United States of America v. Ho Ka Terence Yung

PRECEDENTIAL
UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT
_______________
Nos. 19-1640 & 20-3448
_______________
UNITED STATES OF AMERICA
v.
HO KA TERENCE YUNG,
Appellant.
_______________
On Appeal from the United States District Court
for the District of Delaware
(D.C. No. 1:17-cr-00014-001)
District Judge: Honorable Leonard P. Stark
_______________
Argued: January 12, 2022
Before: RESTREPO, BIBAS, and ROTH, Circuit Judges
(Filed: June 13, 2022)
_______________
Peter Goldberger [ARGUED]
50 Rittenhouse Place
Ardmore, PA 19003

-- 1 of 22 --

2
Edson A. Bostic
Tieffa N. Harper
FEDERAL PUBLIC DEFENDER’S OFFICE
800 King Street, Suite 200
Wilmington, DE 19801
Counsel for Appellant
Ruth Mandelbaum [ARGUED]
Shawn A. Weede
UNITED STATES ATTORNEY’S OFFICE
1313 N. Market St.
Hercules Building, Suite 400
Wilmington, DE 19801
Counsel for Appellee
_______________
OPINION OF THE COURT
_______________
BIBAS, Circuit Judge.
The First Amendment limits the government’s power to
punish offensive or annoying speech. Convicted under a cyber-
stalking statute, Ho Ka Terence Yung challenges that law as
overbroad. But to avoid this problem, we read the statute nar-
rowly and so will affirm his conviction.
Yung also challenges his restitution order. Yung had
waived much of his right to appeal, including any challenge to
the restitution order. But enforcing that waiver would threaten
the separation of powers, so we must hear Yung’s challenge.
And because part of the restitution order was not authorized by
statute, we will vacate that order.

-- 2 of 22 --

3
I. THE SPURNED APPLICANT TURNS CYBERSTALKER
Yung wanted to go to Georgetown Law. He had good
grades and strong test scores. So Georgetown invited him to
interview with an alumnus. But that interview went poorly.
Yung thought his interviewer was insensitive and rude. And a
few weeks later, Georgetown rejected him.
Though Yung eventually got into a good law school,
Georgetown’s rejection still stung. So a year later, he struck
back against the interviewer. First, he launched a cyber-
campaign: he created fake obituaries for the interviewer’s wife
and son; social-media profiles littered with Ku Klux Klan con-
tent in the interviewer’s name; and blog posts as the inter-
viewer, bragging about raping women, a boy, and an eight-
year-old girl. A Google search of the interviewer’s name re-
vealed thousands of similar posts. As a reader of the posts re-
marked: “Someone is really out to nail this guy to a cross.” JA
219.
Next, Yung filed false reports. Posing as a female
Georgetown applicant on law school fora, he accused the inter-
viewer of groping, bigotry, and threatening professional retal-
iation. And in reports to the Better Business Bureau, he ac-
cused the interviewer of sexually assaulting a female associate
and berating prospective employees. He “strongly encouraged
[the interviewer’s employer] to fire this dirty old man.” JA 176.
Yung’s cyber-harassment spilled over into the real world.
Impersonating the interviewer’s wife, he published an online
ad seeking a sex slave. When one man responded to the ad,
Yung ordered him to spy on the family. The wife, another ad

-- 3 of 22 --

4
claimed, “like[d] it when a man puts his hand around [her]
throat and threaten[s] [her] with a knife” and “gun” before forc-
ing her to have sex. JA 168. Because of Yung’s antics, the in-
terviewer’s family got hundreds of phone calls from men seek-
ing sex with the interviewer, his wife, or their son. “[Y]ou pick
up the phone and the first thing they ask is how big is your …
genitalia,” the interviewer testified. JA 325. Responding to
other sexual ads, strange men even came to the interviewer’s
home in the wee hours of three consecutive mornings.
This harassment campaign turned the family’s life into a
“nightmare.” JA 295. They were terrified that every strange
visitor sought to “rape and murder” them. JA 296. They
worked with police to plan safe hiding places in their home in
case someone broke in. They disconnected their phone every
night and quit walking around the neighborhood. And they
feared that they would “never know [normalcy] again.” JA
296.
Because the family’s son studied at Georgetown, the family
informed it of the threat. Georgetown worried that the son
would be targeted there too, so it added security.
Eventually, the interviewer hired lawyers and cyber-inves-
tigators, “begging” them to track down the puppeteer. JA 162.
Working with the FBI, the investigators traced it all back to
Yung.
Yung was charged with cyberstalking. 18 U.S.C.
§§ 2261A(2)(B) & 2261(b). Faced with a mountain of evi-
dence, he challenged the cyberstalking law as overbroad under
the First Amendment. But when that challenge failed, he

-- 4 of 22 --

5
pleaded guilty. Though he waived most of his right to appeal,
he reserved his right to appeal the overbreadth ruling and any
sentence above the statutory maximum.
Yung was sentenced to nearly four years in prison plus
three years of probation. He was also ordered to pay restitution
for the interviewer’s investigative costs (nearly $70,000) and
Georgetown’s security measures ($130,000).
On appeal, Yung revives his overbreadth challenge and
contests the restitution order. The government responds that his
plea agreement lets him appeal only overbreadth, not restitu-
tion. We review each issue de novo. United States v. Gonzalez,
905 F.3d 165, 190 (3d Cir. 2018); United States v. Quillen, 335
F.3d 219, 221 (3d Cir. 2003).
II. THE CYBERSTALKING STATUTE IS NOT OVERBROAD
Yung first challenges his conviction under the cyberstalk-
ing law. He does not argue that it restricts his protected speech
or is improper as applied to him. And he likely could not. The
First Amendment does not protect defaming a private person
or making “true threats”: that is, “serious[ly] express[ing] an
intent to commit an act of unlawful violence to” particular peo-
ple. Virginia v. Black, 538 U.S. 343, 359 (2003); see Chaplin-
sky v. New Hampshire, 315 U.S. 568, 572 (1942).
Rather than challenge the law as applied, Yung attacks it as
overbroad and thus facially invalid. He says it “punishes a sub-
stantial amount of [others’] protected free speech.” Yung Br.
at 18–19 (quoting Virginia v. Hicks, 539 U.S. 113, 118–19
(2003)).

-- 5 of 22 --

6
Overbreadth doctrine is a constitutional anomaly. Ordinar-
ily, litigants lack standing to challenge laws simply because
they “may conceivably be applied unconstitutionally to
others.” Broadrick v. Oklahoma, 413 U.S. 601, 610 (1973). But
we have relaxed that standing requirement in First Amendment
cases to stop overbroad laws from chilling protected speech.
Id. at 612.
Yet invalidating a law as overbroad is “strong medicine”
that we should use “sparingly.” Id. at 613. Courts must hesitate
before stopping the government from prosecuting conduct that
it has the power to ban. Id. at 615. And the overbreadth excep-
tion to ordinary standing rules has been cogently criticized. See
United States v. Sineneng-Smith, 140 S. Ct. 1575, 1583–88
(2020) (Thomas, J., concurring). So we will not expand it.
Before striking down a law, we must ensure that any over-
breadth is both “real” and “substantial.” Broadrick, 413 U.S. at
615. Because we can avoid reading this statute as overbroad,
we will. Id. at 613; New York v. Ferber, 458 U.S. 747, 769 n.24
(1982).
A. The statute
Congress enacted the cyberstalking law in 2006 and broad-
ened it in 2013. As amended, it makes a defendant a cyber-
stalker if he checks three boxes:
• An act. The defendant must “use[ ] the mail, any
interactive computer service or electronic
communication service or … system …, or any
other facility of interstate or foreign commerce”

-- 6 of 22 --

7
at least twice. 18 U.S.C. § 2261A(2); see also
§ 2266(2).
• An intent. He must have acted “with the intent to
kill, injure, harass, intimidate, or place under
surveillance with intent to kill, injure, harass, or
intimidate another person.” § 2261A(2).
• A result. Finally, his actions must cause some
emotional response. They must either put the
target “in reasonable fear of … death … or seri-
ous bodily injury,” or “cause[ ], attempt[ ] to
cause, or … be reasonably expected to cause sub-
stantial emotional distress.” § 2261A(2)(A), (B).
Because Yung pleaded guilty to the emotional-
distress result element, we focus on that one.
This is not the first time that we have entertained an over-
breadth challenge to the statute. A few years ago, we rejected
an overbreadth challenge to the 2006 version of Section
2261A. Gonzalez, 905 F.3d at 190 n.10. But the 2013 amend-
ment broadened its scope. Now the law punishes not only those
who intend to harass, but also those who intend to intimidate.
Compare 18 U.S.C. § 2261A(2) (2006), with id. (2013). Plus, a
defendant no longer has to cause substantial emotional distress.
It is enough that his conduct be “reasonably expected to cause”
such distress. Compare id. (2006), with id. (2013). Because the
revised law reaches further, we must review it again.
The government argues that the act, intent, and result ele-
ments limit prosecution to “prohibited actions with a serious
criminal intent” that “cause serious harm.” Gov’t Br. 27; see

-- 7 of 22 --

8
United States v. Ackell, 907 F.3d 67, 74–77 (1st Cir. 2018)
(adopting the government’s position). Read that way, there
would be no First Amendment problem. Yung counters that the
law punishes lots of protected speech.
Ultimately, we reject Yung’s argument. True, if read
broadly, the statute would punish protected speech. We agree
with Yung that the act and result elements are not enough to
save it. But if we can, we must read the statute narrowly enough
to avoid constitutional problems. And here, a narrow reading
of the statute’s intent element is plausible. So the statute is not
overbroad.
B. The act element captures both conduct and speech
By itself, the act element does not prevent overbreadth. The
more speech a law punishes, the likelier it is to be overbroad.
Hicks, 539 U.S. at 124. Here, we reject the government’s posi-
tion that the cyberstalking “statute focuses on conduct, not
speech.” Gov’t Br. at 24. Rather, it reaches a lot of speech: it
targets emails, texts, and social media posts, like the ones Yung
wrote. Thus, we must decide whether the speech it reaches is
protected by the First Amendment.
C. The result element alone does not save the statute
The result element does little to confine the law to unpro-
tected speech. The law, for instance, punishes people for acting
in a way that “causes, attempts to cause, or would be reasona-
bly expected to cause substantial emotional distress.” 18
U.S.C. § 2261A(2)(B). True, the “[s]ubstantial” emotional dis-
tress must be “fairly large,” more than mere annoyance. Sub-
stantial (def. 9), The Oxford English Dictionary (2d ed. 2000).

-- 8 of 22 --

9
Even so, the law captures much speech, in part because it does
not require that emotional distress be objectively reasonable.
Though we hope that Americans can discuss sensitive issues
without taking offense, that is not always so. And the law pe-
nalizes speech even when a listener’s distress is unexpected or
idiosyncratic.
That is a problem. The First Amendment protects lots of
speech that is substantially emotionally distressing. Protesters
may picket a marine’s funeral with signs like “Thank God for
Dead Soldiers,” “God Hates Fags,” and “You’re Going to
Hell.” Snyder v. Phelps, 562 U.S. 443, 448 (2011). And a por-
nographer may parody a famous minister as having drunken
sex with his mother. Hustler Mag. v. Falwell, 485 U.S. 46, 47–
48, 51 (1988). These statements are deeply offensive, yet still
covered by the First Amendment.
So neither the act nor the result element suffices to narrow
the law’s wide reach.
D. The intent element, narrowly construed, saves the
statute
1. Broadly construing intent to harass or intimidate would
raise constitutional problems. Recall that the statute punishes
only defendants who “inten[d] to kill, injure, harass, intimi-
date, or place under surveillance with intent to kill, injure, har-
ass, or intimidate another person.” 18 U.S.C. § 2261A(2). Even
speech “directed to inciting or producing imminent lawless ac-
tion” is unprotected by the First Amendment. Brandenburg v.
Ohio, 395 U.S. 444, 447 (1969) (per curiam). So “intent to kill,

-- 9 of 22 --

10
injure, … or place under surveillance with intent to kill, [or]
injure” is unprotected. § 2261A(2).
But “intent to … harass [or] intimidate” is another matter.
Id. If we read those words broadly, the law will reach protected
speech. Take the verb “harass.” It can mean aggression, even
violence: “worry[ing] and imped[ing] by repeated attacks.”
Harass (def. 1b), Webster’s Third New International Diction-
ary of the English Language Unabridged (1966); accord Har-
ass (def. 3), Oxford English Dictionary (2d ed. 1989) (OED).
But “harass” can also mean “to vex, trouble, or annoy contin-
ually or chronically.” Harass (def. 2b), Webster’s Third; see
also Harass (def. 4), OED. These poles mark a spectrum from
repeated annoyance to outright violence.
Like harassment, intimidation has both narrow and broad
meanings. To “intimidate” can mean a specific, violent action.
It “esp[ecially]” means “to force [someone] to or deter [him]
from some action by threats or violence.” Intimidate, OED; ac-
cord Intimidation, Black’s Law Dictionary (10th ed. 2014)
(“Unlawful coercion; extortion.”). But “intimidate” can also
mean broadly “[t]o render timid, inspire with fear; to overawe,
cow.” Intimidate, OED.
Harassment and intimidation, narrowly construed, are pun-
ishable. “Intimidation in the constitutionally proscribable
sense of the word … plac[es] the victim in fear of bodily harm
or death.” Black, 538 U.S. at 360 (emphasis added). Harassing
debt collection and coercive threats are also unprotected. See,
e.g., Barr v. Am. Ass’n of Pol. Consultants, 140 S. Ct. 2335,
2347 (2020) (suggesting that the Constitution lets Congress
regulate the way people collect debts); Saxe v. State Coll. Area

-- 10 of 22 --

11
Sch. Dist., 240 F.3d 200, 208 (3d Cir. 2001) (Alito, J.) (describ-
ing a “robber’s demand ‘your money or your life’ ” as an un-
protected threat); cf. Bronson v. Kinzie, 42 U.S. 311, 315–16
(1843) (recognizing the ability of a state to “secure its citizens
from unjust and harassing litigation”).
Yet the broader definitions of “harass” and “intimidate” can
describe nonviolent, nonthreatening speech. Filling a city
councilman’s voicemail box with complaints about his vote on
a controversial municipal ordinance may “vex” or “cow” him.
Ranting in the comments section of a website that a senator
voted to lock refugee kids in cages could well “annoy [her]
continually or chronically” or “render [her] timid.” Or, to take
a couple more mundane examples, “negative restaurant re-
views left on Google or Yelp, irate emails sent to service pro-
viders (contractors, plumbers, etc.), … or antagonistic com-
ments left on news sites” are often persistently annoying or
even scary. People v. Moreno, 2022 WL 894725, at *5 (Colo.
Mar. 28, 2022). Each might satisfy the statute’s act and intent
elements, read broadly, and (depending on the recipient’s reac-
tion) the result element too.
But criminalizing that speech would collide with the First
Amendment. The First Amendment protects at least some
speech that persistently annoys someone and makes him fear-
ful or timid. As then-Judge Alito observed: “There is no cate-
gorical ‘harassment exception’ to the First Amendment’s free
speech clause.” Saxe, 240 F.3d at 204. Though “non-expres-
sive, physically harassing conduct is entirely outside [its] am-
bit,” “deeply offensive” speech is not. Id. at 206 (emphasis
added). On the contrary, “the free speech clause protects a wide

-- 11 of 22 --

12
variety of speech that listeners may consider deeply offensive.”
Id.
Thus, broad harassment laws that punish offensive speech
“steer[ ] into the territory of the First Amendment.” DeAngelis
v. El Paso Mun. Police Officers Ass’n, 51 F.3d 591, 596 (5th
Cir. 1995) (Title VII); see also Dambrot v. Cent. Michigan
Univ., 55 F.3d 1177, 1183 (6th Cir. 1995) (university speech
policy). And courts have often struck them down. See, e.g.,
State v. Brobst, 857 A.2d 1253, 1255–56 (N.H. 2004) (holding
overbroad a harassment statute covering any speech made
“with the intent to annoy or alarm another”); Ex parte Barton,
586 S.W.3d 573, 584–85 (Tex. Ct. App. 2019) (same);
Moreno, 2022 WL 894725, at *5–6 (same). So here too, we
must ensure that the cyberstalking statute does not “present[ ]
a ‘realistic danger’ [that] the [Government] could compro-
mise” First Amendment protections. Dambrot, 55 F.3d at
1183.
2. Though the text supports the broad reading, constitu-
tional avoidance tells us to select the narrow one. To decide
between the broad and narrow readings, we use ordinary tools
of statutory interpretation. Here, those tools support the broad
reading of the statute. Even so, the narrow reading is textually
plausible. Because that definition will not “twist the text be-
yond what it will bear,” we must adopt it. Amy Coney Barrett,
Substantive Canons and Faithful Agency, 90 Boston U. L. Rev.
109, 141 (2010) (defining constitutional avoidance); see Fer-
ber, 458 U.S. at 769 n.24.
To start, we acknowledge the strong textual arguments in
favor of the broad reading. For one, reading the statute broadly

-- 12 of 22 --

13
fits with two canons of construction: consistent usage and sur-
plusage. One of the statute’s result elements tracks the narrow
definition of “intimidate” word for word: “places that person
in reasonable fear of … death … or serious bodily injury.” 18
U.S.C. § 2261A(2)(A); Black, 538 U.S. at 360. Yet the intent
element merely says “intimidate,” without elaborating. So if
we read the intent element’s use of “intimidate” to mean “plac-
ing [a person] in fear of bodily harm or death,” we create an
inconsistent-usage problem. Black, 538 U.S. at 360. Normally,
where Congress uses different words, we read those words to
have different meanings. See Antonin Scalia & Bryan A. Gar-
ner, Reading Law: The Interpretation of Legal Texts 170
(2012) (presumption of consistent usage). And that suggests
Congress meant “intimidate” to mean something different from
“intent to cause fear of harm or death.” The broad reading pro-
duces that result; the narrow one does not.
Plus, the other result element requires only that the act
“cause[d] … substantial emotional distress.” § 2261A(2)(B).
So causing “substantial emotional distress” presumably in-
cludes something other than putting someone in fear of bodily
harm. And someone who fears death or injury is usually dis-
tressed too. Thus, the narrow reading would let the government
charge most crimes under § 2261A(2)(B), leaving
§ 2261A(2)(A)’s fear element almost “meaningless.” Yates v.
United States, 574 U.S. 528, 543 (2015) (canon against sur-
plusage); see §§ 2261(b), 2261B(a) (setting the same penalties
for both crimes). Statutes typically do not work that way.
But though that problem borders on surplusage, it does not
foreclose the narrower reading. Even under our narrow

-- 13 of 22 --

14
reading, the result elements would not be entirely superfluous.
Imagine a defendant who intended to make his victim fear
death or injury but produced a lesser emotional result: perhaps
an incompetent criminal whose vague “threats” succeed only
in upsetting their recipient through sheer persistence. The
emotional-distress result element would let the statute reach
that cyberstalker.
Besides, these surplusage and consistent-usage concerns
are “not absolute.” Lamie v. U.S. Tr., 540 U.S. 526, 536 (2004).
Congress is not always precise when drafting statutes; it occa-
sionally “use[s] different words to denote the same concept.”
Scalia & Garner, Reading Law 170. Thus, concerns about re-
dundancy only “supply a clue as to the better interpretation of
the statute.” Rimini St., Inc. v. Oracle USA, Inc., 139 S. Ct. 873,
881 (2019). And courts may accept a reading that creates sur-
plusage if “some maxim point[s] in a different direction.”
Chickasaw Nation v. United States, 534 U.S. 84, 94 (2001) (in-
ternal quotation marks omitted). For instance, presuming “in-
artful drafting,” the Supreme Court has accepted a construction
of the Affordable Care Act that it acknowledged created sur-
plusage. See King v. Burwell, 576 U.S. 473, 491 (2015).
A second point in favor of the broad reading: it fits with
how juries infer intent. We often instruct them to “consider the
natural and probable results or consequences” of a defendant’s
acts and ask if he “intended those results or consequences.”
United States v. Sussman, 709 F.3d 155, 177 (3d Cir. 2013).
Here, a jury would consider whether a defendant intended to
cause the “substantial emotional distress” that resulted. On that
approach, “intent to intimidate” could include intentionally

-- 14 of 22 --

15
causing an emotional reaction generally (the broader reading),
not just intentionally causing fear of physical harm (the nar-
rower reading).
But harassment statutes sometimes do limit a jury’s ability
to lean on the natural and probable causes of conduct to infer
the defendant’s intent. Indeed, a few states require prosecutors
to show “intent to place [a] person in imminent fear of death or
bodily injury” even when the result is mere “substantial emo-
tional distress.” Commonwealth v. Cullen, 947 N.E.2d 1147,
1150 (Mass. App. Ct. 2011); accord State v. Diez, 811 So. 2d
1020, 1024 (La. Ct. App. 2002).
Thus, though these textual clues suggest that the broader
reading is the better reading, they do not render the narrower
reading implausible. And other textual clues justify the nar-
rower reading too: neighboring terms reinforce reading “intim-
idate” and “harass” narrowly. When construing a word, we
give it “more precise content” that fits with “the neighboring
words with which it is associated.” Williams, 553 U.S. at 294
(explaining the “commonsense canon of noscitur a sociis”).
Here, both “kill” and “injure” are violent verbs. After those
verbs, one naturally reads “intimidate” to mean putting the vic-
tim in fear of death or injury. And one naturally reads “harass”
to mean a course of conduct designed to distress the victim by
threatening, intimidating, or the like. Yung’s campaign of ter-
ror, inciting sexual violence against the interviewer and his
family at their home, exemplifies the narrower kind of harass-
ment and intimidation.
To “intimidate,” we hold, a defendant must put the victim
in fear of death or bodily injury. And to “harass,” he must

-- 15 of 22 --

16
distress the victim by threatening, intimidating, or the like.
That reading limits intent to harass to “criminal harassment,
which is unprotected because it constitutes true threats or
speech that is integral to proscribable criminal conduct.” Ac-
kell, 907 F.3d at 76. It also limits “intent to intimidate” to what
it “especially” means, a form of true threats or speech integral
to a crime. Id.; Intimidate, OED. Those narrow readings ensure
that protected speech largely escapes the law’s net. Thus, we
can avoid the “strong medicine” of invalidating the statute as
facially overbroad. Broadrick, 413 U.S. at 613.
In reading the statute narrowly, we reaffirm our earlier de-
cision upholding the cyberstalking statute. Gonzalez, 905 F.3d
at 190 n.10 (2006 version). And we join every other circuit that
has evaluated the law. United States v. Fleury, 20 F.4th 1353,
1362–63 (11th Cir. 2021) (current version); Ackell, 907 F.3d at
77 (same); see also United States v. Sayer, 748 F.3d 425, 436
(1st Cir. 2014) (2006 version); United States v. Bowker, 372
F.3d 365, 379 (6th Cir. 2004) (same), vacated on other
grounds, 543 U.S. 1182 (2005); United States v. Petrovic, 701
F.3d 849, 856 (8th Cir. 2012) (same); Osinger, 753 F.3d at
944–45 (same).
E. We will affirm, not vacate, Yung’s conviction
Because we adopt this “limiting construction” to save the
statute, Yung urges us not to affirm. Yung Br. 27 n.22. Rather,
he claims, we should “vacate [his] conviction and remand with
leave to withdraw his plea and reconsider his options under that
new legal landscape.” Id. His brief does not say why. But at
argument, his counsel hinted that, because Yung did not know

-- 16 of 22 --

17
how we would later read the statute, his plea could not have
been “knowing and intelligent.” Oral Arg. Tr. 9:13.
Not so. For a defendant’s guilty plea to be knowing and in-
telligent, he must be of sound mind, understand the nature of
the charges and the direct penal consequences, and have the
advice of competent counsel. Brady v. United States, 397 U.S.
742, 755–56 (1970). But he may not later withdraw his plea
just because he “did not correctly assess every relevant factor
entering into his decision.” Id. at 757. For instance, even if a
defendant pleaded guilty to avoid the threat of the death pen-
alty, and a court later struck that threat down, his plea still
stands as knowing. Id. at 755.
Indeed, at argument, Yung’s counsel argued that to vacate
his conviction, we would have to craft a new guilty-plea rule
for overbreadth challenges. Oral Arg. Tr. 10:13–11:9. But even
if we were to consider that novel idea, Yung forfeited it: he
tucks it into a single footnote, without supporting authority or
analysis. John Wyeth & Bro. Ltd. v. CIGNA Int’l Corp., 119
F.3d 1070, 1076 n.6 (3d Cir. 1997) (Alito, J.). So his conviction
stands.
III. THE DISTRICT COURT PROPERLY ORDERED RESTITU-
TION TO THE INTERVIEWER, BUT NOT GEORGETOWN
The District Court ordered Yung to pay restitution to his
victim and Georgetown. Yung challenges both orders, claim-
ing that the statute does not authorize them. The government
counters that Yung waived his right to appeal the orders. But
any such waiver is unenforceable. And on the merits, only res-
titution to the interviewer is authorized by statute.

-- 17 of 22 --

18
A. Yung could not waive his claim that the restitution
order exceeds the statute
In his plea agreement, Yung waived “the right to file any
appeal,” with limited exceptions. JA 122 ¶ 10. For instance, he
“reserve[d] the right” to renew his overbreadth challenge and
to contest any “sentence exceed[ing] the statutory maximum.”
Id. Yet he never reserved the right to challenge the restitution
order.
Yung disagrees, arguing that his restitution order “exceeds
the statutory maximum” because it is not “clearly authorized
by [statute].” Reply Br. 8. But we have held that a restitution
order can never exceed the “statutory maximum.” United
States v. Leahy, 438 F.3d 328, 337–38 (3d Cir. 2006). That
term implies some “range” of potential sentences from which
the sentencing court must pick. Id. Yet restitution statutes au-
thorize only one award: “the full amount of each victim’s
losses.” Id. (quoting 18 U.S.C. § 3664(f)(1)(A)). “Thus, there
is no restitution range” and no statutory maximum. Id.
Even so, we will not enforce Yung’s waiver of his right to
challenge the restitution order. See United States v. Gordon,
480 F.3d 1205, 1209–10 (10th Cir. 2007) (holding likewise).
Doing so would let litigants subvert the Constitution’s struc-
ture and thus “amount[ ] to a miscarriage of justice.” United
States v. Khattak, 273 F.3d 557, 562 (3d Cir. 2001); see also
United States v. Teeter, 257 F.3d 14, 25 n.10 (1st Cir. 2001).
True, we let defendants waive most of their individual
rights because we treat plea bargains like contracts. See United
States v. Williams, 510 F.3d 416, 422 (3d Cir. 2007). A

-- 18 of 22 --

19
defendant, for instance, can waive his rights to counsel, to a
jury trial, and even to confront his accusers, if he does so know-
ingly and voluntarily. United States v. Mezzanatto, 513 U.S.
196, 200–01 (1995).
Still, there are limits. Plea bargains are agreements between
the executive branch, charged with “tak[ing] Care that the
Laws be faithfully executed,” and a defendant subject to those
laws. U.S. Const. art. II, § 3. Judges must ensure that a bargain
respects those laws. So if it offends these structural principles,
we need not enforce it. See Nancy J. King, Priceless Process:
Nonnegotiable Features of Criminal Litigation, 47 UCLA L.
Rev. 113, 154–58, 166–72 (1999).
Thus, when the executive branch threatens to intrude upon
the legislature’s power in a case before us, judges must rebuff
that encroachment. For instance, we should not let a defendant
waive his right to appeal a conviction for acts that are not a
crime. Cf. Brady, 397 U.S. at 758; King, Priceless Process, at
168–69. Otherwise, we would let the government and a private
party de facto create a new crime. But only Congress has that
power in our limited government. United States v. Hudson &
Goodwin, 11 U.S. (7 Cranch) 32, 32 (1812). Even if the de-
fendant consents, we cannot turn a blind eye to punishment for
acts not criminalized by Congress. The judiciary must safe-
guard the separation of powers.
Likewise, a defendant cannot waive his right to appeal a
sentence unauthorized by Congress. And we cannot enforce
such a waiver. United States v. Cohen, 459 F.3d 490, 497–98
(4th Cir. 2006); United States v. Thomas, 932 F.3d 1139, 1140–
41 (8th Cir. 2019); United States v. Phillips, 174 F.3d 1074,

-- 19 of 22 --

20
1076 (9th Cir. 1999); Gordon, 480 F.3d at 1209; see also
United States v. Chem. & Metal Indus., 677 F.3d 750, 752 (5th
Cir. 2012). If we did so, we would be crafting our own punish-
ment and thus “intrud[ing] into areas committed to [an]other
branch[ ] of government.” Flast v. Cohen, 392 U.S. 83, 95
(1968). So Yung could not have waived his right to challenge
whether the statute authorized his restitution order, and we
must hear his appeal.
B. The interviewer is entitled to restitution
Now on to the merits. The District Court ordered Yung to
pay the interviewer restitution for his investigative costs and
attorney’s fees. The special restitution statute for cyberstalking
victims is broad: it lets victims recover “attorneys’ fees” and
“any … losses suffered … as a proximate result of the offense.”
18 U.S.C. § 2264(b)(3)(E), (G); see also Lagos v. United
States, 138 S. Ct. 1684, 1689 (2018) (discussing § 2264). The
question, then, is whether the interviewer’s losses were a
“direct and foreseeable” result of the crime. Paroline v. United
States, 572 U.S. 434, 449 (2014) (parsing 18 U.S.C. § 2259(b),
worded similarly to § 2264(b)).
They were. Yung used pseudonyms to defame the inter-
viewer and recruited others to threaten his family. To make that
campaign of harassment stop, they needed to track Yung down,
report him to the authorities, and get charges filed against him.
Because those expenses were foreseeable, this restitution order
is valid.

-- 20 of 22 --

21
C. Georgetown is not entitled to restitution
But Georgetown should not get restitution. Unlike the in-
terviewer, Georgetown was never itself harassed. Though it
worried that Yung might eventually target its campus, he never
did. So Georgetown does not qualify for the special cyberstalk-
ing restitution statute. See 18 U.S.C. § 2264(c) (defining “vic-
tim[s]” eligible under that statute). Instead, it could claim res-
titution only under the general restitution statute. That law is
far more limited. It allows recovery only if Georgetown
showed that Yung’s “offense result[ed] in damage to or de-
struction of property.” 18 U.S.C. § 3663(b)(1). The govern-
ment claims that the property that Yung damaged “was the
safety and security of Georgetown’s campus.” Oral Arg. Tr.
27:13.
That is not enough, for two reasons. First, Georgetown can-
not show that Yung damaged its property. Yung harmed no
land, buildings, intellectual property, or the like. Rather, he
threatened the safety of the campus, forcing Georgetown to
beef up its security systems. We do not treat safety and security
as a property right. True, we once extended restitution beyond
tangible property to uphold restitution for a prosecutor’s loss
of “hard-won convictions.” United States v. Hand, 863 F.2d
1100, 1104 (3d Cir. 1988). But Hand offered no definition or
even explanation of how convictions could be property. And
convictions are not analogous to safety on Georgetown’s cam-
pus. So Hand does not persuade us to depart from the ordinary
understanding of property here. See Gov’t of V.I. v. Davis, 43
F.3d 41, 46 (3d Cir. 1994) (distinguishing and limiting Hand).

-- 21 of 22 --

22
Even if safety and security were property, Georgetown
showed no damage to them. “Damage … reduces the value or
usefulness of the [property] or spoils its appearance.” United
States v. Quillen, 335 F.3d 219, 225 (3d Cir. 2003) (quoting
Oxford American Dictionary 214 (1980)). For instance, we
held that an anthrax scare damaged a mail room by making it
temporarily “unusable.” Id. at 222. Yet Yung’s threats never
made Georgetown’s campus unusable for students and faculty,
or its security systems unusable for run-of-the-mill disturb-
ances. Nor does Georgetown say that its security systems were
unhelpful in dealing with Yung. It says only that it “had to de-
ploy numerous, continuous security measures above and be-
yond the customary means and methods” to protect its prop-
erty. JA 518–19. That is not enough.
* * * * *
Cyberstalking is a serious crime that calls for serious pun-
ishment. But courts must be vigilant to keep crimes and pun-
ishments within the bounds of law. Cyberstalking laws must be
read narrowly to avoid punishing protected speech. We cannot
enforce appellate waivers that violate the separation of powers.
And we must keep penalties within the confines authorized by
Congress.
Here, we are confident that Yung’s conviction is lawful, as
is his duty to compensate the interviewer for the harm he
caused. But because Georgetown suffered no damage to any
property right, we will vacate that restitution order.

-- 22 of 22 --