The Appeals Court acknowledged that there were lots of issues at play in the appeal, but that they only had to judge one of them to vacate the conviction.
The prosecutors selected New Jersey as the venue for the case, despite the fact that Aurnheimer and his co-conspirators hadn't been located in NJ, and AT&T's servers weren't in NJ. The rationale was that some of the addresses disclosed belonged to NJ residents.
Not only did they select a tenuous venue, but they allowed the court to sidestep the issue during jury instructions. The jury decides whether venue is correct. Because venue was important to the case, the jury was supposed to receive instructions on how to evaluate the validity of the venue. But the trial court decided that venue had been adequately established.
"The venue error in this case is not harmless
because there was no evidence that any of the essential
conduct elements occurred in New Jersey. If Auernheimer’s
jury had been properly instructed on venue, it could not have
returned a guilty verdict"
One reason this matters is that the CFAA charges that were applied to Auernheimer depended in part on NJ state law. In fact, the specifics of NJ state computer crime law might have been the reasons prosecutors stretched venue so much to get the case located there. But with the Appeals Court determining that the NJ venue was invalid, the whole framework of the case falls apart.
They did comment on something else than venue, though (page 12):
We also note that in order to be guilty of accessing “without
authorization, or in excess of authorization” under New
Jersey law, the Government needed to prove that
Auernheimer or Spitler circumvented a code- or password-based barrier to access
[..]
The account slurper simply accessed the publicly
facing portion of the login screen and scraped information
that AT&T unintentionally published
(If NJ law demands breaking a password, that seems to run counter to the idea they picked NJ for its law, or was that concerning some other charge?)
The rationale was that some of the addresses disclosed belonged to NJ residents.
I guess he should be tried in every state and several other countries then to account for the 114,000 people that were part of the list.
Reading the appellate ruling, U.S. District Judge Susan Wigenton's decisions make her seem like she's off her rocker. Beyond that, it's amazing how he was treated in court by the judge:
As [the prosecutor] spoke, a U.S. marshal approached Auernheimer from behind and told him to put away his phone. Other marshals pushed his head against the defense table and handcuffed him.
[the judge] declared a recess, and the marshals escorted Auernheimer to a side room. When he returned a few minutes later, he was shackled, with a chain around his waist and handcuffs attached to the chain.
Sentenced to 3.5 years in jail for loading a URL from a publicly accessible web page that required no login, no password.
Though his testimony was hilarious, as the trial was an obvious farce "What do you do for a living?" "P/T disaster response" he actually talked himself into a bogus conviction by handing the prosecutor everything needed to twist his statements around to the jury. His trial is a good lesson in not underestimating the skill of a lawyer to manipulate banal statements into perceived admissions of guilt or intent. He shouldn't have testified at all and just let some expert explain there's nothing illegal about what he was accused of. He rambled about SIM cloning and everything basically playing into their hands.
I remember wincing when I first read the transcript. Weev was his own worst enemy at that point, and as he proceeded to fall apart on the stand, his testimony become more and more damaging: at best, he came off as evasive, sarcastic, and arrogant. From there, it was as easy as pie for the prosecutor to paint him as having something to hide. An impression which, unfortunately, weev actively contributed to.
It's not fair, but there's a reason why most defendants don't testify on their own behalf: they are, almost always, seated too close to the matter and unable to come across as objective.
It sounds like this could have bearing on the Tidbit / Jeremy Rubin case. He was from MIT attending a hackathon and NJ decided to go after him along the same lines using the CFAA -- his hack could be used to defraud residents of NJ -- even though he had no connection to NJ.
Suits them well. Prosecutors try to abuse their power too much sometimes, especially when they selectively try to "make an example" out of someone. Glad the Appeals Court put them in their place this time.
As usual, of course, there are no adverse consequences whatsoever for the prosecutors. They can screw up as often as they like, and as long as their screwups put people in jail they're golden.
Must be nice to have a job with no accountability. I wonder what that's like.
I get that he's now retroactively never been convicted of a felony, but he was in prison focused on protecting his corn bread for a couple years. Clearly this affects his employability, as well as his general happiness, having been deprived of both liberty and safe corn bread for a while.
Civil suit against ATT? Wrongful prosecution against the feds?
AT&T isn't a named party and did not bring the suit. Their civil liability is pretty much zero as far as I understand it.
Wrongful prosecution is, for all intents and purposes, impossible to prove.
Because it was overturned on appeal and the determination was not on the merits (ie. what he did isn't actually illegal) but instead on procedural grounds he loses a bunch of options for remedy.
If he had been convicted would he have also been required to pay for the "damage" done to AT&T's computer?
Isn't there something in the CFAA about having to allege causing damage, measurable in financial terms?
Maybe they did not use that provision?
Surely there must be logical reasons I am overlooking, but I find it peculiar that today technology companies can so easily get federal authorities to bring proceedings on their behalf.
Whether it's the DMCA or the CFAA, these "violations" seem like civil matters to me.
Do they harm the public, or do they just (potentially) harm a business?
I thought this opinion was very clearly written and although it only addresses venue, it does have some precedential value for the future of "CFAA law".
For one, if you plan to rely on improper venue as a defense, stay away from the Second Circuit!
People who are wrongfully charged have no recourse, except in the most egregious or best publicized cases. It's even a police tactic to charge someone as a punishment in itself. His best option now is to move on with his life, success will bring him closure.
Personally I think that everyone who ever has a conviction overturned should be compensated for all time lost and costs incurred.
Not because the state would be dissuaded from pushing edge-cases but because we, the people, have robbed someone of part of their life. We should make it right.
A percentage is better than nothing, last time I was curious and looked it was 60-70% of your expected earning up to a max (120K/year IIRC) in my state. You can either take the `deal` so to speak or go to court for your compensation
"An error regarding venue exhibits many of the
characteristics of structural error. If the District Court had
found venue lacking upon Auernheimer’s motion to dismiss,
there would have been no trial in New Jersey at all"
"He would still be convicted of some of the computer hacking charges in other states."
That's hardly a sure bet. The prosecutors would have to convince a completely different jury that a crime had been committed, and that different group of jurors could be far more skeptical.
As someone who was questioned by the AUSA and FBI in front of that federal grand jury, from the onset of things, the prosecution wasn't interested in finding justice, only in twisting everyone's words as much as necessary to secure an indictment, and later, a conviction.
I sympathize. That's how I feel about our recent wars, among other things. But I'm paying for them anyway, and will be for the foreseeable future. Sucks.
I find it fascinating that the precedent for the decision -- to vacate charges due to improper venue -- is established by the court by going all the way back to the Declaration of Independence and the Constitution.
The proper place of colonial trials was so
important to the founding generation that it was listed as a
grievance in the Declaration of Independence. See The
Declaration of Independence para. 21 (U.S. 1776) (objecting
to “transporting us beyond seas to be tried for pretended
offences”). It was of such concern that the Constitution of the
United States “twice safeguards the defendant’s venue right.”
United States v. Cabrales, 524 U.S. 1, 6 (1998). Article III
requires that “the Trial of all Crimes . . . shall be held in the
State where the said Crimes shall have been committed.”
U.S. Const. art. III, § 2, cl. 3. The Sixth Amendment further
provides that “[i]n all criminal prosecutions, the accused shall
enjoy the right to a speedy and public trial, by an impartial
jury of the State and district wherein the crime shall have
been committed.”
That's a little weaker than precedent; they're mostly citing it just as generic historical background, support for the introductory scene-setting observation that venue is an important matter rather than a mere procedural technicality. But their actual analysis of whether venue is proper in NJ, and whether vacating the conviction is proper if not, doesn't rely on that.
How does this square with the jurisdiction shopping that patent trolls do, to their great advantage. Somehow, everyone who infringes on a patent does so while in the eastern district of Texas?
I'm assuming they're going to just let this die, now, and release weev, and not try again against him.
This avoids any serious ruling about CFAA, and preserves the arbitrarily-expansive reading of CFAA to use against other victims. They've already ruined weev's life sufficiently for their purposes.
Didn't their most important charge rely on the "in the commission of a felony" accelerator? Didn't that felony rely on NJ state law? Didn't this case just limit their ability to pull the laws of arbitrary states out of their asses for making similar claims in the future?
True. (although they can probably find other felonies to invoke, and maybe there will be an effort to get more state to adopt whacko versions of CFAA...)
I'm fairly certain that this would be a clear application of Double Jeopardy clause of the 5th Amendment for at least the majority of charges; in short, this is true because whether or not the case had merit, the prosecution definitely screwed up the proceeding.
There may have been a case for CFAA violation (right or wrong), but the prosecutors improperly chose New Jersey as the venue of proceedings. This was a calculated move that had the effect of producing additional state charges, which then resulted in an increased Federal charge for CFAA + State Law violations. That sort of willful "venue shopping" cuts both ways, then; as soon as they try for additional charges, prosecutors now had to conclusively prove that the location of venue was material to the crime at hand, as well as the actions committed.
Since Weev &co were not in NJ at the time the act occurred, and neither were the machines they accessed, and there's no conclusive proof of NJ residents being harmed, then the venue of crime committed was incorrect and thus so were the additional charges hung on it. And that is the prosecutorial misstep which was overturned on this appeal, which is subject to jeopardy limitations.
When a conviction is vacated (as was the case here) it does not violate the double jeopardy clause to try the accused again for the charge for which he was convicted.
The case on point is United States v. Ball, 163 U.S. 662 (1896)* which rejects the English common law rule that holds the opposite. Frankfurter's dissent in Green v. United States, 355 U.S. 184 (1957)+ is far easier to read and lays out the history well.
If they did, and he was convicted again, would his time served on the vacated conviction be discounted off any sentence? It would seem highly unjust if not.
Under these facts (the prosecution theory was a stretch that they don't want tested; the original conviction was caused in part by the defendant's stupid behavior during the first trial; the defendant already served time; the New Jersey federal prosecutors who brought the case can't do it again) the government is very likely to back off.
Has anyone made any actual statements one way or the other on the possibility of re-prosecution in a different venue? I agree with your guess, but one never knows.
To a degree. This only applies for being tried in NJ for the same crime. They're free to charge him in other states and try him without double jeopardy applying:
"But if a single act violates the law of two states, the law treats the act as separate offenses and thus not in conflict with the Double Jeopardy Clause. A second state with a case against a defendant may decide that a conviction in the first state is sufficient, so it does not necessarily mean more than one state will bring charges. Therefore, it is up to the discretion of the particular prosecutor, as with other criminal cases."
This is known as the Dual Sovereignty Doctrine. This is also what makes hacking such a perilous crime. If you're hacking a large corporation in one state, you may have victims in multiple states. Thus, you can be tried separately for essentially the same crime in multiple states regardless of being acquitted in other states.
> To a degree. This only applies for being tried in NJ for the same crime.
No, because this wasn't a prosecution under NJ law, it was a prosecution under federal law, in which the violation of NJ was an element of the offense. So double jeopardy prevents any further federal prosecution for the same offense, but doesn't prevent prosecution under state law of NJ or other states (even though the court here found NJ law did not apply, federal circuit court precedent on state law questions is not binding on state courts.)
Yes, double jeopardy only applies if a criminal trial concluded with an acquittal. In that case the defendant can't be charged a second time. But with cases that basically didn't conclude either way, non-convictions that are also non-acquittals, such as mistrials, vacated convictions, cases thrown out for procedural reasons, etc., the government is free to bring the charges again, on the theory that the first "jeopardy" hasn't really concluded properly, with either an acquittal or a conviction. For example, a case that ends in a hung jury can be re-tried with a new jury; a case thrown out for improper venue can be re-charged in proper venue; a conviction thrown out for ineffective assistance of counsel can be re-tried with better counsel; etc.
I wondered why they couldn't use the (relatively small amount of) drugs they found when they raided him in Arkansas to, under Arkansas state law, fuck him somehow.
I like to refer to this as lawyers "pretending to fail"; See, they are being told by their superiors to press a position officially, but to cripple it technically so that it never survives appeal. This allows eventual remedy for the accused, in the form of appeal, while allowing the State actors to promote their high conviction rates for cyber criminals during/post-trial. The state's main interest in the publicity of the case is to send a message to the public that cyber crime is taken very seriously, with the aim of deterring future activities of a similar nature by copycats. Weev's case being vacated should garner far less attention than the arrest and trial. Everyone but the accused himself benefits from the case, regardless of outcome.
As the case is vacated, Weev could still be jailed, dependant on whether or not his legal representation files a motion in the lower court to release him; another classic case of "pretending to fail".
Any bets on how long 'til he manages to cop a legit conviction for criminal harassment? He'd been lucky so far in that most of his trolling victims just wanted to hide under a rock rather than press charges.
I appreciate the HN desire to link to the source, but as I reader I'd really appreciate submitters link to a good summary/analysis for dense subject matter such as court documents or scientific papers. Ideally they'd chose a summary that itself links to the source.
The document isn't dense. I found it pretty straight-forward, actually. It isn't short, but unless you are a member of the "tl;dr" contingent, the gist is pretty easy to discern.
The trick is that things like "Count one charged Auernheimer with conspiracy to violate CFAA § 1030(a)(2)(C) and (c)(2)(B)(ii)" translate to "Count one charged Auernheimer for breaking a law" and things like "See Perez, 280 F.3d at 329; see also Rodriguez-Moreno, 526 U.S. at 281-82 (citing Hyde, 225 U.S. at 356-67)" are references that you don't need to resolve in order to understand.
It also helps if you can translate things like "It is far from clear that this Court has ever “adopted” this test. We have mentioned it only once." into "oh no you didn't".
By "tl;dr" I refer to the attitude that rejects reading something solely based on its length. That is not a good survival skill, any more than rejecting all but candy is a good survival skill in an age of calorie surplus.
There's a difference in that analogy, though. You don't want to overconsume calories; you do want to consume as much information as possible. If we were trying to maximize calorie intake over time, corn syrup would probably be the winning route.
That's an interesting observation. I don't agree with it though. You suggest that one should consume information up to one's limits. When then does one create information? Even if that information already exists - quoting Westheimer, 'A couple of months in the laboratory can frequently save a couple of hours in the library.' - the process of creating the knowledge is good practice for when one needs to create new knowledge, and for evaluating the validity of existing knowledge.
I do think your second sentence is apropos, but in a different way than you intended. Corn syrup, while calorie rich, provides neither protein nor necessary vitamins and minerals. For that matter, reading summaries is often information poor, compared to the underlying material.
Heavens no! I'd much rather have a good summary than dive into documents written for domain specialists by other domain specialists.
For legal documents, research studies, academic papers and the like the cognitive load associated with wading through the original usually by far outweighs the marginal return.
The caveat is, of course, that one must be careful with one's choice of summariser.
Did you find this court judgment "dense"? I didn't. I even found the judgment's summary of the case against weev to be clear and informative, and others here agree.
I encourage you to read court decisions, research studies, and academic papers. Many are clear, insightful, and educational. It's also true that many are not, but I'm astonished by the number of people who don't even try.
At the very least, it's hard to judge the summarizer without sometimes comparing summaries to the primary literature.
I don't even know who weev is, much less that he was convicted for something, when this happened and why. A tl;dr would be much preferable to reading the court documents with no context.
I think it's fair to say that if you don't know who weev is, then very little about the case would interest you, including a summary of the legal decision.
Similarly, there's a posting now titled "Finally, usable GCM cipher suites in SChannel" ( https://news.ycombinator.com/item?id=7574678 ). I don't know what a GCM cipher suite is, nor what SChannel is, nor why it's a relief that this has happened. The link itself is not insightful. While it expands GCM as "Galois/counter mode", that's meaningless to me.
BTW, in this case, 'weev' matches some 63 other HN posts, though several provide no more summarized context than this link text. (Eg, a couple of other posts directly to other legal documents, a story about visiting weev in prison, and a letter from weev while in prison.) A Google, Yahoo, and Bing search all return http://en.wikipedia.org/wiki/Weev as the first hit. Perhaps one of those can provide the background you're looking for?
Well I'll go ahead and agree that for the most part many legal decisions are fairly straightforward. And even their length is usually due to dumping in tons of citations and systematically examining the various components of whatever legal test they're talking about. It's written to convince higher courts and other judges in a way that can withstand their scrutiny.
But as long as you're willing to hit the "I believe" button a few times while reading a legal decision they actually don't take too long to get the gist of.
Along the lines of the "I believe button"; I've found after reading several legal briefs and opinions, I'm able to quickly determine based on a section's heading whether it's interesting contentful content or just legal cruft. I'm 95% convinced (though without evidence) that everyone in the legal profession does the same, though obviously they must have a broader concept of what's interesting content. The rest is just citation copypasta, and that's okay.
The opinion came out very recently (within the past hour), so there is not likely a good summary or analysis available yet. Seems reasonable for OP to want to spread the news without waiting for a news story.
As a reader, I far prefer this to any kind of summary. This was well written, thoughtful, and thorough. I can't imagine any value that any summary would have added to this, unless I were just hoping to skim it over my lunch break. And I greatly prefer to read one well written, thoughtful, thorough article in a day, then a dozen summaries which inflame the senses without providing any particularly useful information.
Can someone tell me why they decided to try him in New Jersey in the first place? I understand some of the addresses were in NJ, but that seems like a weak reason. Is there something about NJ computer crime statute that they thought would help the case over other states?
"To enhance the potential punishment from a misdemeanor to a felony, the Government alleged that Auernheimer’s CFAA violation occurred in furtherance of a violation of New Jersey’s computer crime statute, N.J. Stat. Ann. § 2C:20-31(a)"
It's less that US decided to try him in New Jersey, and more that the prosecutors who wanted to try him were in New Jersey. If the US Attorney for the Eastern District of Arkansas had wanted a crack at this case, it would not have ended up in NJ.
[Edit] To be clear, there is nothing unique about the New Jersey statute that was used as a sentencing enhancement. As many states do, Arkansas has a similar statute - A.C.A. § 5-41-104 - so the sentencing enhancement could have been applied with Arkansas as the venue. The E. Arkansas US Attorney's Office exercised prosecutorial discretion by not seeking indictment. The New Jersey USAO decided they wanted to prosecute and thought they could make a colorable claim on the issue of venue.
The prosecution tells us much more about the New Jersey USAO than it does about the overall desire of the US Government to prosecute this particular act.
I don't think that can be it. I'm pretty sure they could apply the relevant New Jersey law even if the trial did not physically occur in NJ. For the purposes of that analysis, it would be enough that some "victims" resided in NJ.
The linked-to court judgement says that there are no applicable NJ laws. The relevant laws don't apply, and that it's not enough that some 4% of the numbers were from people in NJ.
I think you (and apparently several other people) have misunderstood my comment: it is clear from the opinion that for 4% of victims to live in New Jersey is not adequate for venue to be proper. The question I was responding to, though, was why the government would want for venue to be proper in New Jersey. It was hypothesized that the government sought to apply some particular New Jersey law. My point was only that, assuming there is some such law (and it appears from the opinion that there is -- though its applicability is questionable), that would not explain why the government sought to have the trial in New Jersey because they could apply the New Jersey law regardless of whether the trial was held in New Jersey.
The more likely explanation, as others have pointed out, is simply that the U.S. Attorney for the District of New Jersey is the one who wanted to bring the case.
"so he downloaded the iPad operating system onto his computer, decrypted it, and browsed through the operating system’s code to try to find a way to register it."
This seems highly suspect and improbable to me. If he was so skilled to reverse engineer iOS and "decrypt it" (whatever that means), why would he need weev's help in writing the slurper??
More than likely, though, whoever wrote the document (I'm guessing a judge) doesn't really understand what happened, and that scares me a little.
It's important to understand here that the judgment was not vacated on grounds that had anything to do with the crime charged -- the Court didn't conclude that he wasn't guilty.
Instead, it was vacated for lack of venue. In other words, he got off on a technicality.
Well, while technically you are right (heh), there is actually an opinion stated on the whole case as well:
We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code- or password-based barrier to access.
That's not an opinion, that's just a legal citation. The Court expressly avoided an opinion: "we need not
resolve whether Auernheimer’s conduct involved such a
breach..."
A quote from the opinion mentioned in another comment:
"To enhance the potential punishment from a misdemeanor to a felony, the Government alleged that Auernheimer’s CFAA violation occurred in furtherance of a violation of New Jersey’s computer crime statute, N.J. Stat. Ann. § 2C:20-31(a)"
In order to adjudicate the substantive matter in the case, proper procedure must first be assured, which includes assuring jurisdiction and venue are proper for the case before the Court. My point here is that the question of whether the law applied was never analyzed by the appellate court because it found the venue was faulty.
My understanding is that they were trying to try him according to specific laws passed in NJ that would classify his alleged actions as felonious. INAL but that seems to make a pretty substantial difference.
Where in the opinion does the Court say that? If they did, it would be a serious procedural error that would likely be overruled on appeal. A court cannot take substantive issues into account (other than where the alleged activity took place) when determining whether venue is proper.
What I find disturbing: a person brought a piece of news to Gawker. Gawker publishes data then wipes hands clean of almost all coverage while said person sits in jail http://gawker.com/tag/weev
So I just finished reading the judgement. The one point that is unclear to me is the charge of violating the CFAA. The secondary charge related to NJ is thoroughly debunked and is the basis of the vacated judgment. But since the CFAA is a federal statute, isn't venue irrelevant since all venues in the case are in the US?
Is this an instance where, now having been vacated on the basis of venue, weev can't be retried with the CFAA? Double jeopardy etc.
1) It's only a felony if the secondary charge is allowed
2) They can retry this if they want, since the judgement was vacated, weev was not acquited or convicted. My understanding is that so long as there weren't certain kinds of prosecutorial misconduct (e.g. the prosecutor intentionally caused a mistrial so they could start over).
3) That being said, retrials are fairly rare, since it's expensive and it tends to look bad for the prosecutors.
The error is a structural one. Due to that fact the entire trial was tainted, not matter what else happened. Thus they can start over.
Just because it's a federal crime doesn't mean he can be tried anywhere. This is exactly what this is all about. That under Federal, and New Jersey, law he has to be tried in one of the places the crime was committed.
The prosecutors selected New Jersey as the venue for the case, despite the fact that Aurnheimer and his co-conspirators hadn't been located in NJ, and AT&T's servers weren't in NJ. The rationale was that some of the addresses disclosed belonged to NJ residents.
Not only did they select a tenuous venue, but they allowed the court to sidestep the issue during jury instructions. The jury decides whether venue is correct. Because venue was important to the case, the jury was supposed to receive instructions on how to evaluate the validity of the venue. But the trial court decided that venue had been adequately established.
"The venue error in this case is not harmless because there was no evidence that any of the essential conduct elements occurred in New Jersey. If Auernheimer’s jury had been properly instructed on venue, it could not have returned a guilty verdict"
One reason this matters is that the CFAA charges that were applied to Auernheimer depended in part on NJ state law. In fact, the specifics of NJ state computer crime law might have been the reasons prosecutors stretched venue so much to get the case located there. But with the Appeals Court determining that the NJ venue was invalid, the whole framework of the case falls apart.