UNITED STATES COURT OF APPEALS
FOR THE SECOND CIRCUIT
UNITED STATES OF AMERICA,
Appellee v.
PETER IAN MCCLAIN,
Appellant.
________
APPELLANT'S BRIEF _________
On Appeal from the United States District Court For the Southern District of New York
Final Round
Harlan Fiske Stone Moot Court 2011-2012
Columbia Law School
Will Rollins – Issue I
Class of 2012
Robert Bernstein – Issue II
Class of 2013
i
TABLE OF CONTENTS
Page
Table of Contents ........................................................................................................................... i
Table of Authorities ..................................................................................................................... iii
Questions Presented .......................................................................................................................x
Stipulations ................................................................................................................................... xi
Constitutional and Statutory Provisions Involved ................................................................... xii
Statement of the Case ....................................................................................................................1
Statement of Facts ..........................................................................................................................2
Summary of Argument ..................................................................................................................6
Argument ........................................................................................................................................8
I. MR. MCCLAIN'S CONVICTIONS UNDER THE FEDERAL OBSTRUCTION OF
JUSTICE LAWS ARE NOT SUPPORTED BY THE EVIDENCE, CONTRAVENE
THE PURPOSE OF THE STATUTES, AND VIOLATE THE U.S.
CONSTITUTION. .............................................................................................................8
A. The Government Has Not Established That Mr. McClain Is Guilty Of Federal
"Witness Tampering" Under 18 U.S.C. § 1512(b)(3). ...................................................8
1. The Evidence Is Insufficient To Establish A Violation Of Subsection (b)(3) ........8
2. Sending An E-Mail To A Local Law Enforcement Officer In The Absence Of A
Federal Investigation Does Not Establish A "Federal Nexus" Under 18 U.S.C.
§ 1512(b)(3). ..........................................................................................................14
3. The Government's Use Of Subsection (b)(3) Against Mr. McClain Contravenes
The Purpose Of The Statute And Violates The U.S. Constitution. ........................19
B. Conduct Prohibited By 18 U.S.C. § 1519 Does Not Extend To Mr. McClain's
Modification Of The Teletronix Press Release. ...........................................................22
1. There Is Insufficient Evidence To Demonstrate That Mr. McClain "Knowingly"
Falsified The Teletronix Press Release Or "Intended" To "Impede, Obstruct Or
Influence" A Congressional Investigation. ............................................................23
2. The Government Has Used §1519 To Unconstitutionally Criminalize Mr.
McClain's Statement That Teletronix Cell Phones Do Not Cause Cancer. ...........26
ii
II. ACQUITTAL IS NECESSARY BECAUSE MR. MCCLAIN COMMITTED NO
COMPUTER HACKING: HE USED HIS COMPANY COMPUTER TO
DOWNLOAD AND ACCESS PERSONAL FILES AND ALSO TO PARTICIPATE
IN AN ONLINE SOCIAL EXPERIMENT. ..................................................................33
A. Mr. McClain Did Not Violate 18 U.S.C. § 1030(a)(2)(C) Because He Had Permission
To Access His Computer And, Specifically, To Access Personal Information On That
Computer. ....................................................................................................................35
1. The Court Should Adopt The Code-Based View Of Authorization Because It Is
Most Faithful To The CFAA's Plain Meaning, Underlying Rationale, And
Legislative History. ................................................................................................36
2. Non-Code-Based Notions Of Authorization Are Unworkable, But Even If Valid,
They Would Not Support A Conviction Because Mr. McClain Remained Fiercely
Loyal To Teletronix During His Employment And Did Not Misappropriate Any
Information. ...........................................................................................................40
B. Mr. McClain Did Not Violate 18 U.S.C. § 1030(a)(4) By Exposing A Technological
And Moral Flaw In The Jonathan's Card Social Experiment. .....................................46
C. The Court Must Adopt A Narrower Interpretation Of The CFAA Because A Broad
Reading Renders The Statute Unconstitutionally Vague.............................................49
Conclusion ....................................................................................................................................52
iii
TABLE OF AUTHORITIES
Page
Cases
Arthur Andersen LLP v. United States,
544 U.S. 696 (2005) ...............................................................................................14, 15, 16
Brown v. Entm't Merchs. Ass'n,
131 S. Ct. 2729 (2011) ......................................................................................................29
City of Chicago v. Morales,
527 U.S. 41 (1999) .................................................................................................26, 34, 49
Clark v. Martinez,
543 U.S. 371 (2005) ...........................................................................................................18
Consol. Edison Co. of N.Y. v. Pub. Serv. Comm'n of N.Y.,
388 U.S. 130 (1967) ..........................................................................................................30
Curtis Pub. Co. v. Butts,
388 U.S. 130 (1967) ..........................................................................................................30
EF Cultural Travel BV v. Explorica, Inc.,
274 F.3d 577 (1st Cir. 2001) ......................................................................36, 41, 44, 45, 47
Farrell v. Burke,
449 F.3d 470 (2d Cir. 2006) .......................................................................................27, 29
Fowler v. United States,
131 S. Ct. 2045 (2011) .....................................................................................17, 18, 31, 32
Gonzalez v. Carhart,
550 U.S. 124 (2007) .....................................................................................................44, 50
Grayned v. City of Rockford,
408 U.S. 104 (1972) ...........................................................................................................27
Hill v. Colorado,
530 U.S. 703 (2000) ...........................................................................................................29
Int'l Airport Ctrs., L.L.C. v. Citrin,
440 F.3d 418 (7th Cir. 2006) .....................................................................36, 41, 43, 44, 47
Kolender v. Lawson,
461 U.S. 352 (1983) .....................................................................................................49, 51
iv
TABLE OF AUTHORITIES
(continued)
LVRC Holdings LLC v. Brekka,
581 F.3d 1127 (9th Cir. 2009) ...................................................................36, 37, 43, 44, 47
New York Times Co. v Sullivan,
376 U.S. 254 (1964) ..........................................................................................................30
Nike, Inc. v. Kasky,
539 U.S. 654 (2003) ..........................................................................................................30
Orbit One Commc'ns, Inc. v. Numerex Corp.,
692 F. Supp. 2d 373 (S.D.N.Y. 2010)..........................................................................38, 39
Raygor v. Regents,
534 U.S. 533 (2002) ..........................................................................................................21
Smith v. Goguen,
415 U.S. 566 (1974) .....................................................................................................28, 51
Thomas v. Collins,
323 U.S. 516 (1945) ..........................................................................................................30
Thyroff v. Nationwide Mut. Ins. Co.,
864 N.E.2d 1272 (2007)...............................................................................................42, 43
United States v. Alvarez,
638 F.3d 666 (9th Cir. 2011) ............................................................................................31
United States v. Aguilar,
515 U.S. 593 (1995) ...................................................................................15, 16, 17, 20, 32
United States v. Aleynikov,
737 F. Supp. 2d 173 (S.D.N.Y. 2010)..............................................................35, 37, 38, 44
United States v. Andrews,
754 F. Supp. 1197 (N.D. Ill. 1990) ....................................................................................18
United States v. Chamberlain,
2006 U.S. Dist. LEXIS 32647 (W.D.N.C. May 19, 2006) ................................................26
United States v. Cobb,
905 F.2d 784 (4th Cir. 1990) .............................................................................................18
v
TABLE OF AUTHORITIES
(continued)
United States v. Dauray,
215 F.3d 257 (2d Cir. 2000)...............................................................................................38
United States v. Davis,
926 F.2d 969 (10th Cir. 1991) ...........................................................................................18
United States v. Diaz,
176 F.3d 52 (2d. Cir. 1999)................................................................................................16
United States v. Drew,
259 F.R.D. 449 (C.D. Cal. 2009) .......................................................................................51
United States v. Dunning,
929 F.2d 579 (10th Cir. 1991) ...........................................................................................18
United States v. Fortenberry,
971 F.2d 717 (11th Cir. 1992) ...........................................................................................18
United States v. Gomez,
191 F. App'x. 413 (6th Cir. 2006) ......................................................................................18
United States v. Gray,
642 F.3d 371 (2d. Cir. 2011)..............................................................................................23
United States v. Guadagna,
183 F.3d 122 (2d Cir.1999)................................................................................................20
United States v. Handakas,
286 F.3d 92 (2d Cir. 2002) .........................................................................................22, 28
United States v. Harriss,
347 U.S. 612 (1954) .......................................................................................................6, 19
United States v. Jackson,
1993 U.S. Dist. LEXIS 14341 (D. Kan. Sept. 9, 1993) .....................................................18
United States v. John,
597 F.3d 263 (5th Cir. 2010) .............................................................................................35
United States v. Kernell
667 F.3d 746 (6th Cir. 2012) ......................................................................................27, 28
United States v. Lamont,
18 F.R.D. 27 (S.D.N.Y. 1955), order aff'd, 236 F.2d 312 (2d Cir. 1956) .........................25
vi
TABLE OF AUTHORITIES
(continued)
United States v. Lopez,
372 F.3d 86 (2d Cir. 2004), cert. granted, judgment vacated on other grounds, 544 U.S.
902 (2005) ....................................................................................................................16, 17
United States v. Lopez,
514 U.S. 549 (1995) .....................................................................................................23, 31
United States v. Morris,
928 F.2d 504 (2d. Cir. 1991)..............................................................................................40
United States v. Morrison,
529 U.S. 598 (2000) ...........................................................................................................20
United States v. Nadi
996 F.2d 548 (2d Cir.1993)................................................................................................21
United States v. Nosal,
642 F.3d 781 (9th Cir. 2011), reh'g granted, 661 F.3d 1180 (9th Cir. 2011) ............ passim
United States v. Quattrone,
441 F.3d 153 (2d Cir. 2006).....................................................................................9, 15, 16
United States v. Reich,
479 F.3d 179 (2d Cir. 2007)...............................................................................................16
United States v. Reese,
92 U.S. 214 (1875) ............................................................................................................28
United States v. Romero,
54 F.3d 56 (2d Cir. 1995).............................................................................................11, 17
United States v. Santos,
553 U.S. 507 (2008) ...........................................................................................................39
United States v. Samaria,
239 F. 3d 228 (2d Cir. 2001)..............................................................................................20
United States v. Schwarz,
283 F.3d 76 (2d Cir. 2002)...........................................................................................15, 16
United States v. Shinderman,
2006 U.S. Dist. LEXIS 8254 (D. Me. Mar. 2, 2006) .........................................................26
vii
TABLE OF AUTHORITIES
(continued)
United States v. Smyth,
2007 U.S. App. LEXIS 577 (3d Cir. Jan. 11, 2007) ..........................................................26
United States v. Strandlof,
667 F.3d 1146 (10th Cir. 2012) ........................................................................................31
United States v. Stevens,
130 S. Ct. 1577 (2010) ......................................................................................................29
United States v. Veal,
153 F.3d 1233 (11th Cir. 1998) .........................................................................................18
United States v. Velastegui,
199 F.3d 590 (2d Cir. 1999)...............................................................................................39
United States v. Williams,
553 U.S. 285 (2008) ...........................................................................................................49
United States v. Williams,
890 F.2d 102 (8th Cir. 1989) .............................................................................................18
Univ. Sports Publ'ns Co. v. Playmakers Media Co.,
735 F. Supp. 2d. 378 (S.D.N.Y. 2010)...............................................................................38
viii
Constitutional Provisions
U.S. Const. amend. I ............................................................................................................... xii, 27
U.S. Const. amend. V.............................................................................................................. xii, 27
Statutory Provisions and Legislative History
18 U.S.C. § 1030 (2008) .......................................................................................................... xi, xii
18 U.S.C. § 1030(a)(2)(c) (2008).............................................................................1, 33, 35, 36, 42
18 U.S.C. § 1030(a)(4) (2008) .......................................................................................1, 36, 42, 46
18 U.S.C. § 1030(e)(8) (2008) ...................................................................................................1, 39
18 U.S.C. § 1503 (2011) ................................................................................................................15
18 U.S.C. § 1505 (2011) ................................................................................................................16
18 U.S.C. § 1512 (2008) ........................................................................................................ passim
18 U.S.C. § 1512(b)(3) (2008) ............................................................................................... passim
18 U.S.C. § 1519 (2002) ........................................................................................................ passim
H.R. Rep. No. 98-894 (1984), reprinted in 1984 U.S.C.C.A.N. 3689 ....................................40, 44
Pub. L. No. 97-291, § 1, 96 Stat. 1248 (1982) ...............................................................................19
Pub. L. No. 107-204, 116 Stat. 745 (2002) ..............................................................................24, 25
S. Rep. No. 99-432 (1986), reprinted in 1986 U.S.C.C.A.N. 2479 ...............................................40
S. Rep. No. 107-146 (2002) .....................................................................................................25, 26
ix
Secondary Authorities
Orin S. Kerr, Cybercrime's Cope: Interpreting "Access" and "Authorization" in Computer
Misuse Statutes, 78 N.Y.U. L. Rev. 1596 (2003) .................................................................. passim
Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 Minn. L. Rev.
1561 (2010) ........................................................................................................................47, 50, 51
Patricia L. Bellia, Defending Cyberproperty, 79 N.Y.U. L. Rev. 2164 (2004) .............................48
Patrizia Frei et al., Use of Mobile Phones and Risk of Brain Tumors: Update of Danish Cohort
Study, BMJ.com (Oct. 2011), http://www.bmj.com/content/343/bmj.d6387. ...............................24
x
QUESTIONS PRESENTED
1. Whether liability for obstruction of justice attaches to statements made to a non-federal
investigator in the absence of a federal investigation or the modification of a press release in
response to an announced Congressional investigation, pursuant to 18 U.S.C. §§ 1512, 1519 and
the Constitution of the United States.
2. Under federal law, criminal computer hacking is the act of accessing a computer without
any permission or the act of accessing private information on a computer that a person is not
entitled to access. Peter McClain, while Teletronix's Vice President charged with managing the
company's entire network infrastructure, used his work computer to access and download
personal files and to participate in an online social experiment. Did Mr. McClain commit
computer hacking?
xi
STIPULATIONS
1. The parties have agreed that the jurisdiction and venue are proper in the United States
District Court for the Southern District of New York and the United States Court of
Appeals for the Second Circuit.
2. The DOI Assistant Commissioner acts on behalf of the Commissioner, having been
delegated his full investigative authority.
3. The jury instructions track the language found in the indictment counts and lower court
opinion.
4. Sun News Network is a cable television station located in Toronto, Canada.
5. Congress and the FCC maintain jurisdiction over all matters concerning mobile telephony
in this case.
xii
CONSTITUTIONAL AND STATUTORY PROVISIONS INVOLVED
The Free Speech Clause of the First Amendment of the United States Constitution
provides in pertinent part, "Congress shall make no law . . . abridging the freedom of speech."
U.S. Const. amend. I.
The Due Process Clause of the Fifth Amendment of the United States Constitution
provides in pertinent part, "No person shall . . . be deprived of life, liberty, or property, without
due process of law." U.S. Const. amend V.
18 U.S.C. § 1519 (2002) provides in pertinent part:
Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false
entry in any record, document, or tangible object with the intent to impede, obstruct, or influence
the investigation or proper administration of any matter within the jurisdiction of any department
or agency of the United States . . . or in relation to or contemplation of any such matter . . . shall be
fined under this title, imprisoned not more than 20 year, or both.
18 U.S.C. § 1512 (2008) provides in pertinent part:
Whoever knowingly uses intimidation, threatens, or corruptly persuades another person, or
attempts to do so, or engages in misleading conduct toward another person, with intent to . . .
hinder, delay, or prevent the communication to a law enforcement officer or judge of the United
States of information relating to the commission or possible commission of a Federal offense or a
violation of conditions of probation supervised release, parole, or release pending judicial
proceedings; shall be fined under this title or imprisoned not more than 20 years, or both.
The Computer Fraud and Abuse Act provides in pertinent part:
(a) Whoever--
. . .
(2) intentionally accesses a computer without authorization or exceeds authorized
access, and thereby obtains--
. . .
(C) information from any protected computer;
. . .
(4) knowingly and with intent to defraud, accesses a protected computer without
authorization, or exceeds authorized access, and by means of such conduct furthers the
intended fraud and obtains anything of value, unless the object of the fraud and the thing
obtained consists only of the use of the computer and the value of such use is not more
than $5,000 in any 1-year period;
. . .
(c) The punishment for an offense under subsection (a) or (b) of this section is--
. . .
[2](B) a fine under this title or imprisonment for not more than 5 years, or both, in the
case of an offense under subsection (a)(2), or an attempt to commit an offense punishable
under this subparagraph, if--
. . .
xiii
(ii) the offense was committed in furtherance of any criminal or tortious act in
violation of the Constitution or laws of the United States or of any State;
. . .
(3)(A) a fine under this title or imprisonment for not more than five years, or both, in the
case of an offense under subsection (a)(4) or (a)(7) of this section which does not occur
after a conviction for another offense under this section, or an attempt to commit an
offense punishable under this subparagraph;
. . .
(e) As used in this section--
(1) the term "computer" means an electronic, magnetic, optical, electrochemical, or other
high speed data processing device performing logical, arithmetic, or storage functions,
and includes any data storage facility or communications facility directly related to or
operating in conjunction with such device, but such term does not include an automated
typewriter or typesetter, a portable hand held calculator, or other similar device;
(2) the term "protected computer" means a computer--
. . .
(B) which is used in or affecting interstate or foreign commerce or
communication, including a computer located outside the United States that is
used in a manner that affects interstate or foreign commerce or communication
of the United States;
. . .
(6) the term "exceeds authorized access" means to access a computer with authorization
and to use such access to obtain or alter information in the computer that the accesser is
not entitled so to obtain or alter;
18 U.S.C. § 1030 (2008).
1
STATEMENT OF THE CASE
1. On August 1, 2011, Peter McClain was convicted on two counts of obstruction of justice
pursuant to 18 U.S.C. §§ 1512 and 1519 in the U.S. District Court for the Southern
District of New York. Although Mr. McClain was also convicted of violating 18 U.S.C.
§ 1030(a)(2)(c) and § 1030(a)(4) of the Computer Fraud and Abuse Act ("CFAA"), he
was acquitted on a separate count of computer hacking.
2. Following his trial, Mr. McClain renewed motions for judgments of acquittal and/or a
new trial pursuant to Fed. R. Crim. P. 29 and 33. Mr. McClain asserted that his
convictions under the federal obstruction of justice laws violated his due process rights
under the U.S. Constitution because they did not give him adequate notice that his
conduct was subject to criminal punishment. Additionally, Mr. McClain asserted that the
Government lacked the power to charge him under the federal obstruction of justice
statutes because there was no sufficient "nexus" linking his conduct to a federal
investigation or proceeding. Mr. McClain also argued that his convictions of violating
the CFAA were invalid because he was not "without authorization" and did not "exceed
authorization" within the meaning of the statute. Finally, Mr. McClain argued that the
CFAA is also unconstitutionally vague.
3. The district court rejected these arguments and denied Mr. McClain's motions on August
2, 2011. The court held that "[n]othing about [18 U.S.C. § 1519] is . . . vague" and that
the drafters of the Act intended it to "apply broadly to document destruction cases." The
court also concluded that Mr. McClain's obstruction of justice convictions could be
sustained because, "at the very least," he "falsified a document in relation to a matter
within federal jurisdiction." The district court also ruled that because Mr. McClain did
not have contractual permission to download a cell phone prototype from his employer
and "reaped personal benefit from others" in using a Starbucks card "without
authorization," he could be held liable for criminal conduct under the CFAA. Finally, the
court held that the CFAA's mens rea requirement was sufficient to protect against
unconstitutionally vague applications of the statute.
4. On August 3, 2011, Mr. McClain provided notice of his intention to appeal the district
court's final order to the Second Circuit pursuant to Fed. R. App. P. 4(b). Mr. McClain
also provided notice of his retention of new counsel.
5. This Court ordered that Mr. McClain's case be scheduled for oral argument so that the
Circuit "may revisit its ruling in Gray and construe the Computer Fraud and Abuse Act as
applied to this case." Briefs were ordered to be submitted by November 3, 2011.
2
STATEMENT OF FACTS
Peter Ian McClain served loyally as the Vice President and Chief of Information
Technology at Teletronix Cellular Corporation ("Teletronix") for eight years, from June 2003
until his sudden termination on June 25, 2011. R-22, 40. In that capacity, he oversaw the IT
department, managed the company's entire network infrastructure, and supervised all IT
personnel. R-19.
Lisa Laing, CEO of Teletronix, described Mr. McClain as an eager, "go-to guy" within
Teletronix who was willing to do "whatever he could to help the company succeed." Id.
Mr. McClain had no engineering expertise and was not at all involved in Teletronix's cell
phone design or production. R-19. But Mr. McClain did have a pipedream of being a cell phone
inventor, and in his free time, he produced notes and doodles of some of his fanciful cell phone
ideas. R-19, 33.
Although Mr. McClain also did not work in Teletronix's research and development
division, he did have a particularly keen interest in speculation about the carcinogenic effects of
cell phone use. R-19, 32.
As an IT specialist, Mr. McClain became interested in April 2011 in a mobile phone-
based social experiment known as Jonathan's Card. R-12. The experiment allowed Starbucks
consumers to share a common account with which participants could withdraw and deposit
money at will—all for the buying of Starbucks coffee. R-10, 38. Jonathan's Card was the virtual
equivalent of a "take penny, leave a penny" tray. Participants could use the virtual account to
"get a coffee" with the expectation—but no requirement—that they would later deposit money
into the account in order to "give a coffee" to others. Id. In that regard, Jonathan's Card was an
experiment in social altruism.
3
Mr. McClain wished to expose what he saw as a technological and moral flaw in the
experiment. R-12, 34. In particular, he wanted his fellow experiment participants to consider
whether they should be channeling their collective altruism—assuming its existence—and
donating their money to "something more important than coffee." Id. Using his work computer,
Mr. McClain exploited a technological weakness in the Jonathan's Card design that allowed him
to withdraw $4,200 from the communal pot. Id. He then placed these funds on Starbucks gift
cards and auctioned the gift cards on eBay with the expectation that he would donate the
proceeds to charity. Id. The gift cards sold on eBay for $5,400, suggesting that purchasers
"overbid" on the gift cards because the money was going to charity. Id. Mr. McClain's aim was
to donate the $5,400 to "a worthy cause." Id. Thus, the $4,200 that consumers placed in the
Jonathan's Card account in order to buy coffee for other consumers could become a $5,400
donation to charity. In this way, Mr. McClain highlighted what he saw as the moral "opportunity
cost" involved in Jonathan's Card. Id. No security systems were cracked in the process. R-38.
June 2011 proved to be a hectic and tumultuous month for Mr. McClain and for
Teletronix. On June 7, 2011, unknown computer hackers launched a significant cyber attack on
New York City's computer network that affected the city's library and subway systems for two
hours. R-11, 26. Sal Palukas, a New York City investigator, traced the attack to internet
protocol ("IP") addresses at Teletronix, raising the possibility that a Teletronix device was used
as a "zombie computer" in the attack. R-26. (A zombie computer is one whose owner is
unaware that it is being used for cyber attacks.) Id. On June 8, Officer Palukas contacted Ms.
Laing to enlist Teletronix's help with the investigation. R-13, 27.
Ms. Laing waited nine days before discussing the matter with Mr. McClain, even though
Mr. McClain oversaw all IT operations. R-22. Ms. Laing and Mr. McClain met on June 17 to
4
discuss the matter. R-22. Ms. Laing then left Mr. McClain a note: "Pete-- As usual, THANK
YOU. Please get to the bottom of this—do what you have to do to salvage the situation." R-43.
Mr. McClain e-mailed Officer Palukas to assure him that no Teletronix employee instigated the
cyber attack. R-32, 49. Officer Palukas' inquiries at Teletronix ultimately revealed no leads
about the attack. See R-29, 30.
Teletronix was also busy that same month responding to news of a potential
Congressional investigation into the link between cell phone use and cancer. R-13. A study at
that time by the World Health Organization ("WHO") classified "radiofrequency electromagnetic
fields as possibly carcincogenic to humans." R-41. WHO did not indicate that Teletronix
phones were part of the study. Id. Then, on June 13, Senators Redgrove and Meyer held a press
conference to announce their intent to investigate the cell phone industry. R-13.
Ms. Laing and Mr. McClain discussed the WHO study in their June 17 conversation. On
June 19, Mr. McClain, hoping to assuage consumer fears about mobile phone safety and mindful
of Ms. Laing's instruction to "do what you can to salvage the situation," modified a Teletronix
press release about the New York City cyber attack; he added a paragraph, which in part said:
"We stand out from the pack, and it's precisely because the use of our cell phones carries
absolutely zero risk of causing cancer, now or at any point in the future." R-22, 44. In Ms.
Laing's view, this amounted only to "slightly different verbiage" than Teletronix had intended.
R-22. She viewed Mr. McClain's edits as an attempt "to do something to help [Teletronix]." Id.
At the time Mr. McClain edited the press release, he believed that Teletronix's "cellphones
carried no risk of causing cancer" and that cell phones, in general, "really just might have zero
risk of causing cancer." R-32, 35.
5
On June 25, Ms. Laing unexpectedly terminated Mr. McClain's employment after his
eight years of service at Teletronix. R-15, 22. She told him, "[T]hings are just too weird to keep
you here." R-22. But she suggested to Mr. McClain that he was still a valued Teletronix
employee and that his termination was only a temporary one. Id. Ms. Laing told Mr. McClain
that he was only being let go "for now" and "until things blow over." Id. She issued Mr.
McClain no formal notice of termination, telling him, "Feel free to take your time and grab your
stuff." R-24.
As noted above, Mr. McClain was not in any way involved in Teletronix's cell phone
design or production, but he was a dilettante inventor and did occasionally produce notes and
doodles of ideas for cell phones. R-19. One week prior to his termination, Mr. McClain used his
work computer for personal use: he accessed and downloaded personal files relating to some of
his fanciful invention ideas. R-23, 33. Then, Mr. McClain, immediately after being terminated,
e-mailed these personal files to non-work e-mail accounts, presumably so that he could retain
copies of his doodles after he left Teletronix. Id.
Exhibit A is representative of the contents of these files. It is a doodle of a faceless head
with a ring around the forehead, attached to a trapezoidal shape near the ear. See R-39. It
appears to be an extremely crude rendition of a cell phone headset. Id. Ms. Laing knew Mr.
McClain had absolutely no engineering background, and she understandably never once referred
to this doodle as an actual invention. R-19, 23.
6
SUMMARY OF THE ARGUMENT
Part One: Mr. McClain's Wrongful Convictions Under the Federal Obstruction of Justice
Laws
Peter McClain's conviction under 18 U.S.C. § 1512(b)(3) for statements made to a local
New York City law enforcement officer is not sufficiently supported by the evidence in the
record. The Government has failed to establish the requisite "federal nexus" to place Mr.
McClain's e-mail to Officer Palukas within the scope of conduct prohibited by § 1512(b)(3), and
his prosecution contravenes the congressional intent and case law surrounding a statute that was
written to protect victims, witnesses, and informants in federal cases. The Government's use of
§1512(b)(3) to prosecute Mr. McClain for purely local conduct stretches the statute beyond what
the Constitution allows, and it eviscerates well established limits on the federal government's
power to reach intrastate conduct.
The evidence in the record is also legally insufficient to prove that Mr. McClain's
modification of the Teletronix press release was a violation of 18 U.S.C. § 1519. The
Government's use of § 1519 against Mr. McClain in this case is an unconstitutionally overbroad
application of the statute; one that circumscribed Mr. McClain's protected speech under the First
Amendment and failed to provide fair notice that his conduct was forbidden.
Part Two: Mr. McClain Did Not Commit Computer Hacking When He Used His Work
Computer For Personal Use.
The Court should acquit Mr. McClain of both counts of violating the CFAA because
employees who use their work computers for personal reasons do not commit computer hacking.
The touchstone of this case is the meaning of unauthorized access as used in the CFAA. The
Court essentially has two options: it can remain faithful to the statute's plain meaning, underlying
rationale, and legislative history by adopting a reading of authorization in which computer users
commit computer hacking when they circumvent code-based restrictions on their access
7
privileges. Alternatively, the Court can adopt an interpretation of the CFAA that posits that
users access computers without authorization when they have permission to use the computer but
breach contract-imposed access restrictions. This latter view makes criminals of the millions of
American employees who briefly use their work computers for personal reasons contrary to their
employers' wishes. The contract-based view of authorization is unwarranted because it converts
the CFAA into an instrument of arbitrary enforcement, but even if legitimate, this interpretation
would not support the convictions in this case.
Acquittal on Count Four is necessary because the government offers no evidence that Mr.
McClain accessed Starbucks' computers in any way. Finding for the government would require
the Court to accept a vacuous reading of the statute, in which "access" means any link between
two computers, however remote. This case presents the Court with an opportunity to reject a
statutory interpretation that draws virtually all computer activity into the purview of the CFAA.
Were the Court to adopt the interpretation of the CFAA that the government urges, it
would render the statute unconstitutionally vague. The expansive view of unauthorized access—
in which an employee violates the statute for checking the weather at work—fails to provide
adequate notice of what conduct is prohibited. It also invites arbitrary and discriminatory
enforcement by eliminating any minimal guidelines to curtail prosecutorial discretion. The
Court of Appeals should seize the opportunity to save the constitutionality of the CFAA by
adopting a view of unauthorized access that provides adequate notice to computer users and
minimal guidelines to law enforcement.
8
ARGUMENT
I. MR. MCCLAIN'S CONVICTIONS UNDER THE FEDERAL OBSTRUCTION OF
JUSTICE LAWS ARE NOT SUPPORTED BY THE EVIDENCE, CONTRAVENE
THE PURPOSE OF THE STATUTES, AND VIOLATE THE U.S.
CONSTITUTION.
A. Mr. McClain Is Not Guilty Of Federal "Witness Tampering" Under 18 U.S.C. §
1512(b)(3).
Peter McClain's conviction under § 1512(b)(3) is not sufficiently supported by the
evidence in the record, most of which consists of hearsay, opinion testimony, and electronic files
collected by a New York City resident and e-mailed to a local law enforcement officer.1 This
evidence fails to establish the requisite "federal nexus" to place appellant's e-mail within the
scope of conduct prohibited by § 1512(b)(3). Mr. McClain's conviction violates fundamental
tenets of federalism and due process, contravening the legislative intent and case law
surrounding a statute written to protect victims, witnesses, and informants in federal cases.
1. The Evidence Is Insufficient To Establish A Violation Of Subsection (b)(3).
The Government alleges that Mr. McClain "did knowingly corruptly persuade, or
engaged in misleading conduct toward the [New York City] Assistant Commissioner of the
Department of Investigations ("DOI"), with intent to hinder, delay or prevent the communication
to a law enforcement officer or judge of the United States of information relating to the
commission or possible commission of a Federal offense" in violation of § 1512(b)(3). R-16.2
Mr. McClain is accused of affiliating with "Anonymous" ("a group of individuals bound by
shared social and political goals" that engages in hacking attacks against businesses and
1 Mr. McClain’s trial counsel did not object to the admission of this testimony or the third-party electronic evidence
introduced at trial. He has retained new counsel on appeal. 2 18 U.S.C. § 1512 (b)(3) (pertaining to "Tampering With a Victim, Witness or Informant") provides:
"Whoever knowingly uses intimidation, threatens, or corruptly persuades another person, or attempts to do so, or
engages in misleading conduct toward another person, with intent to . . . hinder, delay, or prevent the
communication to a law enforcement officer or judge of the United States of information relating to the commission
or possible commission of a Federal offense or a violation of conditions of probation supervised release, parole, or
release pending judicial proceedings; shall be fined under this title or imprisoned not more than 20 years, or both."
9
governments) and lying about this affiliation to Officer Sal Palukas, Assistant Commissioner of
New York's DOI. R-10, 16.
Following the jury verdict, Mr. McClain motioned for a judgment of acquittal pursuant to
Federal Rule of Criminal Procedure 29. R-56. The standard of review for a denial of a Rule 29
motion is de novo. United States v. Jackson, 335 F.3d 170, 180 (2d Cir. 2003). Mr. McClain's
conviction should be upheld if "any rational trier of fact could have found the essential elements
of the crime beyond a reasonable doubt." Jackson v. Virginia, 443 U.S. 307, 319 (1979). If the
Government has failed to prove even one essential element beyond a reasonable doubt, the Court
must reverse Mr. McClain's conviction. United States v. Pierce, 224 F.3d 158, 167-68 (2d Cir.
2000). As noted by the district court judge in his Rule 29 decision, "[p]rosecutors seemed to
have insufficient evidence to link the defendant to the Anonymous attacks. . . ." R-57. Thus, the
sole basis for Mr. McClain's § 1512(b)(3) conviction was his allegedly "knowingly" misleading
conduct concerning the purported "link" that he or Teletronix had to Anonymous. R-57 to -58.
Viewed in the light most favorable to the Government, the evidence does not prove
beyond a reasonable doubt that Mr. McClain: (1) acted with the specific intent to impede
communications with a federal law enforcement officer about the possible commission of a
federal offense, or (2) "knowingly" engaged in (3) "misleading conduct" toward Officer Palukas
about his alleged affiliation with Anonymous. See United States v. Genao, 343 F.3d 578, 586
(2d Cir. 2003) (defendant must specifically intend to "interfere with the communication of
information" relating to the commission or possible commission of a federal offense in order to
be convicted of violating § 1512(b)(3)); United States v. Quattrone, 441 F.3d 153, 176 (2d Cir.
2006) (Section 1512(b) requires proof of a mental state that is "knowingly corrupt with respect
10
to the action taken . . . . [T]he conduct to be punished . . . must not only be made with wrongful
intent but also with a 'consciousness' that the conduct in question is wrongful.").
At Mr. McClain's trial, the CEO of Teletronix, Lisa Laing, testified that she informed Mr.
McClain of the city’s DOI investigation into hacking allegations and "told him that we needed to
get to the bottom of this." R-22. (As the Chief of Information Technology at Teltronix, Mr.
McClain oversaw the company's entire network infrastructure. R-18.) She also wrote him a note
asking him to cooperate with the DOI, R-43, and testified that "about an hour" after their
meeting, she overheard him say "something" by the coffee machine: "This could get bigger –
we're talking bigger than New York City." Mr. McClain allegedly stated, "[h]ave to nip it in the
bud now." R-22. Ms. Laing provided absolutely no context for Mr. McClain's statement, and
she did not know whom he was talking to or what type of question he may have been answering,
let alone the general topic of conversation at the coffee machine. R-22. This testimony offers
scant support for specific intent, and no other evidence shows that these statements attributed to
Mr. McClain were related to the DOI investigation.
Two days after he received Ms. Laing's note asking him to "get to the bottom" of the
hacking allegations, Mr. McClain sent Officer Palukas an e-mail in which he stated: "I can assure
you that no employee of Teletronix, Inc. has interfered with the electronic infrastructure of the
great City of New York, nor maintained any kind of relationship with Anonymous or its
affiliates." R-14. The Government asserts that this e-mail amounted to a federal crime.
Unlike United States v. Hertular, 562 F.3d 433, 439 (2d Cir. 2009), in which the
defendant "knew . . .that information was regularly being communicated by confidential
informants to DEA agents," here there is no evidence indicating that Mr. McClain even
considered that the DOI was cooperating with federal law enforcement officers. The
11
Anonymous attack was directed exclusively at New York City, and Mr. McClain never
implicitly or explicitly expressed a desire to prevent Officer Palukas from communicating with
federal law enforcement. R-11. Cf. United States v. Romero, 54 F.3d 56, 59 (2d Cir. 1995)
(evidence that the defendant "had become suspicious that [victim] was cooperating with federal
authorities" sufficient to support conviction under § 1512). Mr. McClain never even considered
that the underlying crimes being investigated were federal in nature, and there is no evidence
showing he actually discovered that Teletronix's IP addresses were used in the cyber attacks.
Officer Palukas did not speak with federal law enforcement until after he spoke with Mr.
McClain. R-29. Thus, even assuming arguendo that Mr. McClain's e-mail was a lie, Lisa
Laing's eavesdropping at the office coffee machine and Officer Palukas' "suspicions" that Mr.
McClain was "someone bad" do not establish that the e-mail was intended to prevent Officer
Palukas from communicating with an arm of the federal government. R-22, 27, 29. The
Government also never identified the underlying "possible federal offense" about which Mr.
McClain was alleged to have been untruthful, nor did it demonstrate that he had uncovered a link
between Teletronix and the Anonymous assault at the time he contacted Officer Palukas.
In addition to its failure to prove specific intent, the Government did not prove that Mr.
McClain "misled" Officer Palukas about the "possible commission of a federal offense" because
the Government never demonstrated that Mr. McClain was actually affiliated with Anonymous.
To show Mr. McClain's alleged affiliation, the prosecution introduced a screenshot of Mr.
McClain's computer in which the screen name "cellacious" converses with "AnonOps" (allegedly
the username for Anonymous). R-47. Ms. Laing testified that she discovered the screenshot
"that [appellant] e-mailed to himself, and tried to delete from our servers" in the course of her
own personal investigation after she fired Mr. McClain. R-23. She offered no explanation as to
12
how or why she knew that appellant e-mailed the shot to himself or "tried to delete it from
[Teletronix's] servers." R-23. She then forwarded this screen shot to Officer Palukas. R-23.
Professor Simon Li, a computer science expert retained by the NYC Department of
Investigations to help identify the origin of the cyber attacks, also testified that he "recognized"
the screen shot provided by Ms. Laing as a "gathering space" of Anonymous and managed to
track the user handle "cellacious" to Peter McClain. R-38.
Given that Professor Li and Officer Palukas both admitted that the screenshot could have
been created by a "zombie computer," this evidence does not establish McClain's affiliation with
Anonymous beyond a reasonable doubt.3 Officer Palukas stated that even though the DOI had
traced the hacking traffic to computers at Teletronix, "it didn't necessarily mean anyone at
Teletronix was at the controls here. It could have easily meant that there was a so-called zombie
computer being used to instigate it:"
Q: Is that what you concluded here, that this was in fact a zombie computer?
A: No. We would have no way of knowing whether the person was the victim of a script installed onto the
computer – which would make it into a zombie computer – or whether the computer owner was
consciously involved in the attack.
R-27.
Compounding the doubt as to Mr. McClain's guilt, Professor Li testified that because "the
people or entities involved did an awfully good job covering their tracks," he was not even
certain that Anonymous was responsible for the attacks. R-37. Professor Li stated that even
though two-thirds of the IP addresses involved in the cyber attack came from Teletronix servers,
this didn't signify "much" because Anonymous (like many hacking organizations) "turns to
zombie computers on a regular basis to pursue its illegal activities." R-37. The record contains
no additional evidence (e.g., surveillance footage, password login information, keycard swipes,
3 A “zombie computer” is a computer whose owner does not know it is being used to perpetrate hacking attacks. R-
36-37.
13
etc.) indicating that Mr. McClain was physically at his computer or in his office at the time of the
Anonymous attacks or at the unknown time that the exchange between "Cellacious" and
"AnonOps" took place. See R-9 to -17.
Given these undisputed facts about the screenshot, no rational juror could have concluded
that Mr. McClain was actually affiliated with Anonymous. Indeed, according to the
Government's own evidence, it is not even clear which specific hacking organization was
responsible for the cyber attack on New York City or the invasion of Teletronix's servers. See,
e.g., R-37. Accordingly, no rational juror could have concluded that Mr. McClain engaged in
"misleading" conduct by stating that neither he nor anyone at the company "interfered with the
electronic infrastructure," of New York nor "maintained any kind of relationship with
Anonymous or its affiliates." R-37.
Even if Mr. McClain owned the username "cellacious," as the Government alleges, the
substance of the screenshot itself does not indicate a "relationship" with Anonymous because
only one portion of the conversation is visible. R-47. Statements from “cellacious” such as "I'm
proud to be a part of this," are impossible to evaluate without knowing the content of the other
half of the exchange or the exact date/time that this conversation took place. Without context,
there is insufficient evidence to prove that Mr. McClain "consciously misled" Officer Palukas
about having "a relationship" with Anonymous or that Mr. McClain intended to mislead him
about a "possible federal offense." Even if Mr. McClain sympathized or communicated with
Anonymous (which is unsupported by the record), his denial of a "relationship" in the context of
an e-mail to a law enforcement officer investigating a cyber attack is not inherently misleading
based on this undated e-mail; having sympathy or expressing vocal support for a hacking
14
organization with various social and political goals is not in and of itself a crime, nor does it
necessarily amount to a "relationship." R-14. See Brandenberg v. Ohio, 395 U.S. 444 (1969).
2. Sending An E-Mail To A Local Law Enforcement Officer In The Absence Of A
Federal Investigation Does Not Establish A "Federal Nexus."
The evidence discussed above is insufficient to establish the federal nexus required to
subject Mr. McClain to a federal conviction. Without a federal nexus, the specific intent
requirement of § 1512(b)(3) is vitiated, and purely intrastate conduct is subject to federal
prosecution. This court reviews questions of statutory interpretation de novo. See Puello v.
Bureau of Citizenship and Immigration, 511 F.3d 324, 327 (2d Cir. 2007).
In the Supreme Court's only case to interpret the federal nexus requirement under §
1512(b), Arthur Andersen LLP v. United States, certiorari was granted based on a circuit conflict
interpreting the federal nexus required under the precise subsection that Mr. McClain is accused
of violating: § 1512(b)(3). Arthur Andersen LLP v. United States, 544 U.S. 696, 702 n.7.
(comparing United States v. Shotts, 145 F.3d 1289, 1301 (11th Cir. 1998) with United States v.
Farrell, 126 F.3d 484, 489-90 (3d Cir. 1997)). The Arthur Andersen majority repeatedly
referred to § 1512(b) in its entirety (and not a specific subsection therein, even though the
defendant was indicted under § 1512(b)(2)) and concluded that a defendant cannot obstruct
justice if "he does not have in contemplation any particular official proceeding in which [the
obstructed information] might be material." Arthur Andersen, 544 U.S. at 707. Despite the
provision in § 1512(f)(1) that a judicial proceeding "need not be pending or about to be
instituted," the Court rejected the Government's argument that a proceeding "need not even be
foreseen." Id. at 707-08. Writing for a unanimous court, Chief Justice Rehnquist concluded that
"restraint" in assessing the reach of § 1512(b) was particularly appropriate where "the act
underlying the conviction" is by itself innocuous. Id. at 703-04. Accordingly, a federal "nexus"
15
– a relationship in time, causation, or logic – to the federal proceedings was required because
"persuading a person with intent to cause that person to withhold testimony or documents from a
. . . Government official is not inherently malign." Immediately after this sentence in the
opinion, the Court inserted a footnote specifically referencing subsection (b)(3). Id. at n.8.
The Supreme Court also relied heavily on the legislative history of § 1512 in United
States v. Aguilar, where it held that a federal nexus must be present to establish a violation of 18
U.S.C § 1503.4 United States v. Aguilar, 515 U.S. 593, 597 (1995). The Aguilar court held that
false statements to an FBI agent who had not been asked to appear before a grand jury would not
have the "natural and probable effect" of interfering with the due administration of justice. Id.
The Court concluded: "We do not believe that uttering false statements to an investigating agent
– and that seems to be all that was proven here – who might or might not testify before a grand
jury is sufficient to make out a violation of the catchall provision of § 1503." Id.; see also United
States v. Schwarz, 283 F.3d 76, 108 (2d Cir. 2002) (false statements made to federal agents who
"might or might not" later testify before a grand jury insufficient to establish liability for
obstruction of justice under § 1512(c)(2)).
This Court, too, has specifically acknowledged that "Arthur Andersen makes clear that
Aguilar's nexus requirement applies to some degree to section § 1512(b)." United States v.
Quattrone, 441 F.3d 153, 176 (2d Cir. 2006). In fact, this court applied the Aguilar nexus to §
1512(b) when evaluating a sufficiency of the evidence challenge made by the defendant in
Quattrone. Quattrone, 441 F.3d at 176. The court held that "[S]ection 1512(b) requires proof of
a mental state that is 'knowingly . . . corrupt[ ]' with respect to the action taken. . . . The Supreme
4 18 U.S.C. § 1503(a) provides “Whoever corruptly, or by threats or force, or by any threatening letter or
communication, endeavors to influence, intimidate, or impede any grand or petit juror, or officer in or of any court
of the United States . . . or officer who may be serving at any examination or other proceeding before any United
States magistrate judge . . . or endeavors to influence, obstruct, or impede, the due administration of justice, shall be
punished as provided in subsection (b)."
16
Court has made clear that the conduct to be punished, then, must not only be made with wrongful
intent but also with a conscious[ness] that the conduct in question is wrongful." Id. The court
also went on to hold that the trial judge erred by wholly eliminating a federal "nexus" jury
instruction for a related obstruction of justice statute (18 U.S.C. § 1505):
When the [district] court finally explained to the jury how to apply the law to the facts, it
eviscerated the nexus requirement. It removed the defendant's specific knowledge of the
investigatory proceedings and the subpoenas/document requests from the obstruction equation. It
left a bare-bones strict liability crime. Given the court's instruction for the nexus determination,
all that need be proven was that an investigation had called for certain documents and that the
defendant had ordered the destruction of those documents. Although wrongful intent, corrupt
intent, and the nexus requirement were correctly defined, the charge, as a whole, relieved the jury
of having to make those findings in assessing criminal liability.
Quattrone, 441 F.3d at 179.
Thus, this Court has effectively concluded that §1512(b) has the same nexus established
by Aguilar and Arthur Andersen. To violate subsection (b)(3), Peter McClain must have been
"conscious of his wrongdoing" and intended to obstruct Officer Palukas' communication of
information to federal authorities about the commission or possible commission of a federal
offense. Similar to Arthur Andersen and Aguilar, here there is no evidence that Mr. McClain
knew of the federal nature of the offense into which Officer Palukas was inquiring, no evidence
that Mr. McClain anticipated that Officer Palukas would speak to federal authorities, and no
evidence that a federal investigation was underway at the time Mr. McClain sent his e-mail. See,
e.g., R-27, 28, 32-34. Even assuming Mr. McClain’s e-mail was false (which, again, is not
supported by sufficient evidence in the record), statements made to a local police officer, who
might or might not communicate with federal authorities, about an offense that may or may not
be federal, does not make out a violation of § 1512(b)(3). Cf. United States v. Reich, 479 F.3d
179, 186 (2d Cir. 2007) (effects of defendant's fake judicial order actionable under § 1512(c)(2)
because they were "closer in time, causation, and logic" to the federal proceeding and "more
natural and probable than those in Aguilar, Schwarz, or Quattrone").
17
A federal nexus requires not only proof of a "possible" federal offense but also
"additional appropriate evidence." United States v. Lopez, 372 F.3d 86, 92 (2d Cir. 2004), cert.
granted, judgment vacated on other grounds, 544 U.S. 902 (2005); United States v. Diaz, 176
F.3d 52, 91 (2d. Cir. 1999). In Lopez, the court listed several examples of "additional
appropriate evidence" that might satisfy the federal nexus requirement, including "actual
knowledge" of the federal nature of the offense or proof that "there was a[n] [ongoing] federal
investigation" at the time. See also United States v. Romero, 54 F.3d 56, 59 (2d Cir. 1995)
(evidence that the defendant "had become suspicious that [victim] was cooperating with federal
authorities" sufficient to establish a federal nexus under § 1512). Here, there is no such evidence.
Without "additional appropriate evidence" to establish a federal nexus, courts have
overturned a variety of convictions under the federal obstruction of justice laws. In Lopez, for
example, showing that a thwarted communication simply "related to" a federal offense was not
enough: "All the government proved was that conduct punishable under both state and federal
law was involved and that [the victim] was willing to communicate with local authorities."
Lopez, 372 F.3d at 92. In concluding that no reasonable juror could have found the defendant
guilty of violating § 1512, the court wrote:
The government provided no evidence . . . that a federal investigation was underway, that federal
authorities were in any way involved, that Lopez knew of the federal nature of his offense at the
time he murdered [the victim], or that [the victim] intended to communicate or anticipated
communicating with federal authorities . . . . It is always possible that [the victim] someday
"might" have turned to federal officials; but the range of things he "might" do is limitless, and no
evidence in the record connects this possibility with reality.
Id. at 92.
Finally, the Supreme Court's recent decision in Fowler v. United States offers additional
support for applying the Aguilar-Arthur Andersen nexus to subsection (b)(3). In Fowler the
Court refused to adopt a "mere possibility" standard under § 1512(a), which would impose
18
liability for communications made to "another person" that might reach federal authorities.
Fowler v. United States, 131 S. Ct. 2045, 2051-52 (2011). Fowler rejected the approach that had
been taken by several Courts of Appeals, including the Eleventh Circuit in a case that
specifically upheld a § 1512(b)(3) conviction under the "mere possibility" standard. United
States v. Veal, 153 F.3d 1233, 1250 (11th Cir. 1998). Because it is always "possible" that a
communication will be made with a federal officer, the Court held that adopting the
government's proposed "possibility" standard " under Veal would . . . weaken or eliminate the
independent force of the separate statutory requirement that the defendant, in killing the victim,
must intend to prevent communication with one who is a law enforcement officer or judge of the
United States." Fowler, 131 S. Ct. at 2051-52. In light of the "frequent overlap between state
and federal crimes, the use of a standard based on the word 'possible' would transform a federally
oriented statute into a statute that would deal with crimes, investigations, and witness tampering
that, as a practical matter, are purely state in nature." Id.5
The importance of introducing at least some evidence to show a federal nexus is
heightened by the fact that § 1512(b)(3) criminalizes conduct relating to the "possible
commission of a Federal offense." As set forth more thoroughly below, if the Government were
not required to identify a strong link to a federal investigation, the "possible" language in §
1512(b)(3) could be used to criminalize an unconstitutionally broad range of conduct. See Clark
5 Fowler held that the Government need show only a "reasonable likelihood" that a victim would communicate with
federal law enforcement in order to establish the requisite federal nexus. Fowler’s relatively weaker nexus
requirement (compared to that required by Arthur Andersen and Aguilar) is explained by the statutory differences
between § 1512(a) and § 1512(b), and the fact that, in Fowler, a witness was killed as the result of a "general"intent
to prevent him from communicating with any law enforcement officers. The Fowler court was not only required to
speculate about hypothetical communications that a murdered police officer might have made had he not been killed,
it also addressed a subsection that does not include the language "knowingly, " "corruptly persuade," or engage in
"misleading conduct." Id at 697. The Supreme Court’s only case to specifically address that language - Arthur
Andserson - held that § 1512(b) imposes a mens rea requirement that the defendant "have in contemplation" a
particular proceeding. Because the Fowler analysis dealt exclusively with a subsection that did not even include the
"knowingly" language of subsection (b)(3), the Court’s rejection of Veal’s "mere possibility" standard shows all the
more conclusively why § 1512(b)(3) requires the Arthur Andersen-Aguilar nexus.
19
v. Martinez, 543 U.S. 371, 380-81 (2005) (where two plausible statutory constructions are
available, and if one construction would raise a multitude of constitutional problems, then the
other construction should prevail). Given that Arthur Andersen is the Supreme Court's most
recent decision specifically addressing subsection (b) of § 1512, the Court granted certiorari
based on a conflict involving § 1512(b)(3), the Court repeatedly referenced the entire subsection
in its decision, and footnote 8 in the opinion specifically mentioned subsection (b)(3), the Arthur
Andersen-Aguilar nexus applies, and the Government has not offered sufficient evidence to
establish it in the case at bar.
3. The Government's Use Of Subsection (b)(3) Against Mr. McClain Contravenes
The Purpose Of The Statute And Violates The U.S. Constitution.
Section 1512(b) was written to protect individuals who have witnessed or possess
information regarding a possible federal crime from threats or coercion that would make them
less likely to communicate with federal law enforcement officers. As indicated by the
unambiguous prohibition on hindering, delaying, or preventing "another person" from
communicating with federal law enforcement officers, subsection (b)(3) applies to people who
already possess information about a crime or possible crime. Witnesses who possess no
information about a possible federal crime cannot be "hindered, delayed, or prevented" from
communicating an absence of information to the federal government.
Here, it was precisely because Officer Palukas lacked – but was in pursuit of –
information that he contacted Mr. McClain. R-28. He did not offer Mr. McClain any
information about his investigation, nor did he suggest that he was planning on speaking with
federal authorities. Id. Mr. McClain is not alleged to have "tampered" with Officer Palukas
because Officer Palukas possessed knowledge about the hacking incident (as contemplated by
the statute), but as a result of the officer’s inquiries about the cyber attack on New York City.
20
Given that Congress intended to protect individuals with "knowledge about the commission of a
crime," local investigators who have no knowledge, but are searching for information, are not
logical or intended victims of § 1512(b)(3). See Pub. L. No. 97-291, § 1, 96 Stat. 1248 (1982).
Holding that local residents, law enforcement officers, or state auditors seeking
information are part of the group subject to protection under § 1512(b)(3) would mean that even
people who have no information whatsoever about a federal crime are "witnesses" under federal
law.6 Congress never intended this result, and such an interpretation would raise serious
constitutional concerns regarding the criminalization of a broad range of intrastate activity, as
well as the ambiguous application of a law covering "possible" future federal crimes. See United
States v. Aguilar, 515 U.S. 593 (1995) ("We have traditionally exercised restraint in assessing
the reach of a federal criminal statute, both out of deference to the prerogatives of Congress, and
out of concern that 'a fair warning should be given to the world in language that the common
world will understand, of what the law intends to do if a certain line is passed.").
The Supreme Court has warned against this type of expansive federal jurisdiction. See,
e.g., United States v. Morrison, 529 U.S. 598 (2000) (Federal nexus under the Violence Against
Women Act was too tenuous to "substantially affect" interstate commerce and failed to draw a
"distinction between what is truly national and what is truly local."). Congress "has no general
right to punish murder committed within any of the states, and . . . it is clear . . . that Congress
cannot punish felonies generally." Id. at 618. Here, the Government has used § 1512(b)(3) to
federally criminalize statements made by a New York City resident to a New York City
6 For example, under the Government’s proposed interpretation of § 1512(b)(3), a farmer who lied to a member of
the Arizona "Minutemen" (a group of citizens who patrol the U.S. border in search of illegal immigrants) about
employing undocumented workers would be guilty of federal witness tampering. Under the Government’s proposed
interpretation, the minuteman who asked the question would be a "witness" within the meaning of § 1512(b)(3)—
even if he had absolutely no knowledge, information, or reason to believe the farmer was employing illegal
immigrants. Under the Government’s view, § 1512(b)(3) liability would attach even if no federal investigation was
ever initiated because of the statute’s "commission or possible commission of" language.
21
investigator, despite the fact that Mr. McClain had no knowledge or notice that his statements
would be transmitted to federal authorities, there was no ongoing federal investigation, the
Government never introduced evidence that to identify an underlying federal hacking offense,
and the federal investigation did not begin until after Mr. McClain spoke to Officer Palukas.
This use of § 1512(b)(3) has obliterated the lines of jurisdiction between federal and state
law enforcement. Under the Government's interpretation, every crime, no matter how local, has
the potential to trigger an application of federal law vis-à-vis the transference of information to
federal law enforcement officers. (In Mr. McClain's case, the Government never even
introduced evidence of a possible underlying federal offense.) This reading of the statute is
unconstitutional: Local police matters are specifically reserved to the states, federal courts do
not have "general jurisdiction," and any constitutional doubts regarding the federal nature of a
crime are supposed to be resolved against federal jurisdiction and in favor of the criminal
defendant. Raygor v. Regents, 534 U.S. 533 (2002).
In addition, Mr. McClain did not have constitutionally adequate notice that his e-mail to
Officer Palukas could conceivably result in a federal crime. "When the challenge is vagueness
'as-applied', there is a two-part test: [1] a court must first determine whether the statute gives the
person of ordinary intelligence a reasonable opportunity to know what is prohibited and [2] then
consider whether the law provides explicit standards for those who apply it." United States v.
Nadi, 996 F.2d 548, 550 (2d Cir.1993).
The Government's use of § 1512(b)(3) here fails both prongs. The statute proscribes
misleading "another person" with the intent to hinder communication of information "relating to
the commission or possible commission of a Federal offense." Given the failure to identify an
underlying federal offense in this case, the Government has attempted to expand the statute to
22
include possible investigations of federal offenses. In doing so, the Government is making an ad
hoc attempt to criminalize conduct beyond the plain language of the statute. United States v.
Handakas, 286 F.3d 92, 110 (2d Cir. 2002) ("[C]ourts may not assume the place of Congress by
writing or rewriting criminal laws pursuant to which citizens will be prosecuted. This is solely
the prerogative of Congress."), overruled on other grounds by United States v. Rybicki, 354 F.3d
124 (2d Cir. 2003).
In this case, enforcing officers could not charge anyone with an underlying "federal
offense" because it was impossible to prove that Anonymous had committed the attacks. The
Government used the word "possible" in subsection (b)(3) to expand the scope of the statute to
include "misleading conduct" about federal offenses that (1) were never charged; (2) were not
being investigated at the time the communication was made; and (3) were never conclusively
linked to a specific individual or criminal organization. The absence of explicit standards to
guide the Government's use of § 1512(b)(3) in this case – in addition to the Government's
inability to successfully charge Mr. McClain (or apparently anyone) with the cyber attacks
against New York City – led directly to Mr. McClain's arbitrary and unconstitutional
prosecution.
In light of the plain language, congressional intent, and foregoing jurisprudence
surrounding the obstruction of justice laws, this court should vacate Mr. McClain's conviction
under § 1512(b)(3).
B. Conduct Prohibited By 18 U.S.C. § 1519 Does Not Extend To Mr. McClain's
Modification Of The Teletronix Press Release.
The evidence in the record is insufficient to prove that Peter McClain's modification of a
Teletronix press release was a violation of 18 U.S.C. § 1519. The Government has again failed
to establish the requisite federal nexus to make Mr. McClain's conduct punishable under the laws
23
of the United States, and the use of § 1519 against Mr. McClain is an unconstitutionally vague
and overbroad application of the statute—one that circumscribed Mr. McClain's protected speech
under the First Amendment, failed to provide "fair notice that his contemplated conduct [was]
forbidden," and has the potential to reach purely intrastate activities. See United States v. Lopez,
514 U.S. 549, 561 (1995).
1. There Is Insufficient Evidence To Demonstrate That Mr. McClain "Knowingly"
Falsified The Teletronix Press Release Or "Intended" To "Impede, Obstruct Or
Influence" A Congressional Investigation.
The Government's evidence against Mr. McClain is insufficient to establish that he is
guilty of violating § 1519. The Government failed to prove beyond a reasonable doubt that the
substance of Mr. McClain's modification of the Teletronix press release was false or, even if it
was, that Mr. McClain made the modification with the knowledge of its falsity. The Government
also failed to prove that Mr. McClain altered the press release with the intent to impede a
"matter" before Congress or the FCC. Cf. United States v. Gray, 642 F. 3d 371 (2d. Cir. 2011).
The Government alleges that Mr. McClain intentionally "falsified documents" by writing:
"it's precisely because the use of any of our cell phone carries absolutely zero risk of causing
cancer, now or at any point into the future." R-14. By making these editorial revisions to the
Teletronix press release, the Government asserts that Mr. McClain "knowingly . . . altered and
made a false entry" to a document with the intent to obstruct a "matter" before Congress and the
FCC in violation of § 1519.7 The Government is wrong.
First, the undisputed evidence does not show that Teletronix cell phones carry a risk of
causing cancer. The only evidence that the Government offered in support of its conclusion that
7 The district court upheld Mr. McClain’s conviction because “the jury’s determination that the defendant, at the
very least, knowingly falsified a document in relation to a matter within federal jurisdiction.” R-58. To the extent
that Judge Bonora concluded that Mr. McClain could be convicted without proof of an intent to obstruct a federal
proceeding under 1519, he committed reversible legal error.
24
Mr. McClain's statements concerning cell phones were "false" is a World Health Organization
("WHO") Press Release classifying "radiofrequency electromagnetic fields as possibly
carcinogenic to humans." R-41 to -42. This report is, on its face, inconclusive. The WHO press
release does not state that there is a definitive risk of cancer as a result of using cell phones, and
the Government never offered any expert testimony concerning the link between cell phones and
cancer. R-41 to -42. The WHO press release also fails to identify Teletronix phones as part of
the study, and the Government did not call any experts to testify that Teletronix cell phones were
included in studies about cellular phones and cancer. Thus, the Government's proffered evidence
fails to establish the falsity of Mr. McClain's statements that Teletronix cell phones "do not cause
cancer" because no juror – rational or irrational – was ever exposed to any testimony linking
Teletronix cellular telephones (or even cell phones generally) to a definite risk of cancer.
Moreover, Mr. McClain believes that the cell phones designed by him – and Teletronix's
cell phones – carry "absolutely zero risk of causing cancer, now or at any point into the future."
R-14; see also R-35 ("I never agreed that cell phones in particular did cause cancer. I only saw
that people were complaining about that possibility."). Thus, even assuming arguendo that the
evidence did link Teletronix's cell phones to cancer, the Government failed to prove beyond a
reasonable doubt that Mr. McClain modified the press release with knowledge of its falsity. In
fact, Mr. McClain, like many oncologists and scientists in the telecommunications field,
disagreed with conclusions that cell phones cause cancer and thus did not "know" his statements
to be false within the meaning of § 1519. See, e.g., Patrizia Frei et al., Use of Mobile Phones and
Risk of Brain Tumors: Update of Danish Cohort Study, BMJ.com (Oct. 2011),
http://www.bmj.com/content/343/bmj.d6387 (finding that there is no link between the long term
25
use of mobile phones and brain cancer). The press release itself states that "we [Teletronix /Mr.
McClain] are now inclined to believe this is a sheer error or misunderstanding." R-14.
The Government also did not prove that Mr. McClain modified the press release with the
intent to interfere with an investigation by Congress or the FCC. On the contrary, his testimony
at trial suggests that he would have been eager, if given the opportunity, to provide evidence and
testify about Teletronix's cell phones before Congress: "This was my opening, my chance to
prove that my product was the answer." R-32. While Ms. Liang testified that she personally saw
"reports of a Congressional investigation into cell phone use," R-21, and Mr. McClain received
Ms. Laing's "press release talking about cell phones and cancer" and "remember[ed] scientists
who were brought on the newscast and talked about the [cancer] risk," the record is void of
anything establishing that Mr. McClain was actually aware of (and thus could have intended to
obstruct) an FCC or Congressional investigation. R-32, 35. In support of its Indictment, the
Government merely attached a copy of a television transcript in which a host discussed a
Senator's announced investigation, but it offered no evidence whatsoever that a formal
investigation was ever launched, or that Mr. McClain watched that particular newscast, or acted
in "contemplation" of such a proceeding. R-50. The Government never offered formal evidence
or asked the court to take judicial notice of the fact that an investigation was actually initiated by
either Congress or the Federal Communications Commission. See United States v. Lamont, 18
F.R.D. 27 (S.D.N.Y. 1955), order aff'd, 236 F.2d 312 (2d Cir. 1956) (individual members of
Congress cannot make investigations in absence of authority). Holding Mr. McClain guilty of
violating § 1519 based on the evidence in this record would mean that every time a member of
Congress simply announced an intention or desire to investigate a matter, any changes to written
documents made by any persons relating to the subject matter of the announced investigation
26
could be actionable under federal law—even if a formal agency or committee investigation never
developed. As set forth more thoroughly below, such a rule would violate the Constitution.
In sum, the facts of this case are a far cry from those of United States v. Gray, in which
the defendants conspired with one another to falsify documents while they were under
investigation for abusing a federal inmate. Gray, 642 F.3d at 378. In Gray, the defendants were
well aware that they were falsifying documents, did so intentionally, and "there was ample basis
to conclude that the defendants, as officers at a facility that housed federal prisoners, were aware
of the Department of Justice's policy of investigating allegations of excessive force . . . ." Id.
Gray's holding cannot be construed to allow the prosecution of individuals (such as Mr.
McClain) who express an opinion about a matter that simply falls "within the jurisdiction" of a
Congressional subcommittee or the FCC. Such an interpretation eviscerates the intent
requirement of the statute, subjects a limitless range of conduct (including protected speech) to
criminal punishment, and exceeds Congressional power to reach purely intrastate activities.
2. The Government Has Used §1519 To Unconstitutionally Criminalize Mr.
McClain's Statement That Teletronix Cell Phones Do Not Cause Cancer.
Section 1519 is unconstitutionally vague as applied to Peter McClain. Mr. McClain had
no warning that, by expressing his views about Teletronix cell phones, he would be charged with
violating the Sarbanes-Oxley Act, a federal law written primarily "[t]o protect investors by
improving the accuracy and reliability of corporate disclosures made pursuant to the securities
laws. . ." S. Rep. No. 107-146 (2002). As evidenced by the Government's selective prosecution
of Mr. McClain based on the announcement of a congressional investigation, § 1519 has
"authorized" and "encouraged" arbitrary enforcement. City of Chicago v. Morales, 527 U.S. 41,
56 (1999). Because the Government asserts that the content of the press release is criminal, (i.e.,
statements which have a basis in scientific fact and are the subject of reasonable disagreement
27
among members of the medical and technological communities), §1519 "abuts sensitive areas of
basic First Amendment freedoms." Here, the statute has "operate[d] to inhibit the exercise of
those freedoms," and the Government's use of it is therefore unconstitutional. Grayned v. City of
Rockford, 408 U.S. 104, 108-09 (1972).
Section 1519 did not give Mr. McClain (or any person of reasonable intelligence) notice
that modifying the Teletronix press release would be prohibited, and the statute failed to provide
the Department of Justice with adequate standards to govern its enforcement. Cf. Farrell v.
Burke, 449 F.3d 470, 486 (2d Cir. 2006). Mr. McClain was arrested in the wake of an
announced congressional investigation into the link between cancer and cell phones. He was not
subpoenaed, contacted by a member of Congress or her staff, or asked to speak with anyone
affiliated with the federal government in any capacity. Rather, he was asked by his boss, the
CEO of Teletronix, to respond to speculative reports about the link between cancer and mobile
phones. R-44. He did not destroy any documents or delete any data. In fact, he did not even
delete or black out the previous language in the modified press release; the original wording
remains plainly visible, and Mr. McClain made no efforts to destroy the document. R-44.
Statements designed to assuage consumer fears about a cancer link that Mr. McClain
believed to be non-existent are well outside the core purpose of § 1519, especially given that Mr.
McClain did not know of any federal "matter" at the time he modified the press release and never
destroyed any evidence. As discussed in Part B1, the record does not show that a Congressional
investigation into the link between cell phones and cancer was ever formally initiated. Cf.
United States v. Kernell, 667 F.3d 746 (6th Cir. 2012) (acknowledging that § 1519 might be
potentially vague "as it relates to other defendants," but upholding its application to Kernell
because he was worried about an FBI investigation at the time he deleted computer files). The
28
Government based the entirety of its § 1519 jurisdiction on two U.S. Senators "[holding] a press
conference [on June 13, 2011] in which they demanded that cell phone companies be held to
account for their misleading behavior" and the fact that cell phones are regulated by the FCC. R-
13. For evidentiary support that Mr. McClain was "aware" of this pending federal matter, the
Government offered a transcript of a television program into evidence and elicited testimony that
Mr. McClain has a TV in his office. R-21, 50.
Even assuming that a TV transcript could prove that Mr. McClain was contemplating
some kind of federal "matter," a reasonable person would have no notice that expressing public
disagreement with Congress (by stating that Teletronix cell phones carry "absolutely zero risk"
of cancer) could result in prosecution for obstruction of justice under Sarbanes-Oxley. The
"standardless sweep" of § 1519 thus allowed "policemen, prosecutors, and juries to pursue their
personal predilections" against Mr. McClain, apparently because he disagreed with two
prominent political leaders. United States v. Reese, 92 U.S. 214, 221 (1875); Handakas, 286
F.3d at 107 ("An enactment fails to provide sufficiently explicit standards for those who apply it
when it . . . delegates basic policy matters to policemen, judges and juries for resolution on an ad
hoc and subjective basis.").
"Where a statute's literal scope, unaided by a narrowing state court interpretation, is
capable of reaching expression sheltered by the First Amendment, the doctrine demands a greater
degree of specificity than in other contexts." Smith v. Goguen, 415 U.S. 566, 573 (1974).
Section 1519 is not only vague as applied to Mr. McClain, it is also an unconstitutionally
overbroad use of the statute under the First Amendment.8 Section 1519 cannot be used to
8 Even if this Court determined that Mr. McClain’s rights were not violated in this case, “[a] plaintiff claiming
overbreadth need not show that the challenged regulation injured his or her First Amendment interests in any way in
order to bring the overbreadth challenge.” Farrell, 449 F.3d at 499. We allow a party to bring an overbreadth
29
prosecute citizens who express scientifically supported theories or opinions that are the subject
of politically motivated congressional investigations. Holding otherwise would permit political
leaders to shut down the First Amendment rights of people like Mr. McClain on the grounds that,
as the Government has improperly alleged here, the statements are designed to "obstruct" the
members' announced congressional investigations.9 See Farell, 449 F.3d at 499 ("The purpose
of an overbreadth challenge is to prevent the chilling of constitutionally protected conduct, as
prudent citizens will avoid behavior that may fall within the scope of a prohibition, even if they
are not entirely sure whether it does.").
The prosecution of Mr. McClain restricted his speech based on content and subject matter
and on disapproval of "the message it conveys." Consol. Edison Co. of N.Y. v. Pub. Serv.
Comm'n of N.Y., 447 U.S. 530, 536 (1980); Hill v. Colorado, 530 U.S. 703, 719 (2000). Because
the Teletronix press release does not fall within the "historic and traditional" exceptions allowing
content-based restrictions on speech, the Government's use of the Act is presumptively invalid,
and the Government has the burden to rebut that presumption. United States v. Stevens, 130 S.
Ct. 1577, 1584 (2010). Thus, the Government must show that its use of the Act is necessary to
achieve a compelling interest and is narrowly tailored to that end. Brown v. Entm't Merchs.
Ass'n, 131 S. Ct. 2729, 2738 (2011). While the state undoubtedly has a compelling interest in
protecting consumers from misleading statements about products known to cause cancer, there is
no corresponding interest in suppressing vigorous debate about whether or not those products
are, in fact, actually linked to cancer. Moreover, the Government's enforcement policy
underlying § 1519 is not "narrowly tailored" to meet the aforementioned valid interest.
challenge where that party “satisfies the [Article III] requirement of ‘injury in-fact,’ and [where] it can be expected
satisfactorily to frame the issues in the case.” Id. 9 The Executive Power is retained by the President. The Constitution’s framework does not permit two members of
Congress to arbitrarily criminalize conduct by merely announcing an intention to investigate a given subject;
Congress may not control how laws are enforced by the Executive. See Bowsher v. Synar, 478 U.S. 714 (1986).
30
The Supreme Court has acknowledged that false statements are "inevitable in free
debate," and it has held that bare falsity is not enough to strip a statement of constitutional
protection. Curtis Pub. Co. v. Butts, 388 U.S. 130, 152, (1967) (plurality opinion) ("While the
truth of the underlying facts might be said to mark the line between publications which are of
significant social value and those which might be suppressed without serious social harm . . . ,
we have rejected . . . the argument that a finding of falsity alone should strip protections from the
publisher."). As Justice Jackson put it: "The very purpose of the First Amendment is to
foreclose public authority from assuming a guardianship of the public mind through regulating
the press, speech, and religion. In this field every person must be his own watchman for truth,
because the forefathers did not trust any government to separate the true from the false for us."
Thomas v. Collins, 323 U.S. 516, 545 (1945). An intense public exchange of ideas is a proving
ground for truth, and the Court has acknowledged that factual error is a part of that process. New
York Times Co. v Sullivan, 376 U.S. 254, 279 n.19 (1964) ("Even a false statement may be
deemed to make a valuable contribution to public debate, since it brings about 'the clearer
perception and livelier impression of truth, produced by its collision with error.'" quoting John
Stuart Mill, On Liberty 15 (Blackwell 1947) (1859)).
Thus, even assuming that Mr. McClain's statements were hyperbolic or unsupported by
scientific evidence, not all false statements are unprotected by the First Amendment, as
evidenced by the Court's repeated refusals to establish a universally unprotected form of false
speech. See Nike, Inc. v. Kasky, 539 U.S. 654, 664 (2003) (Stevens, J., concurring). In Stevens,
for example, this court separately cited distinct lines of cases for actionable "defamation" and
"fraud" when comparing specific examples of unprotected false speech. Stevens, 130 S. Ct. at
1584. The Court has been careful to avoid categorical rules because not all false statements are
31
created equal; they can be harmful, benign, or salutary. See United States v. Alvarez, 638 F.3d
666, 674-75 (9th Cir. 2011) (Kozinski, C.J., concurring in the denial of rehearing en banc). In
this case, Mr. McClain's allegedly "false" statements had a basis in scientific fact and were the
subject of reasonable disagreement among members of the medical and technological
communities. Absent adherence to the First Amendment's purpose of removing governmental
restraints from the arena of public discussion, "one of our most fundamental liberties would lie
prostrate before the ever-pressing urgency of the moment, the vacillating sensibilities of the
populace, and some legislators' views on which utterances are and are not socially desirable."
United States v. Strandlof, 667 F.3d 1146, 1185 (10th Cir. 2012) (Holmes, J., dissenting).
While in Gray this Court declined to read a nexus requirement into § 1519, the absence
of that nexus requirement does not permit the Government to unconstitutionally expand the reach
of the statute. Moreover, that decision (Apr. 28, 2011) was reached just one month prior to the
Supreme Court's decision in Fowler (May 26, 2011). Even though § 1519 and § 1512 are
distinct statutory provisions, the Fowler court's reasoning casts doubt upon the constitutionality
of completely eliminating a federal nexus requirement in the obstruction of justice context.
Fowler, 131 S. Ct. at 2051-52 (use of a standard based on the word 'possible' would eliminate
§1512's separate "intent" requirement and transform a federally oriented statute into one that
would deal with crimes, investigations, and witness tampering that are purely state in nature).10
The federal nexus requirement helps to ensure that the statute's broader scope is applied
in a manner that is consistent with the Constitution. Like § 1519, the statute in Fowler (§ 1512
10
The broad rule advocated by the Government in this case – that § 1519 applies to any fabrication or destruction of
documents with the intent to impede the administration of any matter within the jurisdiction of an agency of the
United States regardless of whether or not a federal proceeding ever develops – would also enable the type of
federal prosecution of purely intrastate activities expressly prohibited by the Supreme Court in United States v.
Lopez, 514 U.S. 549, 561 (1995). Mr. McClain has standing to make this challenge. See Bond v. United States, 131
S. Ct. 2355, 2366 (2011) (Individuals have standing to challenge federal statutes on grounds that the measures
interfere with the powers reserved to the States).
32
(a)1)(c)) is intended to apply to federal proceedings that are not yet pending. The Supreme Court
has made it clear, however, that at least some "foreseeability" of a federal matter is required by
this language in order to comport with the Constitution. Arthur Andersen, 544 U.S. at 708;
Fowler, 130 S. Ct. at 2051-52. Likewise, the absence of the word "corruptly" in § 1519 does not
mean that scienter is no longer required by the law, which prohibits intentionally "imped[ing],
obstruct[ing] or influenc[ing]" matters before a federal department or agency. As strongly
suggested by Fowler, such an intent requirement, coupled with the word "knowingly," should
invite a nexus similar to that established by Arthur Andersen. Fowler, 130 S. Ct. at 2051-52.
Without the requirement, the risk of a lack of notice and the criminalization of intrastate
activities and innocent conduct that was identified by Fowler, Arthur Andersen, and Aguilar is
present in § 1519. As demonstrated by the Government's attempt to proscribe Mr. McClain's
protected speech in the case at bar, this risk has become a reality.
Section 1519 must be confined to the intent and jurisdictional requirements that the
authors of Sarbanes-Oxley originally imposed. Otherwise, the statute will become a vehicle
through which First Amendment speech and due process rights can be single-handedly
eliminated at the whim of a few members of Congress. For all of the foregoing reasons, Mr.
McClain respectfully requests that his conviction under 18 U.S.C § 1519 be overturned.
33
II. ACQUITTAL IS NECESSARY BECAUSE MR. MCCLAIN COMMITTED NO
COMPUTER HACKING: HE USED HIS COMPANY COMPUTER TO
DOWNLOAD AND ACCESS PERSONAL FILES AND ALSO TO PARTICIPATE
IN AN ONLINE SOCIAL EXPERIMENT.
The government charged Mr. McClain with violating two provisions of the federal
computer hacking statute, both of which trigger criminal liability when a person access a
computer without authorization or in excess of authorization. 18 U.S.C. §§ 1030(a)(2)(C),
1030(a)(4) (2008). The statute, known as the Computer Fraud and Abuse Act ("CFAA"), avoids
the difficult task of defining what constitutes "authorization" or even "access." Courts have
interpreted these terms in dramatically different ways, illuminating the uncertainty about exactly
what kind of computer conduct the CFAA prohibits. This Court, required to interpret
unauthorized access for the first time, confronts a choice: it can inflate the criminal statute by
broadly construing unauthorized access to encompass situations in which a person breaches a
private use agreement with the computer owner; or, it can confine the scope of unauthorized
access to situations in which a person hacks code-based restrictions on user privileges.
Notions of authorization based in contract and agency law are imprudent because they
risk criminalizing the daily activity of millions of internet users. For the government to prevail
in this appeal, the Court would have to accept an interpretation of unauthorized access that would
make a criminal of the cubicle worker who checks e-mail at the office and of the lonely spinster
who lies about her age in an online dating profile. In these instances, computer use may be
unauthorized, in a certain sense, because it violates an explicit employment agreement, in the
case of the cubicle worker, and the terms of service that the dating site maintains, in the case of
the spinster. This case gives the Court an opportunity to reject criminalizing contract law.
Instead, this Court should articulate a clear conception of the CFAA's actus reus by
cabining unauthorized access to cases in which a hacker bypasses security features on a
34
computer. This kind of authorization turns on whether a computer hacker bypasses code-based
restrictions. This approach offers a bright-line rule that allows courts and computer users to
know when certain actions trigger criminal liability under the CFAA. It avoids criminalizing
mere breach of contract, which itself often presents difficult interpretative questions.
Importantly, the code-based approach focuses judicial inquiry on whether a computer user had
permission to use a computer or had permission to obtain the relevant information.
Closely related to the question of authorization is the problem of determining what
constitutes access under the CFAA. Physical-world assumptions about "access" and trespass do
not readily translate to computer hacking, where it is unclear, for example, whether a person who
visits a website has "accessed" the central server hosting the website; it is similarly unclear
whether a person who sends a friend an e-mail has "accessed" the friend's computer. These are
difficult questions—but they are ones the Court need not reach. To decide this case, the Court
must simply reject an ultra-expansive notion of "access" and conclude that users do not access a
company's computer network by participating in an online social experiment that happens to use
that company's credit as digital currency.
Because the Court in this case runs the risk of construing the CFAA in a way that renders
the statute unconstitutionally vague, it must be mindful of the constitutional specter and should
construe the CFAA to avoid constitutional problems. A law is unconstitutionally vague either
when it provides inadequate notice to allow "ordinary people to understand what conduct it
prohibits" or when it permits arbitrary and discriminatory enforcement. City of Chicago v.
Morales, 527 U.S. 41, 56 (1999). The contract-based view of authorization, which the
government must defend in this case, would provide computer users with virtually no notice of
35
criminal liability and would provide no minimal guidelines to law enforcement. Hence, the
government's reading of the CFAA renders it unconstitutionally vague.
A. Mr. McClain Did Not Violate 18 U.S.C. § 1030(a)(2)(C) Because He Had Permission
To Access His Computer And, Specifically, To Access Personal Information On
That Computer.
A conviction under 18 U.S.C. § 1030(a)(2)(c) requires the government to show that a
computer hacker obtained unauthorized access to a computer, but Mr. McClain had permission
to use his own work computer. Congress' failure to define authorization in the CFAA requires
the Court to interpret that term in this case—and the Court should do so in a way that honors the
plain meaning of the text, the statute's underlying policies, and legislative intent. In the last
decade, other courts have tried themselves to wade out of the CFAA's interpretative thicket, and
this Court of Appeals should look to the approaches adopted by other federal courts—both for
guidance on what is successful and what is not. As one district court in this circuit held just last
year, users do not access computers without authorization when they have permission to access
them, and they do not exceed authorized access when they have permission to access the relevant
information at issue. See United States v. Aleynikov, 737 F. Supp. 2d 173, 191-92 (S.D.N.Y.
2010).
Other courts have offered a variety of problematic approaches to understanding
authorization, but even if any of these approaches were valid, Mr. McClain's actions still fall
beyond the realm of the CFAA because he remained dedicated to Teletronix throughout his
employment and never misused or misappropriated the information at issue. Alternative
approaches to interpreting authorization emphasize: the subsequent misuse of information that a
computer user procures in an authorized way, see United States v. John, 597 F.3d 263, 272 (5th
Cir. 2010); an employee's use of a computer that breaches the common law duty of loyalty to the
36
employer, see Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 420 (7th Cir. 2006); and an
employee's breach of a private agreement with a company, see EF Cultural Travel BV v.
Explorica, Inc., 274 F.3d 577, 583 (1st Cir. 2001). These approaches are unproductive and fail
to comport with CFAA's purpose of targeting computer hacking. Even if valid, though, they do
not support a conviction under the facts here.
1. The Court Should Adopt The Code-Based View Of Authorization Because It Is
Most Faithful To The CFAA's Plain Meaning, Underlying Rationale, And
Legislative History.
Mr. McClain's convictions under the CFAA cannot stand because he was fully authorized
to access his office computer and to access the relevant files on that computer. Count Three of
the government's indictment charges Mr. McClain with violating § 1030(a)(2)(c), and Count
Four charges him with violating § 1030(a)(4). R-16 to -17. Both provisions share a trigger
element of requiring a user to access a computer either without authorization or in excess of
authorized access. See 18 U.S.C. §§ 1030(a)(2)(C), 1030(a)(4). Users "exceed[] authorized
access" when they "access a computer with authorization and . . . use such access to obtain or
alter information in the computer that the accesser [sic] is not entitled so to obtain or alter." §
1030(e)(6) (emphasis added). Congress, however, failed to define authorization, requiring this
Court to resolve the statutory ambiguity.
Under the most sensible interpretation of the CFAA, a person accesses a computer
without authorization when that person has no permission to access the computer, and a person
exceeds authorized access when that person has permission to access the computer but "accesses
information on the computer that the person is not entitled to access." LVRC Holdings LLC v.
Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009). The Ninth Circuit in Brekka adopted an
understanding of authorization centered on whether a user circumvents code-based restrictions or
37
bypasses security features on a computer. See Orin S. Kerr, Cybercrime's Cope: Interpreting
"Access" and "Authorization" in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 1596, 1599-1600
(2003) (distinguishing between contract-based and code-based notions of authorization). In
Brekka, a private company alleged that its former employee violated the CFAA—which also
imposes civil liability—when the employee e-mailed numerous company documents to his
personal e-mail account. Brekka, 581 F.3d at 1129-30. There, the employee did not violate the
CFAA because there was "no dispute" that he "was given permission to use LVRC's computer
and that he accessed documents or information to which he was entitled by virtue of his
employment . . . ." Id. at 1135.
So too in the present case is there no dispute that Mr. McClain had full permission to use
his own work computer and to access the files in question. Mr. McClain was Vice President and
Chief of Information Technology at Teletronix, R-9, a position he dutifully held for eight years
until his abrupt termination in June 2011, R-18. In this capacity, Mr. McClain supervised the
entire IT department at Teletronix, oversaw the company's network infrastructure, and managed
the IT staff. R-19. It is far-fetched for the government to suggest that Mr. McClain, given his
role as head of the IT department, was not authorized to access his very own work computer.
See R-16. The government also cannot seriously aver that Mr. McClain accessed documents that
he was not entitled to view. The government never alleged that Mr. McClain had any restrictions
whatsoever on his computer privileges at Teletronix; to the contrary, it describes the Teletronix
computer system as "his work computer server" and "his computer network," suggesting that
even the government recognizes the extent of Mr. McClain's authorization privileges.
The code-based notion of authorization that the Ninth Circuit articulated in Brekka
accords with several recent district court decisions in the Second Circuit. United States v.
38
Aleynikov concerned a Goldman Sachs computer programmer who allegedly copied thousands of
lines of proprietary source code on his last day of employment. 737 F. Supp. 2d at 175. The
government charged Aleynikov not only with theft of trade secrets and transportation of stolen
property in interstate commerce but also with violating the CFAA. The district court dismissed
the CFAA charge because there was no dispute that the defendant was authorized to access his
computer and to access the source code. Id. at 194. Earlier that year, another Southern District
court found that a computer administrator did not violate the CFAA by misappropriating
confidential information when the administrator had unlimited access privileges to the
confidential files. Univ. Sports Publ'ns Co. v. Playmakers Media Co., 735 F. Supp. 2d. 378, 381-
84 (S.D.N.Y. 2010). In a third case from 2010, yet another judge from the same district held that
an employee does not exceed authorized access by downloading "information to which the
employee freely was given access." Orbit One Commc'ns, Inc. v. Numerex Corp., 692 F. Supp.
2d 373, 385 (S.D.N.Y. 2010).
This reading of the CFAA finds support in the plain meaning of the statute and in the
statute's syntactical structure. Statutory interpretation begins with the statute's plain meaning,
and this Court strives to honor the ordinary meaning of words. United States v. Dauray, 215
F.3d 257, 260 (2d Cir. 2000). The ordinary meaning of authorization supports the conclusion
that "a person who 'accesses a computer without authorization' does so without any permission at
all," and "a person who 'exceeds authorized access' has permission to access the computer, but
not the particular information on the computer that is at issue." Aleynikov, 737 F. Supp. at 191-
92 (citing four dictionary definitions of "authorize"). Further, the critical verb in § 1030(a)(2)
and (4) is "access," indicating that the intended prohibition is the accessing of information and
nothing else. The statute's definition of "damage"—"any impairment to the integrity or
39
availability of data, a program, a system, or information"—comports with a code-based notion of
authorization and with a statute targeting computer hacking, which generally impairs the
integrity of computer data or programs. 18 U.S.C. § 1030(e)(8) (2008); see Orbit One, 692 F.
Supp. at 385-86 (analyzing the relation between the CFAA's damages definitions and the proper
construction of unauthorized access). Any expansive interpretation of authorization that the
government urges this Court to adopt would depart from norms of textual and structural fidelity.
Additionally, policy considerations support this Court rejecting an expansive view of the
CFAA, which is chiefly a criminal statute. First, the rule of lenity, which this Court follows,
requires the Court to construe ambiguous statutes to apply "only to conduct clearly covered."
United States v. Velastegui, 199 F.3d 590, 593 (2d Cir. 1999) (quoting United States v. Lanier,
520 U.S. 259, 266, (1997)). This Court resolves ambiguity in the scope of criminal statutes in
favor of lenity. Id. (citing Rewis v. United States, 401 U.S. 808, 812 (1971)). That is, any
interpretative "tie must go to the defendant." United States v. Santos, 553 U.S. 507, 514 (2008).
In this case, the Court should resolve the ambiguity in "authorization" in a way that avoids
criminalizing the civil tort of misappropriating confidential information. The Court should reject
a contract-based notion of authorization because it leads to constitutional vagueness and because
it allows private computer owners to harness the disapprobation of the criminal law for their own
ends. See Kerr, Cybercrime's Scope, supra, at 1658. Furthermore, the government may
prosecute employees who use computers to steal and transport propriety files with criminal laws
that target theft of trade secrets and interstate transportation of stolen property. See 18 U.S.C. §§
1832(a), 2314 (2011). The fact that the employees "took the information from a computer rather
than a file cabinet makes no difference." Kerr, Cybercrime's Scope, supra, at 1664. The CFAA
is a statute that targets computer hackers.
40
The legislative history of the statute bolsters the supposition that Congress intended to
prohibit computer hacking—not misuse of information that a user has permission to access. The
earliest version of the CFAA, passed in 1984, targeted "the activities of so-called 'hackers'" who
"trespass into" computers. H.R. Rep. No. 98-894, at 10 (1984), reprinted in 1984 U.S.C.C.A.N.
3689, 3695. Congress was clear: "The conduct prohibited is analogous to that of 'breaking and
entering' rather than using a computer (similar to the use of a gun) in committing the offense."
Id. at 2 (emphasis added). When the statute was amended in 1986, Congress explicitly declined
to "enact as sweeping a Federal statute as possible so that no computer crime is potentially
uncovered." S. Rep. No. 99-432, at 4 (1986), reprinted in 1986 U.S.C.C.A.N. 2479, 2482. As
early as 1991, the Second Circuit took note that Congress designed the CFAA to "be aimed at
'outsiders.'" United States v. Morris, 928 F.2d 504, 508 (2d. Cir. 1991) (quoting S. Rep. No. 99-
432, at 10). Perhaps most tellingly, the Senate Report offered the example of an employee who
exceeds implicit contractual limits on authorization by using someone else's computer: that act
would "best be handled by administrative sanctions, rather than by criminal punishment." S.
Rep. No. 99-432, at 8 (emphasis added). In yet another instance, the Report acknowledges that
certain computer use "while technically wrong, should not rise to the level of criminal conduct."
Id. at 7. The CFAA's legislative history leaves no doubt that Congress did not intend to
criminalize the kind of conduct for which the government indicted Mr. McClain here.
2. Non-Code-Based Notions Of Authorization Are Unworkable, But Even If Valid,
They Would Not Support A Conviction Because Mr. McClain Remained
Fiercely Loyal To Teletronix During His Employment And Did Not
Misappropriate Any Information.
Courts have advanced three alternative notions of authorization, each of which finds no
support in the CFAA's language or history and fails to support a conviction under the facts of the
present case. First, the "misuse theory" of authorization holds that employees exceed authorized
41
access when they access files they are entitled to access but subsequently misuse or
misappropriate the information in some way. See United States v. Nosal, 642 F.3d 781, 787-88
(9th Cir. 2011) (2-1), reh'g granted, 661 F.3d 1180, 1180 (9th Cir. 2011) (ordering that the panel
opinion not be "cited as precedent by or to any court of the Ninth Circuit"). This interpretation
emphasizes the implicit expectation that employees do not use their work computers beyond the
scope of their employment. See Kerr, Cybercrime's Scope, supra, at 1632. A second
interpretative approach—one that invariably reaches the same end as the first—focuses on the
employee's common law duty of loyalty to the employer and supposes that all authorization,
explicit or implicit, to use a work computer ceases the moment the employee breaches the duty.
See Citrin, 440 F.3d at 420-21. This approach derives from principles of agency law. The third
approach, related to the other two, turns on whether the employee's computer use breaches an
explicit contractual term. See Explorica, 274 F.3d at 583. These three related views of
authorization all find their principal articulation in cases with sympathetic plaintiffs, but they are
unworkable and unfaithful to the CFAA's purpose of targeting computer hacking. Moreover,
these approaches are irrelevant in this case, where the government failed to allege—and is unable
to show—that Mr. McClain misappropriated any proprietary information or breached his duty of
loyalty.
The first approach, under which a user's computer access is unauthorized when the user
transgresses the employer's expectations on computer use, renders the CFAA a tool of arbitrary
enforcement. Further, it hinges on an employer's expectations. In Nosal, a Ninth Circuit panel
held, over a strongly-worded dissent, that employees exceed authorized access when they violate
known limitations on computer use. 642 F.3d at 788. "It is as simple as that," the panel said. Id.
It is anything but that simple—and a majority of Ninth Circuit judges appear to agree. See
42
Nosal, 661 F.3d at 1180. Nosal involved a former executive at a recruiting firm who persuaded
his former colleagues to forward him highly confidential information from the firm's candidate
database; the defendant then used this proprietary information to launch a competing business.
Id. at 782-83. The Ninth Circuit panel dismissed the concern that its opinion would "make
criminals out of millions of employees who might use their work computers for personal use" or
"to access their personal email accounts or to check the latest college basketball scores" by
pointing out that § 1030(a)(4) contains a scienter requirement. Id. at 788-89. The phrase
"exceeds authorized access," however appears in other provisions of the CFAA, including the
broad § 1030(a)(2)(C), which has no scienter requirement. See Id. at 789 (Campbell, J.,
dissenting). The Nosal interpretation of authorization criminalizes "any person who obtains
information from any computer connected to the internet, in violation of her employer's
computer use restrictions." Id. Additionally, this approach creates the danger of arbitrary
enforcement because every employee who uses a computer for personal reasons would violate
federal law. See id. at 790.
Assuming, arguendo, this view of authorization held water, it would not support a
conviction under these facts because Mr. McClain never misappropriated any proprietary
information. The government's indictment charges Mr. McClain with "the conversion of
property assigned to Teletronix." R-16. Mr. McClain admittedly accessed certain personal files
from his office computer. R-33. In New York, conversion requires that an actor seriously
interfere with another's property rights. Thyroff v. Nationwide Mut. Ins. Co., 864 N.E.2d 1272,
1275 (2007) (quoting approvingly Restatement (Second) of Torts § 222A). Assuming for the
moment that Teletronix indeed had a property interest in Mr. McClain's files, the government
nowhere alleges that Mr. McClain attempted to alter, destroy, or steal the information. See R-15.
43
According to the government, one week prior to his termination, Mr. McClain downloaded
certain files onto a USB drive. Id. The government does not even contend that the USB drive
belonged to Mr. McClain. See id. Similarly, the government alleges that Mr. McClain, on the
day of his termination, e-mailed files to an "unknown address." Id. Even if true, the government
provides no allegations that Mr. McClain did so for an improper purpose or even that the
"unknown address" is a personal address. See id. The government's allegations ultimately
amount merely to insinuations of wrongdoing because the files Mr. McClain accessed were ones
he created. Even construing the facts in the light most favorable to the government, the
indictment requires inference upon inference to support a claim of conversion or any other
wrongful act. And if Teletronix does believe Mr. McClain committed conversion, it is free to
bring suit. See Thyroff, 864 N.E.2d at 292-93 (expanding the tort of conversion to encompass
electronic files).
Equally unavailing for the government is the interpretation of authorization premised on
agency law. The principal case advancing this position is Citrin, in which the Seventh Circuit
held that an employee's "breach of his duty of loyalty terminated his agency relationship" and
any authority to access company computers. 440 F.3d at 420-21. There, an employee
maliciously erased the contents of his company laptop before quitting his job to start a rival
business. Id. at 419. According to the Citrin court, the defendant lost all authorization to access
company computers the moment he breached his duty of loyalty. Id. at 420-21. One major
problem with this approach is that it focuses a court's attention on the absurd determination of
exactly when an employee's "mental state change[s] from loyal employee to disloyal
competitor." Brekka, 581 F.3d at 1134. Even the Ninth Circuit panel in Nosal rejected the Citrin
view as too extreme because it meant an employee's authorization terminates the moment she
44
acts adversely to the company. See Nosal, 642 F.3d at 786. Using the CFAA to prosecute any
employee who acts adversely to her employer's interests "convert[s] an ordinary violation of the
duty of loyalty . . . into a federal offense." Aleynikov, 737 F. Supp. 2d at 194. Revealingly, the
Citrin court repeatedly asserts that Congress "intended" the CFAA to cover not only computer
hackers but also "disgruntled programmers who decide to trash the employer's data system on the
way out," Citrin, 440 F.3d at 420, yet the court cites no legislative history or any other evidence
to support this. To be sure, the companies in Nosal and Citrin are sympathetic victims, but
Congress did not intend the CFAA to encompass employees who happen to "use[] a computer"
in the course of wrongdoing. H.R. Rep. No. 98-894, at 10.
The agency-based notion of authorization also fails to support a conviction in this case
because Mr. McClain remained a fiercely loyal employee until Teletronix dismissed him on June
25, 2011. The government never alleged that Mr. McClain breached his duty of loyalty to his
company. See R-14 to -15. If anything, the government suggests that Mr. McClain was an
overly zealous advocate for Teletronix and that he even allegedly altered a company press
statement to protect Teletronix's reputation. See R-15. The government does allege that Mr.
McClain, immediately after his termination, accessed certain personal files while still at the
office. R-15. But Ms. Laing specifically told Mr. McClain, "Feel free time to take your time and
grab your stuff." R-24. Further, an employee should reasonably be allowed to retrieve personal
files from a computer immediately after termination. This is not a case in which an employee
accessed company servers months after leaving the company. See Brekka, 581 F.3d at 1130.
Finally, contract-based interpretations of authorization create serious constitutional
problems because they allow employers—or any computer owner—to define the scope of the
criminal law. In Explorica, the First Circuit held that an employee's breach of a confidentiality
45
agreement with his former employer constituted a violation of the CFAA. 274 F.3d at 583. The
defendants in that case were former executives of EF, a student travel company, who used EF's
proprietary information to design a "scraper" program to mine sensitive pricing information from
EF's website. Id. at 578-80. They then used this information to support their own competing
business. Id. One commentator has described the First Circuit's reasoning in this case as
"opaque, if not tortured." Kerr, Cybercrime's Scope, supra, at 1638. The contract-based
approach allows private employers to criminalize viewpoints or behavior they disapprove of
simply by having employees sign a use agreement. For example, a pro-life employer could
create a terms-of-use that prohibits pro-choice individuals from accessing the computer network;
a pro-choice user who accesses the network would do so without "authorization" and would thus
commit a federal crime. Id. at 1658-59. The contract-based view of authorization fails to
provide sufficient notice to users about exactly what kind of conduct will trigger criminal
liability. One leading computer crime professor points out, "It is difficult, if not impossible, for a
typical user to know for sure whether he is in compliance with all of the contractual restrictions
regulating each of the computers he has accessed at any given time." Id. at 1659. Companies
who have sustained loss through breach of employment agreements are free to seek recourse—
but they should do so under ordinary contract law.
Acquittal is necessary, even if the Court accepts the contract-based notion, because Mr.
McClain's employment contract did not clearly proscribe the conduct at issue. First, the
government alleges that Mr. McClain's employment agreement proscribed certain "online
activity," R-10, but neither those words nor any others about computers or the internet appear in
the actual contract. See Ex. B, R-40. Second, Mr. McClain's contract does proscribe him from
retaining copies of proprietary documents "of a secret and confidential nature," id., but
46
Teletronix had no property interest in Mr. McClain's personal files, and Mr. McClain had no
reason to believe that Teletronix would consider his personal files covered by the employment
contract. The files at issue are notes and doodles produced by Mr. McClain that relate to a
fanciful idea he had for a new kind of cell phone. R-38. Teletronix knew Mr. McClain had
absolutely no engineering background, and its CEO, Lisa Laing, never once referred to Mr.
McClain's cell phone idea as an actual invention. R-19, 23. In fact, Ms. Laing belittled his
amateur efforts at cell phone design. R-19. Given this attitude, Mr. McClain rightfully regarded
his dilettante doodles as his personal files. Asked why he viewed the files one week prior to his
termination, Mr. McClain explained, "Because I could. I was still employed, I was able to login,
and I was looking at my stuff. I don't see what the big deal was." R-33. Mr. McClain's actual
doodle reveals just how crude and undeveloped his idea was: it depicts a faceless head with a
ring around the forehead, attached to a trapezoidal shape near the ear; that is, it appears to be
nothing more than a rudimentary sketch of a clunky headset. See Ex. A, R-39. This crude
rendition, depicting a personal pipedream of Mr. McClain's, was not something in which
Teletronix had a proprietary interest.
B. Mr. McClain Did Not Violate 18 U.S.C. § 1030(A)(4) By Exposing A Technological
And Moral Flaw In The Jonathan's Card Social Experiment.
The government, perhaps frustrated by its inability to determine the culprit behind the
hacking attack on the New York City computer system, brazenly charges Mr. McClain with
violating 18 U.S.C. § 1030(a)(4) by accessing without authorization the Starbucks computer
system. See R-17. Acquittal is necessary because the government simply offers no evidence—
or even allegations—that Mr. McClain actually accessed Starbucks' computers in any way.
Interpreting access in the CFAA presents even more difficulties than construing authorization,
but the Court today need not determine exactly what it means to access a computer—a question
47
very few courts have even tried to answer; rather, it need only reject the most vacuous notion of
"access," under which users access other computers when they indirectly cause electronic signals
to be transmitted to those computers. Even if Mr. McClain did access the Starbucks system—
and there are no allegations that he did—users do not run afoul of the CFAA by violating a
company's terms of use. Mr. McClain's actions amount to using his work computer to participate
in an online social experiment, albeit in a way different from other participants in the
experiment.
This case presents the Court of Appeals with an opportunity to reject a vacuous reading
of the CFAA in which "access" means any link between two computers, however remote.
Determining what it means to access a computer or a network raises even more difficulties than
unpacking the meaning of authorization. When Congress passed the CFAA, computer access
was far simpler: remote users dialed in to computers over telephone lines. Kerr, Cybercrime's
Scope, supra, at 1641. A quarter-century later, the word "access" in the CFAA is an
anachronism: today, "computer users utilize networks to surf the Web, send and receive instant
messages, download music and videos, and perform countless other tasks, often using 'always on'
Internet connections that merge seamlessly with the computers themselves."11
Id. Perhaps for
this reason, courts avoid interpreting access in the CFAA and instead focus solely on what
constitutes authorization. The leading circuit cases construing the CFAA awkwardly avoid
formulating a conception of access. See, e.g., Brekka, 581 F.3d at 1132; Citrin, 440 F.3d at 420;
Explorica, 274 F.3d at 583. A narrow view of access emphasizes not just a "successful exchange
11
Underscoring this point is how much Professor Kerr's description of what constitutes internet use changed in just
seven years from 2003 when he wrote that description to 2010, when he described the range of electronic use now
encompassed by the CFAA's clumsy definitions: it includes "coffeemakers, microwave ovens, watches, telephones,
children's toys, MP3 players, refrigerators, heating and air-conditioning unites, radios, alarm clocks, televisions, and
DVD players." Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 Minn. L. Rev. 1561,
1578-79 (2010).
48
of electronic signals, but rather . . . conduct by which one is in a position to obtain privileges or
information not available to the general public." Patricia L. Bellia, Defending Cyberproperty, 79
N.Y.U. L. Rev. 2164, 2254 (2004). The expansive view, however, which the government must
defend in this case, posits that access "means any interaction between two computers." Id. at
2253. Under this approach, users would "access" thousands of other computers and networks
anytime they browse the internet. This case illustrates why the Court should reject a view that
draws virtually all computer activity into the purview of the CFAA.
In this case, the government charges Mr. McClain in pure ipse dixit fashion with
"access[ing] . . . a computer on Starbucks' network," R-17, without offering an iota of evidence
to support the claim. What Mr. McClain did was expose a technological—and in his view, a
moral—flaw in the Jonathan's Card social experiment. Jonathan's Card was a social experiment
in which Starbucks consumers could share an account in order to buy each other coffee. R-10. It
was the virtual equivalent of a "take a penny, leave a penny" tray—except here, consumers were
actually taking $5 to buy themselves Frappuccinos and leaving $5 so others, in turn, could buy
venti, non-fat, no-foam soy lattes. Thus, Jonathan's Card was an experiment in collective
altruism. Mr. McClain decided to interject the social experiment with a moral dimension: he
resolved to take not $5 from the common pool but thousands of dollars in order to highlight
whether consumers should channel their collective altruism to "something more important than
coffee." R-34. Mr. McClain donated the money he took from the account to charity. Id. Mr.
McClan did all of this using his work computer. R-12. Mr. McClain may have defied social
expectations by taking the equivalent of a fistful of change from the "take a penny" tray, but
Jonathan's Card was an open pool of money from which anyone could take $1, $10, $100, or
$1,000. Part of the experiment was seeing whether consumers would use the account in an
49
ethical way. Mr. McClain felt it important for the experiment participants to consider whether it
is ethical for one person to take thousands of dollars from the common pool but then donate all
of that money to charity. R-34. Critically, Mr. McClain never cracked any security systems. R-
38. That is, he did not circumvent any code-based restrictions in Jonathan's Card. Further, the
government simply fails to allege that Mr. McClain's participation in the experiment entailed
accessing—or even attempting to access—the Starbucks computer system in any way.
C. The Court Must Adopt A Narrower Interpretation Of The CFAA Because A Broad
Reading Renders The Statute Unconstitutionally Vague.
The void-for-vagueness requirement compels this Court to interpret the notion of
unauthorized access narrowly in order to avoid rendering the CFAA unconstitutional.
Vagueness doctrine derives from the Due Process Clause of the Fifth Amendment. United States
v. Williams, 553 U.S. 285, 304 (2008). A challenged law may be unconstitutionally vague for
two reasons: it fails to provide adequate notice of what conduct it prohibits, or it permits
arbitrary and discriminatory enforcement. Morales, 527 U.S. at 52. Here, the contract-based
interpretation of the CFAA would invalidate the statute on vagueness grounds because the
CFAA would become a law that leaves computer users uncertain about what conduct it prohibits
and because it would invite arbitrary enforcement.
An expansive reading of the CFAA would render the law unconstitutional by potentially
criminalizing such a broad swath of computer activity that users would have no idea when they
run afoul of federal law. To avoid vagueness problems, a criminal law must define the "offense
with sufficient definiteness that ordinary people can understand what conduct is prohibited."
Kolender v. Lawson, 461 U.S. 352, 357 (1983). According to a leading computer crime expert,
the broadly worded provisions of the CFAA and "the increasing computerization of America
have combined to render the CFAA one of the most far-reaching criminal laws in the United
50
States Code." Kerr, Vagueness Challenges, supra, at 1561. Were the Court to adopt a broad,
contract-based view of authorization, it would exacerbate adequate notice problems with the
statute and would push the CFAA farther from the Supreme Court's requirement that criminal
statutes contain "relatively clear guidelines as to prohibited conduct" and provide "objective
criteria" to determine whether criminal liability exists. Gonzalez v. Carhart, 550 U.S. 124, 149
(2007). Computer users do not expect to face criminal liability for violating an employer's
policies on computer use or transgressing shared norms of computer use. Expanding the CFAA
in the way necessary to support Mr. McClain's convictions fails to provide adequate notice to
users of when checking the weather at work will result in their arrest.
A related problem is that the contract-based approach allows individual employers,
computer owners, and website operates to determine the scope of the criminal law. Company A
may have a provision in an employment agreement that prohibits employees from using their
office computers to check personal e-mail, while Company B has no explicit restrictions on
computer use. An employee at Company A who checks her e-mail at work has exceeded
authorized access and has thereby committed a federal crime, while an employee at Company B
who checks his e-mail has no committed no crime. Vagaries in the underlying contract or
employment agreement greatly compound this problem. Suppose an employment contract
provides that employees are unauthorized to use work computers for "improper purposes." It is
unclear whether an employee who checks her personal e-mail or looks at baseball scores for
thirty seconds has violated the contract and thus exceeded authorized use and thus violated
federal law. The same problem exists for online terms of service, which are simply contracts
governing authorization between the website owner and the website user. Professor Kerr notes,
"Agents could set up a webpage, dontvisithere.gov, announce that no one could visit the
51
webpage, and then swoop in and arrest anyone who did." Kerr, Vagueness Challenges, supra, at
1582.
Perhaps the most compelling reason to reject the expansive interpretation of unauthorized
access is that the contract-based approach invites the government to enforce the CFAA
arbitrarily and discriminatorily and to arrest whomever it chooses. The requirement that criminal
statutes "establish minimal guidelines to govern law enforcement," Smith v. Goguen, 415 U.S.
566, 574 (1974), is "the more important aspect of the vagueness doctrine," Kolender, 461 U.S. at
358. Interpretations of unauthorized access not focused on code-based restrictions give the
government authority to arrest any computer user. Such approaches subject almost all users to
the capricious whims of the government, which could prosecute almost anyone for violating the
CFAA. The statute would contain no limiting or guiding factors to curtail prosecutorial
discretion. If every breach of an employment contract's computer policies or of a website's terms
of service qualified as a violation of the CFAA, there would be "absolutely no limitation or
criteria as to which of the breaches should merit criminal prosecution." United States v. Drew,
259 F.R.D. 449, 467 (C.D. Cal. 2009). In contrast, an interpretation of unauthorized access that
looks at whether computer hackers circumvent code-based restrictions provides guidelines to
prosecutors that limit arbitrary enforcement.
The Court of Appeals has an opportunity in this case to save the constitutionality of the
CFAA by adopting a view of unauthorized access that is faithful to the statute's language,
structure, history, and underlying policies. Congress' failure to amend the statute to provide
minimal guidelines for law enforcement compels this Court to read the CFAA in a way that is
consistent with the void-for-vagueness doctrine. This case illustrates the dangers of unbridled
prosecutorial discretion. Someone hacked into the New York City computer system and
52
launched a significant cyber attack. That person deserves to be prosecuted to the fullest extent
possible under the CFAA. The government, lacking sufficient evidence to indict Mr. McClain
for that attack, instead charges him with violating the CFAA by accessing his work computer for
personal use. Congress intended the CFAA to make criminals of computer hackers—not
ordinary office workers.
CONCLUSION
For the reasons above, the judgment of the District Court for the Southern District of
New York should be REVERSED.
![home/goguen/tatami/seek/lisbon04cseweb.ucsd.edu/~goguen/pps/old.lisbon04.pdf · .0/0132 46587 9;:/=?2 @ ACB0DFEHGJILKMDONQP RTSVU-W XFDOSYRTILBZDFW\[6]0W B ^_D`GbaHR ^CGbc0NedZURHfgc0h0NLGJIi]\jbD`GbBZjJGlknmoB0aHD`BZGbG3ILDFB0a](https://static.documents.pub/doc/80x56/604cd3d67474a11fe151c72f/homegoguentatamiseek-goguenppsoldlisbon04pdf-00132-46587-92-acb0dfehgjilkmdonqp.jpg)
