It's important to understand here that the judgment was not vacated on grounds that had anything to do with the crime charged -- the Court didn't conclude that he wasn't guilty.
Instead, it was vacated for lack of venue. In other words, he got off on a technicality.
Well, while technically you are right (heh), there is actually an opinion stated on the whole case as well:
We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code- or password-based barrier to access.
That's not an opinion, that's just a legal citation. The Court expressly avoided an opinion: "we need not
resolve whether Auernheimer’s conduct involved such a
breach..."
A quote from the opinion mentioned in another comment:
"To enhance the potential punishment from a misdemeanor to a felony, the Government alleged that Auernheimer’s CFAA violation occurred in furtherance of a violation of New Jersey’s computer crime statute, N.J. Stat. Ann. § 2C:20-31(a)"
In order to adjudicate the substantive matter in the case, proper procedure must first be assured, which includes assuring jurisdiction and venue are proper for the case before the Court. My point here is that the question of whether the law applied was never analyzed by the appellate court because it found the venue was faulty.
My understanding is that they were trying to try him according to specific laws passed in NJ that would classify his alleged actions as felonious. INAL but that seems to make a pretty substantial difference.
Where in the opinion does the Court say that? If they did, it would be a serious procedural error that would likely be overruled on appeal. A court cannot take substantive issues into account (other than where the alleged activity took place) when determining whether venue is proper.
Instead, it was vacated for lack of venue. In other words, he got off on a technicality.