USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 1 of 14

PUBLISHED

UNITED STATES COURT OF APPEALS

FOR THE FOURTH CIRCUIT

No. 24-4102

UNITED STATES OF AMERICA,

Plaintiff - Appellant,

v.

CONOR BRIAN FITZPATRICK,

Defendant - Appellee.

Appeal from the United States District Court for the Eastern District of Virginia, at
Alexandria. Leonie M. Brinkema, District Judge. (1:23-cr-00119-LMB-1)

Argued: October 29, 2024 Decided: January 21, 2025

Before NIEMEYER, RUSHING, and HEYTENS, Circuit Judges.

Vacated and remanded by published opinion. Judge Niemeyer wrote the opinion, in which
Judge Rushing and Judge Heytens joined.

ARGUED: Joseph Attias, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria,

Virginia, for Appellant. Andrew James Frisch, LAW OFFICES OF ANDREW J. FRISCH,
PLLC, New York, New York, for Appellee. ON BRIEF: Aarash A. Haghighat, Senior
Counsel, Computer Crime and Intellectual Property Section, UNITED STATES
DEPARTMENT OF JUSTICE, Washington, D.C.; Jessica D. Aber, United States Attorney,
Richmond, Virginia, Jacqueline R. Bechara, Assistant United States Attorney, Lauren
Pomerantz Halper, Assistant United States Attorney, OFFICE OF THE UNITED STATES
ATTORNEY, Alexandria, Virginia, for Appellant. Peter Neil Katz, LAW OFFICES OF
PETER KATZ, LLC, Princeton, New Jersey, for Appellee.
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 2 of 14

NIEMEYER, Circuit Judge:

Conor Fitzpatrick pleaded guilty to conspiracy to traffic in stolen personally

identifying information with intent to defraud, in violation of 18 U.S.C. § 1029(b)(2) and

§ 3559(g)(1); to fraudulent solicitation of personally identifying information, in violation

of 18 U.S.C. § 1029(a)(6); and to possession of child pornography, in violation of

18 U.S.C. § 2252(a)(4)(B) and (b)(2). While released on bond awaiting sentencing,

Fitzpatrick violated his conditions of release immediately by secretly downloading a virtual

private network, which he then used virtually every day to access the Internet without the

knowledge of his probation officer.

At sentencing, the district court calculated Fitzpatrick’s advisory Guidelines

sentencing range to be 188 to 235 months’ imprisonment. But based on Fitzpatrick’s

autism spectrum disorder and youth (21 years old at the time of sentencing), it sentenced

Fitzpatrick to a 17-day time-served term of imprisonment, concluding that the Federal

Bureau of Prisons would not be able to treat Fitzpatrick’s autism spectrum disorder and

that he would be “ravaged” in prison.

On appeal, the government contends that the district court abused its discretion by

imposing a substantively unreasonable sentence. We agree. Accordingly, we vacate the

sentence and remand for resentencing.

In March 2022, Fitzpatrick created an online marketplace called “BreachForums”

for the purchase and sale of personally identifying information that had been stolen by

2
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 3 of 14

hackers in data breaches, and he operated the site from March 2022 to March 2023. He

created the site after law enforcement had shut down a similar site called “RaidForums,”

of which he was a well-known member. With his active promotion of the BreachForums

site, it became the largest English-language data-breach forum ever, featuring over

14 billion individual records consisting of names, dates of birth, social security numbers,

employment information, and health insurance information. During the site’s year-long

operation, Fitzpatrick acted as a middleman and facilitated the purchase and sale of the

illegal information, earning $698,714 and causing many victims monetary and reputational

injury. FBI agents, operating undercover, accessed the BreachForums site in July 2022

and purchased the birth dates, social security numbers, and bank account information of

around 15 million Americans for approximately $5,000, ultimately giving rise to

Fitzpatrick’s arrest. A subsequent search of Fitzpatrick’s devices showed that he had also,

during this period, downloaded 26 files with at least 600 images of child pornography and

viewed videos that depicted prepubescent children engaging in sex acts.

Fitzpatrick was indicted in three counts for violating 18 U.S.C. §§ 1029, 3559, and

2252, and he pleaded guilty to the charges. He was released on bond pending sentencing,

subject to several special conditions. The conditions prohibited Fitzpatrick from accessing

the BreachForums website or knowingly contacting any BreachForums user or

coconspirator unless supervised by counsel. They also prohibited him from using a virtual

private network (“VPN”) to obfuscate his identity online. And they prohibited him from

accessing any computer or the Internet unless his probation officer had installed a

3
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 4 of 14

computer-monitoring program on that device, and even then, they prohibited him from

creating or registering any new websites.

Beginning immediately after his plea hearing and release and continuing thereafter

for approximately three months, Fitzpatrick violated the conditions of his release by

participating in various “Discord” chatrooms. He accessed these chatrooms by acquiring

a new iPhone and using a VPN to connect to the Internet to evade detection. During his

chatroom conversations, Fitzpatrick professed innocence to the very crimes to which he

had pleaded guilty, stating that his plea deal was “so BS” and that he had “wanted to fight

it.” He also joked with his friends about selling data to foreign governments, exhorting

one user to “become a foreign asset to china or russia” and to “sell government secrets.”

The chatroom participants also discussed hacking various targets.

Following the discovery of these violations of his conditions for release, Fitzpatrick

was detained pending sentencing for what turned out to be 17 days.

In preparation for sentencing, Fitzpatrick obtained psychological and psychosexual

evaluations from professional psychologists. Dr. Jill Belchic-Schwartz, a pediatric

psychologist, conducted tests that revealed Fitzpatrick had average general cognitive

functioning but manifested deficiencies in interpersonal skills, perspective-taking, and

social interests. For example, Dr. Belchic-Schwartz observed that Fitzpatrick lacked

friends outside of a small online community and spent most of his free time alone in his

room with his computer. She concluded that Fitzpatrick scored within the “autism” range

on a diagnostic measure and thus diagnosed him with autism spectrum disorder.

Otherwise, she observed that Fitzpatrick’s thoughts were logical and coherent. His insight

4
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 5 of 14

and judgments seemed only slightly immature. But his “social naiveté,” she opined, likely

enabled his online friends to pressure him to engage in cybercrimes. She recommended

that the court “strongly” consider alternatives to incarceration, such as a “therapeutic

placement,” as Fitzpatrick would have “difficulty navigating” a term of imprisonment.

Dr. Sara Liebert, a clinical psychologist, evaluated Fitzpatrick’s likelihood of

committing another sex-related offense. She administered an inventory to assess

Fitzpatrick’s likelihood of recidivism and determine specific treatment needs. She

concluded that Fitzpatrick’s need for sex-related treatment was moderate and that he had a

4.5 percent likelihood of committing another sex-based crime. She cited “mounting

evidence” that those who sexually offend as youths do not reoffend as adults and that those

convicted of child pornography do not reoffend. She saw no reason why Fitzpatrick would

be an outlier to those norms. At bottom, she recommended that Fitzpatrick participate in

sex-offense-specific therapy.

At sentencing, Fitzpatrick’s counsel presented these two psychologists’ reports to

the district court and argued vigorously for a variant sentence for time served based on

Fitzpatrick’s autism diagnosis and other personal characteristics. While the district court

initially seemed dubious about counsel’s arguments, it increasingly became concerned

about Fitzpatrick’s condition and the ability of the Bureau of Prisons to manage and treat

him. Following Fitzpatrick’s allocution, it commented, “This is among the most difficult

cases I’ve seen in quite a while in terms of sentencing, because the interplay between the

criminal justice system and the obvious extremely significant mental health issues that this

young man has are really very concerning. . . . My concern is [imprisoning in the general

5
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 6 of 14

prison population] a 21-year-old young man who is probably closer to a 16 or 17-year-old

in terms of actual maturity, I think the mental health records clearly would show that, and

someone with the very clear documented mental health history that we have — this is not

somebody who, you know, post criminal conduct all of a sudden develops mental health

issues. I mean, this young man has had them for years. . . . It’s a very, very sad case.”

After making those preliminary observations, the court sentenced Fitzpatrick as

follows:

In this case, the defendant has been in custody for two weeks, and he has
survived that, but only because he’s in a local jail and he’s in a mental health
unit. He’s not in general population. This young man in general population
I think would just be a disaster.

And so, although the court fully recognizes the seriousness of this criminal
conduct, I am going to sentence the defendant to a sentence of time served
[17 days], followed by a period of 20 years of supervised release.

After explaining other terms and conditions of the sentence, the court explained:

I think this gives us the best opportunity to try to protect the community as
well as to not see this young man just ravaged in a prison setting where he
would never get the mental health treatment that he needs, and he would,
again, be, I think, exposed to all kinds of problems. He would clearly be a
potential victim.

So that is why I’m imposing such an extensively variant sentence.

From the district court’s judgment dated January 19, 2024, the government filed this

appeal, contending that the district court abused its discretion in sentencing Fitzpatrick to

a 17-day time-served sentence.

6
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 7 of 14

II

The question presented in this case is whether Fitzpatrick’s 17-day sentence was

substantively unreasonable.

In sentencing Fitzpatrick, the district court properly calculated his Guidelines

sentencing range to be 188 to 235 months’ imprisonment. But after considering

Fitzpatrick’s history and personal characteristics, including his autism and youth, the court

imposed a time-served sentence of 17 days’ imprisonment. It explained that Fitzpatrick

(1) would be “a potential victim” in prison and (2) would not have access to adequate

treatment.

The government contends that Fitzpatrick’s 17-day imprisonment was substantively

unreasonable and therefore that the district court abused its discretion in imposing that

sentence. It notes that the court relied exclusively on Fitzpatrick’s personal characteristics

and ignored the need for his sentence to reflect the seriousness of his offense, to promote

respect for the law, to deter similar wrongdoing, and to protect the public. The government

also challenges the district court’s sweeping conclusion that the Federal Bureau of Prisons

categorically could not manage, much less treat, someone with Fitzpatrick’s

characteristics. It argues that this case is governed by our decision in United States v. Zuk,

874 F.3d 398 (4th Cir. 2017), where we concluded that a major downward variant sentence

based on similar personal characteristics was substantively unreasonable.

To defend the district court’s sentence, Fitzpatrick’s counsel focuses on

Fitzpatrick’s mental health struggles, arguing that his condition greatly undermined his

culpability for his offenses. Counsel posits that the “cause” of Fitzpatrick’s criminal

7
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 8 of 14

activity was his “mental health issues,” not greed or any other moral shortcoming. Indeed,

he argues that Fitzpatrick could not “truly understand[] the consequences of [his] acts.” He

asserts further that the district court reasonably concluded that the Bureau of Prisons lacks

the capacity to safely manage and treat Fitzpatrick.

The principles of sentencing are well established. A defendant found guilty of an

offense must be sentenced in accordance with 18 U.S.C. §§ 3551–3559 “so as to achieve

the purposes set forth in subparagraphs (A) through (D) of section 3553(a)(2) to the extent

that they are applicable in light of all the circumstances of the case.” 18 U.S.C. § 3551(a).

And those subparagraphs in turn provide that a district court must impose a sentence

sufficient, but not greater than necessary . . . (A) to reflect the seriousness of
the offense, to promote respect for the law, and to provide just punishment
for the offense; (B) to afford adequate deterrence to criminal conduct; (C) to
protect the public from further crimes of the defendant; and (D) to provide
the defendant with needed education or vocational training, medical care, or
other correctional treatment in the most effective manner.

18 U.S.C. § 3553(a)(2). The Supreme Court has characterized these purposes as retribution

(punishment), deterrence, incapacitation, and rehabilitation. See Rita v. United States,

551 U.S. 338, 347–48 (2007). And in fulfilling sentencing’s purposes, a district court must

consider and weigh (1) the nature of the offense and the defendant’s history and

characteristics; (2) the kinds of sentences legally available; (3) the advisory sentencing

range provided by the Sentencing Guidelines; (4) any relevant policy statement issued by

the Sentencing Commission; (5) the need to avoid unwarranted sentencing disparities; and

(6) the need for restitution. 18 U.S.C. § 3553(a). Within the context of these requirements,

8
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 9 of 14

however, a district court has considerable discretion to select the particular sentence to

impose. See United States v. Booker, 543 U.S. 220, 233 (2005).

In reviewing a sentence for substantive reasonableness, we independently “examine

the totality of the circumstances to see whether the sentencing court abused its discretion

in concluding that the sentence it chose satisfied the standards set forth in § 3553(a).”

United States v. Abed, 3 F.4th 104, 119 (4th Cir. 2021) (cleaned up); accord Gall v. United

States, 552 U.S. 38, 51 (2007).

When selecting Fitzpatrick’s sentence, the district court relied only on his history

and personal characteristics — his autism and youth — even though it acknowledged in

passing the seriousness of his crimes. The court also mentioned briefly the need to protect

the public when it imposed a 20-year term of supervised release, stating that such

supervised release would “give[] us the best opportunity to try to protect the community.”

(Emphasis added). But it never explained why supervised release was adequate, especially

in light of Fitzpatrick’s repeated violations of his conditions of presentence release. And,

most glaringly, the court never addressed, as required, how his sentence “achieve[s]”

respect for the law, punishment, deterrence, and incapacitation, all of which are core

purposes of sentencing. 18 U.S.C. §§ 3551(a), 3553(a)(2).

First, as to whether the sentence was sufficient “to reflect the seriousness of the

offense,” 18 U.S.C. § 3553(a)(2)(A), the court recognized generally that Fitzpatrick’s

criminal conduct was serious, but it seemingly gave this factor no weight. Yet, Fitzpatrick

created and operated the largest ever English-language online marketplace for buying and

selling stolen personal data, which featured over 14 billion individual records of millions

9
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 10 of 14

of persons. Moreover, many persons were injured by this conduct. Fitzpatrick also

downloaded at least 600 images of child pornography and viewed prepubescent girls

engaging in sexual acts. Congress has deemed child pornography violations as some of

the most serious of crimes, recognizing, as state legislatures also have, that it can “decrease

the production of child pornography if it penalizes those who possess and view the product,

thereby decreasing demand.” Osborne v. Ohio, 495 U.S. 103, 109–10 (1990). Moreover,

it has evinced a clear goal of “increasing the guideline penalties and reducing the incidence

of downward departures” for child pornography offenses. U.S. Sent’g Comm’n, The

History of the Child Pornography Guidelines 6 (2009); accord United States v. Pugh,

515 F.3d 1179, 1198 (11th Cir. 2008) (tracing the increasing severity over time of penalties

for child pornography crimes). Not only did Fitzpatrick commit serious offenses, but he

also showed a lack of remorse, joking about committing additional crimes even after

entering a guilty plea. Yet, despite Fitzpatrick’s conduct, the district court never addressed

the seriousness of his crimes or explained how its sentence fulfilled § 3553(a)(2)(A).

Second, the court failed to account for the need for its sentence to promote respect

for the law and ensure just punishment for the offense. The Sentencing Guidelines advise

that the just punishment for Fitzpatrick’s offenses would be 188 to 235 months’

imprisonment, yet the court varied downward by more than 99% and imposed a 17-day

term of imprisonment. This sentence was even below what Fitzpatrick’s friends on the

Internet in chats after his guilty plea had jokingly expected that he would receive — “ur

gonna get like a month.” Moreover, the court does not appear to have considered how such

an extreme variance might contribute to unwarranted sentencing disparities.

10
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 11 of 14

Third, the court never considered how its sentence would deter others from

committing such crimes. See 18 U.S.C. § 3553(a)(2)(B). If anything, a 17-day sentence

for the commission of three serious felonies signals to would-be criminals that they might

get one free pass before facing any serious penalties.

Fourth and finally, the district court concluded that Fitzpatrick’s term of supervised

release would “protect the public from further crimes of the defendant,” 18 U.S.C.

§ 3553(a)(2)(C), because his parents would help supervise him at home. Yet, the court

seemingly failed to consider that Fitzpatrick immediately and continuously violated the

conditions of his presentence release while at home under the supervision of his parents.

Indeed, Fitzpatrick committed the very offenses at issue while living at home with his

parents.

Instead of addressing these required sentencing factors, the district court focused

almost exclusively on Fitzpatrick’s personal history and characteristics. But even as to that

factor, the court failed to identify any evidence to support its sweeping conclusion that the

Federal Bureau of Prisons could not manage Fitzpatrick given his mental condition. When

pressed at oral argument about the lack of record evidence that could support the court’s

claim, Fitzpatrick’s counsel stated that the Bureau of Prisons’ inability to treat inmates

“wasn’t addressed on the record” but had “certainly been addressed in the public forum,”

submitting that it was “common knowledge” that the Bureau of Prisons is an “agency in

crisis even as to dealing with mentally sound inmates.” The government properly responds,

however, that such “common knowledge” is not supported by the record and that the

Bureau of Prisons houses and treats mentally ill inmates all the time.

11
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 12 of 14

In short, § 3553(a) requires that a sentence be sufficient to serve the purposes of

punishment, deterrence, and incapacitation, among others. And a sentence of 17 days

based simply on Fitzpatrick’s personal history and characteristics does not fulfill those

purposes. We conclude, therefore, that it was substantively unreasonable.

This case is substantially similar to and indeed governed by our decision in United

States v. Zuk. In Zuk, we concluded that arguments nearly identical to those pressed by

Fitzpatrick here did not justify a major downward variance given all the circumstances

presented in that case. Zuk, who at sentencing was 22 and diagnosed with autism, pleaded

guilty to possession of child pornography. 874 F.3d at 400. The undisputed evidence

showed that he had possessed nearly 14,000 images and had “communicated on a daily

basis with a 16-year-old who was sexually abusing his 5-year-old cousin,” id. at 400, and

that he directed the 16-year-old “to produce specific sadistic images” of his abuse, id. at

411. During the sentencing hearing, the district court heard expert testimony that Zuk was

unlikely to recidivate if he received proper treatment. Id. at 403. Although another expert

opined that Zuk’s autism had contributed to the offense, there was no evidence that it had

caused his criminal conduct. Id. at 404, 411. Zuk urged the court to take into account the

fact that he had autism and that his brain was not fully developed at the time he committed

his offense. Id. at 403. Zuk also emphasized that he was twice assaulted in prison while

awaiting sentencing and would only be further victimized if sentenced to a lengthy term of

incarceration. Id. at 402, 408. The district court, relying almost exclusively on Zuk’s

autism, varied downward from a Guidelines sentence of 240 months’ imprisonment to a

time-served sentence of 26 months. Id. at 406.

12
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 13 of 14

When the government challenged the substantive reasonableness of the sentence on

appeal, Zuk argued that the district court’s sentence was substantively reasonable because

it considered:

(1) how his autism spectrum disorder mitigated his culpability for his
conduct and affected his treatment needs;

(2) the importance of Zuk’s receiving intensive sex-offender treatment in

a therapeutic community . . . while his brain was still developing; and

(3) his vulnerability in prison due to his autism spectrum disorder and
slight frame.

Zuk, 874 F.3d at 408. We disagreed and vacated the district court’s sentence as

substantively unreasonable, explaining that the time-served sentence “fail[ed] in a message

of deterrence, d[id] not adequately protect the public, and undoubtedly d[id] not promote

respect for the law.” Id. at 411. We concluded that “when a district court focuses so

heavily on a single sentencing purpose only tangentially connected to a defendant’s grave

criminal misconduct, it risks abusing its discretion.” Id. at 410.

Just as in Zuk where no expert testified that Zuk’s medical condition caused his

criminal conduct, no expert testified in this case that Fitzpatrick’s condition caused his

criminal misconduct. At most, Dr. Belchic-Schwartz stated that Fitzpatrick faced

“substantial difficulty resisting impulses and considering consequences before acting.”

That statement, however, does not suggest that Fitzpatrick’s autism caused his crimes, nor,

for that matter, does it distinguish him from most people who commit crimes. Likewise,

the record here does not support Fitzpatrick’s assertion that he could not “truly understand[]

the consequences of [his] acts.” Indeed, the record contradicts that position. Fitzpatrick’s

13
USCA4 Appeal: 24-4102 Doc: 68 Filed: 01/21/2025 Pg: 14 of 14

conduct involved the sophisticated creation, promotion, and operation of a data-breach

website that, under his supervision, became the largest of its kind in the English-speaking

world. Even after he pleaded guilty, Fitzpatrick lied to his friends and asserted that he

never viewed child pornography. He also downloaded and utilized VPNs to hide both his

initial criminal conduct and his repeated violations of his conditions of presentence release.

Such conduct reveals clearly that Fitzpatrick knew what he was doing was wrong and chose

to do it anyway, as well as to hide it — again, much like the defendant in Zuk. See 874 F.3d

at 411.

We noted in Zuk that a district court risks abusing its discretion when it grants a

defendant’s request for a major downward variance based almost exclusively upon the

defendant’s personal history and characteristics. See 874 F.3d at 410. Here, we conclude

that the district court’s reliance on only Fitzpatrick’s personal history and characteristics

constituted just such an abuse of discretion. The district court failed to impose a sentence

that accounted for the severity of Fitzpatrick’s offenses, the need to punish and provide

respect for the law, the need to adequately deter criminal conduct, and the need to protect

the public from further crimes. Simply put, a 17-day sentence does not fulfill those

required sentencing purposes and therefore was substantively unreasonable.

Accordingly, we vacate Fitzpatrick’s sentence and remand for resentencing in

accordance with the principles set forth herein.

VACATED AND REMANDED

14