In breathtakingly short order, the Third Circuit has issued its decision in United States v. Andrew Auernheimer a/k/a Weev. Weev won. Tor Ekeland picked him up last night, just in time to audition for the next Hobbit movie.
And lest anyone think that the Weev has grown soft and contemplative in the can, his twits (no doubt by his friends in Weev’s name, since Weev was in prison at the time) show otherwise.
It’s just his sense of humor, so don’t get all huffy about it. He’s quite a card in some quarters.
This is offered to make a point before getting into the opinion: The ruling on appeal is of huge significance to anyone who uses a computer, which pretty much means everyone. Weev, nonetheless, is by no means a hero, or even a martyr. Had he not been such a malicious troll, a douche of the first order, there is a good chance this case would never have made it to the circuit, as he wouldn’t have been convicted.
Some say “all’s well that ends well.” I do not. Nor is this necessarily the end. It is hardly a certainty that this won’t rear its ugly head again, and that Weev, being too smart for his own good, won’t totally screw things up for the rest of us. Seizing defeat from the jaws of victory may well be in Weev’s future.
The sexy issue on appeal was whether the Computer Fraud and Abuse Act of 1986, crafted when floppies were still 5¼ inches, prohibited access to a website when it hurt the owner’s feelings. The 3d Circuit didn’t rule on this question. Instead, it reversed the conviction based on an issue of probably greater importance, but far less sex appeal: venue.
Venue issues are animated in part by the danger of allowing the Government to choose its forum free from any external constraints. The ever-increasing ubiquity of the Internet only amplifies this concern. As we progress technologically, we must remain mindful that cybercrimes do not happen in some metaphysical location that justifies disregarding constitutional limits on venue. People and computers still exist in identifiable places in the physical world. When people commit crimes, we have the ability and obligation to ensure that they do not stand to account for those crimes in forums in which they performed no essential conduct element of the crimes charged.
The importance of this passage cannot be understated. The internet is everywhere, from California to Timbuktu. If its only constraint is the locus where the government finds it most useful to prosecute, then a person could essentially be indicted anywhere, forced to defend in a foreign state, district, even country, because the internet is everywhere. But the court, in a forceful and detailed way, explained that when it comes to being prosecuted, the physical world still counts.
Venue in criminal cases is more than a technicality; it involves “matters that touch closely the fair administration of criminal justice and public confidence in it.” United States v. Johnson, 323 U.S. 273, 276 (1944). This is especially true of computer crimes in the era of mass interconnectivity. Because we conclude that venue did not lie in New Jersey, we will reverse the District Court’s venue determination and vacate Auernheimer’s conviction.
What this means is that just because the government can come up with some theoretical connection between conduct that occurred in Bumfuck, Arkansas and Snookie’s email address does not mean you will be forced to go to New Jersey before conviction. The ramifications are mind-boggling.
While the applicability of ancient law to digital reality is often a horrible fit, venue is a constitutional requirement that doesn’t change, no matter how transcendent the web may be.
“Though our nation has changed in ways which it is difficult to imagine that the Framers of the Constitution could have foreseen, the rights of criminal defendants which they sought to protect in the venue provisions of the Constitution are neither outdated nor outmoded.” Passodelis, 615 F.2d at 977. Just as this was true when we decided Passodelis in 1980 — after the advent of railroad, express mail, the telegraph, the telephone, the automobile, air travel, and satellite communications — it remains true in today’s Internet age.
The internet may be ethereal, but people are real. They exist in a place. That place matters. And it matters enormously to anyone who has the misfortune of finding themselves on the wrong end of the government’s largesse.
Notwithstanding the fact that the court did not rule on the sexier issue, the opinion is noteworthy nonetheless. Initially, what’s clear is that the court demonstrated a fairly sophisticated understanding of the conduct involved, implicitly rejecting the government’s argument that “this internet-y stuff is just too hard for normal folks to understand,” and so hackers are witches, burn them.
Moreover, the court’s characterization of Weev’s, and his co-conspirator, Daniel Spitler’s, conduct was remarkably benign. There was no hate, no loaded adjectives, no malevolent overtones (or undertones), but rather a description of how they happened upon a security error on AT&T’s website and toyed with it to see how far it would go.
Enormous credit goes to the amici in the case, who dedicated their pixels to explaining both the conduct in which Weev and Spitler engaged, and its normalcy among people who are computer savvy, and Weev’s pro bono counsel, Orin Kerr, for demystifying the internet. It appears the court “got it,” and even though the ruling was on venue, it was sending a message to the government that this witch hunt based on ignorance isn’t going to fly.
Although we need not resolve whether Auernheimer’s conduct involved [a breach of a code-based barrier to access] no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published.
Well played, Judge Chagares. Well played. So does this mean Weev’s travails have come to an end? That’s not clear. There are solid arguments to be made on either side as to whether he is subject to indictment in a district with proper venue without offending double jeopardy, and while Weev may have waddled out of prison last night, he remains subject to pre-trial supervision so that the government may do whatever voodoo it decides to do.
We may yet get the sexy CFAA ruling that everyone was hoping for out of this case. Let’s hope Weev doesn’t do something to screw it up.
Update: As if not to let us ponder that final sentence too long, a twit from Weev this morning:
The defendant has banned his lawyer from representing him properly. This should be interesting.