Summary
concluding that appellant forfeited argument that “he “tuck[ed] it into a single footnote, without supporting authority or analysis”
Summary of this case from Wahlig v. KijakaziOpinion
19-1640 20-3448
06-13-2022
UNITED STATES OF AMERICA v. HO KA TERENCE YUNG, Appellant.
Peter Goldberger Edson A. Bostic Tieffa N. Harper FEDERAL PUBLIC DEFENDER'S OFFICE Counsel for Appellant Ruth Mandelbaum Shawn A. Weede UNITED STATES ATTORNEY'S OFFICE Counsel for Appellee
Argued: January 12, 2022
On Appeal from the United States District Court for the District of Delaware (D.C. No. 1:17-cr-00014-001) District Judge: Honorable Leonard P. Stark
Peter Goldberger Edson A. Bostic Tieffa N. Harper FEDERAL PUBLIC DEFENDER'S OFFICE Counsel for Appellant
Ruth Mandelbaum Shawn A. Weede UNITED STATES ATTORNEY'S OFFICE Counsel for Appellee
Before: RESTREPO, BIBAS, and ROTH, Circuit Judges
OPINION
BIBAS, CIRCUIT JUDGE.
The First Amendment limits the government's power to punish offensive or annoying speech. Convicted under a cyber-stalking statute, Ho Ka Terence Yung challenges that law as overbroad. But to avoid this problem, we read the statute narrowly and so will affirm his conviction.
Yung also challenges his restitution order. Yung had waived much of his right to appeal, including any challenge to the restitution order. But enforcing that waiver would threaten the separation of powers, so we must hear Yung's challenge. And because part of the restitution order was not authorized by statute, we will vacate that order.
I. The Spurned Applicant Turns Cyberstalker
Yung wanted to go to Georgetown Law. He had good grades and strong test scores. So Georgetown invited him to interview with an alumnus. But that interview went poorly. Yung thought his interviewer was insensitive and rude. And a few weeks later, Georgetown rejected him.
Though Yung eventually got into a good law school, Georgetown's rejection still stung. So a year later, he struck back against the interviewer. First, he launched a cyber-campaign: he created fake obituaries for the interviewer's wife and son; social-media profiles littered with Ku Klux Klan content in the interviewer's name; and blog posts as the interviewer, bragging about raping women, a boy, and an eight-year-old girl. A Google search of the interviewer's name revealed thousands of similar posts. As a reader of the posts remarked: "Someone is really out to nail this guy to a cross." JA 219.
Next, Yung filed false reports. Posing as a female Georgetown applicant on law school fora, he accused the interviewer of groping, bigotry, and threatening professional retaliation. And in reports to the Better Business Bureau, he accused the interviewer of sexually assaulting a female associate and berating prospective employees. He "strongly encouraged [the interviewer's employer] to fire this dirty old man." JA 176.
Yung's cyber-harassment spilled over into the real world. Impersonating the interviewer's wife, he published an online ad seeking a sex slave. When one man responded to the ad, Yung ordered him to spy on the family. The wife, another ad claimed, "like[d] it when a man puts his hand around [her] throat and threaten[s] [her] with a knife" and "gun" before forcing her to have sex. JA 168. Because of Yung's antics, the interviewer's family got hundreds of phone calls from men seeking sex with the interviewer, his wife, or their son. "[Y]ou pick up the phone and the first thing they ask is how big is your … genitalia," the interviewer testified. JA 325. Responding to other sexual ads, strange men even came to the interviewer's home in the wee hours of three consecutive mornings.
This harassment campaign turned the family's life into a "nightmare." JA 295. They were terrified that every strange visitor sought to "rape and murder" them. JA 296. They worked with police to plan safe hiding places in their home in case someone broke in. They disconnected their phone every night and quit walking around the neighborhood. And they feared that they would "never know [normalcy] again." JA 296.
Because the family's son studied at Georgetown, the family informed it of the threat. Georgetown worried that the son would be targeted there too, so it added security.
Eventually, the interviewer hired lawyers and cyber-inves-tigators, "begging" them to track down the puppeteer. JA 162. Working with the FBI, the investigators traced it all back to Yung.
Yung was charged with cyberstalking. 18 U.S.C. §§ 2261A(2)(B) & 2261(b). Faced with a mountain of evidence, he challenged the cyberstalking law as overbroad under the First Amendment. But when that challenge failed, he pleaded guilty. Though he waived most of his right to appeal, he reserved his right to appeal the overbreadth ruling and any sentence above the statutory maximum.
Yung was sentenced to nearly four years in prison plus three years of probation. He was also ordered to pay restitution for the interviewer's investigative costs (nearly $70,000) and Georgetown's security measures ($130,000).
On appeal, Yung revives his overbreadth challenge and contests the restitution order. The government responds that his plea agreement lets him appeal only overbreadth, not restitution. We review each issue de novo. United States v. Gonzalez, 905 F.3d 165, 190 (3d Cir. 2018); United States v. Quillen, 335 F.3d 219, 221 (3d Cir. 2003).
II. The Cyberstalking Statute Is Not Overbroad
Yung first challenges his conviction under the cyberstalk-ing law. He does not argue that it restricts his protected speech or is improper as applied to him. And he likely could not. The First Amendment does not protect defaming a private person or making "true threats": that is, "serious[ly] express[ing] an intent to commit an act of unlawful violence to" particular people. Virginia v. Black, 538 U.S. 343, 359 (2003); see Chaplin-sky v. New Hampshire, 315 U.S. 568, 572 (1942).
Rather than challenge the law as applied, Yung attacks it as overbroad and thus facially invalid. He says it "punishes a substantial amount of [others'] protected free speech." Yung Br. at 18-19 (quoting Virginia v. Hicks, 539 U.S. 113, 118-19 (2003)).
Overbreadth doctrine is a constitutional anomaly. Ordinarily, litigants lack standing to challenge laws simply because they "may conceivably be applied unconstitutionally to others." Broadrick v. Oklahoma, 413 U.S. 601, 610 (1973). But we have relaxed that standing requirement in First Amendment cases to stop overbroad laws from chilling protected speech. Id. at 612.
Yet invalidating a law as overbroad is "strong medicine" that we should use "sparingly." Id. at 613. Courts must hesitate before stopping the government from prosecuting conduct that it has the power to ban. Id. at 615. And the overbreadth exception to ordinary standing rules has been cogently criticized. See United States v. Sineneng-Smith, 140 S.Ct. 1575, 1583-88 (2020) (Thomas, J., concurring). So we will not expand it. Before striking down a law, we must ensure that any over-breadth is both "real" and "substantial." Broadrick, 413 U.S. at 615 . Because we can avoid reading this statute as overbroad, we will. Id. at 613; New York v. Ferber, 458 U.S. 747, 769 n.24 (1982).
A. The statute
Congress enacted the cyberstalking law in 2006 and broadened it in 2013. As amended, it makes a defendant a cyber-stalker if he checks three boxes:
• An act. The defendant must "use[] the mail, any interactive computer service or electronic communication service or … system …, or any other facility of interstate or foreign commerce"
at least twice. 18 U.S.C. § 2261A(2); see also § 2266(2).
• An intent. He must have acted "with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person." § 2261A(2).
• A result. Finally, his actions must cause some emotional response. They must either put the target "in reasonable fear of … death … or serious bodily injury," or "cause[], attempt[] to cause, or … be reasonably expected to cause substantial emotional distress." § 2261A(2)(A), (B). Because Yung pleaded guilty to the emotional-distress result element, we focus on that one.
This is not the first time that we have entertained an over-breadth challenge to the statute. A few years ago, we rejected an overbreadth challenge to the 2006 version of Section 2261A. Gonzalez, 905 F.3d at 190 n.10. But the 2013 amendment broadened its scope. Now the law punishes not only those who intend to harass, but also those who intend to intimidate. Compare 18 U.S.C. § 2261A(2) (2006), with id. (2013). Plus, a defendant no longer has to cause substantial emotional distress. It is enough that his conduct be "reasonably expected to cause" such distress. Compare id. (2006), with id. (2013). Because the revised law reaches further, we must review it again.
The government argues that the act, intent, and result elements limit prosecution to "prohibited actions with a serious criminal intent" that "cause serious harm." Gov't Br. 27; see United States v. Ackell, 907 F.3d 67, 74-77 (1st Cir. 2018) (adopting the government's position). Read that way, there would be no First Amendment problem. Yung counters that the law punishes lots of protected speech.
Ultimately, we reject Yung's argument. True, if read broadly, the statute would punish protected speech. We agree with Yung that the act and result elements are not enough to save it. But if we can, we must read the statute narrowly enough to avoid constitutional problems. And here, a narrow reading of the statute's intent element is plausible. So the statute is not overbroad.
B. The act element captures both conduct and speech
By itself, the act element does not prevent overbreadth. The more speech a law punishes, the likelier it is to be overbroad. Hicks, 539 U.S. at 124. Here, we reject the government's position that the cyberstalking "statute focuses on conduct, not speech." Gov't Br. at 24. Rather, it reaches a lot of speech: it targets emails, texts, and social media posts, like the ones Yung wrote. Thus, we must decide whether the speech it reaches is protected by the First Amendment.
C. The result element alone does not save the statute
The result element does little to confine the law to unprotected speech. The law, for instance, punishes people for acting in a way that "causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress." 18 U.S.C. § 2261A(2)(B). True, the "[s]ubstantial" emotional distress must be "fairly large," more than mere annoyance. Substantial (def. 9), The Oxford English Dictionary (2d ed. 2000). Even so, the law captures much speech, in part because it does not require that emotional distress be objectively reasonable. Though we hope that Americans can discuss sensitive issues without taking offense, that is not always so. And the law penalizes speech even when a listener's distress is unexpected or idiosyncratic.
That is a problem. The First Amendment protects lots of speech that is substantially emotionally distressing. Protesters may picket a marine's funeral with signs like "Thank God for Dead Soldiers," "God Hates Fags," and "You're Going to Hell." Snyder v. Phelps, 562 U.S. 443, 448 (2011). And a por-nographer may parody a famous minister as having drunken sex with his mother. Hustler Mag. v. Falwell, 485 U.S. 46, 47- 48, 51 (1988). These statements are deeply offensive, yet still covered by the First Amendment.
So neither the act nor the result element suffices to narrow the law's wide reach.
D. The intent element, narrowly construed, saves the statute
1. Broadly construing intent to harass or intimidate would raise constitutional problems.
Recall that the statute punishes only defendants who "inten[d] to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person." 18 U.S.C. § 2261A(2). Even speech "directed to inciting or producing imminent lawless action" is unprotected by the First Amendment. Brandenburg v. Ohio, 395 U.S. 444, 447 (1969) (per curiam). So "intent to kill, injure, … or place under surveillance with intent to kill, [or] injure" is unprotected. § 2261A(2).
But "intent to … harass [or] intimidate" is another matter. Id. If we read those words broadly, the law will reach protected speech. Take the verb "harass." It can mean aggression, even violence: "worry[ing] and imped[ing] by repeated attacks." Harass (def. 1b), Webster's Third New International Dictionary of the English Language Unabridged (1966); accord Harass (def. 3), Oxford English Dictionary (2d ed. 1989) (OED). But "harass" can also mean "to vex, trouble, or annoy continually or chronically." Harass (def. 2b), Webster's Third; see also Harass (def. 4), OED. These poles mark a spectrum from repeated annoyance to outright violence.
Like harassment, intimidation has both narrow and broad meanings. To "intimidate" can mean a specific, violent action. It "esp[ecially]" means "to force [someone] to or deter [him] from some action by threats or violence." Intimidate, OED; accord Intimidation, Black's Law Dictionary (10th ed. 2014) ("Unlawful coercion; extortion."). But "intimidate" can also mean broadly "[t]o render timid, inspire with fear; to overawe, cow." Intimidate, OED.
Harassment and intimidation, narrowly construed, are punishable. "Intimidation in the constitutionally proscribable sense of the word … plac[es] the victim in fear of bodily harm or death." Black, 538 U.S. at 360 (emphasis added). Harassing debt collection and coercive threats are also unprotected. See, e.g., Barr v. Am. Ass'n of Pol. Consultants, 140 S.Ct. 2335, 2347 (2020) (suggesting that the Constitution lets Congress regulate the way people collect debts); Saxe v. State Coll. Area Sch. Dist., 240 F.3d 200, 208 (3d Cir. 2001) (Alito, J.) (describing a "robber's demand 'your money or your life'" as an unprotected threat); cf. Bronson v. Kinzie, 42 U.S. 311, 315-16 (1843) (recognizing the ability of a state to "secure its citizens from unjust and harassing litigation").
Yet the broader definitions of "harass" and "intimidate" can describe nonviolent, nonthreatening speech. Filling a city councilman's voicemail box with complaints about his vote on a controversial municipal ordinance may "vex" or "cow" him. Ranting in the comments section of a website that a senator voted to lock refugee kids in cages could well "annoy [her] continually or chronically" or "render [her] timid." Or, to take a couple more mundane examples, "negative restaurant reviews left on Google or Yelp, irate emails sent to service providers (contractors, plumbers, etc.), … or antagonistic comments left on news sites" are often persistently annoying or even scary. People v. Moreno, 2022 WL 894725, at *5 (Colo. Mar. 28, 2022). Each might satisfy the statute's act and intent elements, read broadly, and (depending on the recipient's reaction) the result element too.
But criminalizing that speech would collide with the First Amendment. The First Amendment protects at least some speech that persistently annoys someone and makes him fearful or timid. As then-Judge Alito observed: "There is no categorical 'harassment exception' to the First Amendment's free speech clause." Saxe, 240 F.3d at 204. Though "non-expressive, physically harassing conduct is entirely outside [its] ambit," "deeply offensive" speech is not. Id. at 206 (emphasis added). On the contrary, "the free speech clause protects a wide variety of speech that listeners may consider deeply offensive." Id.
Thus, broad harassment laws that punish offensive speech "steer[] into the territory of the First Amendment." DeAngelis v. El Paso Mun. Police Officers Ass'n, 51 F.3d 591, 596 (5th Cir. 1995) (Title VII); see also Dambrot v. Cent. Michigan Univ., 55 F.3d 1177, 1183 (6th Cir. 1995) (university speech policy). And courts have often struck them down. See, e.g., State v. Brobst, 857 A.2d 1253, 1255-56 (N.H. 2004) (holding overbroad a harassment statute covering any speech made "with the intent to annoy or alarm another"); Ex parte Barton, 586 S.W.3d 573, 584-85 (Tex. Ct. App. 2019) (same); Moreno, 2022 WL 894725, at *5-6 (same). So here too, we must ensure that the cyberstalking statute does not "present[] a 'realistic danger' [that] the [Government] could compromise" First Amendment protections. Dambrot, 55 F.3d at 1183.
2. Though the text supports the broad reading, constitutional avoidance tells us to select the narrow one.
To decide between the broad and narrow readings, we use ordinary tools of statutory interpretation. Here, those tools support the broad reading of the statute. Even so, the narrow reading is textually plausible. Because that definition will not "twist the text beyond what it will bear," we must adopt it. Amy Coney Barrett, Substantive Canons and Faithful Agency, 90 Boston U. L. Rev. 109, 141 (2010) (defining constitutional avoidance); see Fer-ber, 458 U.S. at 769 n.24.
To start, we acknowledge the strong textual arguments in favor of the broad reading. For one, reading the statute broadly fits with two canons of construction: consistent usage and surplusage. One of the statute's result elements tracks the narrow definition of "intimidate" word for word: "places that person in reasonable fear of … death … or serious bodily injury." 18 U.S.C. § 2261A(2)(A); Black, 538 U.S. at 360. Yet the intent element merely says "intimidate," without elaborating. So if we read the intent element's use of "intimidate" to mean "placing [a person] in fear of bodily harm or death," we create an inconsistent-usage problem. Black, 538 U.S. at 360. Normally, where Congress uses different words, we read those words to have different meanings. See Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 170 (2012) (presumption of consistent usage). And that suggests Congress meant "intimidate" to mean something different from "intent to cause fear of harm or death." The broad reading produces that result; the narrow one does not.
Plus, the other result element requires only that the act "cause[d] … substantial emotional distress." § 2261A(2)(B). So causing "substantial emotional distress" presumably includes something other than putting someone in fear of bodily harm. And someone who fears death or injury is usually distressed too. Thus, the narrow reading would let the government charge most crimes under § 2261A(2)(B), leaving § 2261A(2)(A)'s fear element almost "meaningless." Yates v. United States, 574 U.S. 528, 543 (2015) (canon against surplusage); see §§ 2261(b), 2261B(a) (setting the same penalties for both crimes). Statutes typically do not work that way.
But though that problem borders on surplusage, it does not foreclose the narrower reading. Even under our narrow reading, the result elements would not be entirely superfluous. Imagine a defendant who intended to make his victim fear death or injury but produced a lesser emotional result: perhaps an incompetent criminal whose vague "threats" succeed only in upsetting their recipient through sheer persistence. The emotional-distress result element would let the statute reach that cyberstalker.
Besides, these surplusage and consistent-usage concerns are "not absolute." Lamie v. U.S. Tr., 540 U.S. 526, 536 (2004). Congress is not always precise when drafting statutes; it occasionally "use[s] different words to denote the same concept." Scalia & Garner, Reading Law 170. Thus, concerns about redundancy only "supply a clue as to the better interpretation of the statute." Rimini St., Inc. v. Oracle USA, Inc., 139 S.Ct. 873, 881 (2019). And courts may accept a reading that creates surplusage if "some maxim point[s] in a different direction." Chickasaw Nation v. United States, 534 U.S. 84, 94 (2001) (internal quotation marks omitted). For instance, presuming "inartful drafting," the Supreme Court has accepted a construction of the Affordable Care Act that it acknowledged created surplusage. See King v. Burwell, 576 U.S. 473, 491 (2015).
A second point in favor of the broad reading: it fits with how juries infer intent. We often instruct them to "consider the natural and probable results or consequences" of a defendant's acts and ask if he "intended those results or consequences." United States v. Sussman, 709 F.3d 155, 177 (3d Cir. 2013). Here, a jury would consider whether a defendant intended to cause the "substantial emotional distress" that resulted. On that approach, "intent to intimidate" could include intentionally causing an emotional reaction generally (the broader reading), not just intentionally causing fear of physical harm (the narrower reading).
But harassment statutes sometimes do limit a jury's ability to lean on the natural and probable causes of conduct to infer the defendant's intent. Indeed, a few states require prosecutors to show "intent to place [a] person in imminent fear of death or bodily injury" even when the result is mere "substantial emotional distress." Commonwealth v. Cullen, 947 N.E.2d 1147, 1150 (Mass. App. Ct. 2011); accord State v. Diez, 811 So.2d 1020, 1024 (La. Ct. App. 2002).
Thus, though these textual clues suggest that the broader reading is the better reading, they do not render the narrower reading implausible. And other textual clues justify the narrower reading too: neighboring terms reinforce reading "intimidate" and "harass" narrowly. When construing a word, we give it "more precise content" that fits with "the neighboring words with which it is associated." Williams, 553 U.S. at 294 (explaining the "commonsense canon of noscitur a sociis"). Here, both "kill" and "injure" are violent verbs. After those verbs, one naturally reads "intimidate" to mean putting the victim in fear of death or injury. And one naturally reads "harass" to mean a course of conduct designed to distress the victim by threatening, intimidating, or the like. Yung's campaign of terror, inciting sexual violence against the interviewer and his family at their home, exemplifies the narrower kind of harassment and intimidation.
To "intimidate," we hold, a defendant must put the victim in fear of death or bodily injury. And to "harass," he must distress the victim by threatening, intimidating, or the like. That reading limits intent to harass to "criminal harassment, which is unprotected because it constitutes true threats or speech that is integral to proscribable criminal conduct." Ac-kell, 907 F.3d at 76. It also limits "intent to intimidate" to what it "especially" means, a form of true threats or speech integral to a crime. Id.; Intimidate, OED. Those narrow readings ensure that protected speech largely escapes the law's net. Thus, we can avoid the "strong medicine" of invalidating the statute as facially overbroad. Broadrick, 413 U.S. at 613.
In reading the statute narrowly, we reaffirm our earlier decision upholding the cyberstalking statute. Gonzalez, 905 F.3d at 190 n.10 (2006 version). And we join every other circuit that has evaluated the law. United States v. Fleury, 20 F.4th 1353, 1362-63 (11th Cir. 2021) (current version); Ackell, 907 F.3d at 77 (same); see also United States v. Sayer, 748 F.3d 425, 436 (1st Cir. 2014) (2006 version); United States v. Bowker, 372 F.3d 365, 379 (6th Cir. 2004) (same), vacated on other grounds, 543 U.S. 1182 (2005); United States v. Petrovic, 701 F.3d 849, 856 (8th Cir. 2012) (same); Osinger, 753 F.3d at 944-45 (same).
E. We will affirm, not vacate, Yung's conviction
Because we adopt this "limiting construction" to save the statute, Yung urges us not to affirm. Yung Br. 27 n.22. Rather, he claims, we should "vacate [his] conviction and remand with leave to withdraw his plea and reconsider his options under that new legal landscape." Id. His brief does not say why. But at argument, his counsel hinted that, because Yung did not know how we would later read the statute, his plea could not have been "knowing and intelligent." Oral Arg. Tr. 9:13.
Not so. For a defendant's guilty plea to be knowing and intelligent, he must be of sound mind, understand the nature of the charges and the direct penal consequences, and have the advice of competent counsel. Brady v. United States, 397 U.S. 742, 755-56 (1970). But he may not later withdraw his plea just because he "did not correctly assess every relevant factor entering into his decision." Id. at 757. For instance, even if a defendant pleaded guilty to avoid the threat of the death penalty, and a court later struck that threat down, his plea still stands as knowing. Id. at 755.
Indeed, at argument, Yung's counsel argued that to vacate his conviction, we would have to craft a new guilty-plea rule for overbreadth challenges. Oral Arg. Tr. 10:13-11:9. But even if we were to consider that novel idea, Yung forfeited it: he tucks it into a single footnote, without supporting authority or analysis. John Wyeth & Bro. Ltd. v. CIGNA Int'l Corp., 119 F.3d 1070, 1076 n.6 (3d Cir. 1997) (Alito, J.). So his conviction stands.
III. The District Court Properly Ordered Restitution to the Interviewer, But Not Georgetown
The District Court ordered Yung to pay restitution to his victim and Georgetown. Yung challenges both orders, claiming that the statute does not authorize them. The government counters that Yung waived his right to appeal the orders. But any such waiver is unenforceable. And on the merits, only restitution to the interviewer is authorized by statute.
A. Yung could not waive his claim that the restitution order exceeds the statute
In his plea agreement, Yung waived "the right to file any appeal," with limited exceptions. JA 122 ¶ 10. For instance, he "reserve[d] the right" to renew his overbreadth challenge and to contest any "sentence exceed[ing] the statutory maximum." Id. Yet he never reserved the right to challenge the restitution order.
Yung disagrees, arguing that his restitution order "exceeds the statutory maximum" because it is not "clearly authorized by [statute]." Reply Br. 8. But we have held that a restitution order can never exceed the "statutory maximum." United States v. Leahy, 438 F.3d 328, 337-38 (3d Cir. 2006). That term implies some "range" of potential sentences from which the sentencing court must pick. Id. Yet restitution statutes authorize only one award: "the full amount of each victim's losses." Id. (quoting 18 U.S.C. § 3664(f)(1)(A)). "Thus, there is no restitution range" and no statutory maximum. Id.
Even so, we will not enforce Yung's waiver of his right to challenge the restitution order. See United States v. Gordon, 480 F.3d 1205, 1209-10 (10th Cir. 2007) (holding likewise). Doing so would let litigants subvert the Constitution's structure and thus "amount[] to a miscarriage of justice." United States v. Khattak, 273 F.3d 557, 562 (3d Cir. 2001); see also United States v. Teeter, 257 F.3d 14, 25 n.10 (1st Cir. 2001).
True, we let defendants waive most of their individual rights because we treat plea bargains like contracts. See United States v. Williams, 510 F.3d 416, 422 (3d Cir. 2007). A defendant, for instance, can waive his rights to counsel, to a jury trial, and even to confront his accusers, if he does so knowingly and voluntarily. United States v. Mezzanatto, 513 U.S. 196, 200-01 (1995).
Still, there are limits. Plea bargains are agreements between the executive branch, charged with "tak[ing] Care that the Laws be faithfully executed," and a defendant subject to those laws. U.S. Const. art. II, § 3. Judges must ensure that a bargain respects those laws. So if it offends these structural principles, we need not enforce it. See Nancy J. King, Priceless Process: Nonnegotiable Features of Criminal Litigation, 47 UCLA L. Rev. 113, 154-58, 166-72 (1999).
Thus, when the executive branch threatens to intrude upon the legislature's power in a case before us, judges must rebuff that encroachment. For instance, we should not let a defendant waive his right to appeal a conviction for acts that are not a crime. Cf. Brady, 397 U.S. at 758; King, Priceless Process, at 168-69. Otherwise, we would let the government and a private party de facto create a new crime. But only Congress has that power in our limited government. United States v. Hudson & Goodwin, 11 U.S. (7 Cranch) 32, 32 (1812). Even if the defendant consents, we cannot turn a blind eye to punishment for acts not criminalized by Congress. The judiciary must safeguard the separation of powers.
Likewise, a defendant cannot waive his right to appeal a sentence unauthorized by Congress. And we cannot enforce such a waiver. United States v. Cohen, 459 F.3d 490, 497-98 (4th Cir. 2006); United States v. Thomas, 932 F.3d 1139, 1140- 41 (8th Cir. 2019); United States v. Phillips, 174 F.3d 1074, 1076 (9th Cir. 1999); Gordon, 480 F.3d at 1209; see also United States v. Chem. & Metal Indus., 677 F.3d 750, 752 (5th Cir. 2012). If we did so, we would be crafting our own punishment and thus "intrud[ing] into areas committed to [an]other branch[] of government." Flast v. Cohen, 392 U.S. 83, 95 (1968). So Yung could not have waived his right to challenge whether the statute authorized his restitution order, and we must hear his appeal.
B. The interviewer is entitled to restitution
Now on to the merits. The District Court ordered Yung to pay the interviewer restitution for his investigative costs and attorney's fees. The special restitution statute for cyberstalking victims is broad: it lets victims recover "attorneys' fees" and "any … losses suffered … as a proximate result of the offense." 18 U.S.C. § 2264(b)(3)(E), (G); see also Lagos v. United States, 138 S.Ct. 1684, 1689 (2018) (discussing § 2264). The question, then, is whether the interviewer's losses were a "direct and foreseeable" result of the crime. Paroline v. United States, 572 U.S. 434, 449 (2014) (parsing 18 U.S.C. § 2259(b), worded similarly to § 2264(b)).
They were. Yung used pseudonyms to defame the interviewer and recruited others to threaten his family. To make that campaign of harassment stop, they needed to track Yung down, report him to the authorities, and get charges filed against him. Because those expenses were foreseeable, this restitution order is valid.
C. Georgetown is not entitled to restitution
But Georgetown should not get restitution. Unlike the interviewer, Georgetown was never itself harassed. Though it worried that Yung might eventually target its campus, he never did. So Georgetown does not qualify for the special cyberstalk-ing restitution statute. See 18 U.S.C. § 2264(c) (defining "vic-tim[s]" eligible under that statute). Instead, it could claim restitution only under the general restitution statute. That law is far more limited. It allows recovery only if Georgetown showed that Yung's "offense result[ed] in damage to or de-struction of property." 18 U.S.C. § 3663(b)(1). The government claims that the property that Yung damaged "was the safety and security of Georgetown's campus." Oral Arg. Tr. 27:13.
That is not enough, for two reasons. First, Georgetown cannot show that Yung damaged its property. Yung harmed no land, buildings, intellectual property, or the like. Rather, he threatened the safety of the campus, forcing Georgetown to beef up its security systems. We do not treat safety and security as a property right. True, we once extended restitution beyond tangible property to uphold restitution for a prosecutor's loss of "hard-won convictions." United States v. Hand, 863 F.2d 1100, 1104 (3d Cir. 1988). But Hand offered no definition or even explanation of how convictions could be property. And convictions are not analogous to safety on Georgetown's campus. So Hand does not persuade us to depart from the ordinary understanding of property here. See Gov't of V.I. v. Davis, 43 F.3d 41, 46 (3d Cir. 1994) (distinguishing and limiting Hand).
Even if safety and security were property, Georgetown showed no damage to them. "Damage … reduces the value or usefulness of the [property] or spoils its appearance." United States v. Quillen, 335 F.3d 219, 225 (3d Cir. 2003) (quoting Oxford American Dictionary 214 (1980)). For instance, we held that an anthrax scare damaged a mail room by making it temporarily "unusable." Id. at 222. Yet Yung's threats never made Georgetown's campus unusable for students and faculty, or its security systems unusable for run-of-the-mill disturbances. Nor does Georgetown say that its security systems were unhelpful in dealing with Yung. It says only that it "had to deploy numerous, continuous security measures above and beyond the customary means and methods" to protect its property. JA 518-19. That is not enough.
Cyberstalking is a serious crime that calls for serious punishment. But courts must be vigilant to keep crimes and punishments within the bounds of law. Cyberstalking laws must be read narrowly to avoid punishing protected speech. We cannot enforce appellate waivers that violate the separation of powers. And we must keep penalties within the confines authorized by Congress.
Here, we are confident that Yung's conviction is lawful, as is his duty to compensate the interviewer for the harm he caused. But because Georgetown suffered no damage to any property right, we will vacate that restitution order.