In March 2023, Conor Brian Fitzpatrick, aka “Pompompurin,” was arrested at his home in New York. As a member of the former RaidForums, and as the owner and active participant in BreachForums, he was charged with one count each of:
18 U.S.C. § 1029(b)(2) and 3559(g)(1) Conspiracy to Commit Access Device Fraud;
18 U.S.C. § 1029(a)(6) and 2 Access Device Fraud – Unauthorized Solicitation; and
18 U.S.C. § 2252(a)(4)(B) and (b)(2) Possession of Child Pornography
Fitzpatrick subsequently pleaded guilty to all three counts. As part of the plea deal, and consistent with federal sentencing guidelines for his offense levels, the government sought a 15-year prison sentence plus restitution and supervised release. But while awaiting sentencing, Fitzpatrick violated his bond conditions. In December of 2023, he was arrested and detained for 17 days until his sentencing hearing. His failure to adhere to his bond conditions and his failure to really express genuine remorse for his actions and to accept full responsibility for his actions were noted by the prosecution as indicators that he was a high risk for recidivism, and that society needed to be protected from him by sending him to prison.
In a surprising turn of events, however, Fitzpatrick was sentenced to time served, restitution, and 20 years of supervised release with special conditions. The time served amounted to 17 days in a detention facility for violating his bond.
The government appealed, and the Fourth Circuit, after hearing oral arguments and reading the filings, agreed that the sentence was unreasonable in light of sentencing guidelines. The appellate court therefore vacated the sentence and remanded the case to the district court for re-sentencing consistent with sentencing guideline factors. As they explained in their opinion:
When selecting Fitzpatrick’s sentence, the district court relied only on his history and personal characteristics — his autism and youth — even though it acknowledged in passing the seriousness of his crimes. The court also mentioned briefly the need to protect the public when it imposed a 20-year term of supervised release, stating that such supervised release would “give[] us the best opportunity to try to protect the community.” (Emphasis added). But it never explained why supervised release was adequate, especially in light of Fitzpatrick’s repeated violations of his conditions of presentence release. And, most glaringly, the court never addressed, as required, how his sentence “achieve[s]” respect for the law, punishment, deterrence, and incapacitation, all of which are core purposes of sentencing. 18 U.S.C. §§ 3551(a), 3553(a)(2).
On September 16, Judge Brinkema — the same judge who sentenced Fitzpatrick originally — will re-sentence Fitzpatrick.
Both the government and defense counsel have submitted their pre-sentence memoranda with recommendations. Some of the appendices are sealed, but these filings reveal a bit more about Fitzpatrick’s psychiatric history and how he has been doing since his original sentence.
The Prosecution’s Recommendation
The government’s position has not changed from its original position. In a memorandum submitted by Erik Siebert, Lauren Halper, and Thomas Dougherty, the government seeks a minimum prison sentence of 188 months. As part of their submission, they include a statement from a former prison psychologist who claims that the Bureau of Prisons is capable of handling someone with the issues Fitzpatrick has (symptoms of Autism Spectrum Disorder and a history of suicide attempts).
From the introduction to the prosecution’s memorandum:
The defendant and his co-conspirators earned nearly $700,000 through the operation of BreachForums. The defendant’s crimes left numerous victims, many of whom suffered substantial monetary and reputational losses, and in the case of one victim company, the suicide death of its CEO. The defendant also downloaded and stored child pornography, including videos of prepubescent girls masturbating. In doing so, he perpetuated yet another set of victims.
The defendant now comes before the Court for resentencing after having pleaded guilty to conspiracy to commit access device fraud, in violation of 18 U.S.C. §§ 1029(b)(2) and 3559(g)(1); solicitation for the purpose of offering access devices, in violation of 18 U.S.C., §§ 1029(a)(6) and 2; and possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2). The applicable Guidelines range was correctly calculated in the Presentence Investigation Report (“PSR”) as 120 months’ imprisonment as to Counts 1 and 2 and 188 months to 235 months’ imprisonment as to Count 3. See Dkt. 63 (PSR) ¶ 122.
For the reasons below, the United States respectfully recommends that the Court impose a sentence of 188 months’ imprisonment, which is sufficient, but not greater than necessary, to reflect the seriousness of the crime, the significant harm caused by the defendant’s crimes, the risk of recidivism, and to deter the defendant and others who may seek to profit from this type of widespread cybercrime in the future.
Prior to reading this filing, DataBreaches had been unaware of any victim’s suicide. Perhaps any reference to it was in previously sealed filings, but it now features prominently in this unsealed memorandum, and the prosecution now seeks to increase the amount of restitution to include restitution for this victim. DataBreaches is not naming the corporate victim or the CEO, although it was possible from the prosecution’s filing and details about the incident to determine who Victim-5 was.
Unsurprisingly, the prosecution’s memorandum also emphasizes the fact that Fitzpatrick did not comply with the terms of his bond, did not show genuine remorse for his conduct, and even denied responsibility for some of his behavior. They note that although he tried to claim that his behavior was (partly) the result of not having support or treatment, he had actually been receiving treatment over a period of years.
Addressing any concern about whether Fitzpatrick could receive needed care or protections in prison, the prosecution submitted a report by a psychologist with past prison experience who asserts that prisons are equipped to evaluate and handle prisoners like Fitzpatrick. The prosecution also addresses reports by other mental health professionals who had evaluated Fitzpatrick, and pointed out that Fitzpatrick was lying to one therapist and that another professional mentioned problems that individuals with autism might experience, but there was nothing in Fitzpatrick’s records to indicate that those were issues for him.
The Defense’s Memorandum
Nina Ginsberg and Peter Katz are representing Fitzpatrick. Their memorandum stresses his mental health issues and the fact that he has allegedly been complying fully with the terms of his supervised release for the past 20 months. They write:
Ever since his sentencing – 20 months ago – Conor has been fully compliant with the Court’s conditions. For almost two years, Conor has been on home confinement with an inability to use any electronic device for the first year. He adhered to every one of the Court’s instructions. And this is no trivial feat. In essence, for 20 months, Conor has been in his own form of jail. For 12 months he had no form of communication with the outside world. In some ways, Conor’s punishment thus far has been more severe than if he had been in jail. Conor is well on his way to rehabilitation. Putting him in prison now for any extended period would serve no interest of society.
This dovetails with the second factor not fully evidenced during his first sentencing proceeding – the abject inability of the Bureau of Prisons to accommodate Conor’s needs in a way that would not subject him to grave risks of suicide, social and emotional regression and deterioration, and cruel and unusual punishment.
The concerns over Fitzpatrick’s history of suicide attempts and any social-emotional impairment due to ASD clearly are matters that the court needs to consider, although in the past, the district court judge appeared to have focused on them to the exclusion of other sentencing factors.
In support of the concerns they raise, the defense has submitted a 2024 report by the Department of Justice’s Office of the Inspector General that supports their claims that prisons are not really up to the task of handling someone with Fitzpatrick’s issues. They note that the prosecution’s submission claiming that prisons were capable was written by someone who had only limited experience working in a prison years ago, compared to the author of the 2024 report who had 24 years of experience, including recent experience.
In DataBreaches’ opinion: in a battle of competing opinions, the defense’s presentation on prisons is much stronger and more compelling than the prosecution’s report. But Judge Brinkema has already been shot down once on appeal for an unreasonably light sentence. She will not want to have another sentence vacated. So what will she do if she is still very concerned about Fitzpatrick’s mental health and ability to survive and cope in prison? What does the defense propose to help her justify a lenient sentence?
As we detail below, based upon all the current factors relevant to sentencing, we submit that the Court impose a sentence on Counts One and Two of 15 years of Probation with the special condition of intermittent commitment of one year of weekends (the maximum allowed by law) along with any other special conditions the Court deems appropriate to run concurrent to a sentence on Count Three of time served with 20 years of Supervised Release. This sentence comports with the Court of Appeals dictates as well as prevents Conor from becoming institutionalized or suffering the very real risk of cruel and unusual punishment as detailed below by the Bureau of Prisons’ immediate former Chief of Mental Health Services.
With respect to the Victim-5 material, they argue against the consideration of revising the restitution part of the sentence:
The government now seeks to expand restitution by introducing a new alleged victim (Victim-5) and evidence not previously presented. This effort is impermissible under controlling Fourth Circuit precedent and must be rejected. No valid explanation has been made regarding a more than 20-month delay in making such an application. Indeed, a cursory review of the government’s application indicates that the information provided by Victim-5 was known years before Conor’s original sentencing. There is no good faith explanation, nor legal basis for such a request now.
So what will Judge Drinkema do? What the defense proposes does not seem sufficient to serve as a deterrent to others who might want to run an online forum like BreachForums or who might want to middleman transactions or help others sell stolen data. Under the defense counsel’s proposal, Fitzpatrick would basically be getting probation for all his crimes on RaidForums and BreachForums except for weekend incarceration for a year. Does that seem appropriate as a punishment? Does it seem appropriate as a deterrent? If not, what are the alternatives?
What will Judge Drinkema do? We’ll find out next week.