CFAA Prosecutorial Abuse

7 min read

Detailed case files on the weaponization of the Computer Fraud and Abuse Act. United States v. Auernheimer, Aaron Swartz, and the revolving door.
Contents 11 sections

CFAA Prosecutorial Abuse — Research File

Purpose

Detailed references for people who used courts improperly to persecute hackers/trolls. Primary case: United States v. Auernheimer (weev). Cross-references: Aaron Swartz, Bridgegate (Kelly v. United States).

United States v. Auernheimer (2012–2014)

Case: US v. Andrew Auernheimer, District of New Jersey Docket: 2:11-cr-00470 (D.N.J.) Appeal: No. 13-1816 (3d Cir.) Conduct: Visiting a public AT&T URL with sequential ICC-IDs, harvesting 114,000 unprotected email addresses. No authentication bypassed. No encryption broken. No password cracked. Outcome: Convicted Nov 2012, sentenced 41 months (Mar 2013), reversed on venue by Third Circuit (Apr 2014) (Justia). Court expressed “grave doubts” about whether conduct violated CFAA at all.

Prosecution Team

Paul J. Fishman — U.S. Attorney, District of New Jersey (2009–2017)

  • Obama appointee. Case brought and announced under his authority.
  • Fired by Jeff Sessions in 2017 (mass firing of Obama-era USAs).
  • Now partner at Arnold & Porter, Washington/NYC.
  • Other controversy: Led the Bridgegate prosecution (United States v. Kelly). Supreme Court unanimously reversed the convictions in Kelly v. United States (2020), finding the charged conduct (lane closures for political retaliation) did not constitute federal fraud. Chris Christie publicly accused Fishman of “prosecutorial misconduct and personal vindictiveness.”
  • Potential conflict: Prior law firm represented Carla Katz (union leader who dated Gov. Corzine), a target of investigations under his office’s jurisdiction. Handling of recusal/ethics screen not well documented.
  • No formal bar discipline found.

Michael Martinez — Executive Assistant U.S. Attorney

  • Number-three position in the office. Supervised white-collar programs including Economic Crimes Unit.
  • Clerked for Samuel Alito on the Third Circuit.
  • 10+ years at USAO-DNJ.
  • Now partner at Gibson Dunn, NYC (white-collar defense).
  • Notable defense clients include Bridgegate defendants, pharma price-fixing investigations, FIFA RICO cases.
  • No bar discipline or ethics complaints found.

Zach Intrater — AUSA, Computer Hacking & IP Section

Mark E. Coyne — Chief, Appeals Division, USAO-DNJ (Newark)

  • Career appellate prosecutor. Still at USAO-DNJ as of recent reporting.
  • Handled government’s position in Bridgegate at Supreme Court level.
  • No controversies found.

Glenn J. Moramarco — AUSA, Camden office

  • On appellate brief. Appears to have retired. Limited public info.

Documented Criticism of the Prosecution

A. Forum Shopping / Venue Manipulation

Neither defendant was in NJ. AT&T’s servers were not in NJ. No evidence that internet traffic traversed NJ. Only connection: some iPad owners lived there. NACDL amicus argued this “invites prosecutorial forum-shopping.” Third Circuit agreed — vacated conviction on venue.

Government chose NJ to invoke NJ state computer crime statute as predicate to elevate federal charges from misdemeanor to felony.

B. Charge Stacking — Misdemeanor-to-Felony Bootstrapping

Core CFAA violation (if it existed) was a misdemeanor. Prosecutors used circular bootstrapping: argued CFAA violation occurred “in furtherance of” NJ state computer crime statute violation, upgrading federal charge to felony.

Orin Kerr (GWU, former DOJ computer-crimes prosecutor, took appeal pro bono): “circular theories that try to turn misdemeanors into felonies” and “an astonishing view of venue.”

C. No “Unauthorized Access” Actually Occurred

Email addresses returned by AT&T’s publicly accessible servers in response to HTTP GET requests. No password circumvented, no authentication bypassed, no code-based restriction defeated. AT&T configured servers to return email addresses when queried with ICC-IDs (SIM card identifiers).

EFF: “accessing data on a public website isn’t criminal, even if the website owner doesn’t like how their data is being used.”

Third Circuit noted “grave doubts” about whether conduct violated CFAA.

D. Identity Theft Charge Was Dubious

Charged with “fraud in connection with personal information” (identity theft) for possessing email addresses — never used for fraudulent purpose. Addresses disclosed to Gawker reporter to publicize security flaw.

E. Inflated Loss / Disproportionate Sentencing

Prosecutors sought maximum sentence. AT&T never declared actual financial loss. $73,000 restitution order criticized as disconnected from reality — AT&T’s remediation was a notification email costing essentially nothing. Prosecutors “dripped with contempt” at sentencing, cited Auernheimer’s Reddit AMA as evidence of dangerousness.

F. Linked to Aaron Swartz Prosecution

Frequently cited alongside Swartz as emblematic of CFAA abuse. Marcia Hofmann (EFF): prosecutors have “great latitude to abuse their discretion and throw the book at people they simply don’t like.” Jennifer Granick (Stanford CIS): clear “overreach.”

G. Extraordinary Amicus Support

Amicus briefs from EFF, NACDL, cybersecurity researchers, legal academics. Orin Kerr took case pro bono. EFF formally joined defense team on appeal.

The Pattern

The people who prosecuted weev for visiting a public URL:

  1. Chose a jurisdiction with no connection to the conduct (forum shopping)
  2. Bootstrapped a misdemeanor into a felony using circular legal theory
  3. Charged identity theft for possessing email addresses never used fraudulently
  4. Sought maximum sentence (41 months) for incrementing a number in a URL
  5. Faced zero professional consequences when the Third Circuit reversed
  6. All went on to lucrative private practice careers

The company that left 114,000 email addresses on an unauthenticated public endpoint faced no legal consequences whatsoever.

Aaron Swartz (2011–2013)

Case: US v. Aaron Swartz, District of Massachusetts Conduct: Bulk-downloading academic articles from JSTOR via MIT network Charges: 13 felony counts under CFAA and wire fraud (Wikipedia) Maximum sentence: 35 years + $1M in fines (Wikipedia) JSOR’s position: Declined to pursue charges. Settled with Swartz. MIT’s position: Declined to intervene. Prosecutor: AUSA Stephen Heymann (D. Mass.) Outcome: Swartz hanged himself on January 11, 2013, age 26 (New Yorker).

Stephen Heymann — AUSA, D. Mass.

  • Son of Philip Heymann, former Deputy Attorney General under Clinton.
  • Described as a “zealous prosecutor” of computer crime cases.
  • Previously prosecuted Jonathan James (first juvenile convicted of federal cybercrime). James later committed suicide in 2008 at age 24, fearing prosecution for the TJX breach (which he was not involved in). Two suicides linked to Heymann’s computer crime prosecutions.
  • Congress investigated DOJ handling of Swartz case. Inspector General review found prosecution was “appropriate” but “could have been handled differently.” The bar for “inappropriately” is apparently two dead defendants.
  • “Aaron’s Law” (CFAA reform bill) introduced in Swartz’s name. Never passed.

Carmen Ortiz — U.S. Attorney, D. Mass. (2009–2017)

  • Supervised Swartz prosecution.
  • Under heavy public criticism, stated publicly that any plea deal would require Swartz to plead to a felony and serve 6 months — after JSTOR and MIT both declined to pursue charges (Wikipedia).
  • Obama appointee. Left office 2017.
  • No formal discipline.

Sources:

Bridgegate — Kelly v. United States (2020)

Included because prosecuted by same U.S. Attorney (Fishman) who brought Auernheimer case. Pattern: aggressive prosecution theories, later reversed.

Case: United States v. Bridget Anne Kelly & William E. Baroni Conduct: Lane closures on George Washington Bridge as political retaliation Prosecution: Charged as federal fraud/civil rights violation Supreme Court: Unanimously reversed. 9-0 (Wikipedia). Conduct was “an abuse of power” but not federal fraud. “Not every corrupt act by state or local officials is a federal crime.” Significance: Same office that prosecuted weev for visiting a URL also prosecuted political operatives under a theory so broad the Supreme Court said 9-0 it wasn’t even a crime.

Source: https://www.supremecourt.gov/opinions/19pdf/18-1059_e2p3.pdf

The Revolving Door

Prosecutorweev Case RoleNow
Paul FishmanU.S. AttorneyArnold & Porter partner
Michael MartinezExec AUSAGibson Dunn partner
Zach IntraterLead AUSACo-founded Agnifilo Intrater LLP
Mark CoyneChief, AppealsStill at USAO-DNJ
Stephen Heymann (Swartz)Lead AUSALeft DOJ
Carmen Ortiz (Swartz)U.S. AttorneyLeft office 2017

Every one built a career. Nobody was sanctioned. Two defendants died.

Research compiled February 2026. Sources verified via web search. For use in Book 1 (Ch. 14, Ch. 17) and thefire.lol.

Source URLs