USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 1 of 14
PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 24-4102
UNITED STATES OF AMERICA,
Plaintiff - Appellant,
v.
CONOR BRIAN FITZPATRICK,
Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:23-cr-00119-LMB-1)
Argued: October 29, 2024 Decided: January 21, 2025
Before NIEMEYER, RUSHING, and HEYTENS, Circuit Judges.
Vacated and remanded by published opinion. Judge Niemeyer wrote the opinion, in which Judge Rushing and Judge Heytens joined.
ARGUED: Joseph Attias, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellant. Andrew James Frisch, LAW OFFICES OF ANDREW J. FRISCH, PLLC, New York, New York, for Appellee. ON BRIEF: Aarash A. Haghighat, Senior Counsel, Computer Crime and Intellectual Property Section, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; Jessica D. Aber, United States Attorney, Richmond, Virginia, Jacqueline R. Bechara, Assistant United States Attorney, Lauren Pomerantz Halper, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellant. Peter Neil Katz, LAW OFFICES OF PETER KATZ, LLC, Princeton, New Jersey, for Appellee. USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 2 of 14
NIEMEYER, Circuit Judge:
Conor Fitzpatrick pleaded guilty to conspiracy to traffic in stolen personally
identifying information with intent to defraud, in violation of 18 U.S.C. § 1029(b)(2) and
§ 3559(g)(1); to fraudulent solicitation of personally identifying information, in violation
of 18 U.S.C. § 1029(a)(6); and to possession of child pornography, in violation of
18 U.S.C. § 2252(a)(4)(B) and (b)(2). While released on bond awaiting sentencing,
Fitzpatrick violated his conditions of release immediately by secretly downloading a virtual
private network, which he then used virtually every day to access the Internet without the
knowledge of his probation officer.
At sentencing, the district court calculated Fitzpatrick’s advisory Guidelines
sentencing range to be 188 to 235 months’ imprisonment. But based on Fitzpatrick’s
autism spectrum disorder and youth (21 years old at the time of sentencing), it sentenced
Fitzpatrick to a 17-day time-served term of imprisonment, concluding that the Federal
Bureau of Prisons would not be able to treat Fitzpatrick’s autism spectrum disorder and
that he would be “ravaged” in prison.
On appeal, the government contends that the district court abused its discretion by
imposing a substantively unreasonable sentence. We agree. Accordingly, we vacate the
sentence and remand for resentencing.
I
In March 2022, Fitzpatrick created an online marketplace called “BreachForums”
for the purchase and sale of personally identifying information that had been stolen by
2 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 3 of 14
hackers in data breaches, and he operated the site from March 2022 to March 2023. He
created the site after law enforcement had shut down a similar site called “RaidForums,”
of which he was a well-known member. With his active promotion of the BreachForums
site, it became the largest English-language data-breach forum ever, featuring over
14 billion individual records consisting of names, dates of birth, social security numbers,
employment information, and health insurance information. During the site’s year-long
operation, Fitzpatrick acted as a middleman and facilitated the purchase and sale of the
illegal information, earning $698,714 and causing many victims monetary and reputational
injury. FBI agents, operating undercover, accessed the BreachForums site in July 2022
and purchased the birth dates, social security numbers, and bank account information of
around 15 million Americans for approximately $5,000, ultimately giving rise to
Fitzpatrick’s arrest. A subsequent search of Fitzpatrick’s devices showed that he had also,
during this period, downloaded 26 files with at least 600 images of child pornography and
viewed videos that depicted prepubescent children engaging in sex acts.
Fitzpatrick was indicted in three counts for violating 18 U.S.C. §§ 1029, 3559, and
2252, and he pleaded guilty to the charges. He was released on bond pending sentencing,
subject to several special conditions. The conditions prohibited Fitzpatrick from accessing
the BreachForums website or knowingly contacting any BreachForums user or
coconspirator unless supervised by counsel. They also prohibited him from using a virtual
private network (“VPN”) to obfuscate his identity online. And they prohibited him from
accessing any computer or the Internet unless his probation officer had installed a
3 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 4 of 14
computer-monitoring program on that device, and even then, they prohibited him from
creating or registering any new websites.
Beginning immediately after his plea hearing and release and continuing thereafter
for approximately three months, Fitzpatrick violated the conditions of his release by
participating in various “Discord” chatrooms. He accessed these chatrooms by acquiring
a new iPhone and using a VPN to connect to the Internet to evade detection. During his
chatroom conversations, Fitzpatrick professed innocence to the very crimes to which he
had pleaded guilty, stating that his plea deal was “so BS” and that he had “wanted to fight
it.” He also joked with his friends about selling data to foreign governments, exhorting
one user to “become a foreign asset to china or russia” and to “sell government secrets.”
The chatroom participants also discussed hacking various targets.
Following the discovery of these violations of his conditions for release, Fitzpatrick
was detained pending sentencing for what turned out to be 17 days.
In preparation for sentencing, Fitzpatrick obtained psychological and psychosexual
evaluations from professional psychologists. Dr. Jill Belchic-Schwartz, a pediatric
psychologist, conducted tests that revealed Fitzpatrick had average general cognitive
functioning but manifested deficiencies in interpersonal skills, perspective-taking, and
social interests. For example, Dr. Belchic-Schwartz observed that Fitzpatrick lacked
friends outside of a small online community and spent most of his free time alone in his
room with his computer. She concluded that Fitzpatrick scored within the “autism” range
on a diagnostic measure and thus diagnosed him with autism spectrum disorder.
Otherwise, she observed that Fitzpatrick’s thoughts were logical and coherent. His insight
4 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 5 of 14
and judgments seemed only slightly immature. But his “social naiveté,” she opined, likely
enabled his online friends to pressure him to engage in cybercrimes. She recommended
that the court “strongly” consider alternatives to incarceration, such as a “therapeutic
placement,” as Fitzpatrick would have “difficulty navigating” a term of imprisonment.
Dr. Sara Liebert, a clinical psychologist, evaluated Fitzpatrick’s likelihood of
committing another sex-related offense. She administered an inventory to assess
Fitzpatrick’s likelihood of recidivism and determine specific treatment needs. She
concluded that Fitzpatrick’s need for sex-related treatment was moderate and that he had a
4.5 percent likelihood of committing another sex-based crime. She cited “mounting
evidence” that those who sexually offend as youths do not reoffend as adults and that those
convicted of child pornography do not reoffend. She saw no reason why Fitzpatrick would
be an outlier to those norms. At bottom, she recommended that Fitzpatrick participate in
sex-offense-specific therapy.
At sentencing, Fitzpatrick’s counsel presented these two psychologists’ reports to
the district court and argued vigorously for a variant sentence for time served based on
Fitzpatrick’s autism diagnosis and other personal characteristics. While the district court
initially seemed dubious about counsel’s arguments, it increasingly became concerned
about Fitzpatrick’s condition and the ability of the Bureau of Prisons to manage and treat
him. Following Fitzpatrick’s allocution, it commented, “This is among the most difficult
cases I’ve seen in quite a while in terms of sentencing, because the interplay between the
criminal justice system and the obvious extremely significant mental health issues that this
young man has are really very concerning. . . . My concern is [imprisoning in the general
5 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 6 of 14
prison population] a 21-year-old young man who is probably closer to a 16 or 17-year-old
in terms of actual maturity, I think the mental health records clearly would show that, and
someone with the very clear documented mental health history that we have — this is not
somebody who, you know, post criminal conduct all of a sudden develops mental health
issues. I mean, this young man has had them for years. . . . It’s a very, very sad case.”
After making those preliminary observations, the court sentenced Fitzpatrick as
follows:
In this case, the defendant has been in custody for two weeks, and he has survived that, but only because he’s in a local jail and he’s in a mental health unit. He’s not in general population. This young man in general population I think would just be a disaster.
And so, although the court fully recognizes the seriousness of this criminal conduct, I am going to sentence the defendant to a sentence of time served [17 days], followed by a period of 20 years of supervised release.
After explaining other terms and conditions of the sentence, the court explained:
I think this gives us the best opportunity to try to protect the community as well as to not see this young man just ravaged in a prison setting where he would never get the mental health treatment that he needs, and he would, again, be, I think, exposed to all kinds of problems. He would clearly be a potential victim.
So that is why I’m imposing such an extensively variant sentence.
From the district court’s judgment dated January 19, 2024, the government filed this
appeal, contending that the district court abused its discretion in sentencing Fitzpatrick to
a 17-day time-served sentence.
6 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 7 of 14
II
The question presented in this case is whether Fitzpatrick’s 17-day sentence was
substantively unreasonable.
In sentencing Fitzpatrick, the district court properly calculated his Guidelines
sentencing range to be 188 to 235 months’ imprisonment. But after considering
Fitzpatrick’s history and personal characteristics, including his autism and youth, the court
imposed a time-served sentence of 17 days’ imprisonment. It explained that Fitzpatrick
(1) would be “a potential victim” in prison and (2) would not have access to adequate
treatment.
The government contends that Fitzpatrick’s 17-day imprisonment was substantively
unreasonable and therefore that the district court abused its discretion in imposing that
sentence. It notes that the court relied exclusively on Fitzpatrick’s personal characteristics
and ignored the need for his sentence to reflect the seriousness of his offense, to promote
respect for the law, to deter similar wrongdoing, and to protect the public. The government
also challenges the district court’s sweeping conclusion that the Federal Bureau of Prisons
categorically could not manage, much less treat, someone with Fitzpatrick’s
characteristics. It argues that this case is governed by our decision in United States v. Zuk,
874 F.3d 398 (4th Cir. 2017), where we concluded that a major downward variant sentence
based on similar personal characteristics was substantively unreasonable.
To defend the district court’s sentence, Fitzpatrick’s counsel focuses on
Fitzpatrick’s mental health struggles, arguing that his condition greatly undermined his
culpability for his offenses. Counsel posits that the “cause” of Fitzpatrick’s criminal
7 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 8 of 14
activity was his “mental health issues,” not greed or any other moral shortcoming. Indeed,
he argues that Fitzpatrick could not “truly understand[] the consequences of [his] acts.” He
asserts further that the district court reasonably concluded that the Bureau of Prisons lacks
the capacity to safely manage and treat Fitzpatrick.
The principles of sentencing are well established. A defendant found guilty of an
offense must be sentenced in accordance with 18 U.S.C. §§ 3551–3559 “so as to achieve
the purposes set forth in subparagraphs (A) through (D) of section 3553(a)(2) to the extent
that they are applicable in light of all the circumstances of the case.” 18 U.S.C. § 3551(a).
And those subparagraphs in turn provide that a district court must impose a sentence
sufficient, but not greater than necessary . . . (A) to reflect the seriousness of the offense, to promote respect for the law, and to provide just punishment for the offense; (B) to afford adequate deterrence to criminal conduct; (C) to protect the public from further crimes of the defendant; and (D) to provide the defendant with needed education or vocational training, medical care, or other correctional treatment in the most effective manner.
18 U.S.C. § 3553(a)(2). The Supreme Court has characterized these purposes as retribution
(punishment), deterrence, incapacitation, and rehabilitation. See Rita v. United States,
551 U.S. 338, 347–48 (2007). And in fulfilling sentencing’s purposes, a district court must
consider and weigh (1) the nature of the offense and the defendant’s history and
characteristics; (2) the kinds of sentences legally available; (3) the advisory sentencing
range provided by the Sentencing Guidelines; (4) any relevant policy statement issued by
the Sentencing Commission; (5) the need to avoid unwarranted sentencing disparities; and
(6) the need for restitution. 18 U.S.C. § 3553(a). Within the context of these requirements,
8 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 9 of 14
however, a district court has considerable discretion to select the particular sentence to
impose. See United States v. Booker, 543 U.S. 220, 233 (2005).
In reviewing a sentence for substantive reasonableness, we independently “examine
the totality of the circumstances to see whether the sentencing court abused its discretion
in concluding that the sentence it chose satisfied the standards set forth in § 3553(a).”
United States v. Abed, 3 F.4th 104, 119 (4th Cir. 2021) (cleaned up); accord Gall v. United
States, 552 U.S. 38, 51 (2007).
When selecting Fitzpatrick’s sentence, the district court relied only on his history
and personal characteristics — his autism and youth — even though it acknowledged in
passing the seriousness of his crimes. The court also mentioned briefly the need to protect
the public when it imposed a 20-year term of supervised release, stating that such
supervised release would “give[] us the best opportunity to try to protect the community.”
(Emphasis added). But it never explained why supervised release was adequate, especially
in light of Fitzpatrick’s repeated violations of his conditions of presentence release. And,
most glaringly, the court never addressed, as required, how his sentence “achieve[s]”
respect for the law, punishment, deterrence, and incapacitation, all of which are core
purposes of sentencing. 18 U.S.C. §§ 3551(a), 3553(a)(2).
First, as to whether the sentence was sufficient “to reflect the seriousness of the
offense,” 18 U.S.C. § 3553(a)(2)(A), the court recognized generally that Fitzpatrick’s
criminal conduct was serious, but it seemingly gave this factor no weight. Yet, Fitzpatrick
created and operated the largest ever English-language online marketplace for buying and
selling stolen personal data, which featured over 14 billion individual records of millions
9 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 10 of 14
of persons. Moreover, many persons were injured by this conduct. Fitzpatrick also
downloaded at least 600 images of child pornography and viewed prepubescent girls
engaging in sexual acts. Congress has deemed child pornography violations as some of
the most serious of crimes, recognizing, as state legislatures also have, that it can “decrease
the production of child pornography if it penalizes those who possess and view the product,
thereby decreasing demand.” Osborne v. Ohio, 495 U.S. 103, 109–10 (1990). Moreover,
it has evinced a clear goal of “increasing the guideline penalties and reducing the incidence
of downward departures” for child pornography offenses. U.S. Sent’g Comm’n, The
History of the Child Pornography Guidelines 6 (2009); accord United States v. Pugh,
515 F.3d 1179, 1198 (11th Cir. 2008) (tracing the increasing severity over time of penalties
for child pornography crimes). Not only did Fitzpatrick commit serious offenses, but he
also showed a lack of remorse, joking about committing additional crimes even after
entering a guilty plea. Yet, despite Fitzpatrick’s conduct, the district court never addressed
the seriousness of his crimes or explained how its sentence fulfilled § 3553(a)(2)(A).
Second, the court failed to account for the need for its sentence to promote respect
for the law and ensure just punishment for the offense. The Sentencing Guidelines advise
that the just punishment for Fitzpatrick’s offenses would be 188 to 235 months’
imprisonment, yet the court varied downward by more than 99% and imposed a 17-day
term of imprisonment. This sentence was even below what Fitzpatrick’s friends on the
Internet in chats after his guilty plea had jokingly expected that he would receive — “ur
gonna get like a month.” Moreover, the court does not appear to have considered how such
an extreme variance might contribute to unwarranted sentencing disparities.
10 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 11 of 14
Third, the court never considered how its sentence would deter others from
committing such crimes. See 18 U.S.C. § 3553(a)(2)(B). If anything, a 17-day sentence
for the commission of three serious felonies signals to would-be criminals that they might
get one free pass before facing any serious penalties.
Fourth and finally, the district court concluded that Fitzpatrick’s term of supervised
release would “protect the public from further crimes of the defendant,” 18 U.S.C.
§ 3553(a)(2)(C), because his parents would help supervise him at home. Yet, the court
seemingly failed to consider that Fitzpatrick immediately and continuously violated the
conditions of his presentence release while at home under the supervision of his parents.
Indeed, Fitzpatrick committed the very offenses at issue while living at home with his
parents.
Instead of addressing these required sentencing factors, the district court focused
almost exclusively on Fitzpatrick’s personal history and characteristics. But even as to that
factor, the court failed to identify any evidence to support its sweeping conclusion that the
Federal Bureau of Prisons could not manage Fitzpatrick given his mental condition. When
pressed at oral argument about the lack of record evidence that could support the court’s
claim, Fitzpatrick’s counsel stated that the Bureau of Prisons’ inability to treat inmates
“wasn’t addressed on the record” but had “certainly been addressed in the public forum,”
submitting that it was “common knowledge” that the Bureau of Prisons is an “agency in
crisis even as to dealing with mentally sound inmates.” The government properly responds,
however, that such “common knowledge” is not supported by the record and that the
Bureau of Prisons houses and treats mentally ill inmates all the time.
11 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 12 of 14
In short, § 3553(a) requires that a sentence be sufficient to serve the purposes of
punishment, deterrence, and incapacitation, among others. And a sentence of 17 days
based simply on Fitzpatrick’s personal history and characteristics does not fulfill those
purposes. We conclude, therefore, that it was substantively unreasonable.
This case is substantially similar to and indeed governed by our decision in United
States v. Zuk. In Zuk, we concluded that arguments nearly identical to those pressed by
Fitzpatrick here did not justify a major downward variance given all the circumstances
presented in that case. Zuk, who at sentencing was 22 and diagnosed with autism, pleaded
guilty to possession of child pornography. 874 F.3d at 400. The undisputed evidence
showed that he had possessed nearly 14,000 images and had “communicated on a daily
basis with a 16-year-old who was sexually abusing his 5-year-old cousin,” id. at 400, and
that he directed the 16-year-old “to produce specific sadistic images” of his abuse, id. at
411. During the sentencing hearing, the district court heard expert testimony that Zuk was
unlikely to recidivate if he received proper treatment. Id. at 403. Although another expert
opined that Zuk’s autism had contributed to the offense, there was no evidence that it had
caused his criminal conduct. Id. at 404, 411. Zuk urged the court to take into account the
fact that he had autism and that his brain was not fully developed at the time he committed
his offense. Id. at 403. Zuk also emphasized that he was twice assaulted in prison while
awaiting sentencing and would only be further victimized if sentenced to a lengthy term of
incarceration. Id. at 402, 408. The district court, relying almost exclusively on Zuk’s
autism, varied downward from a Guidelines sentence of 240 months’ imprisonment to a
time-served sentence of 26 months. Id. at 406.
12 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 13 of 14
When the government challenged the substantive reasonableness of the sentence on
appeal, Zuk argued that the district court’s sentence was substantively reasonable because
it considered:
(1) how his autism spectrum disorder mitigated his culpability for his conduct and affected his treatment needs;
(2) the importance of Zuk’s receiving intensive sex-offender treatment in a therapeutic community . . . while his brain was still developing; and
(3) his vulnerability in prison due to his autism spectrum disorder and slight frame.
Zuk, 874 F.3d at 408. We disagreed and vacated the district court’s sentence as
substantively unreasonable, explaining that the time-served sentence “fail[ed] in a message
of deterrence, d[id] not adequately protect the public, and undoubtedly d[id] not promote
respect for the law.” Id. at 411. We concluded that “when a district court focuses so
heavily on a single sentencing purpose only tangentially connected to a defendant’s grave
criminal misconduct, it risks abusing its discretion.” Id. at 410.
Just as in Zuk where no expert testified that Zuk’s medical condition caused his
criminal conduct, no expert testified in this case that Fitzpatrick’s condition caused his
criminal misconduct. At most, Dr. Belchic-Schwartz stated that Fitzpatrick faced
“substantial difficulty resisting impulses and considering consequences before acting.”
That statement, however, does not suggest that Fitzpatrick’s autism caused his crimes, nor,
for that matter, does it distinguish him from most people who commit crimes. Likewise,
the record here does not support Fitzpatrick’s assertion that he could not “truly understand[]
the consequences of [his] acts.” Indeed, the record contradicts that position. Fitzpatrick’s
13 USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 14 of 14
conduct involved the sophisticated creation, promotion, and operation of a data-breach
website that, under his supervision, became the largest of its kind in the English-speaking
world. Even after he pleaded guilty, Fitzpatrick lied to his friends and asserted that he
never viewed child pornography. He also downloaded and utilized VPNs to hide both his
initial criminal conduct and his repeated violations of his conditions of presentence release.
Such conduct reveals clearly that Fitzpatrick knew what he was doing was wrong and chose
to do it anyway, as well as to hide it — again, much like the defendant in Zuk. See 874 F.3d
at 411.
We noted in Zuk that a district court risks abusing its discretion when it grants a
defendant’s request for a major downward variance based almost exclusively upon the
defendant’s personal history and characteristics. See 874 F.3d at 410. Here, we conclude
that the district court’s reliance on only Fitzpatrick’s personal history and characteristics
constituted just such an abuse of discretion. The district court failed to impose a sentence
that accounted for the severity of Fitzpatrick’s offenses, the need to punish and provide
respect for the law, the need to adequately deter criminal conduct, and the need to protect
the public from further crimes. Simply put, a 17-day sentence does not fulfill those
required sentencing purposes and therefore was substantively unreasonable.
Accordingly, we vacate Fitzpatrick’s sentence and remand for resentencing in
accordance with the principles set forth herein.
VACATED AND REMANDED