## Facts

- Apple’s iPad 3G customers registered for service through an AT&T-controlled website using an email address (user ID) and password.
- AT&T configured an iPad login page to “prepopulate” the email field when its servers received an HTTP request containing a particular ICC-ID tied to an account.
- Daniel Spitler discovered that sending incrementing ICC-IDs to an AT&T URL could cause AT&T’s servers to return pages displaying associated email addresses.
- Spitler wrote an automated “account slurper” script that sent repeated HTTP requests with sequentially altered ICC-IDs and saved any returned email addresses.
- Spitler shared the method with Andrew Auernheimer, who helped refine and publicize the activity.
- The script collected about 114,000 iPad user email addresses, including those of prominent individuals.
- Auernheimer coordinated with a journalist to publicize the issue; the resulting story included redacted email addresses and ICC-IDs.
- Key locations: Spitler acted from California; Auernheimer acted from Arkansas; the accessed servers were in Texas and Georgia; the journalist was not in New Jersey.
- The government prosecuted in the District of New Jersey based principally on the fact that thousands of affected email addresses belonged to New Jersey residents.

## Issues

1. Whether venue for conspiracy to violate the CFAA and identity fraud was proper in the District of New Jersey when the alleged access, related acts, and relevant servers were located outside New Jersey.
2. If venue was improper, whether the convictions could nevertheless stand on waiver or harmless-error theories.

## Decision

- The Third Circuit held venue in the District of New Jersey was improper for both counts.
- The court rejected venue based solely on victim residence or effects felt in New Jersey.
- The court found no evidence of any essential conduct element, or any overt act in furtherance of a conspiracy, occurring in New Jersey.
- The court declined to treat the venue defect as harmless and vacated the convictions.

## Legal Principles

- Criminal venue is a constitutional protection requiring prosecution in the state and district where the crime was committed.
- Venue turns on where the offense’s essential conduct elements occurred, not on circumstance elements such as where victims reside.
- Harm experienced in a district, without in-district conduct constituting the offense, does not by itself establish venue.
- For conspiracy-based venue, the government must show an overt act in furtherance of the conspiracy occurred in the district.
- Improper venue is not treated as a mere technical defect when it compromises the constitutional right to trial in the proper district.

## Conclusion

Because no essential conduct element (and no conspiratorial overt act) occurred in New Jersey, and victim location alone could not supply venue, the Third Circuit vacated Auernheimer’s convictions for conspiracy to violate the CFAA and identity fraud.


United States v. Auernheimer, 748 F.3d 525 (3d Cir. 2014)