CFAA Prosecutorial Abuse

9 min read

Detailed case files on the weaponization of the Computer Fraud and Abuse Act. United States v. Auernheimer, Aaron Swartz, and the revolving door.
Contents 11 sections

CFAA Prosecutorial Abuse — Research File

Purpose

Detailed references for people who used courts improperly to persecute hackers/trolls. Primary case: United States v. Auernheimer (weev). Cross-references: Aaron Swartz, Bridgegate (Kelly v. United States).

United States v. Auernheimer (2012–2014)

Case: US v. Andrew Auernheimer, District of New Jersey Docket: 2:11-cr-00470 (D.N.J.) Appeal: No. 13-1816 (3d Cir.) Conduct: Visiting a public AT&T URL with sequential ICC-IDs, harvesting 114,000 unprotected email addresses. No authentication bypassed. No encryption broken. No password cracked. Outcome: Convicted Nov 2012, sentenced 41 months (Mar 2013), reversed on venue by Third Circuit (Apr 2014) (Justia). The court decided only venue, but noted: “Although we need not resolve whether Auernheimer’s conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published.” (opinion)

Prosecution Team

Paul J. Fishman — U.S. Attorney, District of New Jersey (2009–2017)

  • Obama appointee. Case brought and announced under his authority.

  • Fired by Jeff Sessions in 2017 (mass firing of Obama-era USAs).

  • Now partner at Arnold & Porter, Washington/NYC.

  • Other controversy: Led the Bridgegate prosecution (United States v. Kelly). Supreme Court unanimously reversed the convictions in Kelly v. United States (2020), finding the charged conduct (lane closures for political retaliation) did not constitute federal fraud. Chris Christie publicly accused Fishman of “prosecutorial misconduct and personal vindictiveness.”

  • Potential conflict: In private practice he represented Carla Katz (union leader who dated Gov. Corzine), a target of investigations under his office’s jurisdiction: “Private clients have included Jim Cramer, the host of Mad Money, and Carla Katz, former state workers’ union leader and Gov. Corzine’s former girlfriend.” Handling of recusal/ethics screen not well documented.

  • No formal bar discipline found.

Michael Martinez — Executive Assistant U.S. Attorney

  • Number-three position in the office. Supervised white-collar programs including Economic Crimes Unit.

  • Clerked for Samuel Alito on the Third Circuit.

  • 10+ years at USAO-DNJ.

  • Now partner at Gibson Dunn, NYC (white-collar defense).

  • Notable defense matters, per his firm bio: “a former New Jersey government official” in the Bridgegate proceedings; “a senior executive of a pharmaceutical company” in the generic-drug price-fixing investigation; and “the owner of a South American sports broadcasting and marketing company” indicted in the FIFA RICO case.

  • No bar discipline or ethics complaints found.

Zach Intrater — AUSA, Computer Hacking & IP Section

Mark E. Coyne — Chief, Appeals Division, USAO-DNJ (Newark)

Glenn J. Moramarco — AUSA, Camden office

  • On appellate brief. Appears to have retired. Limited public info.

Documented Criticism of the Prosecution

A. Forum Shopping / Venue Manipulation

Neither defendant was in NJ. AT&T’s servers were not in NJ. No evidence that internet traffic traversed NJ. Only connection: some iPad owners lived there. NACDL amicus argued this “invites prosecutorial forum-shopping.” Third Circuit agreed — vacated conviction on venue.

Government chose NJ to invoke NJ state computer crime statute as predicate to elevate federal charges from misdemeanor to felony.

B. Charge Stacking — Misdemeanor-to-Felony Bootstrapping

Core CFAA violation (if it existed) was a misdemeanor. Prosecutors used circular bootstrapping: argued CFAA violation occurred “in furtherance of” NJ state computer crime statute violation, upgrading federal charge to felony.

Orin Kerr (GWU, former DOJ computer-crimes prosecutor, took appeal pro bono): “circular theories that try to turn misdemeanors into felonies” and “an astonishing view of venue.”

C. No “Unauthorized Access” Actually Occurred

Email addresses returned by AT&T’s publicly accessible servers in response to HTTP GET requests. No password circumvented, no authentication bypassed, no code-based restriction defeated. AT&T configured servers to return email addresses when queried with ICC-IDs (SIM card identifiers).

EFF: “accessing data on a public website isn’t criminal, even if the website owner doesn’t like how their data is being used.”

The Third Circuit, deciding only venue, noted that “no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier.”

D. Identity Theft Charge Was Dubious

Charged with “fraud in connection with personal information” (identity theft) for possessing email addresses — never used for fraudulent purpose. Addresses disclosed to Gawker reporter to publicize security flaw.

E. Inflated Loss / Disproportionate Sentencing

Prosecutors sought maximum sentence. AT&T never declared actual financial loss. $73,000 restitution order criticized as disconnected from reality — AT&T’s remediation was a notification email costing essentially nothing. Prosecutors “dripped with contempt” at sentencing, cited Auernheimer’s Reddit AMA as evidence of dangerousness.

F. Linked to Aaron Swartz Prosecution

Frequently cited alongside Swartz as emblematic of CFAA abuse. Marcia Hofmann (EFF): prosecutors have “great latitude to abuse their discretion and throw the book at people they simply don’t like.” Jennifer Granick (Stanford CIS): clear “overreach.”

G. Extraordinary Amicus Support

Amicus briefs from EFF, NACDL, cybersecurity researchers, legal academics. Orin Kerr took case pro bono. EFF formally joined defense team on appeal.

The Pattern

The people who prosecuted weev for visiting a public URL:

  1. Chose a jurisdiction with no connection to the conduct (forum shopping)
  2. Bootstrapped a misdemeanor into a felony using circular legal theory
  3. Charged identity theft for possessing email addresses never used fraudulently
  4. Sought maximum sentence (41 months) for incrementing a number in a URL
  5. Faced zero professional consequences when the Third Circuit reversed
  6. Most went on to lucrative private practice careers (Coyne stayed at USAO-DNJ)

The government’s case, in its own terms: AT&T did not intend the data to be public; the script spoofed an iPad User-Agent, which the prosecution argued showed intent to deceive; the scale was deliberate; and the addresses went to a reporter, not to AT&T. Kerr and the EFF answered that a publicly served page is not “unauthorized access”. The Third Circuit never ruled on that question.

The company that left 114,000 email addresses on an unauthenticated public endpoint faced no legal consequences whatsoever.

Aaron Swartz (2011–2013)

Case: US v. Aaron Swartz, District of Massachusetts Conduct: Bulk-downloading academic articles from JSTOR via MIT network Charges: 13 felony counts under CFAA and wire fraud (Wikipedia) Maximum sentence: 35 years + $1M in fines (Wikipedia; USAO-MA, 19 Jul 2011) JSTOR’s position: Declined to pursue charges. Settled with Swartz. MIT’s position: Declined to intervene. Prosecutor: AUSA Stephen Heymann (D. Mass.) Outcome: Swartz hanged himself on January 11, 2013, age 26 (New Yorker).

Stephen Heymann — AUSA, D. Mass.

  • Son of Philip Heymann, former Deputy Attorney General under Clinton.
  • Described as a “zealous prosecutor” of computer crime cases.
  • Led the 2008 TJX investigation in which Jonathan James (first juvenile incarcerated for federal cybercrime, in a 2000 case brought in Miami) was named a suspect (the 2000 case “marks the first time a juvenile hacker will serve time in a detention facility” – DOJ). James later committed suicide in 2008 at age 24, fearing prosecution for the TJX breach (which he was not involved in; his note denied any role: “In a five page suicide note, James wrote that he was innocent, but was certain federal officials would make him a scapegoat” – Kevin Poulsen, Wired, July 9, 2009, reprinted on InfoSec News). Two suicides linked to Heymann’s computer crime cases. BuzzFeed News reported the link between the two cases (Justine Sharrock, BuzzFeed News, 2013).
  • Rep. Darrell Issa’s House Oversight Committee investigated DOJ’s handling of the Swartz case. Swartz’s lawyers filed a professional-misconduct complaint against Heymann with DOJ’s Office of Professional Responsibility (March 2013). Inspector General review found prosecution was “appropriate” but “could have been handled differently.” Attorney General Eric Holder called the prosecution a “good use of prosecutorial discretion” (Jonathan Turley, Mar 18, 2013). Ortiz’s own statement: “I must, however, make clear that this office’s conduct was appropriate in bringing and handling this case” (statement, 16 Jan 2013; CBS News). The bar for “inappropriately” is apparently two dead targets.
  • “Aaron’s Law” (CFAA reform bill) introduced in Swartz’s name. Never passed.

Carmen Ortiz — U.S. Attorney, D. Mass. (2009–2017)

  • Supervised Swartz prosecution.
  • Under heavy public criticism, stated publicly that any plea deal would require Swartz to plead to a felony and serve 6 months — after JSTOR and MIT both declined to pursue charges (Wikipedia).
  • Obama appointee. Left office 2017.
  • No formal discipline.

Sources:

Bridgegate — Kelly v. United States (2020)

Included because prosecuted by same U.S. Attorney (Fishman) who brought Auernheimer case. Pattern: aggressive prosecution theories, later reversed.

Case: United States v. Bridget Anne Kelly & William E. Baroni Conduct: Lane closures on George Washington Bridge as political retaliation Prosecution: Charged as federal fraud/civil rights violation Supreme Court: Unanimously reversed. 9-0 (Wikipedia). Conduct was “an abuse of power” but not federal fraud. “Not every corrupt act by state or local officials is a federal crime.” Significance: Same office that prosecuted weev for visiting a URL also prosecuted political operatives under a theory so broad the Supreme Court said 9-0 it wasn’t even a crime.

Source: https://www.supremecourt.gov/opinions/19pdf/18-1059_e2p3.pdf

The Revolving Door

Prosecutorweev Case RoleNow
Paul FishmanU.S. AttorneyArnold & Porter partner
Michael MartinezExec AUSAGibson Dunn partner
Zach IntraterLead AUSACo-founded Agnifilo Intrater LLP
Mark CoyneChief, AppealsStill at USAO-DNJ
Stephen Heymann (Swartz)Lead AUSALeft DOJ
Carmen Ortiz (Swartz)U.S. AttorneyLeft office 2017

Every one built a career. Nobody was sanctioned. Aaron Swartz, a defendant, died; so did Jonathan James, a suspect who was never charged.

Research compiled February 2026. Sources verified via web search. For use in Book 1 (Ch. 14, Ch. 17) and thefire.lol.

Source URLs