United States v. Paige Thompson

130 F.4th 1158
CourtCourt of Appeals for the Ninth Circuit
DecidedMarch 17, 2025
Docket22-30179
StatusPublished
Cited by3 cases

This text of 130 F.4th 1158 (United States v. Paige Thompson) is published on Counsel Stack Legal Research, covering Court of Appeals for the Ninth Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. Paige Thompson, 130 F.4th 1158 (9th Cir. 2025).

Opinion

FOR PUBLICATION

UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 22-30179

Plaintiff-Appellant, D.C. Nos. 2:19-cr-00159- v. RSL-1 2:19-cr-00159- PAIGE A. THOMPSON, RSL

Defendant-Appellee. OPINION

Appeal from the United States District Court for the Western District of Washington Robert S. Lasnik, District Judge, Presiding

Argued and Submitted June 5, 2024 Portland, Oregon

Filed March 17, 2025

Before: Johnnie B. Rawlinson, Danielle J. Forrest, and Jennifer Sung, Circuit Judges.

Opinion by Judge Forrest; Dissent by Judge Sung 2 USA V. THOMPSON

SUMMARY *

Criminal Law

The panel vacated Paige Thompson’s sentence and remanded for resentencing in a case in which Thompson committed the second largest data breach in the United States at the time, causing tens of millions of dollars in damage and emotional and reputational harm to numerous individuals and entities. The district court correctly calculated Thompson’s sentencing range under the Federal Sentencing Guidelines to be 168 to 210 months of imprisonment. It then granted a roughly 98% downward variance to time served (approximately 100 days) and five years of probation. The panel held that the district court overemphasized Thompson’s personal story and committed a clear error of judgment in weighing several of the factors set forth in 18 U.S.C. § 3553(a), which resulted in a substantively unreasonable sentence. The panel held that it was clear error for the district court to conclude that Thompson’s actions were not “malicious,” that Thompson did not do anything “bad” before she was caught, and that Thompson was “tortured and tormented about what she did,” given that these findings were not supported by the record. Noting that the district court considered that Thompson is transgender and autistic, and has suffered prior trauma in

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. USA V. THOMPSON 3

her life, the panel explained that Thompson’s personal background and characteristics are proper considerations at sentencing, but they may not be the sole basis for the chosen sentence. The panel explained that fraud crimes typically are calculated and, as a result, are particularly amenable to general deterrence. The district court’s failure to give this factor meaningful weight was a clear error of judgment. As for specific deterrence, the district court’s failure to consider highly relevant evidence of Thompson’ risk of recidivism was an abuse of discretion. Beyond the district court’s general acknowledgment that the Guidelines help avoid sentencing disparities, nothing in the record indicates that the district court weighed the risk of unwarranted disparity in choosing the sentence. Given the district court’s unsupported findings on some of the relevant facts, the panel concluded that the district court’s explanation for the sentence it imposed is inadequate to justify the resulting disparity between Thompson’s sentence and the sentences imposed in other cases, which is a weighty consideration given the extent of the district court’s variance. Dissenting, Judge Sung concluded that the sentence is substantively reasonable under an abuse of discretion standard. She wrote that while the majority clearly disagrees with the district judge’s conclusion that consideration of the § 3553(a) factors justified a sentence of probation and believes that the circumstances presented here were insufficient to sustain such a marked deviation from the Guidelines range, it is not for the Court of Appeals to decide de novo whether the justification for a variance is sufficient or the sentence reasonable. 4 USA V. THOMPSON

COUNSEL

Tania M. Culbertson (argued) and Andrew C. Friedman, Assistant United States Attorneys; Jessica M. Manca, Special Assistant United States Attorney; Tessa M. Gorman, Acting United States Attorney; Office of the United States Attorney, United States Department of Justice, Seattle, Washington; for Plaintiff-Appellant. Ann K. Wagner (argued) and Nancy Tenney, Assistant Federal Public Defenders; Vicki W.W. Lai, Chief Appellate Federal Public Defender; Office of the Federal Public Defender, Seattle, Washington; Mohammad A. Hamoudi, Stritmatter Kessler Koehler Moore, Seattle, Washington; for Defendant-Appellee. Tyler G. Welti, Venable LLP, San Francisco, California; Matthew D. Field and Harley L. Geiger, Venable LLP, Washington, D.C.; for Amicus Curiae The Center for Cybersecurity Policy and Law. USA V. THOMPSON 5

OPINION

FORREST, Circuit Judge:

Paige Thompson committed the second largest data breach in United States history at the time, causing tens of millions of dollars in damage and emotional and reputational harm to numerous individuals and entities. The district court correctly calculated Thompson’s sentencing range under the Federal Sentencing Guidelines (the Guidelines) to be 168 to 210 months of imprisonment. It then granted a roughly 98% downward variance to time served (approximately 100 days) and five years of probation. Because the district court made clearly erroneous findings and did not properly weigh the 18 U.S.C. § 3553(a) sentencing factors, we conclude that the sentence it imposed is substantively unreasonable, and we vacate and remand for resentencing. I. BACKGROUND A. The Crime Before the events at issue, Thompson worked as a Systems Engineer at Amazon Simple Storage Service (S3). S3 is “an object storage service” offered to businesses by Amazon Web Services (AWS). Amazon S3, Amazon Web Servs., https://aws.amazon.com/s3/ [https://perma.cc/L74B- 8GXY] (last visited Dec. 2, 2024). Over two years after her employment at Amazon ended, Thompson began hacking AWS customers’ accounts. She used a virtual private network service and The Onion Router network to anonymize her activity. Using a programming script, she scanned millions of publicly available IP addresses associated with AWS for vulnerabilities in their systems. 6 USA V. THOMPSON

When Thompson found vulnerable accounts, she queried them for security credentials and saved those credentials on her computer. The credentials allowed Thompson to authenticate directly into AWS customers’ cloud- computing 1 environments. Once inside, if the credentials permitted, Thompson ran a “sync” command to download data from customers’ cloud storage. In total, Thompson got credentials from at least 200 entities and stole data from at least 30 of them. For example, Thompson obtained Capital One’s security credentials and downloaded personally identifying information (PII) of 98 million Americans. Thompson then compressed and stored the data stolen from AWS customers on her computer, and she researched additional storage options. While Thompson did not sell or distribute any stolen information, she did research ways to profit from the data, bragged about possessing it, and encouraged others to hack vulnerable accounts. She also blamed her breaches on the companies’ inadequate cybersecurity. In addition to downloading private data, Thompson used AWS customers’ computing power to mine cryptocurrency 2—a cyberattack known as “cryptojacking.”

1 Cloud computing allows customers to “access technology services, such as computing power, storage, and databases, [over the internet] . . . from a cloud provider” “[i]nstead of buying, owning, and maintaining physical data centers and servers.” What is cloud computing?, Amazon Web Servs., https://aws.amazon.com/what-is-cloud-computing/ [https://perma.cc/XJ7F-ABA8] (last visited Dec. 2, 2024).

Free access — add to your briefcase to read the full text and ask questions with AI

Related

United States v. Scovotto
Ninth Circuit, 2026
United States v. Sablan
Ninth Circuit, 2025
United States v. White
Ninth Circuit, 2025

Cite This Page — Counsel Stack

Bluebook (online)
130 F.4th 1158, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-paige-thompson-ca9-2025.