Marcia Hofmann

Background and education

Marcia Clare Hofmann is an American attorney whose practice centers on electronic privacy, computer crime law, copyright and free expression. She is a graduate of Mount Holyoke College and the University of Dayton School of Law, and has been named a US-UK Fulbright Scholar. Her early professional work was in Washington, D.C., in the open-government and privacy advocacy world rather than in private corporate practice.

From 2003 to 2006 Hofmann served as staff counsel and director of the Open Government Project at the Electronic Privacy Information Center (EPIC), where her work involved public records litigation and transparency advocacy directed at federal agencies.

Electronic Frontier Foundation

In 2006 Hofmann joined the Electronic Frontier Foundation as a staff attorney, later serving as senior staff attorney and then special counsel. At EFF she litigated numerous cases against federal agencies under the Freedom of Information Act, and became known for defending programmers and security researchers facing charges connected to the disclosure of security flaws.

That defense work placed her in the middle of a recurring problem in computer security: researchers who find and report vulnerabilities can be treated as intruders under statutes written decades earlier, most notably the Computer Fraud and Abuse Act. Hofmann argued publicly and in court for narrower readings of the statute, and wrote and spoke frequently on the legal exposure faced by people doing security work. Between 2010 and 2014 she was also a non-residential fellow with the Stanford Center for Internet and Society.

United States v. Auernheimer

Hofmann was part of the team that represented Andrew Auernheimer, known online as "weev", on appeal from his November 2012 conviction in federal court in New Jersey on charges of identity fraud and conspiracy to access a computer without authorization. The case grew out of the exposure of a flaw in an AT&T website that returned subscriber email addresses to anyone supplying a sequential identifier in a URL. Auernheimer was sentenced in March 2013 to 41 months in prison.

On appeal the defense argued, among other points, that retrieving information from a publicly reachable web address does not constitute unauthorized access under the Computer Fraud and Abuse Act, and that the prosecution had been brought in the wrong district: Auernheimer had been in Arkansas, while AT&T's servers were in Georgia and Texas. On April 11, 2014 the United States Court of Appeals for the Third Circuit vacated the conviction on venue grounds and ordered his release. EFF's announcement of the ruling named Hofmann, alongside EFF, Professor Orin Kerr of George Washington University and attorney Tor Ekeland, as counsel on the appeal.

Lavabit and the encryption-key dispute

Hofmann also represented the encrypted email provider Lavabit and its founder Ladar Levison in litigation, captioned in part under seal, arising from government demands for the company's private SSL keys. The underlying investigation was widely understood to concern Edward Snowden. Levison shut the service down in August 2013 rather than turn over keys that would have exposed all of the service's users, and was later held in contempt; the Fourth Circuit ruled against Lavabit in 2014 without resolving the central legal questions the case raised about compelled disclosure of encryption keys.

Private practice and later work

Hofmann left EFF in 2013 to start a private practice while continuing to serve as special counsel to the organization. In that period she helped represent the Freedom of the Press Foundation in litigation against the Justice Department, filed amicus briefs in Twitter's lawsuit over the right to publish details of government surveillance requests, submitted comments on behalf of EFF, the Internet Archive and Reddit to the New York State Department of Financial Services regarding the proposed BitLicense regulation, and commented to the United States Copyright Office in support of a security research exemption to the prohibition on circumventing technical protection measures in vehicles. She was part of the defense team for security researcher Marcus Hutchins. In 2020 she joined Twitter as product counsel.

Teaching and legacy

Hofmann has taught as an adjunct professor at the University of California Hastings College of the Law and the University of Colorado Law School, and has been a frequent speaker at security and privacy conferences, where her talks and clinics helped familiarize technical audiences with their legal exposure. Her career reflects a broader shift during the 2000s and 2010s in which digital civil liberties organizations became a standing legal counterweight in computer crime prosecutions, and in which questions about what counts as "authorized access" moved from obscure statutory argument to a mainstream policy debate.

Timeline

• 2003Becomes staff counsel and director of the Open Government Project at the Electronic Privacy Information Center.
• 2006Joins the Electronic Frontier Foundation as a staff attorney.
• 2010Begins a term as non-residential fellow at the Stanford Center for Internet and Society, continuing to 2014.
• 2013Leaves EFF's staff to start a private practice, continuing as special counsel to the organization.
• 2013-08Lavabit suspends operations rather than surrender its private SSL keys; Hofmann represents the company and founder Ladar Levison in the ensuing litigation.
• 2014-04-11The Third Circuit vacates Andrew Auernheimer's conviction on venue grounds; EFF names Hofmann among his appellate counsel.
• 2014Files comments with the New York State Department of Financial Services on the proposed BitLicense rules on behalf of EFF, the Internet Archive and Reddit.
• 2015Comments to the U.S. Copyright Office supporting a security research exemption for circumvention of vehicle software protections.
• 2020Joins Twitter as product counsel.