An Arkansas man found guilty of violating the main U.S. anti-hacking law by taking 114,000 e-mail addresses from AT&T Inc. (T:US) had his conviction thrown out by an appeals court that ruled he was tried in the wrong state.
Andrew Auernheimer, known in the online world as “weev,” was indicted and convicted at trial in Newark, New Jersey, of conspiracy to violate the Computer Fraud and Abuse Act and of identity fraud. The U.S. Court of Appeals in Philadelphia ruled today he never should have been charged in New Jersey because his crimes had no connection to the state.
A three-judge panel said that while the case raised “complex and novel issues that are of great public importance in our increasingly interconnected age,” its decision turned on venue -- the proper place for a defendant to be tried.
Auernheimer, who is serving a 41-month prison term, gained notoriety for breaking into computer systems, disrupting blog sites and riling people with personal attacks. His supporters made the case a rallying point to argue that the Justice Department wields the CFAA too broadly, threatening Internet freedom. His lawyer said he was punished for his views.
“I’m ecstatic,” said Auernheimer’s attorney, Tor Ekeland. “This is a really great decision. We’ve been arguing since Day One that this was improperly brought in New Jersey. They hate his speech. This whole case has not really been about computer crime.”
Ekeland obtained a court order to release Auernheimer from the Allenwood Federal Correctional Complex in White Deer, Pennsylvania, subject to his previous bail conditions.
His client has been held in solitary confinement for 23 hours a day and has “generally been treated horribly,” Ekeland said. He said prosecutors told him they want Auernheimer held on the same supervised release conditions as he had before trial.
Matthew Reilly, a spokesman for U.S. Attorney Paul Fishman, who oversaw Auernheimer’s prosecution, said the office was reviewing its options.
A former federal prosecutor, Doug Burns, said Auernheimer could be retried if the Justice Department seeks his indictment in the proper district. The constitutional bar against double jeopardy wouldn’t apply, he said.
“The cure for no venue in one district is to bring the case in the correct district,” Burns said.
Auernheimer was represented on appeal by the Electronic Frontier Foundation, which applauded the ruling.
“Today’s decision is important beyond weev’s specific case,” EFF attorney Hanni Fakhoury said in a statement. “The court made clear that the location of a criminal defendant remains an important constitutional limitation, even in today’s Internet age.”
Auernheimer was convicted of conspiracy to access AT&T’s servers without authorization and of identity theft. Prosecutors said his associate Daniel Spitler breached AT&T servers and stole e-mail addresses of more than 114,000 users of Apple Inc. (AAPL:US)’s iPads. Auernheimer disclosed that data to the Gawker website. AT&T plugged the hole and apologized to customers.
Auernheimer e-mailed iPad users at news organizations to say he had “stolen” identification numbers for their addresses, and he “would be happy to discuss the method of theft.” At trial, Auernheimer said he used the words like “theft” as “rhetoric and hyperbole” to “sensationalize” the story.
In an interview last year, Fishman said his office doesn’t pursue minor infractions of the law, and the privacy violations in the case were obvious.
“If you hack and you get 114,000 e-mail addresses, and you look at them and say, ‘I don’t want to tell anybody about this,’ it’s different than sending them out and publicizing what you do and basically thumbing your nose,” Fishman said. “If we don’t respond under circumstances when people do something that is so notorious, that sends a bad message, too.”
Spitler pleaded guilty and testified against Auernheimer. He described how he carried out his attack by writing computer code to generate iPad identification numbers. Auernheimer told jurors that the information was public and that he never considered what he did as theft.
Auernheimer was in Fayetteville, Arkansas, while Spitler was in San Francisco and the computer servers they hacked were in Dallas and Atlanta, according to the ruling.
“Despite the absence of any apparent connection to New Jersey,” Auernheimer was indicted by a grand jury in Newark, U.S. Circuit Judge Michael Chagares wrote for the panel.
Trying someone where a crime occurred is a fundamental constitutional right intended to prevent the government from shopping for the most favorable forum, Chagares wrote.
“The ever-increasing ubiquity of the Internet only amplifies this concern,” he said. “As we progress technologically, we must remain mindful that cybercrimes do not happen in some metaphysical location that justifies disregarding constitutional limits on venue.”
Auernheimer’s supporters said he was punished for being obnoxious.
At his sentencing hearing in March 2013, he told the prosecutors and the judge, “If you people understood what you were doing with the rule of law and the Constitution, you would feel shame.” The judge criticized his “pervasive disrespect,” which she factored into his sentence.
After being imprisoned, Auernheimer sent electronic messages about his experience, relying on friends who posted tidbits from e-mails sent through the prison e-mail system.
In April 2013, he was cut off from prison e-mail without explanation. He used recordings, posted by supporters on the audio-sharing site SoundCloud to document his prison experience.
In late April 2013, all his books and papers were taken away and he was placed in a special housing unit used to separate and punish inmates.
“The conditions in the SHU here are pretty terrible,” Auernheimer wrote in a letter dated May 1, 2013, to Bloomberg News. “We are rotated on a weekly basis between solitary confinement and extreme overcrowding. Right now I am subject to the latter, in a bunk where I cannot even sit up.”
The case is U.S. v. Auernheimer, 13-1816, U.S. Court of Appeals for the Third Circuit (Philadelphia).
To contact the reporter on this story: Andrew Zajac in Washington at email@example.com
To contact the editors responsible for this story: Michael Hytha at firstname.lastname@example.org Fred Strasser, Peter Blumberg