United States v. Dennis Richard Ashe (94-5087) David Daughtrey (94-5364)

KRUPANSKY, Circuit Judge. In case number 94-5364, defendant-appellant David Daughtrey (“Daughtrey”) seeks appellate review of the judgment of conviction and sentence entered against him by the district court subsequent to his guilty plea to a charge of trafficking in altered cellular telephones capable of impermissibly accessing cellular telephone services without charge in alleged violation of 18 U.S.C. § 1029. In case number 94-5087, defendant-appellant Dennis Richard Ashe (“Ashe”) appealed his jury conviction on charges of producing and possessing similar devices. Both appeals challenge this court, in the first instance, to determine if the possession, distribution, sale, and use of mobile cellular telephones which have been converted, by the insertion of a “tumbling” microchip that counterfeits electronic codes that access the transmitting facilities operated by commercial cellular telephone companies, in a manner that circumvents the carrier’s service monitoring procedures thereby permitting the user to avoid charges resulting from the *772 illicit invasion of the cellular telephone company’s property (“free riding”), constitutes a violation of 18 U.S.C. § 1029. In the second instance, this court must determine, in Daughtrey’s appeal, the propriety of the sentence imposed by the trial court. In the instant cases, sometime prior to April of 1992, Daughtrey, a resident of Los Angeles, California, became the target of a United States Secret Service investigation of an alleged illegal cellular telephone scam. The evidence disclosed that Daughtrey had distributed approximately 500 “Mitsubishi 800” mobile cellular telephones throughout the nation, each of which had been modified as hereinabove described. After enlisting the assistance of a Daugh-trey confederate (John Brady of Salt Lake City, Utah), Special Agent Bruce Ward on April 8, 1992 arranged the purchase of a “tumbling” cellular device from Daughtrey. On April 10, 1992, Daughtrey and an accomplice (Jesus Rizo) were arrested at Daugh-trey’s residence after he displayed several converted mobile cellular telephones to Ward. Daughtrey agreed to cooperate with the authorities, admitting that he mailed approximately 500 modified “tumbling” cellular telephones to various destinations around the country (including Chattanooga, Tennessee). He provided a list of his subscribers. 1 On September 13, 1993, acting pro se, Daughtrey waived indictment and pleaded guilty to a one-count bill of information in the United States District Court for the Eastern District of Tennessee which alleged the following: The United States Attorney charges that on or about June 14, 1991, in the Eastern District of Tennessee, the defendant, DAVID DAUGHTREY, knowingly and with intent to defraud, trafficked in device-making equipment, as defined in 18 U.S.C. § 1029(e)(6), i.e., an altered cellular telephone capable of generating codes used to obtain cellular telephone service without authorization and without payment for the service, such conduct having an effect on interstate commerce; all in violation of 18 U.S.C. § 1029(a)(4). On January 17, 1994, in reliance upon United States v. Brady, 13 F.3d 334 (10th Cir.1993), Daughtrey moved pro se for a judgment of acquittal, asserting that his conduct did not violate 18 U.S.C. § 1029, 2 which relief the district court denied. On February 28, 1994, the government agreed to amend Daughtrey’s written plea agreement “to provide that the defendant retains the right to appeal the statutory construction question involving 18 U.S.C. § 1029.” Daughtrey noticed a timely appeal from the judgment subsequently entered against him. Following Daughtrey’s arrest, Ashe, a resident of Chattanooga, Tennessee, became enmeshed in the ongoing Secret Service investigation. Ashe reproduced the Daughtrey tumbling chip from a purchased converted mobile cellular telephone. Subsequently, he produced additional copies for sale, one of which he transferred to Shane Hendrix, who was acting in undercover cooperation with treasury agent Robert T. Pettway, on May 25, 1993. The authorities arrested Ashe immediately following the transaction. On June 8, 1993, a grand jury in the Eastern District of Tennessee returned a one-count indictment against Ashe which recited: The Grand Jury charges that on or about May 25, 1993, in the Eastern District of Tennessee, the defendant, DENNIS RICHARD ASHE, knowingly and with intent to defraud, did produce and possess device-making equipment, as defined in 18 U.S.C. § 1029(e)(6), i.e., an altered cellular telephone capable of generating codes used to obtain cellular telephone service without authorization and without payment for the *773 service, such conduct having an effect on interstate commerce; all in violation of 18 U.S.C. § 1029(a)(4). On September 15, 1993, Ashe, represented by counsel, also petitioned for dismissal of the indictment, arguing that the charged conduct did not violate section 1029. The district court denied the requested relief. Following conviction by a jury, Ashe timely noticed an appeal from the district court judgment entered against him. A brief summary of the operational mechanics of a cellular telephone network is a helpful point of departure for arriving at a resolution of the issues joined in these consolidated appeals. Cellular telephone service is available from commercially owned and operated communication networks that utilize individual cellular telephone units which have wireless radio transmission capabilities, operating among a series of geographic cells. Each geographic cell is served by a radio transmission tower and antenna, and as the cellular telephone user moves from one cell to another, the telephone call is automatically relayed from one transmission tower to the other, thus maintaining consistent signal quality. United States v. Brady, 13 F.3d 334 (10th Cir.1993). Another feature provided by cellular carriers permits a cellular telephone customer to “roam,” placing calls from a foreign geographic cell, that is a geographic cell owned and operated by a carrier with whom the customer has no subscription account, i.e. a foreign carrier. 3 This permits a caller to place a local or long distance call from anywhere in the'United States while outside the geographical area serviced by his/her home carrier with whom he has a subscription contract. When a “roamer” 4 places a call from a foreign geographical service area the cellular telephone automatically transmits the caller’s assigned MIN and ESN. 5 By design, the MIN transmitted by a “tumbling” cellular telephone will identify an ostensible home carrier 6 located outside of the geographical region from which the user placed the illegitimate call; accordingly, all calls made on the “tumbling” cellular telephone are treated as “roamer” calls by the servicing carrier. In processing a “roamer” call, a foreign carrier immediately recognizes the MIN as belonging to another existing carrier. To provide effective customer service, “roamer” calls are, by internetwork agreement, practice, and procedure, immediately transmitted by a foreign carrier before validation of the identifying MIN/ESN combination has been completed by a central data bank clearing house located in San Angelo, Texas. Because the clearing house is incapable of instant validation, a time lag occurs while its computers seek to match the automatically transmitted identifying MIN/ESN with an existing home carrier-subscriber combination recorded in its data bank of national inter-network listings. In the absence of a valid match all subsequent calls using the same MIN/ESN combination will be rejected. Although service charges resulting from unmatched MIN/ESN combinations are listed together with all pertinent information related to the call in the foreign carrier’s billing computer, the illicit “roaming” customer cannot be identified; consequently the charges cannot be collected from any individual. The illicit “roaming” caller may use the same combination of counterfeit MIN/ESN num *774 bers until it is invalidated, at which time the user merely “re-tumbles” the numbers by entering a new, randomly selected combination into the key board of the cellular telephone, and may continue to “free ride” indefinitely. 7 In resolving the charged error of the district court in the instant case, this court finds the Brady interpretation of a 18 U.S.C. § 1029(e)(2) violation 8 to be misconceived and concludes that the invasion of an identifiable customer’s account is not a necessary element of proof to support a conviction under the statute here in issue. „To prevail, the government need only prove by the appropriate weight of the evidence that the defendant possessed, produced, trafficked, had control over, or had custody of an instrument or device (or device-making equipment) that permits a theft of services. Because preexisting agreements and practices within the inter-telephone carrier network require a MIN-identified home carrier to reimburse a foreign carrier for the air time incurred by either a valid subscriber or an illicit “roamer” identified by a transmitted MIN and ESN combination that actuated access to the inter-cellular telephone network, a fraudulently identified ostensible home carrier ultimately assumes the loss of the unidentified “free rider” call which was debited to its account as a result of the counterfeit MIN/ESN identification combination. 9 In 1992, the losses charged to cellular telephone carriers resulting from “free riding” amounted to over $100 million. This court accordingly concludes that a converted “tumbling” cellular telephone is a device which is capable of accessing cellular telephone carrier accounts by transmitting counterfeit MIN and ESN signals that permit illicit “roamers” to fraudulently obtain free air time. In sum, the instruments here in issue are devices that permit and facilitate the theft of “air time” from the individual cellular telephone carriers comprising the national inter-cellular telephone network of companies that are engaged in the commerce of providing cellular telephone services to subscribers, and is accordingly in violation of 18 U.S.C. § 1029. This disposition is in accord with the Ninth Circuit’s decision in United States v. Bailey, 41 F.3d 413 (9th Cir.1994). 10 *775 Secondly, Daughtrey contested his sentence (twelve months of imprisonment followed by three years of supervised release) on the theory that the lower court erred by imposing an eleven point increase to his base offense level 11 under United States Sentencing Guidelines (U.S.S.G.) § 2Fl.l(b)(l)(L) for causing fraud losses in a sum between $800,-000 and $1,500,000. In support of the enhancement, the district court had adopted the loss estimate calculation of $1,221,300 contained in the Presentence Report (PSR): In this case the defendant sold 500 phones beginning on or about January 1991 until on or about April 1992. Therefore, in order to ascribe a specific value to the fraudulently obtained cellular service, it is first recognized that roamer airtime rates are higher than normal local subscriber airtime rates. These rates include a daily access charge of $3 on average and per minute charges of $.99 on average. Average airtime consumption in Chattanooga during the month of June 1993 was 145 minutes. By attributing a usage pattern of 20 days (x $3) per month and average airtime consumption (145 minutes x $.99 minute) a value of $203.55 is obtained. When this value is multiplied by the number of months used by all phones [ (500 x 12 = 6000) x 203.55] a loss of $1,221,300 is produced. This is considered to be a very conservative loss estimate in that due to the fact that no charges were paid by the user of an ESN tumbler, it would be reasonable to suspect that airtime usage would be heavier for an ESN tumbler than for a paying customer. Furthermore this figure is also only representative of the value of cellular service in making calls in the Chattanooga area. Any long distance calling would have incurred toll charges. Daughtrey argued at the sentencing hearing, and on appeal, that this computation was erroneous because (1) the 500 unit quantification was allegedly unreliable, and (2) the loss estimate attached to each unit was purportedly speculative and insupportable. Initially, it should be noted that Daughtrey’s plea agreement waived his right to contest any aspect of his sentencing. As previously disclosed, the subsequent amendment to that contract invested him with the right to appeal only the statutory construction issue resolved herein. Any right, even a *776 constitutional right, may be surrendered in a plea agreement if that waiver was made knowingly and voluntarily. Town of Newton v. Rumery, 480 U.S. 386, 393, 107 S.Ct. 1187, 1192, 94 L.Ed.2d 405 (1987); United States v. Johnson, 22 F.3d 674, 681-82 (6th Cir.1994). This reviewing court finds no clear error in the district court’s finding that Daughtrey understood the terms of the plea agreement when he voluntarily executed it, and therefore he cannot be excused from the plain meaning of that contract. See Baker v. United States, 781 F.2d 85, 90 (6th Cir.), cert. denied, 479 U.S. 1017, 107 S.Ct. 667, 93 L.Ed.2d 719 (1986). Even if Daughtrey had not surrendered the right to appeal his sentence, his assignment of sentencing error would fail. A preponderance of the evidence supported the finding that Daughtrey trafficked in 500 “tumbling” telephones, given his expressed admission of that number. 12 The loss estimate attributed to these 500 units by the PSR was reasonable, and indeed was highly conservative. See U.S.S.G. § 2F1.1, comment. (n. 8) (fraud losses need not be determined with precision in order to trigger enhancements for particular dollar loss amounts, but rather a reasonable estimate based upon the available information will suffice); United States v. Kohlbach, 38 F.3d 832, 835 (6th Cir.1994); United States v. Milli-gan, 17 F.3d 177, 183 (6th Cir.1994). The precise amount of losses caused by the “tumblers” manufactured and distributed by Daughtrey could not be computed with exactitude because no method exists for determining all of the fraudulent MIN/ESN combinations historically broadcast by the pertinent units, 13 and therefore no means exists for tracing the vast majority of illegitimate calls to any particular device. The PSR estimation quoted above, which was supported by a preponderance of the evidence and which conservatively resolved uncertainties in favor of the defendant, 14 was corroborated by Daughtrey’s admission contained in his written confession of April 10, 1992 (see Note 1, supra) that he sold the 500 telephones for an average per unit price of $1,600, 15 which yields a total sales figure of approximately $800,000. It is reasonable to infer that, in order for these transactions to make economic sense for the purchasers of the equipment, the buyers must have anticipated obtaining, in the comparative short run, use value at least equivalent to the unit purchase price. See U.S.S.G. § 2F1.1, comment. (n. 8) (“The offender’s gain from committing the fraud is an alternative estimate that ordinarily will underestimate the loss.”) (Emphasis added). Accordingly, the district court did not commit clear error by estimating fraud losses in an amount between $800,-000 and $1,500,000 caused by equipment trafficked by Daughtrey, and therefore no error adhered in his sentencing. Accordingly, the convictions of Daughtrey and Ashe, and the sentence of Daughtrey, are hereby AFFIRMED. Footnotes [1] Daughtrey admitted in a written confession executed on the day of his arrest, which he later corroborated during a September 13', 1993 interview with his probation officer, that he purchased a "tumbling” cellular telephone in December 1990 for $2,200. He subsequently isolated the operative microchip and reproduced it for distribution. [2] On October 20, 1994, the Ninth Circuit decided United States v. Bailey, 41 F.3d 413 (9th Cir.1994), which ruled, contrary to Brady, supra, that "tumbling" cellular telephone fraud is indeed embraced by 18 U.S.C. § 1029. [3] The term “foreign carrier," as used in this opinion, is a provider of cellular telephone services in a geographical area other than the geographical area of a subscriber's home contracting carrier. [4] As employed in this disposition, the term "roamer" is defined as an individual who places a cellular telephone call outside of the geographic region of his or her home carrier, which call is processed by a foreign carrier. [5] Cellular telephones are programmed with two identifying numbers by the manufacturer of the equipment and by the home carrier. The mobile identification number (MIN) is a ten digit number (usually the area code and telephone number) assigned to the customer's cellular telephone by the home carrier when the customer subscribes to that carrier's service. The MIN identifies the home carrier and the subscriber. The electronic serial number (ESN) is an eight digit number programmed onto an electronic chip by the telephone manufacturer. The ESN identifies the instrument and its manufacturer. [6] The “ostensible home carrier” is the cellular service company identified as the home carrier by a counterfeited MIN transmitted by a "tumbling” cellular telephone. [7] A "tumbling” cellular telephone must be distinguished from a "cloned" cellular telephone. A “cloned” unit emits pirated ESN/MIN information programmed into the device which, without authorization, identifies an actual subscriber's account. Calls made on a "clone" will be charged to a specific, identifiable, existing account until the subscriber recognizes and reports the unauthorized charges. “Cloned” phones were not involved in the instant prosecutions. [8] Section 1029(e) defines "access device” and "counterfeit access device" as follows: (1) the term "access device " means any card, plate, code, account number, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument); (2) the term "counterfeit access device " means any access device that is counterfeit, fictitious, altered, or forged, or an identifiable component of an access device or a counterfeit access device[.] (Emphasis added). Section 1029(a) posits, in part: Whoever— (4) knowingly, and with intent to defraud, produces, traffics in, has control or custody of, or possesses device-making equipment; shall, if the offense affects interstate or foreign commerce, be punished as provided in subsection (c) of this section. (Emphasis added). Section 1029(e)(6) directs: the term "device-making equipment” means any equipment, mechanism, or impression designed or primarily used for making an access device or a counterfeit access device. (Emphasis added). [9] This custom is analogous to credit card industry practices, in which the issuing bank pays the vendor for goods or services billed to the card’s account number even if the account number was counterfeit or if the purchases were fraudulently charged to an innocent customer's account. In such cases, the credit card company must bear the associated losses because it cannot in turn bill any legitimate customer for these costs. [10] See also United States v. Taylor, 945 F.2d 1050 (8th Cir.1991) (misuse of an unassigned credit card account number to fraudulently extract value is cognizable under section 1029); United States v. Brewer, 835 F.2d 550 (5th Cir.1987) (misappropriation of unassigned long distance telephone access codes to obtain unauthorized services is covered by section 1029); United States v. Jacobowitz, 877 F.2d 162, 165 (2nd Cir.), cert. denied, 493 U.S. 866, 110 S.Ct. 186, 107 L.Ed.2d 141 (1989) (abuse of an expired, *775 revoked, or- cancelled credit card is actionable under 18 U.S.C. § 1029(e)(3) as use of an "unauthorized access device"). Accord, Bailey, supra, 41 F.3d at 417-18 ("We agree with those cases [:Taylor and Brewer ] that actual or potential recourse by the provider of the goods or services against the party for whose benefit the account is maintained is not a necessary element of "account access” under § 1029. It matters only that the user of the access device be able to obtain goods or services from which he [or she] would otherwise be excluded.”) These access devices, like the fraudulent tumbling MIN/ESN combinations in the instant cases, enabled the user to raid an “account” within the system, albeit a fictitious or unassigned customer account. The perpetrator successfully stole value through the artifice of invented account codes which deceived the system by rendering the impression that an existing, valid customer account was being accessed. Although this court does not reach the merits of the Tenth Circuit's ruling in United States v. McNutt, 908 F.2d 561 (10th Cir.1990), cert. denied, 498 U.S. 1084, 111 S.Ct. 955, 112 L.Ed.2d 1043 (1991), which was relied upon by the defendants and by the Brady court, it concludes that, even if correctly decided, McNutt was materially distinguishable from the instant cases. The McNutt court anchored its decision in part in the determination that no account was accessed by the use of a "cloned” electronic address on a satellite descrambler to passively capture omnipresent satellite broadcasts because the service provider suffered no out-of-pocket financial loss by the user’s "free riding,” but rather merely endured the economic cost of lost revenues. McNutt, supra, 908 F.2d at 563-64. By contrast, as developed above, in the cellular communications industry the ostensible home carriers suffer actual out-of-pocket financial losses, which value is extracted from fictitious accounts by means of deceptive counterfeit access devices (codes) produced by “tumbling" instruments, and which losses were recprded as debits to fictitious accounts identified by counterfeit account numbers. Accord, Bailey, supra, 41 F.3d at 418-19. [11] Although the Sentencing Table (U.S.S.G. Chapter 5, Part A) yielded a range of 27 to 33 months of incarceration for Daughtrey’s total offense level of 18 and criminal history category of I, the district court granted the government’s motion for a downward departure under U.S.S.G. § 5K1.1 in recognition of Daughtrey’s substantial assistance in the continuing investigation of other violators, and accordingly reduced Daughtrey's sentence to 12 months of penal custody. [12] At the sentencing hearing, Daughtrey attempted to retract this admission by attesting that he only sold about 300 units. He subsequently adjusted his testimony by asserting that he may have distributed between 300 and 500 “tumblers.” The sentencing judge expressly found by a preponderance of the evidence that Daughtrey trafficked 500 devices. [13] Even if the authorities had custody of all 500 relevant units, which they did not, no extant mechanism would enable them to determine all of the specific MIN/ESN signals which were transmitted during the service lifetime of any "tumbling” telephone. Investigators could only determine the MIN/ESN combination encoded into each unit at the time of its seizure. [14] In addition to the PSR's exclusion of an estimated cost factor for long distance calls which may have been placed by the users of the 500 Daughtrey units, as well as its failure to enhance the average use estimation in view of the natural propensity of gratuitous service consumers to use those services more frequently than paying customers, the PSR estimate was further conservative in that it assumed an average service period per unit of twelve months, whereas undoubtedly many of the units (the first of which were sold in January 1991) were operational for longer durations; presumably many are still in use. [15] Generally, the record disclosed that the 500 telephones were each sold for amounts typically ranging between $1,000 and $2,000 per unit, although some fetched prices as high as $3,000.