US Attorney Mulls High Court Bid In AT&T Data Breach Case

http://www.law360.com/appellate/articles/538889/us-attorney-mulls-high-court-bid-in-at-t-data-breach-case

Law360, New York (May 16, 2014, 9:15 PM ET) -- New Jersey U.S. Attorney Paul Fishman on Friday said he’s considering a U.S. Supreme Court appeal following a Third Circuit ruling vacating the conviction of a hacker who allegedly accessed AT&T servers and stole more than 114,000 Apple iPad users’ email addresses.

Fishman discussed the case Friday following his speech on cybercrime at the New Jersey Bar Association’s annual conference in Atlantic City. The U.S. attorney said he was disappointed by the Third Circuit’s decision to reverse the conviction of Andrew Auernheimer, who was found guilty of identity fraud and violating the Computer Fraud and Abuse Act, and may lobby for high court certification.

With a little more than three weeks left to file an appeal, an attendee told Fishman it was apparent the government planned to let the case lie, but Fishman said an appeal is still on the table.

“I’m not going to tell you that, but we still have time,” Fishman said. “We haven’t decided what we’re going to do, but we’re having those discussions and there’s still time.”

Fishman said he doesn’t expect the Third Circuit’s precedential decision to have any impact on his office’s current and future cases, because the jurisdictional issues implicated in the Auernheimer case were so unusual.

“We may never have that venue issue again,” Fishman said. “We thought we had enough to prove the venue in that case, and [U.S. District Court] Judge [Susan] Wigenton thought it was enough, but the Third Circuit disagreed.”

Prosecutors in New Jersey originally brought charges against Auernheimer, who is also known by the pseudonym weev, after learning he and co-defendant Daniel Spitler allegedly conspired to write a script that attacked AT&T's servers and harvested thousands of email addresses, including those of ABC News anchor Diane Sawyer, former New York City Mayor Michael Bloomberg and Chicago Mayor Rahm Emanuel.

The script, termed the “iPad 3G Account Slurper,” worked by mimicking the behavior of an iPad 3G, gaining access to the servers and then guessing at ranges of identification numbers to secure the email address pairings for specific users, according to court documents.

Immediately after the security breach in June 2010, Auernheimer turned over the email addresses to the website Gawker.com, which published them in redacted form, according to prosecutors.

Auernheimer moved to dismiss the superseding indictment on improper venue grounds, but a New Jersey federal judge rejected the request on the grounds that his disclosure of about 4,500 New Jersey residents' email addressed affected them in the state and violated state law.

In December 2012, a jury found Auernheimer guilty of conspiring to access the AT&T servers without authorization and disclose that information, and unlawful possession and transfer the data. He was sentenced to serve 41 months in prison and pay $71,200 in restitution to AT&T.

The three-judge Third Circuit panel held that the question of venue should turn on where the allegedly unlawful conduct was carried out. Because Auernheimer, Spitler, AT&T's servers and the reporter to whom the captured email addresses were disclosed were not located in New Jersey, prosecutors had no grounds for bringing the case in the state, the panel ruled.

“As we progress technologically, we must remain mindful that cybercrimes do not happen in some metaphysical location that justifies disregarding constitutional limits on venue,” the panel wrote. “People and computers still exist in identifiable places in the physical world. When people commit crimes, we have the ability and obligation to ensure that they do not stand to account for those crimes in forums in which they performed no 'essential conduct element' of the crimes charged.”

The government has until June 9 to file a Supreme Court appeal.

Auernheimer is represented by Orin S. Kerr of George Washington University Law School, Tor B. Ekeland and Mark H. Jaffee of Tor Ekeland PC, and Marcia C. Hofmann and Hanni M. Fakhoury of the Electronic Frontier Foundation,

The government is represented by Paul J. Fishman, Glenn J. Moramarco and Mark E. Coyne of the U.S. Attorney’s Office for the District of New Jersey.

The case is U.S. v. Andrew Auernheimer, case number 13-1816, in the U.S. Court of Appeals for the Third Circuit.

--Additional reporting by Allison Grande, Matt Fair and Martin Bricketto. Editing by Chris Yates.