The Supreme Court held that this 1
fraud was not a proper predicate for aggravated identity theft under § 1028A(a)(1) 2
because the 3
use of the patientʹs name was not at the crux of what made the 4
underlying overbilling fraudulent. The crux of the healthcare 5
fraud was a misrepresentation about the qualifications of 6
[defendantʹs] employee. The patientʹs name was an ancillary 7
feature of the billing method employed. 8
599 U.S. at 132. ʺ[W]ith fraud or deceit crimes like the one in this case, the means of 9
identification specifically must be used in a manner that is fraudulent or deceptive.ʺ Id. 10
at 131‐32 (emphases added). 11
This interpretation of 18 U.S.C. § 1028A(a)(1) and its appropriate felony 12
predicates affords no relief for Cuomo, whose use of the social security numbers of 13
debtors was both fraudulent and deceptive: As ʺcooperating witnesses . . . testified[,] 14
. . . the entire process was about impersonating debtors,ʺ and ʺwas done so that the 15
states would falsely recognize Paymerica employees as the target debtors and provide 16
[to Paymerica] restricted POE information meant only for those debtors,ʺ D.Ct. Op. 17
at 6‐7. 18
In sum, Cuomoʹs contentions provide no basis for setting aside the juryʹs 19
verdicts. 20
28

-- 28 of 35 --

III. SENTENCING CHALLENGES 1
As indicated in Part I.B. above, Cuomoʹs sentence to 45 monthsʹ 2
imprisonment included 21 months for the computer‐related and social‐security‐ 3
number‐misuse counts. In calculating the Guidelines‐recommended sentences for 4
these offenses, the district court adopted the fact descriptions and recommendations 5
of the presentence report (ʺPSRʺ) for several increases in his Guidelines offense level. 6
(See Sentencing Transcript, August 11, 2022 (ʺS.Tr.ʺ), at 3.) Cuomoʹs base offense level 7
was 6. His total offense level was 16, resulting from (A) three enhancements for 8
specific offense characteristics, i.e., (1) two steps under § 2B1.1(b)(2)(A)(i) because the 9
offense involved 10 or more victims, (2) two steps under § 2B1.1(b)(10)(C) because it 10
involved sophisticated means, and (3) two steps under § 2B1.1(b)(18) because it 11
involved an intent to obtain personal information, and (B) a four‐step upward 12
adjustment under § 3B1.1(a) because of his leadership role in the criminal activity. On 13
appeal, Cuomo challenges the increases with respect to personal information and 14
leadership role. 15
We review the ʺreasonableness of sentencing decisions for abuse of 16
discretion, a standard incorporat[ing] de novo review of questions of law, including 17
29

-- 29 of 35 --

. . . interpretation of the Guidelines, and clear error review of questions of fact.ʺ 1
United States v. Taylor, 961 F.3d 68, 74 (2d Cir. 2020) (internal quotation marks 2
omitted). 3
A. Cuomoʹs Role 4
The Guidelines recommend a four‐step increase in offense level for a 5
ʺdefendant [who] was an organizer or leader of a criminal activity that involved five 6
or more participants,ʺ Guidelines § 3B1.1(a)‐‐including the defendant, see, e.g., United 7
States v. Paccione, 202 F.3d 622, 625 (2d Cir.) (ʺPaccioneʺ), cert. denied, 530 U.S. 1221 8
(2000). ʺWhether a defendant is considered a leader depends upon the degree of 9
discretion exercised by him, the nature and degree of his participation in planning or 10
organizing the offense, and the degree of control and authority exercised over the 11
other members of the conspiracy.ʺ United States v. Beaulieau, 959 F.2d 375, 379‐80 (2d 12
Cir. 1992). A defendant may be a leader of a crime even if it was planned, financed, 13
and orchestrated by another participant. See, e.g., United States v. Williams, 23 F.3d 14
629, 635 (2d Cir.), cert. denied, 513 U.S. 1045 (1994). 15
We review the district courtʹs conclusion that a defendant met the criteria 16
for ʺa leadership enhancement under U.S.S.G. § 3B1.1(a) de novo, but review the 17
30

-- 30 of 35 --

courtʹs findings of fact supporting its conclusion for clear error.ʺ See, e.g., Paccione, 202 1
F.3d at 624. Sentencing judges are ʺgiven latitude concerning their supervisory role 2
findings, even when their findings were not as precise as they might have been,ʺ 3
United States v. Napoli, 179 F.3d 1, 14 (2d Cir. 1999) (ʺNapoliʺ) (internal quotation marks 4
omitted), cert. denied, 120 S. Ct. 1176 (2000), so long as their findings are sufficient to 5
permit meaningful appellate review, see, e.g., United States v. Ware, 577 F.3d 442, 6
451‐52 (2d Cir. 2009), cert. denied, 562 U.S. 995 (2010). 7
The district court, in addressing Cuomoʹs role, stated as follows: 8
Iʹve looked at the nature and scope of the illegal activity, the 9
degree with which this defendant oversaw this illegal conspiracy. 10
And I find that based upon the fact that this defendant incorporated 11
and was president of Ameripay; that this defendant established the 12
account with TLO which allowed him to get information about 13
debtors and that this defendant used both Ameripay and Paymerica to 14
get the identity of debtors; also that he managed co‐conspirators . . . ; 15
that his employees characterize this defendant as a manager when Mr. 16
Trowbridge was not present; . . . [and] this defendant was very involved 17
with a number of these supposed debtors. 18
(Sentencing Tr. 6‐7 (emphases added).) 19
Cuomo challenges the sufficiency of the courtʹs findings, stating 20
principally that the TLO account was a ʺlegitimate business expense for anyone 21
involved in pursuing judgment debtors,ʺ that ʺ[t]he employees were not Cuomoʹs 22
31

-- 31 of 35 --

employees,ʺ and that ʺ[t]here were no ʹsupposed debtorsʹ in this case. Ameripay 1
pursued debtors who had court judgments against them.ʺ (Cuomo brief on appeal 2
at 42 (emphasis in original).) He also argues that the district court ignored ʺample 3
evidence that Trowbridge was the sole manager and leader.ʺ (Id.) These arguments 4
are wide of the mark. 5
The test for reviewing the courtʹs findings is not whether there were 6
legitimate aspects of the business of Ameripay and Paymerica, or whether the 7
individuals who did most of the skip‐tracing were employees of Cuomo personally, 8
rather than of the company he incorporated and its affiliate, or even whether there 9
was evidence from which the court could have ruled differently. Rather, the 10
ʺsentencing courtʹs findings as to the defendantʹs role in the offense will be 11
overturned only if they are clearly erroneous.ʺ Napoli, 179 F.3d at 15 (internal 12
quotation marks omitted). And ʺ[w]here there are two permissible views of the 13
evidence, the factfinderʹs choice between them cannot be clearly erroneous.ʺ Anderson 14
v. City of Bessemer City, 470 U.S. 564, 574 (1985). 15
The district courtʹs findings that Cuomo was Ameripayʹs founder and 16
president and that he managed other coconspirators are supported by testimony and 17
documents in the trial record. Ameripayʹs corporate documents showed Cuomo as 18
32

-- 32 of 35 --

its founder and president. Multiple witnesses who worked at Paymerica also testified 1
that Cuomo was ʺsecond in commandʺ to Trowbridge (e.g., Tr. 354, 389), and that 2
Cuomo supervised the skiptracers (id. at 460), ʺauditedʺ their time and attendance (id. 3
at 559) and the quality of their performance (id. at 463), and reported to Trowbridge 4
on their productivity or on their ʺgoofing offʺ (id. at 433). As summarized in the PSR, 5
whose factual descriptions the sentencing judge expressly adopted, Paymerica 6
employees characterized Cuomo as being in charge when Trowbridge was not 7
present, and Trowbridge traveled ʺa lot.ʺ 8
We see no clear error in the sentencing courtʹs findings as to Cuomoʹs 9
leadership role in the conspiracy, which demonstrate that Cuomo was intimately 10
involved in organizing and planning the conspiracy and that he exercised direct 11
authority over most of his coconspirators. We thus affirm the imposition of the four‐ 12
step enhancement based on Cuomoʹs leadership role. 13
B. Personal Information 14
The Guidelines recommend a two‐step increase in offense level if ʺthe 15
defendant was convicted of an offense under 18 U.S.C. § 1030, and the offense 16
33

-- 33 of 35 --

involved an intent to obtain personal information.ʺ Guidelines § 2B1.1(b)(18)(A). 1
ʺʹPersonal informationʹʺ is defined to 2
mean[] sensitive or private information involving an identifiable 3
individual (including such information in the possession of a third 4
party), including (A) medical records; (B) wills; (C) diaries; (D) 5
private correspondence, including e‐mail; (E) financial records; (F) 6
photographs of a sensitive or private nature; or (G) similar 7
information. 8
Guidelines § 2B1.1, Application Note 1 (emphasis added). 9
Cuomo contends that ʺ[t]his enhancement is inapplicableʺ because 10
ʺplaces of employment are not listed in the definition.ʺ (Cuomo brief on appeal at 44.) 11
But we need not reach this issue. ʺAn error in Guidelines calculation is harmless if 12
correcting the error would result in no change to the Guidelines offense level and 13
sentencing range.ʺ United States v. Cramer, 777 F.3d 597, 603 (2d Cir. 2015). The 14
Guidelines provide that appropriate offense‐characteristic enhancements are to be 15
applied before the application of adjustments on account of the defendantʹs role, see 16
Guidelines § 1B1.1(a); and without the personal‐information enhancement, the two‐ 17
step increases for each of the other two offense‐characteristic enhancements (number 18
of victims and sophisticated means) would have increased Cuomoʹs offense level 19
from 6 to level 10. However, the guideline establishing the sophisticated‐means 20
34

-- 34 of 35 --

enhancement‐‐whose applicability Cuomo does not challenge on appeal‐‐(see 1
Government brief on appeal at 75; Cuomo reply brief on appeal at 21)‐‐while initially 2
providing for a two‐step enhancement, dictates that ʺ[i]f the resulting offense level is 3
less than level 12, increase to level 12,ʺ see Guidelines § 2B1.1(b)(10)(C) (emphasis 4
added). Accordingly, even if Cuomoʹs challenge to the application of the personal‐ 5
information enhancement were successful, the sophisticated‐means enhancement 6
would increase his enhanced offense level to level 12. The four‐step adjustment for 7
his leadership role increases his offense level to level 16, leaving his total offense level 8
and sentencing range unchanged. 9
CONCLUSION 10
We have considered all of Cuomoʹs contentions on this appeal and have 11
found them to be without merit. The judgment of the district court is affirmed. 12
35

-- 35 of 35 --