PRECEDENTIAL
UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT _______________
Nos. 19-1640 & 20-3448 _______________
UNITED STATES OF AMERICA
v.
HO KA TERENCE YUNG, Appellant. _______________
On Appeal from the United States District Court for the District of Delaware (D.C. No. 1:17-cr-00014-001) District Judge: Honorable Leonard P. Stark _______________
Argued: January 12, 2022
Before: RESTREPO, BIBAS, and ROTH, Circuit Judges
(Filed: June 13, 2022) _______________
Peter Goldberger [ARGUED] 50 Rittenhouse Place Ardmore, PA 19003 Edson A. Bostic Tieffa N. Harper FEDERAL PUBLIC DEFENDER’S OFFICE 800 King Street, Suite 200 Wilmington, DE 19801 Counsel for Appellant
Ruth Mandelbaum [ARGUED] Shawn A. Weede UNITED STATES ATTORNEY’S OFFICE 1313 N. Market St. Hercules Building, Suite 400 Wilmington, DE 19801 Counsel for Appellee _______________
OPINION OF THE COURT _______________
BIBAS, Circuit Judge. The First Amendment limits the government’s power to punish offensive or annoying speech. Convicted under a cyber- stalking statute, Ho Ka Terence Yung challenges that law as overbroad. But to avoid this problem, we read the statute nar- rowly and so will affirm his conviction. Yung also challenges his restitution order. Yung had waived much of his right to appeal, including any challenge to the restitution order. But enforcing that waiver would threaten the separation of powers, so we must hear Yung’s challenge. And because part of the restitution order was not authorized by statute, we will vacate that order.
2 I. THE SPURNED APPLICANT TURNS CYBERSTALKER Yung wanted to go to Georgetown Law. He had good grades and strong test scores. So Georgetown invited him to interview with an alumnus. But that interview went poorly. Yung thought his interviewer was insensitive and rude. And a few weeks later, Georgetown rejected him. Though Yung eventually got into a good law school, Georgetown’s rejection still stung. So a year later, he struck back against the interviewer. First, he launched a cyber- campaign: he created fake obituaries for the interviewer’s wife and son; social-media profiles littered with Ku Klux Klan con- tent in the interviewer’s name; and blog posts as the inter- viewer, bragging about raping women, a boy, and an eight- year-old girl. A Google search of the interviewer’s name re- vealed thousands of similar posts. As a reader of the posts re- marked: “Someone is really out to nail this guy to a cross.” JA 219. Next, Yung filed false reports. Posing as a female Georgetown applicant on law school fora, he accused the inter- viewer of groping, bigotry, and threatening professional retal- iation. And in reports to the Better Business Bureau, he ac- cused the interviewer of sexually assaulting a female associate and berating prospective employees. He “strongly encouraged [the interviewer’s employer] to fire this dirty old man.” JA 176. Yung’s cyber-harassment spilled over into the real world. Impersonating the interviewer’s wife, he published an online ad seeking a sex slave. When one man responded to the ad, Yung ordered him to spy on the family. The wife, another ad
3 claimed, “like[d] it when a man puts his hand around [her] throat and threaten[s] [her] with a knife” and “gun” before forc- ing her to have sex. JA 168. Because of Yung’s antics, the in- terviewer’s family got hundreds of phone calls from men seek- ing sex with the interviewer, his wife, or their son. “[Y]ou pick up the phone and the first thing they ask is how big is your … genitalia,” the interviewer testified. JA 325. Responding to other sexual ads, strange men even came to the interviewer’s home in the wee hours of three consecutive mornings. This harassment campaign turned the family’s life into a “nightmare.” JA 295. They were terrified that every strange visitor sought to “rape and murder” them. JA 296. They worked with police to plan safe hiding places in their home in case someone broke in. They disconnected their phone every night and quit walking around the neighborhood. And they feared that they would “never know [normalcy] again.” JA 296. Because the family’s son studied at Georgetown, the family informed it of the threat. Georgetown worried that the son would be targeted there too, so it added security. Eventually, the interviewer hired lawyers and cyber-inves- tigators, “begging” them to track down the puppeteer. JA 162. Working with the FBI, the investigators traced it all back to Yung. Yung was charged with cyberstalking. 18 U.S.C. §§ 2261A(2)(B) & 2261(b). Faced with a mountain of evi- dence, he challenged the cyberstalking law as overbroad under the First Amendment. But when that challenge failed, he
4 pleaded guilty. Though he waived most of his right to appeal, he reserved his right to appeal the overbreadth ruling and any sentence above the statutory maximum. Yung was sentenced to nearly four years in prison plus three years of probation. He was also ordered to pay restitution for the interviewer’s investigative costs (nearly $70,000) and Georgetown’s security measures ($130,000). On appeal, Yung revives his overbreadth challenge and contests the restitution order. The government responds that his plea agreement lets him appeal only overbreadth, not restitu- tion. We review each issue de novo. United States v. Gonzalez, 905 F.3d 165, 190 (3d Cir. 2018); United States v. Quillen, 335 F.3d 219, 221 (3d Cir. 2003). II. THE CYBERSTALKING STATUTE IS NOT OVERBROAD Yung first challenges his conviction under the cyberstalk- ing law. He does not argue that it restricts his protected speech or is improper as applied to him. And he likely could not. The First Amendment does not protect defaming a private person or making “true threats”: that is, “serious[ly] express[ing] an intent to commit an act of unlawful violence to” particular peo- ple. Virginia v. Black, 538 U.S. 343, 359 (2003); see Chaplin- sky v. New Hampshire, 315 U.S. 568, 572 (1942). Rather than challenge the law as applied, Yung attacks it as overbroad and thus facially invalid. He says it “punishes a sub- stantial amount of [others’] protected free speech.” Yung Br. at 18–19 (quoting Virginia v. Hicks, 539 U.S. 113, 118–19 (2003)).
5 Overbreadth doctrine is a constitutional anomaly. Ordinar- ily, litigants lack standing to challenge laws simply because they “may conceivably be applied unconstitutionally to others.” Broadrick v. Oklahoma, 413 U.S. 601, 610 (1973). But we have relaxed that standing requirement in First Amendment cases to stop overbroad laws from chilling protected speech. Id. at 612. Yet invalidating a law as overbroad is “strong medicine” that we should use “sparingly.” Id. at 613. Courts must hesitate before stopping the government from prosecuting conduct that it has the power to ban. Id. at 615. And the overbreadth excep- tion to ordinary standing rules has been cogently criticized. See United States v. Sineneng-Smith, 140 S. Ct. 1575, 1583–88 (2020) (Thomas, J., concurring). So we will not expand it. Before striking down a law, we must ensure that any over- breadth is both “real” and “substantial.” Broadrick, 413 U.S. at 615. Because we can avoid reading this statute as overbroad, we will. Id. at 613; New York v. Ferber, 458 U.S. 747, 769 n.24 (1982). A. The statute Congress enacted the cyberstalking law in 2006 and broad- ened it in 2013. As amended, it makes a defendant a cyber- stalker if he checks three boxes:
• An act. The defendant must “use[ ] the mail, any interactive computer service or electronic communication service or … system …, or any other facility of interstate or foreign commerce”
6 at least twice. 18 U.S.C. § 2261A(2); see also § 2266(2).
• An intent. He must have acted “with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person.” § 2261A(2).
• A result. Finally, his actions must cause some emotional response. They must either put the target “in reasonable fear of … death … or seri- ous bodily injury,” or “cause[ ], attempt[ ] to cause, or … be reasonably expected to cause sub- stantial emotional distress.” § 2261A(2)(A), (B). Because Yung pleaded guilty to the emotional- distress result element, we focus on that one. This is not the first time that we have entertained an over- breadth challenge to the statute. A few years ago, we rejected an overbreadth challenge to the 2006 version of Section 2261A. Gonzalez, 905 F.3d at 190 n.10. But the 2013 amend- ment broadened its scope. Now the law punishes not only those who intend to harass, but also those who intend to intimidate. Compare 18 U.S.C. § 2261A(2) (2006), with id. (2013). Plus, a defendant no longer has to cause substantial emotional distress. It is enough that his conduct be “reasonably expected to cause” such distress. Compare id. (2006), with id. (2013). Because the revised law reaches further, we must review it again. The government argues that the act, intent, and result ele- ments limit prosecution to “prohibited actions with a serious criminal intent” that “cause serious harm.” Gov’t Br. 27; see
7 United States v. Ackell, 907 F.3d 67, 74–77 (1st Cir. 2018) (adopting the government’s position). Read that way, there would be no First Amendment problem. Yung counters that the law punishes lots of protected speech. Ultimately, we reject Yung’s argument. True, if read broadly, the statute would punish protected speech. We agree with Yung that the act and result elements are not enough to save it. But if we can, we must read the statute narrowly enough to avoid constitutional problems. And here, a narrow reading of the statute’s intent element is plausible. So the statute is not overbroad. B. The act element captures both conduct and speech By itself, the act element does not prevent overbreadth. The more speech a law punishes, the likelier it is to be overbroad. Hicks, 539 U.S. at 124. Here, we reject the government’s posi- tion that the cyberstalking “statute focuses on conduct, not speech.” Gov’t Br. at 24. Rather, it reaches a lot of speech: it targets emails, texts, and social media posts, like the ones Yung wrote. Thus, we must decide whether the speech it reaches is protected by the First Amendment. C. The result element alone does not save the statute The result element does little to confine the law to unpro- tected speech. The law, for instance, punishes people for acting in a way that “causes, attempts to cause, or would be reasona- bly expected to cause substantial emotional distress.” 18 U.S.C. § 2261A(2)(B). True, the “[s]ubstantial” emotional dis- tress must be “fairly large,” more than mere annoyance. Sub- stantial (def. 9), The Oxford English Dictionary (2d ed. 2000).
8 Even so, the law captures much speech, in part because it does not require that emotional distress be objectively reasonable. Though we hope that Americans can discuss sensitive issues without taking offense, that is not always so. And the law pe- nalizes speech even when a listener’s distress is unexpected or idiosyncratic. That is a problem. The First Amendment protects lots of speech that is substantially emotionally distressing. Protesters may picket a marine’s funeral with signs like “Thank God for Dead Soldiers,” “God Hates Fags,” and “You’re Going to Hell.” Snyder v. Phelps, 562 U.S. 443, 448 (2011). And a por- nographer may parody a famous minister as having drunken sex with his mother. Hustler Mag. v. Falwell, 485 U.S. 46, 47– 48, 51 (1988). These statements are deeply offensive, yet still covered by the First Amendment. So neither the act nor the result element suffices to narrow the law’s wide reach. D. The intent element, narrowly construed, saves the statute 1. Broadly construing intent to harass or intimidate would raise constitutional problems. Recall that the statute punishes only defendants who “inten[d] to kill, injure, harass, intimi- date, or place under surveillance with intent to kill, injure, har- ass, or intimidate another person.” 18 U.S.C. § 2261A(2). Even speech “directed to inciting or producing imminent lawless ac- tion” is unprotected by the First Amendment. Brandenburg v. Ohio, 395 U.S. 444, 447 (1969) (per curiam). So “intent to kill,
9 injure, … or place under surveillance with intent to kill, [or] injure” is unprotected. § 2261A(2). But “intent to … harass [or] intimidate” is another matter. Id. If we read those words broadly, the law will reach protected speech. Take the verb “harass.” It can mean aggression, even violence: “worry[ing] and imped[ing] by repeated attacks.” Harass (def. 1b), Webster’s Third New International Diction- ary of the English Language Unabridged (1966); accord Har- ass (def. 3), Oxford English Dictionary (2d ed. 1989) (OED). But “harass” can also mean “to vex, trouble, or annoy contin- ually or chronically.” Harass (def. 2b), Webster’s Third; see also Harass (def. 4), OED. These poles mark a spectrum from repeated annoyance to outright violence. Like harassment, intimidation has both narrow and broad meanings. To “intimidate” can mean a specific, violent action. It “esp[ecially]” means “to force [someone] to or deter [him] from some action by threats or violence.” Intimidate, OED; ac- cord Intimidation, Black’s Law Dictionary (10th ed. 2014) (“Unlawful coercion; extortion.”). But “intimidate” can also mean broadly “[t]o render timid, inspire with fear; to overawe, cow.” Intimidate, OED. Harassment and intimidation, narrowly construed, are pun- ishable. “Intimidation in the constitutionally proscribable sense of the word … plac[es] the victim in fear of bodily harm or death.” Black, 538 U.S. at 360 (emphasis added). Harassing debt collection and coercive threats are also unprotected. See, e.g., Barr v. Am. Ass’n of Pol. Consultants, 140 S. Ct. 2335, 2347 (2020) (suggesting that the Constitution lets Congress regulate the way people collect debts); Saxe v. State Coll. Area
10 Sch. Dist., 240 F.3d 200, 208 (3d Cir. 2001) (Alito, J.) (describ- ing a “robber’s demand ‘your money or your life’ ” as an un- protected threat); cf. Bronson v. Kinzie, 42 U.S. 311, 315–16 (1843) (recognizing the ability of a state to “secure its citizens from unjust and harassing litigation”). Yet the broader definitions of “harass” and “intimidate” can describe nonviolent, nonthreatening speech. Filling a city councilman’s voicemail box with complaints about his vote on a controversial municipal ordinance may “vex” or “cow” him. Ranting in the comments section of a website that a senator voted to lock refugee kids in cages could well “annoy [her] continually or chronically” or “render [her] timid.” Or, to take a couple more mundane examples, “negative restaurant re- views left on Google or Yelp, irate emails sent to service pro- viders (contractors, plumbers, etc.), … or antagonistic com- ments left on news sites” are often persistently annoying or even scary. People v. Moreno, 2022 WL 894725, at *5 (Colo. Mar. 28, 2022). Each might satisfy the statute’s act and intent elements, read broadly, and (depending on the recipient’s reac- tion) the result element too. But criminalizing that speech would collide with the First Amendment. The First Amendment protects at least some speech that persistently annoys someone and makes him fear- ful or timid. As then-Judge Alito observed: “There is no cate- gorical ‘harassment exception’ to the First Amendment’s free speech clause.” Saxe, 240 F.3d at 204. Though “non-expres- sive, physically harassing conduct is entirely outside [its] am- bit,” “deeply offensive” speech is not. Id. at 206 (emphasis added). On the contrary, “the free speech clause protects a wide
11 variety of speech that listeners may consider deeply offensive.” Id. Thus, broad harassment laws that punish offensive speech “steer[ ] into the territory of the First Amendment.” DeAngelis v. El Paso Mun. Police Officers Ass’n, 51 F.3d 591, 596 (5th Cir. 1995) (Title VII); see also Dambrot v. Cent. Michigan Univ., 55 F.3d 1177, 1183 (6th Cir. 1995) (university speech policy). And courts have often struck them down. See, e.g., State v. Brobst, 857 A.2d 1253, 1255–56 (N.H. 2004) (holding overbroad a harassment statute covering any speech made “with the intent to annoy or alarm another”); Ex parte Barton, 586 S.W.3d 573, 584–85 (Tex. Ct. App. 2019) (same); Moreno, 2022 WL 894725, at *5–6 (same). So here too, we must ensure that the cyberstalking statute does not “present[ ] a ‘realistic danger’ [that] the [Government] could compro- mise” First Amendment protections. Dambrot, 55 F.3d at 1183. 2. Though the text supports the broad reading, constitu- tional avoidance tells us to select the narrow one. To decide between the broad and narrow readings, we use ordinary tools of statutory interpretation. Here, those tools support the broad reading of the statute. Even so, the narrow reading is textually plausible. Because that definition will not “twist the text be- yond what it will bear,” we must adopt it. Amy Coney Barrett, Substantive Canons and Faithful Agency, 90 Boston U. L. Rev. 109, 141 (2010) (defining constitutional avoidance); see Fer- ber, 458 U.S. at 769 n.24. To start, we acknowledge the strong textual arguments in favor of the broad reading. For one, reading the statute broadly
12 fits with two canons of construction: consistent usage and sur- plusage. One of the statute’s result elements tracks the narrow definition of “intimidate” word for word: “places that person in reasonable fear of … death … or serious bodily injury.” 18 U.S.C. § 2261A(2)(A); Black, 538 U.S. at 360. Yet the intent element merely says “intimidate,” without elaborating. So if we read the intent element’s use of “intimidate” to mean “plac- ing [a person] in fear of bodily harm or death,” we create an inconsistent-usage problem. Black, 538 U.S. at 360. Normally, where Congress uses different words, we read those words to have different meanings. See Antonin Scalia & Bryan A. Gar- ner, Reading Law: The Interpretation of Legal Texts 170 (2012) (presumption of consistent usage). And that suggests Congress meant “intimidate” to mean something different from “intent to cause fear of harm or death.” The broad reading pro- duces that result; the narrow one does not. Plus, the other result element requires only that the act “cause[d] … substantial emotional distress.” § 2261A(2)(B). So causing “substantial emotional distress” presumably in- cludes something other than putting someone in fear of bodily harm. And someone who fears death or injury is usually dis- tressed too. Thus, the narrow reading would let the government charge most crimes under § 2261A(2)(B), leaving § 2261A(2)(A)’s fear element almost “meaningless.” Yates v. United States, 574 U.S. 528, 543 (2015) (canon against sur- plusage); see §§ 2261(b), 2261B(a) (setting the same penalties for both crimes). Statutes typically do not work that way. But though that problem borders on surplusage, it does not foreclose the narrower reading. Even under our narrow
13 reading, the result elements would not be entirely superfluous. Imagine a defendant who intended to make his victim fear death or injury but produced a lesser emotional result: perhaps an incompetent criminal whose vague “threats” succeed only in upsetting their recipient through sheer persistence. The emotional-distress result element would let the statute reach that cyberstalker. Besides, these surplusage and consistent-usage concerns are “not absolute.” Lamie v. U.S. Tr., 540 U.S. 526, 536 (2004). Congress is not always precise when drafting statutes; it occa- sionally “use[s] different words to denote the same concept.” Scalia & Garner, Reading Law 170. Thus, concerns about re- dundancy only “supply a clue as to the better interpretation of the statute.” Rimini St., Inc. v. Oracle USA, Inc., 139 S. Ct. 873, 881 (2019). And courts may accept a reading that creates sur- plusage if “some maxim point[s] in a different direction.” Chickasaw Nation v. United States, 534 U.S. 84, 94 (2001) (in- ternal quotation marks omitted). For instance, presuming “in- artful drafting,” the Supreme Court has accepted a construction of the Affordable Care Act that it acknowledged created sur- plusage. See King v. Burwell, 576 U.S. 473, 491 (2015). A second point in favor of the broad reading: it fits with how juries infer intent. We often instruct them to “consider the natural and probable results or consequences” of a defendant’s acts and ask if he “intended those results or consequences.” United States v. Sussman, 709 F.3d 155, 177 (3d Cir. 2013). Here, a jury would consider whether a defendant intended to cause the “substantial emotional distress” that resulted. On that approach, “intent to intimidate” could include intentionally
14 causing an emotional reaction generally (the broader reading), not just intentionally causing fear of physical harm (the nar- rower reading). But harassment statutes sometimes do limit a jury’s ability to lean on the natural and probable causes of conduct to infer the defendant’s intent. Indeed, a few states require prosecutors to show “intent to place [a] person in imminent fear of death or bodily injury” even when the result is mere “substantial emo- tional distress.” Commonwealth v. Cullen, 947 N.E.2d 1147, 1150 (Mass. App. Ct. 2011); accord State v. Diez, 811 So. 2d 1020, 1024 (La. Ct. App. 2002). Thus, though these textual clues suggest that the broader reading is the better reading, they do not render the narrower reading implausible. And other textual clues justify the nar- rower reading too: neighboring terms reinforce reading “intim- idate” and “harass” narrowly. When construing a word, we give it “more precise content” that fits with “the neighboring words with which it is associated.” Williams, 553 U.S. at 294 (explaining the “commonsense canon of noscitur a sociis”). Here, both “kill” and “injure” are violent verbs. After those verbs, one naturally reads “intimidate” to mean putting the vic- tim in fear of death or injury. And one naturally reads “harass” to mean a course of conduct designed to distress the victim by threatening, intimidating, or the like. Yung’s campaign of ter- ror, inciting sexual violence against the interviewer and his family at their home, exemplifies the narrower kind of harass- ment and intimidation. To “intimidate,” we hold, a defendant must put the victim in fear of death or bodily injury. And to “harass,” he must
15 distress the victim by threatening, intimidating, or the like. That reading limits intent to harass to “criminal harassment, which is unprotected because it constitutes true threats or speech that is integral to proscribable criminal conduct.” Ac- kell, 907 F.3d at 76. It also limits “intent to intimidate” to what it “especially” means, a form of true threats or speech integral to a crime. Id.; Intimidate, OED. Those narrow readings ensure that protected speech largely escapes the law’s net. Thus, we can avoid the “strong medicine” of invalidating the statute as facially overbroad. Broadrick, 413 U.S. at 613. In reading the statute narrowly, we reaffirm our earlier de- cision upholding the cyberstalking statute. Gonzalez, 905 F.3d at 190 n.10 (2006 version). And we join every other circuit that has evaluated the law. United States v. Fleury, 20 F.4th 1353, 1362–63 (11th Cir. 2021) (current version); Ackell, 907 F.3d at 77 (same); see also United States v. Sayer, 748 F.3d 425, 436 (1st Cir. 2014) (2006 version); United States v. Bowker, 372 F.3d 365, 379 (6th Cir. 2004) (same), vacated on other grounds, 543 U.S. 1182 (2005); United States v. Petrovic, 701 F.3d 849, 856 (8th Cir. 2012) (same); Osinger, 753 F.3d at 944–45 (same). E. We will affirm, not vacate, Yung’s conviction Because we adopt this “limiting construction” to save the statute, Yung urges us not to affirm. Yung Br. 27 n.22. Rather, he claims, we should “vacate [his] conviction and remand with leave to withdraw his plea and reconsider his options under that new legal landscape.” Id. His brief does not say why. But at argument, his counsel hinted that, because Yung did not know
16 how we would later read the statute, his plea could not have been “knowing and intelligent.” Oral Arg. Tr. 9:13. Not so. For a defendant’s guilty plea to be knowing and in- telligent, he must be of sound mind, understand the nature of the charges and the direct penal consequences, and have the advice of competent counsel. Brady v. United States, 397 U.S. 742, 755–56 (1970). But he may not later withdraw his plea just because he “did not correctly assess every relevant factor entering into his decision.” Id. at 757. For instance, even if a defendant pleaded guilty to avoid the threat of the death pen- alty, and a court later struck that threat down, his plea still stands as knowing. Id. at 755. Indeed, at argument, Yung’s counsel argued that to vacate his conviction, we would have to craft a new guilty-plea rule for overbreadth challenges. Oral Arg. Tr. 10:13–11:9. But even if we were to consider that novel idea, Yung forfeited it: he tucks it into a single footnote, without supporting authority or analysis. John Wyeth & Bro. Ltd. v. CIGNA Int’l Corp., 119 F.3d 1070, 1076 n.6 (3d Cir. 1997) (Alito, J.). So his conviction stands. III. THE DISTRICT COURT PROPERLY ORDERED RESTITU- TION TO THE INTERVIEWER, BUT NOT GEORGETOWN
The District Court ordered Yung to pay restitution to his victim and Georgetown. Yung challenges both orders, claim- ing that the statute does not authorize them. The government counters that Yung waived his right to appeal the orders. But any such waiver is unenforceable. And on the merits, only res- titution to the interviewer is authorized by statute.
17 A. Yung could not waive his claim that the restitution order exceeds the statute
In his plea agreement, Yung waived “the right to file any appeal,” with limited exceptions. JA 122 ¶ 10. For instance, he “reserve[d] the right” to renew his overbreadth challenge and to contest any “sentence exceed[ing] the statutory maximum.” Id. Yet he never reserved the right to challenge the restitution order. Yung disagrees, arguing that his restitution order “exceeds the statutory maximum” because it is not “clearly authorized by [statute].” Reply Br. 8. But we have held that a restitution order can never exceed the “statutory maximum.” United States v. Leahy, 438 F.3d 328, 337–38 (3d Cir. 2006). That term implies some “range” of potential sentences from which the sentencing court must pick. Id. Yet restitution statutes au- thorize only one award: “the full amount of each victim’s losses.” Id. (quoting 18 U.S.C. § 3664(f)(1)(A)). “Thus, there is no restitution range” and no statutory maximum. Id. Even so, we will not enforce Yung’s waiver of his right to challenge the restitution order. See United States v. Gordon, 480 F.3d 1205, 1209–10 (10th Cir. 2007) (holding likewise). Doing so would let litigants subvert the Constitution’s struc- ture and thus “amount[ ] to a miscarriage of justice.” United States v. Khattak, 273 F.3d 557, 562 (3d Cir. 2001); see also United States v. Teeter, 257 F.3d 14, 25 n.10 (1st Cir. 2001). True, we let defendants waive most of their individual rights because we treat plea bargains like contracts. See United States v. Williams, 510 F.3d 416, 422 (3d Cir. 2007). A
18 defendant, for instance, can waive his rights to counsel, to a jury trial, and even to confront his accusers, if he does so know- ingly and voluntarily. United States v. Mezzanatto, 513 U.S. 196, 200–01 (1995). Still, there are limits. Plea bargains are agreements between the executive branch, charged with “tak[ing] Care that the Laws be faithfully executed,” and a defendant subject to those laws. U.S. Const. art. II, § 3. Judges must ensure that a bargain respects those laws. So if it offends these structural principles, we need not enforce it. See Nancy J. King, Priceless Process: Nonnegotiable Features of Criminal Litigation, 47 UCLA L. Rev. 113, 154–58, 166–72 (1999). Thus, when the executive branch threatens to intrude upon the legislature’s power in a case before us, judges must rebuff that encroachment. For instance, we should not let a defendant waive his right to appeal a conviction for acts that are not a crime. Cf. Brady, 397 U.S. at 758; King, Priceless Process, at 168–69. Otherwise, we would let the government and a private party de facto create a new crime. But only Congress has that power in our limited government. United States v. Hudson & Goodwin, 11 U.S. (7 Cranch) 32, 32 (1812). Even if the de- fendant consents, we cannot turn a blind eye to punishment for acts not criminalized by Congress. The judiciary must safe- guard the separation of powers. Likewise, a defendant cannot waive his right to appeal a sentence unauthorized by Congress. And we cannot enforce such a waiver. United States v. Cohen, 459 F.3d 490, 497–98 (4th Cir. 2006); United States v. Thomas, 932 F.3d 1139, 1140– 41 (8th Cir. 2019); United States v. Phillips, 174 F.3d 1074,
19 1076 (9th Cir. 1999); Gordon, 480 F.3d at 1209; see also United States v. Chem. & Metal Indus., 677 F.3d 750, 752 (5th Cir. 2012). If we did so, we would be crafting our own punish- ment and thus “intrud[ing] into areas committed to [an]other branch[ ] of government.” Flast v. Cohen, 392 U.S. 83, 95 (1968). So Yung could not have waived his right to challenge whether the statute authorized his restitution order, and we must hear his appeal. B. The interviewer is entitled to restitution Now on to the merits. The District Court ordered Yung to pay the interviewer restitution for his investigative costs and attorney’s fees. The special restitution statute for cyberstalking victims is broad: it lets victims recover “attorneys’ fees” and “any … losses suffered … as a proximate result of the offense.” 18 U.S.C. § 2264(b)(3)(E), (G); see also Lagos v. United States, 138 S. Ct. 1684, 1689 (2018) (discussing § 2264). The question, then, is whether the interviewer’s losses were a “direct and foreseeable” result of the crime. Paroline v. United States, 572 U.S. 434, 449 (2014) (parsing 18 U.S.C. § 2259(b), worded similarly to § 2264(b)). They were. Yung used pseudonyms to defame the inter- viewer and recruited others to threaten his family. To make that campaign of harassment stop, they needed to track Yung down, report him to the authorities, and get charges filed against him. Because those expenses were foreseeable, this restitution order is valid.
20 C. Georgetown is not entitled to restitution But Georgetown should not get restitution. Unlike the in- terviewer, Georgetown was never itself harassed. Though it worried that Yung might eventually target its campus, he never did. So Georgetown does not qualify for the special cyberstalk- ing restitution statute. See 18 U.S.C. § 2264(c) (defining “vic- tim[s]” eligible under that statute). Instead, it could claim res- titution only under the general restitution statute. That law is far more limited. It allows recovery only if Georgetown showed that Yung’s “offense result[ed] in damage to or de- struction of property.” 18 U.S.C. § 3663(b)(1). The govern- ment claims that the property that Yung damaged “was the safety and security of Georgetown’s campus.” Oral Arg. Tr. 27:13. That is not enough, for two reasons. First, Georgetown can- not show that Yung damaged its property. Yung harmed no land, buildings, intellectual property, or the like. Rather, he threatened the safety of the campus, forcing Georgetown to beef up its security systems. We do not treat safety and security as a property right. True, we once extended restitution beyond tangible property to uphold restitution for a prosecutor’s loss of “hard-won convictions.” United States v. Hand, 863 F.2d 1100, 1104 (3d Cir. 1988). But Hand offered no definition or even explanation of how convictions could be property. And convictions are not analogous to safety on Georgetown’s cam- pus. So Hand does not persuade us to depart from the ordinary understanding of property here. See Gov’t of V.I. v. Davis, 43 F.3d 41, 46 (3d Cir. 1994) (distinguishing and limiting Hand).
21 Even if safety and security were property, Georgetown showed no damage to them. “Damage … reduces the value or usefulness of the [property] or spoils its appearance.” United States v. Quillen, 335 F.3d 219, 225 (3d Cir. 2003) (quoting Oxford American Dictionary 214 (1980)). For instance, we held that an anthrax scare damaged a mail room by making it temporarily “unusable.” Id. at 222. Yet Yung’s threats never made Georgetown’s campus unusable for students and faculty, or its security systems unusable for run-of-the-mill disturb- ances. Nor does Georgetown say that its security systems were unhelpful in dealing with Yung. It says only that it “had to de- ploy numerous, continuous security measures above and be- yond the customary means and methods” to protect its prop- erty. JA 518–19. That is not enough. * * * * * Cyberstalking is a serious crime that calls for serious pun- ishment. But courts must be vigilant to keep crimes and pun- ishments within the bounds of law. Cyberstalking laws must be read narrowly to avoid punishing protected speech. We cannot enforce appellate waivers that violate the separation of powers. And we must keep penalties within the confines authorized by Congress. Here, we are confident that Yung’s conviction is lawful, as is his duty to compensate the interviewer for the harm he caused. But because Georgetown suffered no damage to any property right, we will vacate that restitution order.