PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 24-4102
UNITED STATES OF AMERICA, Plaintiff - Appellant,
v.
CONOR BRIAN FITZPATRICK, Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:23-cr-00119-LMB-1)
Argued: October 29, 2024 Decided: January 21, 2025
Before NIEMEYER, RUSHING, and HEYTENS, Circuit Judges.
Vacated and remanded by published opinion. Judge Niemeyer wrote the opinion, in which Judge Rushing and Judge Heytens joined.
ARGUED: Joseph Attias, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellant. Andrew James Frisch, LAW OFFICES OF ANDREW J. FRISCH, PLLC, New York, New York, for Appellee. ON BRIEF: Aarash A. Haghighat, Senior Counsel, Computer Crime and Intellectual Property Section, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; Jessica D. Aber, United States Attorney, Richmond, Virginia, Jacqueline R. Bechara, Assistant United States Attorney, Lauren Pomerantz Halper, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellant. Peter Neil Katz, LAW OFFICES OF PETER KATZ, LLC, Princeton, New Jersey, for Appellee.
2
NIEMEYER, Circuit Judge:
Conor Fitzpatrick pleaded guilty to conspiracy to traffic in stolen personally identifying information with intent to defraud, in violation of 18 U.S.C. § 1029(b)(2) and § 3559(g)(1); to fraudulent solicitation of personally identifying information, in violation of 18 U.S.C. § 1029(a)(6); and to possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2). While released on bond awaiting sentencing, Fitzpatrick violated his conditions of release immediately by secretly downloading a virtual private network, which he then used virtually every day to access the Internet without the knowledge of his probation officer.
At sentencing, the district court calculated Fitzpatrick’s advisory Guidelines sentencing range to be 188 to 235 months’ imprisonment. But based on Fitzpatrick’s autism spectrum disorder and youth (21 years old at the time of sentencing), it sentenced Fitzpatrick to a 17-day time-served term of imprisonment, concluding that the Federal Bureau of Prisons would not be able to treat Fitzpatrick’s autism spectrum disorder and that he would be “ravaged” in prison.
On appeal, the government contends that the district court abused its discretion by imposing a substantively unreasonable sentence. We agree. Accordingly, we vacate the sentence and remand for resentencing.
I
In March 2022, Fitzpatrick created an online marketplace called “BreachForums”
for the purchase and sale of personally identifying information that had been stolen by
3
hackers in data breaches, and he operated the site from March 2022 to March 2023. He created the site after law enforcement had shut down a similar site called “RaidForums,” of which he was a well-known member. With his active promotion of the BreachForums site, it became the largest English-language data-breach forum ever, featuring over 14 billion individual records consisting of names, dates of birth, social security numbers, employment information, and health insurance information. During the site’s year-long operation, Fitzpatrick acted as a middleman and facilitated the purchase and sale of the illegal information, earning $698,714 and causing many victims monetary and reputational injury. FBI agents, operating undercover, accessed the BreachForums site in July 2022 and purchased the birth dates, social security numbers, and bank account information of around 15 million Americans for approximately $5,000, ultimately giving rise to Fitzpatrick’s arrest. A subsequent search of Fitzpatrick’s devices showed that he had also, during this period, downloaded 26 files with at least 600 images of child pornography and viewed videos that depicted prepubescent children engaging in sex acts.
Fitzpatrick was indicted in three counts for violating 18 U.S.C. §§ 1029, 3559, and 2252, and he pleaded guilty to the charges. He was released on bond pending sentencing, subject to several special conditions. The conditions prohibited Fitzpatrick from accessing the BreachForums website or knowingly contacting any BreachForums user or coconspirator unless supervised by counsel. They also prohibited him from using a virtual private network (“VPN”) to obfuscate his identity online. And they prohibited him from accessing any computer or the Internet unless his probation officer had installed a
4
computer-monitoring program on that device, and even then, they prohibited him from creating or registering any new websites.
Beginning immediately after his plea hearing and release and continuing thereafter for approximately three months, Fitzpatrick violated the conditions of his release by participating in various “Discord” chatrooms. He accessed these chatrooms by acquiring a new iPhone and using a VPN to connect to the Internet to evade detection. During his chatroom conversations, Fitzpatrick professed innocence to the very crimes to which he had pleaded guilty, stating that his plea deal was “so BS” and that he had “wanted to fight it.” He also joked with his friends about selling data to foreign governments, exhorting one user to “become a foreign asset to china or russia” and to “sell government secrets.” The chatroom participants also discussed hacking various targets.
Following the discovery of these violations of his conditions for release, Fitzpatrick was detained pending sentencing for what turned out to be 17 days.
In preparation for sentencing, Fitzpatrick obtained psychological and psychosexual evaluations from professional psychologists. Dr. Jill Belchic-Schwartz, a pediatric psychologist, conducted tests that revealed Fitzpatrick had average general cognitive functioning but manifested deficiencies in interpersonal skills, perspective-taking, and social interests. For example, Dr. Belchic-Schwartz observed that Fitzpatrick lacked friends outside of a small online community and spent most of his free time alone in his room with his computer. She concluded that Fitzpatrick scored within the “autism” range on a diagnostic measure and thus diagnosed him with autism spectrum disorder. Otherwise, she observed that Fitzpatrick’s thoughts were logical and coherent. His insight
5
and judgments seemed only slightly immature. But his “social naiveté,” she opined, likely enabled his online friends to pressure him to engage in cybercrimes. She recommended that the court “strongly” consider alternatives to incarceration, such as a “therapeutic placement,” as Fitzpatrick would have “difficulty navigating” a term of imprisonment.
Dr. Sara Liebert, a clinical psychologist, evaluated Fitzpatrick’s likelihood of committing another sex-related offense. She administered an inventory to assess Fitzpatrick’s likelihood of recidivism and determine specific treatment needs. She concluded that Fitzpatrick’s need for sex-related treatment was moderate and that he had a 4.5 percent likelihood of committing another sex-based crime. She cited “mounting evidence” that those who sexually offend as youths do not reoffend as adults and that those convicted of child pornography do not reoffend. She saw no reason why Fitzpatrick would be an outlier to those norms. At bottom, she recommended that Fitzpatrick participate in sex-offense-specific therapy.
At sentencing, Fitzpatrick’s counsel presented these two psychologists’ reports to the district court and argued vigorously for a variant sentence for time served based on Fitzpatrick’s autism diagnosis and other personal characteristics. While the district court initially seemed dubious about counsel’s arguments, it increasingly became concerned about Fitzpatrick’s condition and the ability of the Bureau of Prisons to manage and treat him. Following Fitzpatrick’s allocution, it commented, “This is among the most difficult cases I’ve seen in quite a while in terms of sentencing, because the interplay between the criminal justice system and the obvious extremely significant mental health issues that this young man has are really very concerning. . . . My concern is [imprisoning in the general
6
prison population] a 21-year-old young man who is probably closer to a 16 or 17-year-old in terms of actual maturity, I think the mental health records clearly would show that, and someone with the very clear documented mental health history that we have — this is not somebody who, you know, post criminal conduct all of a sudden develops mental health issues. I mean, this young man has had them for years. . . . It’s a very, very sad case.”
After making those preliminary observations, the court sentenced Fitzpatrick as follows:
In this case, the defendant has been in custody for two weeks, and he has survived that, but only because he’s in a local jail and he’s in a mental health unit. He’s not in general population. This young man in general population I think would just be a disaster.
And so, although the court fully recognizes the seriousness of this criminal conduct, I am going to sentence the defendant to a sentence of time served [17 days], followed by a period of 20 years of supervised release.
After explaining other terms and conditions of the sentence, the court explained:
I think this gives us the best opportunity to try to protect the community as well as to not see this young man just ravaged in a prison setting where he would never get the mental health treatment that he needs, and he would, again, be, I think, exposed to all kinds of problems. He would clearly be a potential victim.
So that is why I’m imposing such an extensively variant sentence.
From the district court’s judgment dated January 19, 2024, the government filed this appeal, contending that the district court abused its discretion in sentencing Fitzpatrick to a 17-day time-served sentence.
7
II
The question presented in this case is whether Fitzpatrick’s 17-day sentence was substantively unreasonable.
In sentencing Fitzpatrick, the district court properly calculated his Guidelines sentencing range to be 188 to 235 months’ imprisonment. But after considering Fitzpatrick’s history and personal characteristics, including his autism and youth, the court imposed a time-served sentence of 17 days’ imprisonment. It explained that Fitzpatrick (1) would be “a potential victim” in prison and (2) would not have access to adequate treatment.
The government contends that Fitzpatrick’s 17-day imprisonment was substantively unreasonable and therefore that the district court abused its discretion in imposing that sentence. It notes that the court relied exclusively on Fitzpatrick’s personal characteristics and ignored the need for his sentence to reflect the seriousness of his offense, to promote respect for the law, to deter similar wrongdoing, and to protect the public. The government also challenges the district court’s sweeping conclusion that the Federal Bureau of Prisons categorically could not manage, much less treat, someone with Fitzpatrick’s characteristics. It argues that this case is governed by our decision in United States v. Zuk, 874 F.3d 398 (4th Cir. 2017), where we concluded that a major downward variant sentence based on similar personal characteristics was substantively unreasonable.
To defend the district court’s sentence, Fitzpatrick’s counsel focuses on Fitzpatrick’s mental health struggles, arguing that his condition greatly undermined his culpability for his offenses. Counsel posits that the “cause” of Fitzpatrick’s criminal
8
activity was his “mental health issues,” not greed or any other moral shortcoming. Indeed, he argues that Fitzpatrick could not “truly understand[] the consequences of [his] acts.” He asserts further that the district court reasonably concluded that the Bureau of Prisons lacks the capacity to safely manage and treat Fitzpatrick.
The principles of sentencing are well established. A defendant found guilty of an offense must be sentenced in accordance with 18 U.S.C. §§ 3551–3559 “so as to achieve the purposes set forth in subparagraphs (A) through (D) of section 3553(a)(2) to the extent that they are applicable in light of all the circumstances of the case.” 18 U.S.C. § 3551(a). And those subparagraphs in turn provide that a district court must impose a sentence
sufficient, but not greater than necessary . . . (A) to reflect the seriousness of the offense, to promote respect for the law, and to provide just punishment for the offense; (B) to afford adequate deterrence to criminal conduct; (C) to protect the public from further crimes of the defendant; and (D) to provide the defendant with needed education or vocational training, medical care, or other correctional treatment in the most effective manner.
18 U.S.C. § 3553(a)(2). The Supreme Court has characterized these purposes as retribution (punishment), deterrence, incapacitation, and rehabilitation. See Rita v. United States, 551 U.S. 338, 347–48 (2007). And in fulfilling sentencing’s purposes, a district court must consider and weigh (1) the nature of the offense and the defendant’s history and characteristics; (2) the kinds of sentences legally available; (3) the advisory sentencing range provided by the Sentencing Guidelines; (4) any relevant policy statement issued by the Sentencing Commission; (5) the need to avoid unwarranted sentencing disparities; and (6) the need for restitution. 18 U.S.C. § 3553(a). Within the context of these requirements,
9
however, a district court has considerable discretion to select the particular sentence to impose. See United States v. Booker, 543 U.S. 220, 233 (2005).
In reviewing a sentence for substantive reasonableness, we independently “examine the totality of the circumstances to see whether the sentencing court abused its discretion in concluding that the sentence it chose satisfied the standards set forth in § 3553(a).” United States v. Abed, 3 F.4th 104, 119 (4th Cir. 2021) (cleaned up); accord Gall v. United States, 552 U.S. 38, 51 (2007).
When selecting Fitzpatrick’s sentence, the district court relied only on his history and personal characteristics — his autism and youth — even though it acknowledged in passing the seriousness of his crimes. The court also mentioned briefly the need to protect the public when it imposed a 20-year term of supervised release, stating that such supervised release would “give[] us the best opportunity to try to protect the community.” (Emphasis added). But it never explained why supervised release was adequate, especially in light of Fitzpatrick’s repeated violations of his conditions of presentence release. And, most glaringly, the court never addressed, as required, how his sentence “achieve[s]” respect for the law, punishment, deterrence, and incapacitation, all of which are core purposes of sentencing. 18 U.S.C. §§ 3551(a), 3553(a)(2).
First, as to whether the sentence was sufficient “to reflect the seriousness of the offense,” 18 U.S.C. § 3553(a)(2)(A), the court recognized generally that Fitzpatrick’s criminal conduct was serious, but it seemingly gave this factor no weight. Yet, Fitzpatrick created and operated the largest ever English-language online marketplace for buying and selling stolen personal data, which featured over 14 billion individual records of millions
10
of persons. Moreover, many persons were injured by this conduct. Fitzpatrick also downloaded at least 600 images of child pornography and viewed prepubescent girls engaging in sexual acts. Congress has deemed child pornography violations as some of the most serious of crimes, recognizing, as state legislatures also have, that it can “decrease the production of child pornography if it penalizes those who possess and view the product, thereby decreasing demand.” Osborne v. Ohio, 495 U.S. 103, 109–10 (1990). Moreover, it has evinced a clear goal of “increasing the guideline penalties and reducing the incidence of downward departures” for child pornography offenses. U.S. Sent’g Comm’n, The History of the Child Pornography Guidelines 6 (2009); accord United States v. Pugh, 515 F.3d 1179, 1198 (11th Cir. 2008) (tracing the increasing severity over time of penalties for child pornography crimes). Not only did Fitzpatrick commit serious offenses, but he also showed a lack of remorse, joking about committing additional crimes even after entering a guilty plea. Yet, despite Fitzpatrick’s conduct, the district court never addressed the seriousness of his crimes or explained how its sentence fulfilled § 3553(a)(2)(A).
Second, the court failed to account for the need for its sentence to promote respect for the law and ensure just punishment for the offense. The Sentencing Guidelines advise that the just punishment for Fitzpatrick’s offenses would be 188 to 235 months’ imprisonment, yet the court varied downward by more than 99% and imposed a 17-day term of imprisonment. This sentence was even below what Fitzpatrick’s friends on the Internet in chats after his guilty plea had jokingly expected that he would receive — “ur gonna get like a month.” Moreover, the court does not appear to have considered how such an extreme variance might contribute to unwarranted sentencing disparities.
11
Third, the court never considered how its sentence would deter others from committing such crimes. See 18 U.S.C. § 3553(a)(2)(B). If anything, a 17-day sentence for the commission of three serious felonies signals to would-be criminals that they might get one free pass before facing any serious penalties.
Fourth and finally, the district court concluded that Fitzpatrick’s term of supervised release would “protect the public from further crimes of the defendant,” 18 U.S.C. § 3553(a)(2)(C), because his parents would help supervise him at home. Yet, the court seemingly failed to consider that Fitzpatrick immediately and continuously violated the conditions of his presentence release while at home under the supervision of his parents. Indeed, Fitzpatrick committed the very offenses at issue while living at home with his parents.
Instead of addressing these required sentencing factors, the district court focused almost exclusively on Fitzpatrick’s personal history and characteristics. But even as to that factor, the court failed to identify any evidence to support its sweeping conclusion that the Federal Bureau of Prisons could not manage Fitzpatrick given his mental condition. When pressed at oral argument about the lack of record evidence that could support the court’s claim, Fitzpatrick’s counsel stated that the Bureau of Prisons’ inability to treat inmates “wasn’t addressed on the record” but had “certainly been addressed in the public forum,” submitting that it was “common knowledge” that the Bureau of Prisons is an “agency in crisis even as to dealing with mentally sound inmates.” The government properly responds, however, that such “common knowledge” is not supported by the record and that the Bureau of Prisons houses and treats mentally ill inmates all the time.
12
In short, § 3553(a) requires that a sentence be sufficient to serve the purposes of punishment, deterrence, and incapacitation, among others. And a sentence of 17 days based simply on Fitzpatrick’s personal history and characteristics does not fulfill those purposes. We conclude, therefore, that it was substantively unreasonable.
This case is substantially similar to and indeed governed by our decision in United States v. Zuk. In Zuk, we concluded that arguments nearly identical to those pressed by Fitzpatrick here did not justify a major downward variance given all the circumstances presented in that case. Zuk, who at sentencing was 22 and diagnosed with autism, pleaded guilty to possession of child pornography. 874 F.3d at 400. The undisputed evidence showed that he had possessed nearly 14,000 images and had “communicated on a daily basis with a 16-year-old who was sexually abusing his 5-year-old cousin,” id. at 400, and that he directed the 16-year-old “to produce specific sadistic images” of his abuse, id. at 411. During the sentencing hearing, the district court heard expert testimony that Zuk was unlikely to recidivate if he received proper treatment. Id. at 403. Although another expert opined that Zuk’s autism had contributed to the offense, there was no evidence that it had caused his criminal conduct. Id. at 404, 411. Zuk urged the court to take into account the fact that he had autism and that his brain was not fully developed at the time he committed his offense. Id. at 403. Zuk also emphasized that he was twice assaulted in prison while awaiting sentencing and would only be further victimized if sentenced to a lengthy term of incarceration. Id. at 402, 408. The district court, relying almost exclusively on Zuk’s autism, varied downward from a Guidelines sentence of 240 months’ imprisonment to a time-served sentence of 26 months. Id. at 406.
13
When the government challenged the substantive reasonableness of the sentence on appeal, Zuk argued that the district court’s sentence was substantively reasonable because it considered:
(1) how his autism spectrum disorder mitigated his culpability for his conduct and affected his treatment needs;
(2) the importance of Zuk’s receiving intensive sex-offender treatment in a therapeutic community . . . while his brain was still developing; and
(3) his vulnerability in prison due to his autism spectrum disorder and slight frame.
Zuk, 874 F.3d at 408. We disagreed and vacated the district court’s sentence as substantively unreasonable, explaining that the time-served sentence “fail[ed] in a message of deterrence, d[id] not adequately protect the public, and undoubtedly d[id] not promote respect for the law.” Id. at 411. We concluded that “when a district court focuses so heavily on a single sentencing purpose only tangentially connected to a defendant’s grave criminal misconduct, it risks abusing its discretion.” Id. at 410.
Just as in Zuk where no expert testified that Zuk’s medical condition caused his criminal conduct, no expert testified in this case that Fitzpatrick’s condition caused his criminal misconduct. At most, Dr. Belchic-Schwartz stated that Fitzpatrick faced “substantial difficulty resisting impulses and considering consequences before acting.” That statement, however, does not suggest that Fitzpatrick’s autism caused his crimes, nor, for that matter, does it distinguish him from most people who commit crimes. Likewise, the record here does not support Fitzpatrick’s assertion that he could not “truly understand[] the consequences of [his] acts.” Indeed, the record contradicts that position. Fitzpatrick’s
14
conduct involved the sophisticated creation, promotion, and operation of a data-breach website that, under his supervision, became the largest of its kind in the English-speaking world. Even after he pleaded guilty, Fitzpatrick lied to his friends and asserted that he never viewed child pornography. He also downloaded and utilized VPNs to hide both his initial criminal conduct and his repeated violations of his conditions of presentence release. Such conduct reveals clearly that Fitzpatrick knew what he was doing was wrong and chose to do it anyway, as well as to hide it — again, much like the defendant in Zuk. See 874 F.3d at 411.
We noted in Zuk that a district court risks abusing its discretion when it grants a defendant’s request for a major downward variance based almost exclusively upon the defendant’s personal history and characteristics. See 874 F.3d at 410. Here, we conclude that the district court’s reliance on only Fitzpatrick’s personal history and characteristics constituted just such an abuse of discretion. The district court failed to impose a sentence that accounted for the severity of Fitzpatrick’s offenses, the need to punish and provide respect for the law, the need to adequately deter criminal conduct, and the need to protect the public from further crimes. Simply put, a 17-day sentence does not fulfill those required sentencing purposes and therefore was substantively unreasonable.
Accordingly, we vacate Fitzpatrick’s sentence and remand for resentencing in accordance with the principles set forth herein.
VACATED AND REMANDED