PRECEDENTIAL

UNITED STATES COURT OF APPEALS

FOR THE THIRD CIRCUIT

_____________

No. 13-1816

_____________

UNITED STATES OF AMERICA 

v.

ANDREW AUERNHEIMER, 

a/k/a Weev 

a/k/a Weelos 

a/k/a Escher

 ANDREW AUERNHEIMER,

 Appellant

On Appeal from the United States District Court

for the District of New Jersey

(No. 2:11-cr-00470-001)

District Judge: Hon. Susan D. Wigenton

Argued: March 19, 2014

Before: CHAGARES, GREENAWAY, JR., and 

VANASKIE, Circuit Judges.

(Filed: April 11, 2014)

____________

OPINION

____________

Tor B. Ekeland, Esq.

Mark H. Jaffe, Esq.

Tor Ekeland, P.C.

155 Water Street.

Sixth Floor, Suite Two

Brooklyn, NY 11201

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 1 of 22 PageID: 1303 Case: 13-1816 Document: 003111586090 Page: 1 Date Filed: 04/11/2014
2

Orin S. Kerr, Esq. [ARGUED]

George Washington University

2000 H Street, N.W.

Washington, DC 20052

Marcia C. Hofmann, Esq.

25 Taylor Street

San Francisco, CA 94102

Hanni M. Fakhoury, Esq.

Electronic Frontier Foundation

815 Eddy Street

San Francisco, CA 94109

Attorneys for Appellant

Paul J. Fishman, Esq.

Glenn J. Moramarco, Esq. [ARGUED]

Office of United States Attorney

Camden Federal Building & Courthouse

401 Market Street

Camden, NJ 08101

Mark E. Coyne, Esq.

Office of United States Attorney

970 Broad Street

Newark, NJ 07102

Attorneys for Appellee

Christopher C. Walsh, Esq.

Harvard Law School

Cyberlaw Clinic

23 Everett Street

Second Floor

Cambridge, MA 02138

Alexander C. Muentz, Esq.

Temple University

Department of Criminal Justice

1115 Pollett Walk

Philadelphia, PA 19122

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 2 of 22 PageID: 1304 Case: 13-1816 Document: 003111586090 Page: 2 Date Filed: 04/11/2014
3

Jennifer S. Granick, Esq.

Stanford Law School

Center for Internet & Society

559 Nathan Abbott Way

Stanford, CA 94305

Steven P. Ragland, Esq.

Keker & Van Nest

633 Battery Street 

San Francisco, CA 94111 

 Attorneys for Amicus Appellants 

CHAGARES, Circuit Judge.

This case calls upon us to determine whether venue for 

Andrew Auernheimer’s prosecution for conspiracy to violate 

the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 

1030, and identity fraud under 18 U.S.C. § 1028(a)(7) was 

proper in the District of New Jersey. Venue in criminal cases 

is more than a technicality; it involves “matters that touch

closely the fair administration of criminal justice and public 

confidence in it.” United States v. Johnson, 323 U.S. 273, 

276 (1944). This is especially true of computer crimes in the 

era of mass interconnectivity. Because we conclude that 

venue did not lie in New Jersey, we will reverse the District 

Court’s venue determination and vacate Auernheimer’s 

conviction.

I.

A.

The relevant facts are fairly simple and not in dispute. 

Apple, Inc. introduced the first iPad, a tablet computer, in 

2010. Customers who purchased the version that had the 

capability to send and receive data over cellular networks 

(commonly referred to as “3G”) had to purchase a data 

contract from AT&T, Inc. (“AT&T”), which at the time was 

the exclusive provider of data services for this version of the

iPad. Customers registered their accounts with AT&T over 

the Internet on a website that AT&T controlled. In the 

registration process, customers were assigned a user identifier 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 3 of 22 PageID: 1305 Case: 13-1816 Document: 003111586090 Page: 3 Date Filed: 04/11/2014
4

(“user ID”) and created a password — login credentials that 

they would need in order to access their accounts through 

AT&T’s website in the future. The user ID assigned to each 

customer was that customer’s email address.

AT&T decided to make it easier for customers to log 

into their accounts by prepopulating the user ID field on the 

login screen with their email addresses. To do this, AT&T 

programmed its servers to search for an iPad user’s Integrated 

Circuit Card Identifier (“ICC-ID”) when a user directed her 

browser to AT&T’s general login webpage (AT&T’s 

“URL”1). An ICC-ID is the unique nineteen- or twenty-digit 

number that identifies an iPad’s Subscriber Identity Module, 

commonly known as a SIM Card. The SIM Card is the 

computer chip that allows iPads to connect to cellular data 

networks.

If AT&T’s servers recognized the ICC-ID as 

associated with a customer who had registered her account 

with AT&T, then AT&T’s servers would automatically 

redirect the customer’s browser away from the general login 

URL to a different, specific URL. That new specific URL

was unique for every customer and contained the customer’s

ICC-ID in the URL itself. Redirecting the customer’s

browser to the new specific URL told AT&T’s servers which 

email address to populate in the user ID field on the login 

page. This shortcut reduced the amount of time it took a 

customer to log into her account because, with her user ID 

already populated, she had to enter only her password.2

 

1 URL is shorthand for uniform resource locator, which is 

defined as “a specific address . . . used by a browser in 

locating the relevant document [on the Internet].” URL, 

Oxford Eng. Dictionary, http://www.oed.com/view/Entry 

/258858?redirectedFrom=URL#eid (last visited Mar. 27, 

2014). It is more commonly known as a “web address.” 

Appendix (“App.”) 255.

2

To make this more concrete, when an iPad user wanted to 

log into her account, she would direct her browser to 

“https://dcp2.att.com/OEPNDClient/”. If AT&T’s server 

recognized the ICC-ID of the iPad that made the request as an 

iPad that was already registered with AT&T, its servers 

would automatically redirect the user to 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 4 of 22 PageID: 1306 Case: 13-1816 Document: 003111586090 Page: 4 Date Filed: 04/11/2014
5

Daniel Spitler, Auernheimer’s co-conspirator, 

discovered this feature of AT&T’s login process. Although 

he did not own an iPad, he purchased an iPad SIM Card, 

hoping to install it on another computing device and then take 

advantage of the unlimited cellular data plan that AT&T 

offered for $30 per month. At first, he did not know how to 

register his SIM Card, so he downloaded the iPad operating 

system onto his computer, decrypted it, and browsed through 

the operating system’s code to try to find a way to register it. 

In the course of doing so, he came across AT&T’s 

registration URL. He noticed that one of the variables in the

registration URL was a field requiring an ICC-ID.

Spitler then directed his computer’s web browser to 

the registration URL and inserted his iPad’s ICC-ID in the 

requisite place. AT&T’s servers were programmed only to 

permit browsers that self-identified as iPad browsers to access 

the registration URL. This required him to change his 

browser’s user agent. A user agent tells a website what kind 

of browser and operating system a user is running, so servers 

that someone is attempting to access can format their 

responses appropriately. App. 256. 

After changing his browser’s user agent to appear as 

an iPad, Spitler was able to access the AT&T login page. He 

noticed that his email address was already populated in the 

login field and surmised that AT&T’s servers had tied his 

email address to his ICC-ID. He tested this theory by 

changing the ICC-ID in the URL by one digit and discovered 

that doing so returned a different email address. He changed 

the ICC-ID in the URL manually a few more times, and each 

time the server returned other email addresses in the login 

field.

Spitler concluded that this was potentially a 

noteworthy security flaw. He began to write a program that 

he called an “account slurper” that would automate this 

process. The account slurper would repeatedly access the 

 

“https://dcp2.att.com/OEPNDClient/openPage?ICCID=XXX

XXXXXXXXXXXXXXXX&IMEI=0”, where the string of 

“X”s is the nineteen- or twenty-digit ICC-ID.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 5 of 22 PageID: 1307 Case: 13-1816 Document: 003111586090 Page: 5 Date Filed: 04/11/2014
6

AT&T website, each time changing the ICC-ID in the URL 

by one digit. If an email address appeared in the login box, 

the program would save that email address to a file under 

Spitler’s control.

Spitler shared this discovery with Auernheimer, whom 

he knew through Internet-based chat rooms but had never met 

in person. Auernheimer helped him to refine his account 

slurper program, and the program ultimately collected 

114,000 email addresses between June 5 and June 8, 2010. 

Its method — guessing at random — is called a “brute force” 

attack, a term of art in the computer industry referring to an 

inefficient method of simply checking all possible numbers. 

While Spitler’s program was still collecting email 

addresses, Auernheimer emailed various members of the 

media in order to publicize the pair’s exploits. Some of those 

media members emailed AT&T, which immediately fixed the 

breach. One of the media members contacted by 

Auernheimer was Ryan Tate, a reporter at Gawker, a news 

website. Tate expressed interest in publishing Auernheimer’s 

story. To lend credibility to it, Auernheimer shared the list of 

email addresses with him. Tate published a story on June 9, 

2010 describing AT&T’s security flaw, entitled “Apple’s 

Worst Security Breach: 114,000 iPad Owners Exposed.” 

The article mentioned some of the names of those whose 

email addresses were obtained, but published only redacted 

images of a few email addresses and ICC-IDs.

Evidence at trial showed that at all times relevant to 

this case, Spitler was in San Francisco, California and 

Auernheimer was in Fayetteville, Arkansas. The servers that 

they accessed were physically located in Dallas, Texas and 

Atlanta, Georgia. Although no evidence was presented 

regarding the location of the Gawker reporter, it is undisputed 

that he was not in New Jersey.

B.

Despite the absence of any apparent connection to 

New Jersey, a grand jury sitting in Newark returned a twocount superseding indictment charging Auernheimer with 

conspiracy to violate the CFAA, 18 U.S.C. § 1030(a)(2)(C) 

and (c)(2)(B)(ii), in violation of 18 U.S.C. § 371 (count one),

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 6 of 22 PageID: 1308 Case: 13-1816 Document: 003111586090 Page: 6 Date Filed: 04/11/2014
7

and fraud in connection with personal information in 

violation of 18 U.S.C. § 1028(a)(7) (count two, commonly 

referred to as “identity fraud”). To enhance the potential 

punishment from a misdemeanor to a felony, the Government 

alleged that Auernheimer’s CFAA violation occurred in 

furtherance of a violation of New Jersey’s computer crime 

statute, N.J. Stat. Ann. § 2C:20-31(a). See 18 U.S.C. § 

1030(c)(2)(B)(ii).

Auernheimer moved to dismiss the superseding

indictment shortly after it was returned by the grand jury. In 

addition to asserting several challenges concerning the CFAA 

violation, he argued that venue was not proper in the District 

of New Jersey. The District Court acknowledged that neither 

he nor Spitler was ever in New Jersey while allegedly 

committing the crime, and that the servers accessed were not 

in New Jersey, but denied his motion nonetheless. It held that 

venue was proper for the CFAA conspiracy charge because 

Auernheimer’s disclosure of the email addresses of about 

4,500 New Jersey residents affected them in New Jersey and 

violated New Jersey law. It further held that because venue 

was proper for the CFAA count, it was also proper for the 

identity fraud count because proving the CFAA violation was 

a necessary predicate to proving the identity fraud violation.

Auernheimer’s trial lasted five days and resulted in a 

guilty verdict on both counts. Initially, both parties requested 

a jury instruction on venue. App. 575. Venue is a question 

for the jury and the court “must specifically instruct the jury 

on venue” if “(1) the defendant objects to venue prior to or at 

the close of the prosecution’s case-in-chief, (2) there is a 

genuine issue of material fact with regard to proper venue, 

and (3) the defendant timely requests a jury instruction.” 

United States v. Perez, 280 F.3d 318, 334 (3d Cir. 2002). 

Although Auernheimer objected to venue and requested an 

instruction, the District Court held that there was no genuine 

issue of material fact. It concluded that the Government had 

established that venue was proper in New Jersey as a matter 

of law and declined to instruct the jury on venue. App. 591.

After denying Auernheimer’s post-trial motions, the 

District Court sentenced him to forty-one months of 

imprisonment. Auernheimer timely appealed.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 7 of 22 PageID: 1309 Case: 13-1816 Document: 003111586090 Page: 7 Date Filed: 04/11/2014
8

II.

The District Court had jurisdiction pursuant to 18 

U.S.C. § 3231. We have jurisdiction pursuant to 28 U.S.C. § 

1291. Our review of the District Court’s legal decision 

regarding venue is plenary. United States v. Pendleton, 658 

F.3d 299, 302 (3d Cir. 2011). 

III.

Although this appeal raises a number of complex and 

novel issues that are of great public importance in our 

increasingly interconnected age, we find it necessary to reach 

only one that has been fundamental since our country’s 

founding: venue. The proper place of colonial trials was so 

important to the founding generation that it was listed as a 

grievance in the Declaration of Independence. See The 

Declaration of Independence para. 21 (U.S. 1776) (objecting 

to “transporting us beyond seas to be tried for pretended 

offences”). It was of such concern that the Constitution of the 

United States “twice safeguards the defendant’s venue right.”

United States v. Cabrales, 524 U.S. 1, 6 (1998). Article III 

requires that “the Trial of all Crimes . . . shall be held in the 

State where the said Crimes shall have been committed.” 

U.S. Const. art. III, § 2, cl. 3. The Sixth Amendment further 

provides that “[i]n all criminal prosecutions, the accused shall 

enjoy the right to a speedy and public trial, by an impartial 

jury of the State and district wherein the crime shall have 

been committed.” Id. amend VI. This guarantee is codified 

in the Federal Rules of Criminal Procedure, which require

that “the [G]overnment must prosecute an offense in a district 

where the offense was committed.” Fed. R. Crim. P. 18.

Congress may prescribe specific venue requirements 

for particular crimes. Pendleton, 658 F.3d at 303. Where it 

has not, as is the case here, we must determine the crime’s 

locus delicti. Id.; see also Black’s Law Dictionary 1025 (9th 

ed. 2009) (defining locus delicti as the “place where an 

offense was committed”). “[T]he locus delicti must be 

determined from the nature of the crime alleged and the 

location of the act or acts constituting it.” United States v. 

Anderson, 328 U.S. 699, 703 (1946); accord United States v. 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 8 of 22 PageID: 1310 Case: 13-1816 Document: 003111586090 Page: 8 Date Filed: 04/11/2014
9

Rodriguez-Moreno, 526 U.S. 275, 279 (1999); Cabrales, 524 

U.S. at 6-7. To perform this inquiry, we “must [1] initially 

identify the conduct constituting the offense . . . and then [2] 

discern the location of the commission of the criminal acts.”

Rodriguez-Moreno, 526 U.S. at 279. Venue should be 

narrowly construed. Johnson, 323 U.S. at 276.

Continuing offenses, such as conspiracy, that are 

“begun in one district and completed in another, or committed

in more than one district, may be inquired of and prosecuted 

in any district in which such offense was begun, continued, or 

completed.” 18 U.S.C. § 3237(a). In the context of a 

conspiracy charge, “venue can be established wherever a coconspirator has committed an act in furtherance of the 

conspiracy.” Perez, 280 F.3d at 329; accord Hyde v. United 

States, 225 U.S. 347, 356-67 (1912). The Government must 

prove venue by a preponderance of the evidence. United 

States v. Root, 585 F.3d 145, 155 (3d Cir. 2009).

In performing our venue inquiry, we must be careful to 

separate “essential conduct elements” from “circumstance 

element[s].” Rodriguez-Moreno, 526 U.S. at 280 & n.4. For 

example, in Cabrales the Supreme Court considered whether 

venue for money laundering activities was proper in Missouri. 

524 U.S. at 4. The laundered proceeds were generated by 

illegal narcotics sales in Missouri, but all acts constituting the 

money laundering offense took place in Florida. Id. The 

Court held that venue was improper in Missouri. Id. at 10. 

The Supreme Court, later reflecting on Cabrales, observed 

that the “existence of criminally generated proceeds” was 

only a “circumstance element” of money laundering. 

Rodriguez-Moreno, 526 U.S. at 280 n.4. Although it was an 

element of the crime that the Government had to prove to the 

jury, it was a “circumstance element” because it was simply a 

fact that existed at the time that the defendant performed her 

laundering acts. Only “essential conduct elements” can 

provide the basis for venue; “circumstance elements” cannot. 

United States v. Bowens, 224 F.3d 302, 310 (4th Cir. 2000).

A.

Count one charged Auernheimer with conspiracy to 

violate CFAA § 1030(a)(2)(C) and (c)(2)(B)(ii). In the 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 9 of 22 PageID: 1311 Case: 13-1816 Document: 003111586090 Page: 9 Date Filed: 04/11/2014
10

indictment and at trial, the Government identified the nature 

of the conduct constituting the offense as the agreement to 

commit a violation of the CFAA in furtherance of a violation 

of New Jersey’s computer crime statute, N.J. Stat. Ann. § 

2C:20-31(a). Venue would be proper in any district where

the CFAA violation occurred, or wherever any of the acts in 

furtherance of the conspiracy took place. See Perez, 280 F.3d 

at 329; see also Rodriguez-Moreno, 526 U.S. at 281-82 

(citing Hyde, 225 U.S. at 356-67).

The charged portion of the CFAA provides that 

“[w]hoever . . . intentionally accesses a computer without 

authorization or exceeds authorized access, and thereby 

obtains . . . information from any protected computer . . . shall 

be punished as provided in subsection (c) of this section.” 18 

U.S.C. § 1030(a)(2)(C). To be found guilty, the Government 

must prove that the defendant (1) intentionally (2) accessed

without authorization (or exceeded authorized access to) a (3) 

protected computer and (4) thereby obtained information. 

See United States v. Willis, 476 F.3d 1121, 1125 (10th Cir. 

2007) (delineating the elements in a similar manner). The 

statute’s plain language reveals two essential conduct 

elements: accessing without authorization and obtaining

information.

3

New Jersey was not the site of either essential conduct 

element. The evidence at trial demonstrated that the accessed 

AT&T servers were located in Dallas, Texas, and Atlanta, 

Georgia. App. 443-44. In addition, during the time that the 

conspiracy began, continued, and ended, Spitler was 

obtaining information in San Francisco, California (App. 

233), and Auernheimer was assisting him from Fayetteville, 

Arkansas (App. 366). No protected computer was accessed 

and no data was obtained in New Jersey. 

 

3

The Department of Justice’s own manual on prosecuting 

computer crimes provides in its section devoted to venue that 

“it would seem logical that a crime under section 

1030(a)(2)(C) is committed where the offender initiates 

access and where the information is obtained.” Computer 

Crime & Intellectual Prop. Section, Dep’t of Justice, 

Prosecuting Computer Crimes 118, available at

http://www.justice.gov/criminal/cybercrime/docs/ccmanual.p

df (last visited Mar. 26, 2014) (“DOJ Manual”).

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 10 of 22 PageID: 1312 Case: 13-1816 Document: 003111586090 Page: 10 Date Filed: 04/11/2014
11

This is not the end of our analysis, however, because 

the Government did not just charge Auernheimer with 

conspiracy to commit an ordinary violation of the CFAA, but 

also with conspiring to violate the CFAA in furtherance of a 

state crime. The Government can increase the statutory 

maximum punishment for a subsection (a)(2) violation from 

one year to five years if it proves one of the enhancements 

contained in § 1030(c)(2)(B). The enhancement relevant here 

provides for such increased punishment if “the offense was 

committed in furtherance of any criminal or tortious act in 

violation of the . . . laws of . . . any State.” Id. § 

1030(c)(2)(B)(ii). “[A]ny ‘facts that increase the prescribed 

range of penalties to which the criminal defendant is exposed’ 

are elements of the crime” that must be proven to the jury 

beyond a reasonable doubt.4 Alleyne v. United States, 133 S. 

Ct. 2151, 2160 (2013) (quoting Apprendi v. New Jersey, 530 

U.S. 466, 490 (2000)). This is true even if they are explicitly 

termed “sentence enhancement[s]” in the statute. Apprendi, 

530 U.S. at 494 n.19 (quotation marks omitted). 

The New Jersey statute allows for criminal liability “if 

the person purposely or knowingly and without authorization, 

or in excess of authorization, accesses any . . . computer [or]

computer system and knowingly or recklessly discloses, or 

causes to be disclosed any data . . . or personal identifying 

information.” N.J. Stat. Ann. § 2C:20-31(a). Its essential 

conduct elements are accessing without authorization (or in 

excess of authorization) and disclosing data or personal 

identifying information. 

Here, none of the essential conduct elements of a 

violation of the New Jersey statute occurred in New Jersey. 

As discussed, neither Auernheimer nor Spitler accessed a 

 

4

Just because the enhancement is an “element” that the 

Government needed to prove beyond a reasonable doubt does 

not mean that it was an “essential conduct element” of a § 

1030(a)(2)(C) violation within the meaning of RodriguezMoreno that could establish venue. For the purposes of this 

opinion, however, we will assume (without deciding) that the 

enhancement could contain “essential conduct elements.”

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 11 of 22 PageID: 1313 Case: 13-1816 Document: 003111586090 Page: 11 Date Filed: 04/11/2014
12

computer in New Jersey.5 The disclosure did not occur there 

either. The sole disclosure of the data obtained was to the 

Gawker reporter. There was no allegation or evidence that 

the Gawker reporter was in New Jersey. Further, there was 

no evidence that any email addresses of any New Jersey 

residents were ever disclosed publicly in the Gawker article. 

The alleged violation of the New Jersey statute thus cannot 

confer venue for count one.

Just as none of the conduct constituting the CFAA 

violation or its enhancement occurred in New Jersey, none of 

the overt acts that the Government alleged in the superseding 

indictment occurred in New Jersey either. The indictment 

listed four overt acts: writing the account slurper program, 

deploying the account slurper program against AT&T’s 

servers, emailing victims to inform them of the breach, and 

disclosing the emails addresses obtained to Gawker. The coconspirators collaborated on the account slurper program 

from California and Arkansas and deployed it against servers 

located in Texas and Georgia. The Government offered no 

evidence whatsoever that any of the victims that Auernheimer 

emailed were located in New Jersey, or that the Gawker

reporter to whom the list of email addresses was disclosed 

was in the Garden State. 

Because neither Auernheimer nor his co-conspirator 

Spitler performed any “essential conduct element” of the 

underlying CFAA violation or any overt act in furtherance of 

the conspiracy in New Jersey, venue was improper on count 

one. 

 

5 We also note that in order to be guilty of accessing “without 

authorization, or in excess of authorization” under New 

Jersey law, the Government needed to prove that 

Auernheimer or Spitler circumvented a code- or passwordbased barrier to access. See State v. Riley, 988 A.2d 1252, 

1267 (N.J. Super. Ct. Law Div. 2009). Although we need not 

resolve whether Auernheimer’s conduct involved such a 

breach, no evidence was advanced at trial that the account 

slurper ever breached any password gate or other code-based 

barrier. The account slurper simply accessed the publicly 

facing portion of the login screen and scraped information 

that AT&T unintentionally published.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 12 of 22 PageID: 1314 Case: 13-1816 Document: 003111586090 Page: 12 Date Filed: 04/11/2014
13

B.

We now turn to count two of the indictment because 

venue must be analyzed independently for each count. See

Root, 585 F.3d at 155. Count two charged Auernheimer with 

violating 18 U.S.C. § 1028(a)(7), which punishes anyone who 

“knowingly transfers, possesses, or uses, without lawful 

authority, a means of identification of another person with the 

intent to commit, or to aid or abet, or in connection with, any 

[federal crime, or state or local felony].” The statute’s plain 

language indicates that the statute punishes someone who (1) 

knowingly (2) transfers, possesses, or uses without lawful 

authority (3) a means of identification of another person (4) 

with the intent to commit, or in connection with, any violation 

of federal law or any state felony. See United States v. 

Abdelshafi, 592 F.3d 602, 607 (4th Cir. 2010) (delineating the 

elements of a violation of aggravated identity fraud in 18 

U.S.C. § 1028A(a)(1), which are virtually identical, in a 

similar fashion); United States v. Stephens, 571 F.3d 401, 

404-05 (5th Cir. 2009) (same).

The two essential conduct elements under § 1028(a)(7) 

are transfer, possession, or use, and doing so in connection 

with a federal crime or state felony. Cf. Rodriguez-Moreno, 

526 U.S. at 280 (noting that “during and in relation to any 

crime of violence” was an essential conduct element of a 

firearms statute). Starting with the latter essential conduct 

element, the Government charged Auernheimer with 

committing identity fraud “in connection with” the ordinary 

violation of CFAA § 1030(a)(2)(C). As should be clear by 

now, no conduct related to the ordinary CFAA violation 

occurred in New Jersey.

There was also no evidence that Auernheimer’s 

transfer, possession, or use occurred in New Jersey. The 

Government advances two theories of how he could have 

satisfied this essential conduct element. First, it contends that 

he violated § 1028(a)(7) by knowingly using the ICC-IDs of 

other people’s iPads to access AT&T’s servers. See Gov’t 

Br. 64-66. Venue fails under this theory because there was no 

allegation or evidence that he used the ICC-IDs in New 

Jersey. The alleged conspirators used the ICC-IDs in their 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 13 of 22 PageID: 1315 Case: 13-1816 Document: 003111586090 Page: 13 Date Filed: 04/11/2014
14

account slurper program, which was programmed from 

California and Arkansas, and did not access any computer or 

obtain any information in New Jersey. 

The Government also argues that Auernheimer

violated the statute by transferring the list of email addresses 

that he obtained to Gawker with the intent to violate the New 

Jersey computer crime statute. See Gov’t Br. 67-69. But 

there was no allegation in the indictment or evidence at trial 

that the Gawker reporter to whom he transferred the email 

addresses was in New Jersey — and no essential conduct 

element of the alleged violation of New Jersey law occurred 

in New Jersey either.

6

 

Because Auernheimer did not commit any essential 

conduct of the identity fraud charge in New Jersey, venue was 

also improper on count two.

IV.

The Government does not dispute the locations of 

Auernheimer, Spitler, and AT&T’s servers during the period 

of time that Auernheimer was committing the alleged crimes. 

Instead, it advances a series of other reasons why there was 

no defect in venue that warrants vacating his conviction. 

None of them are availing.

A.

The Government argues that we need not rely on the 

essential conduct elements test mandated by Cabrales and 

Rodriguez-Moreno because we have “adopted,” Gov’t Br. 71, 

 

6

Further, count two of the indictment charged Auernheimer 

with transferring, possessing, and using the means of 

identification of others in connection with only an ordinary 

violation of CFAA § 1030(a)(2)(C). It did not mention the 

violation of New Jersey law or the § 1030(c)(2)(B)(ii)

enhancement at all. This second theory thus “broaden[s] the 

possible bases for conviction from that which appeared in the 

indictment.” United States v. McKee, 506 F.3d 225, 229 (3d 

Cir. 2007) (quotation marks omitted). It cannot be a 

permissible basis upon which to find venue for count two.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 14 of 22 PageID: 1316 Case: 13-1816 Document: 003111586090 Page: 14 Date Filed: 04/11/2014
15

a “substantial contacts test.” Under this approach, frequently 

employed by the Court of Appeals for the Second Circuit, a 

number of factors help to determine whether venue was 

proper, including “the site of the defendant’s acts, the 

elements and nature of the crime, the locus of the effect of the 

criminal conduct, and the suitability of each district for 

accurate factfinding.” United States v. Reed, 773 F.2d 477, 

481 (2d Cir. 1985). The Government contends that venue is 

proper in New Jersey because about four percent 

(approximately 4,500 of 114,000) of the email addresses 

obtained from AT&T’s website belonged to New Jersey 

residents, thereby satisfying the “locus of the effect[s]” 

consideration. See id.

It is far from clear that this Court has ever “adopted”

this test. We have mentioned it only once. See United States 

v. Goldberg, 830 F.2d 459, 466 (3d Cir. 1987). The test was 

cited in a long block quote to Reed, and then analyzed in a 

single sentence. Id. The Goldberg panel did not need to rely 

on the locus of the effects of the defendant’s conduct in that 

case because all of his acts took place in the district in which 

he was tried. Id. No panel of this Court has ever cited

Goldberg, or any other case, for this test since — either 

before, or especially after, the Supreme Court clarified the 

venue inquiry in Cabrales and Rodriguez-Moreno. 

Even if it could be said that we perhaps tacitly 

endorsed this test once almost thirty years ago, the test 

operates to limit venue, not to expand it. Cases from the 

Court of Appeals for the Second Circuit make this clear. The 

test “does not represent a formal constitutional test,” but 

rather is merely “helpful in determining whether a chosen 

venue is unfair or prejudicial to a defendant.” United States 

v. Saavedra, 223 F.3d 85, 93 (2d Cir. 2000). To satisfy this 

test, there must be “more than ‘some activity in the situs 

district’; instead, there must be ‘substantial contacts.’” 

United States v. Davis, 689 F.3d 179, 186 (2d Cir. 2012) 

(quoting Reed, 773 F.2d at 481). There “must be some sense 

of venue having been freely chosen by the defendant.” Id.

(alteration and quotation marks omitted). If a defendant 

argues that the chosen venue is constitutionally infirm but that 

it did not result in any hardship to him, the court only 

determines the locus delicti and does not then analyze 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 15 of 22 PageID: 1317 Case: 13-1816 Document: 003111586090 Page: 15 Date Filed: 04/11/2014
16

whether there were “substantial contacts.” See United States 

v. Magassouba, 619 F.3d 202, 205 n.2 (2d Cir. 2010). This 

test thus serves to limit venue in instances where the locus 

delicti constitutionally allows for a given venue, but trying 

the case there is somehow prejudicial or unfair to the 

defendant.

Even assuming that the substantial contacts test is 

viable within our Circuit, it cannot serve as a sufficient basis 

for conferring venue. The Government argues only that it has

minimally satisfied one of the four prongs of the test — the 

“locus of the effect of the criminal conduct.” There was no 

evidence at trial that Auernheimer’s actions evinced any 

contact with New Jersey, much less contact that was 

“substantial.” The Government has not cited, and we have 

not found, any case where the locus of the effects, standing by 

itself, was sufficient to confer constitutionally sound venue.

Undoubtedly there are some instances where the 

location in which a crime’s effects are felt is relevant to 

determining whether venue is proper. See RodriguezMoreno, 526 U.S. at 279 n.2 (reserving the issue of whether 

venue may also be permissibly based on the location where a 

crime’s effects are felt). But those cases are reserved for 

situations in which “an essential conduct element is itself 

defined in terms of its effects.” Bowens, 224 F.3d at 311. 

For example, in a prosecution for Hobbs Act robbery, venue 

may be proper in any district where commerce is affected 

because the terms of the act themselves forbid affecting 

commerce. See 18 U.S.C. § 1951(a); accord United States v. 

Smith, 198 F.3d 377, 383 (2d Cir. 1999). This is consistent 

with Congress’s prerogative to “provide that the locality of a 

crime shall extend over the whole area through which force 

propelled by an offender operates.” Johnson, 323 U.S. at 275.

Sections of the CFAA other than § 1030(a)(2)(C) do 

speak in terms of their effects. For example, § 1030(a)(5)(B) 

criminalizes intentionally accessing a computer without 

authorization and recklessly causing damage. Because that

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 16 of 22 PageID: 1318 Case: 13-1816 Document: 003111586090 Page: 16 Date Filed: 04/11/2014
17

crime is defined in terms of its effects — the damage caused 

— venue could be proper wherever that occurred.7

Congress, however, did not define a violation of § 

1030(a)(2)(C) in terms of its effects. The statute simply 

criminalizes accessing a computer without authorization and 

obtaining information. It punishes only the actions that the 

defendant takes to access and obtain. It does not speak in 

terms of the effects on those whose information is obtained. 

The crime is complete even if the offender never looks at the 

information and immediately destroys it, or the victim has no 

idea that information was ever taken.

B.

The Government also argues that venue was proper in 

New Jersey because Auernheimer failed to obtain 

authorization from approximately 4,500 New Jersey residents 

to “use[] their ICC-ID numbers to access the AT&T servers.” 

Gov’t Br. 80. The Government argues that when a statute 

makes it a crime to fail to do some required act, venue can lie 

in the district in which the act should have been done. The 

Government concludes that venue is proper because 

Auernheimer and Spitler failed to obtain authorization from 

about 4,500 people in New Jersey prior to accessing AT&T’s 

servers.

This rule only applies, however, when a preexisting 

legal duty requires the act that the defendant failed to do. See

1 Wayne R. LaFave, Substantive Criminal Law § 6.2(a) (2d 

ed. 2003) (noting that crimes of omission are generally 

limited by specific duties such as relationship, statute, 

contract, assumption of care, creation of peril, controlling the 

conduct of others, and landowner); accord United States v. 

Sabhnani, 599 F.3d 215, 237 (2d Cir. 2010). Failure to 

 

7

The Department of Justice manual again tailors its guidance 

to this assessment, noting that a prosecution under § 

1030(a)(5) “may be brought where the effects are felt because 

those charges are defined in terms of ‘loss,’ even if the bulk 

of network crimes may not be prosecuted in a district simply 

because the effects of the crime are felt there.” DOJ Manual

at 120.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 17 of 22 PageID: 1319 Case: 13-1816 Document: 003111586090 Page: 17 Date Filed: 04/11/2014
18

perform a required act could confer venue where a defendant 

should have performed that act when a statute penalizes 

inaction, such as failure to report to a military draft board 

(see, e.g., Johnston v. United States, 351 U.S. 215, 219-20 

(1956)), failure to report to prison after being sentenced (see, 

e.g., United States v. Overaker, 766 F.2d 1326, 1327 (9th Cir. 

1985)), or failure to file income tax returns (see, e.g., United 

States v. Garman, 748 F.2d 218, 219 (4th Cir. 1984)). Here, 

Auernheimer was under no such preexisting duty — legal or 

otherwise. Like most statutes, the charged portion of the 

CFAA punishes affirmative acts, not inaction. His failure to 

obtain authorization cannot confer venue in every district in 

which a potential victim lived.

C.

Finally, the Government argues that even if venue 

were improper, we should apply harmless error analysis and 

disregard the error because it did “not affect substantial 

rights.” Fed. R. Crim. P. 52(a). Although the Government 

makes this argument only in passing — it occupies less than 

one page of its 118-page brief — we feel obliged to address 

it. The Government contends that its choice of forum actually 

benefitted Auernheimer, because locating his trial in Newark, 

New Jersey “enhance[d] his ability to attract and retain 

experienced and capable counsel on a pro bono basis.” Gov’t 

Br. 98; see also id. at 97 (noting that Newark was a 

“relatively easy commute” for Auernheimer’s attorney from 

his office in Brooklyn, New York).

At the outset, we are skeptical that venue errors are 

susceptible to harmless error analysis. The Supreme Court 

has divided constitutional errors into two classes: “trial” and 

“structural.” Arizona v. Fulminante, 499 U.S. 279, 307-10

(1991). Trial errors occur “during the presentation of the case 

to the jury” and can be “quantitatively assessed in the context 

of other evidence presented” in order to determine whether 

they are “harmless beyond a reasonable doubt.” Id. at 307-

08. These include “most constitutional errors.” Id. at 306. 

Structural errors “defy” harmless error analysis because they 

“affect[] the framework within which the trial proceeds,” id.

at 309-10, “or indeed [] whether it proceeds at all,” United 

States v. Gonzalez-Lopez, 548 U.S. 140, 150 (2006). These 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 18 of 22 PageID: 1320 Case: 13-1816 Document: 003111586090 Page: 18 Date Filed: 04/11/2014
19

include a “limited class of fundamental constitutional errors,” 

Neder v. United States, 527 U.S. 1, 7 (1999), such as the 

denial of the rights to counsel, self-representation, or a public 

trial. See Gonzales-Lopez, 548 U.S. at 149 (listing examples 

and authority).

An error regarding venue exhibits many of the 

characteristics of structural error. If the District Court had 

found venue lacking upon Auernheimer’s motion to dismiss, 

there would have been no trial in New Jersey at all. Even if 

venue had been raised only at trial, “if venue is improper no 

constitutionally valid verdict could be reached regardless of 

the [potentially] overwhelming evidence against the 

defendant.” United States v. Miller, 111 F.3d 747, 757 (10th 

Cir. 1997) (Barrett, J., dissenting). The error thus “def[ies] 

analysis by harmless-error standards by affecting the entire 

adjudicatory framework.” Puckett v. United States, 556 U.S. 

129, 141 (2009) (quotation marks omitted). Holding that 

defective venue could ever be harmless would arguably 

reduce this constitutional protection to a nullity because, 

under the Government’s formulation, the error would be 

harmless as long as the evidence against the accused of the 

substantive crime was overwhelming. It is doubtful that this 

is the way the venue protections in the Constitution were 

meant to operate. See also 4 Wayne R. LaFave et al., 

Criminal Procedure § 16.1(g) (4th ed. 2007) (“Failure of 

venue will not be treated as harmless error.”). 

The Supreme Court has never held that improper 

venue is subject to harmless error review. The Government 

has pointed to only one case where a court subjected 

defective venue to harmless error review. See United States 

v. Hart-Williams, 967 F. Supp. 73, 78-81 (E.D.N.Y. 1997). 

In Hart-Williams, the district court found the venue error

harmless after the defendant was convicted at a courthouse in 

Brooklyn, New York, that was less than a mile from the 

courthouse where venue would have been proper in 

Manhattan, New York. See id. at 80. No court has cited 

Hart-Williams for this proposition, and the Court of Appeals 

for the Second Circuit has cast doubt on whether the district 

court’s application of harmless error review remains good 

law. See United States v. Brennan, 183 F.3d 139, 149 (2d 

Cir. 1999) (holding that trial in Brooklyn, New York, where 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 19 of 22 PageID: 1321 Case: 13-1816 Document: 003111586090 Page: 19 Date Filed: 04/11/2014
20

venue was improper, was not harmless when the defendant 

timely objected to venue, even though venue would have 

been proper in Manhattan, New York); see also Saavedra, 223 

F.3d at 100 n.5 (Cabranes, J., dissenting) (explicitly noting 

that Brennan forecloses applying harmless error analysis to 

defective venue).

Nonetheless, even assuming that defective venue could 

be amenable to harmless error review, the venue error here 

clearly affected Auernheimer’s substantial rights. In order for 

an error to be harmless, “the Government must ‘prove beyond

a reasonable doubt that the error complained of did not 

contribute to the verdict obtained.’” Gov’t of V.I. v. Davis, 

561 F.3d 159, 165 (3d Cir. 2009) (quoting Chapman v. 

California, 386 U.S. 18, 24 (1967)). The question “is not 

whether, in a trial that occurred without the error, a guilty 

verdict would surely have been rendered, but whether the 

guilty verdict actually rendered in this trial was surely 

unattributable to the error.” Sullivan v. Louisiana, 508 U.S. 

275, 279 (1993). The venue error in this case is not harmless 

because there was no evidence that any of the essential 

conduct elements occurred in New Jersey. If Auernheimer’s 

jury had been properly instructed on venue, it could not have 

returned a guilty verdict; the verdict rendered in this trial 

would have been different. See United States v. Durades, 607 

F.2d 818, 820 (9th Cir. 1979) (failing to try defendant in 

district where crime was allegedly committed infringed the 

defendant’s substantial rights); see also United States v. 

Glenn, 828 F.2d 855, 860 (1st Cir. 1987) (same); United

States v. Stratton, 649 F.2d 1066, 1076 n.15 (5th Cir. 1981) 

(“A defendant’s interest in being tried only in a district where 

venue properly lay clearly constitutes a substantial right.” 

(quotation marks omitted)).

The Supreme Court has repeatedly made clear that the 

constitutional limitations on venue are extraordinarily 

important. “[Q]uestions of venue are more than matters of 

mere procedure. They raise deep issues of public policy in 

the light of which legislation must be construed.” Travis v. 

United States, 364 U.S. 631, 634 (1961) (quotation marks 

omitted). “The provision for trial in the vicinity of the crime 

is a safeguard against the unfairness and hardship involved 

when an accused is prosecuted in a remote place.” United 

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 20 of 22 PageID: 1322 Case: 13-1816 Document: 003111586090 Page: 20 Date Filed: 04/11/2014
21

States v. Cores, 356 U.S. 405, 407 (1958); accord United 

States v. Passodelis, 615 F.2d 975, 977 (3d Cir. 1980). The 

founders were so concerned with the location of a criminal 

trial that they placed the venue requirement, which is 

“principally a protection for the defendant,” Cabrales, 524 

U.S. at 9, in the Constitution in two places. See U.S. Const. 

art. III, § 2, cl. 3 and amend. VI.

They did so for good reason. A defendant who has 

been convicted “in a distant, remote, or unfriendly forum

solely at the prosecutor’s whim,” United States v. Salinas, 

373 F.3d 161, 164 (1st Cir. 2004), has had his substantial 

rights compromised. Auernheimer was hauled over a

thousand miles from Fayetteville, Arkansas to New Jersey. 

Certainly if he had directed his criminal activity toward New 

Jersey to the extent that either he or his co-conspirator 

committed an act in furtherance of their conspiracy there, or 

performed one of the essential conduct elements of the 

charged offenses there, he would have no grounds to 

complain about his uprooting. But that was not what was 

alleged or what happened. While we are not prepared today 

to hold that an error of venue never could be harmless,

8 we do 

not need to because the improper venue here — far from 

where he performed any of his allegedly criminal acts —

 

8 We note that we are not dealing with a situation where the 

error complained of is that the trial judge failed to instruct the 

jury on venue. That claim may be reviewed for harmless 

error. See United States v. Casch, 448 F.3d 1115, 1117-18 

(9th Cir. 2006) (noting that when proof of venue is clear, 

failure to instruct the jury can be considered harmless error); 

United States v. Martinez, 901 F.2d 374, 377 (4th Cir. 1990)

(same); United States v. Moeckly, 769 F.2d 453, 461 (8th Cir. 

1985) (same). In that situation, the failure to instruct would 

be harmless if the Government demonstrates under the 

Chapman standard that sufficient evidence of venue existed 

such that the jury would have come to that conclusion too. 

Cf. Neder, 527 U.S. at 7-11 (holding that an erroneous jury 

instruction that omitted an element of the offense is subject to 

harmless error analysis). The question that we address today 

is whether a venue defect could be harmless when there is no 

possibility that the jury could have found venue proper.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 21 of 22 PageID: 1323 Case: 13-1816 Document: 003111586090 Page: 21 Date Filed: 04/11/2014
22

denied Auernheimer’s substantial right to be tried in the place 

where his alleged crime was committed.9 

V.

Venue issues are animated in part by the “danger of 

allowing the [G]overnment to choose its forum free from any 

external constraints.” Salinas, 373 F.3d at 169-70 (citing 

Travis, 364 U.S. at 634). The ever-increasing ubiquity of the 

Internet only amplifies this concern. As we progress 

technologically, we must remain mindful that cybercrimes do 

not happen in some metaphysical location that justifies 

disregarding constitutional limits on venue. People and 

computers still exist in identifiable places in the physical 

world. When people commit crimes, we have the ability and 

obligation to ensure that they do not stand to account for 

those crimes in forums in which they performed no “essential 

conduct element” of the crimes charged. Rodriguez-Moreno, 

526 U.S. at 280. 

“Though our nation has changed in ways which it is 

difficult to imagine that the Framers of the Constitution could 

have foreseen, the rights of criminal defendants which they 

sought to protect in the venue provisions of the Constitution 

are neither outdated nor outmoded.” Passodelis, 615 F.2d at

977. Just as this was true when we decided Passodelis in 

1980 — after the advent of railroad, express mail, the 

telegraph, the telephone, the automobile, air travel, and 

satellite communications — it remains true in today’s Internet 

age. For the forgoing reasons, we will reverse the District 

Court’s venue determination and vacate Auernheimer’s 

conviction.

 

9 We in no way imply that venue cannot be waived by the 

defendant by failing to object to it in a timely fashion. See

Perez, 280 F.3d at 328. Because Auernheimer explicitly 

moved to dismiss the indictment for lack of venue, there is no 

contention that he waived his venue right here.

Case 2:11-cr-00470-SDW Document 99-1 Filed 04/11/14 Page 22 of 22 PageID: 1324 Case: 13-1816 Document: 003111586090 Page: 22 Date Filed: 04/11/2014