Posted by: Patrick Allen Foster | April 13, 2014

Third Circuit Reverses Hacker’s Conviction, Ruling Venue Was Wrong


The Third Circuit has reversed the conviction of hacker Andrew Auernheimer on the grounds that the federal prosecutors brought the case in the wrong venue: “Andrew ‘Weev’ Auernheimer was in Arkansas during the time of the hack, his alleged co-conspirator was in California, and the servers that they accessed were physically located in Dallas, Texas and Atlanta, Georgia. Prosecutors therefore had no justification for bringing the case against Auernheimer in New Jersey…”

You can read the opinion here (pdf, 22 pages).

Orin Kerr, who argued the appeal for Auernheimer, has a post about the decision at the Volokh Conspiracy. As Prof. Kerr notes, since the panel reversed the conviction on venue grounds, the Court of Appeals largely did not address questions of the reach and interpretation of the Computer Fraud and Abuse Act.

See also this post by Leigh Beadon at Techdirt and this post by David Kravets at Ars Technica.

Here is one key passage from the conclusion of appellate court’s opinion (p. 22):

Venue issues are animated in part by the “danger of allowing the [G]overnment to choose its forum free from any external constraints.” Salinas, 373 F.3d at 169-70 (citing Travis, 364 U.S. at 634). The ever-increasing ubiquity of the Internet only amplifies this concern. As we progress technologically, we must remain mindful that cybercrimes do not happen in some metaphysical location that justifies disregarding constitutional limits on venue. People and computers still exist in identifiable places in the physical world. When people commit crimes, we have the ability and obligation to ensure that they do not stand to account for those crimes in forums in which they performed no “essential conduct element” of the crimes charged. Rodriguez-Moreno, 526 U.S. at 280.

Late last month, shortly after oral arguments before the Third Circuit in the Weev case, seasoned criminal defense attorney Scott Greenfield wrote a post about how the venue question could be crucial in this case:

While the hacker community was far more interested in, and concerned about, the way in which the 3rd Circuit will interpret the Computer Fraud and Abuse Act, as the broad interpretation applied in Weev’s case would essentially criminalize what the InfoSec wing does daily, the court spent far more of its time and focus on the question of venue. Arcane and legalistic, this question has even broader implications for all of us.

Weev hacked AT&T while physically in Arkansas. AT&T servers were in California [sic] and Georgia. Gawker, who received the information about AT&T’s security flaw and posted it online, is located in New York. So naturally, the prosecution was brought in New Jersey, with the government arguing that an FBI agent read the Gawker article there.

“I would urge the court to not go narrow on computer crimes,” the prosecutor said. One judge interjected: “[That would mean] every computer crime at every computer in America would be in all 50 states.”

This would suggest that the concept of venue, mentioned twice in the Constitution, would cease to exist for computer crimes. Whether it’s the federal district that is most convenient to the government, or the least convenient to the defendant, any computer crime could be prosecuted in any of the 94 districts of the United States. When is the last time you hung out in Anchorage?

Also (emphasis added):

It strikes me as inconceivable that a smart Assistant United States Attorney can’t comprehend the workings of basic code designed to repeat an internet query, particularly since there were numerous amici briefs dedicated to explaining in the simplest possible terms what was done, how it was done, and why it was little more than what all of us do every day, even if unwittingly because the shiny button performs many of the functions for us automatically. After all, if the buttons work, someone has to know how to program them.

Rather, the government’s argument…is an appeal to ignorance. It’s in the government’s interest to perpetuate the myth that computer technology is some unfathomable magic performed within boxes that mere mortals, judges, can’t possibly understand. This voodoo is done only by shamans, or as Motherboard describes him, ”the notorious internet troll who seems to be equally celebrated and reviled,” Weev.

Fortunately, it seems that the Third Circuit did not fall for the government’s obfuscations.

Image Credit: Self-portrait of Andrew “Weev” Auernheimer, June 2010. Used under a CC BY-SA 3.0 license. Source: Wikimedia Commons.


  1. I loved Kerr’s comment on Twitter: “The next edition of my Computer Crime Law casebook will definitively have a new section on venue.”

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


%d bloggers like this: