Appeals court upholds Somerville man's 10-year sentence for cyberattacks on Children's Hospital

A federal appeals court ruled today that the judges involved in Martin Gottesfeld's trial for launching a massive cyberattack against Children's Hospital over the Justina Pelletier case did nothing wrong and that Gottesfeld can spend the rest of his 121-month sentence behind bars.

Gottesfeld, 37, was convicted in 2019, some five years after he corralled tens of thousands of routers across the Internet to attack the hospital - and some three years after a Disney cruise ship rescued him and his wife from their stalled boat between Florida and Cuba after they had fled Somerville. Gottesfeld, currently housed at a federal prison in Terre Haute, IN, is scheduled for release on Nov. 14, 2024.

According to prosecutors, Gottesfeld read about Pelletier case online and became convinced that Children's Hospital - and a Framingham center that took over her care - were terrorizing the girl and deserved to be attacked.

At the height of his attacks in the spring of 2014 - which involved massive amounts of HTTP traffic from the 40,000 routers he had managed to infect with his customized software - several key Children's services were knocked offline, including the system for determining which drugs doctors could administer and in which doses. Because of its position in the Longwood Medical Area, other institutions, including Dana Farber and Harvard Medical School, also began having connectivity issues.

Peak traffic per second sent at Children's in April, 2014, from government filing:

The hospital began to get a grip on the problem - at one point its servers were being hit with 28 gigabits of Internet traffic every second - by hiring an Israeli cybersecurity firm that routed all Children's-bound traffic to its servers in Israel so that the bad packets could be dropped. Children's estimated it spent $450,000 dealing with Gottesfeld's attacks and lost more than $300,000 in donations it had planned to solicit that spring but couldn't.

Gottesfeld's appeal attorney tried several routes to get his sentence overturned, but the US Court of Appeals for the First Circuit rejected them all.

The court ruled that a long delay between the time Gottesfeld was arrested and the time he was indicted did not violate the Speedy Trial Act - which mandates no more than 30 days pass between an arrest and an indictment. This was in part because the judge in the case issued several ""ends-of-justice continuances" - delays that the judge felt were in the best interest of justice, which is allowed under the law. The court noted that some of these were because Gottesfeld himself sought delays as he tried to work out a plea deal.

The court also rejected the argument that a magistrate judge who issued a search warrant for Gottesfeld's apartment should not have because her husband is a doctor at Brigham and Women's which was affected by the DDoS outages at Children's. The court said that while it is quite likely that the doctor saw some impact from such a major outage in the Longwood area, Gottesfeld produced no proof that his life or job was significantly harmed by the outage, to the extent that it would have caused an issue for his wife or that she was even aware her husband was affected at all.

The court did not address a second conflict-of-interest recusal demand that Gottesfeld made himself beofre his trial, that the judge, Nathaniel Gorton, should have recused himself both because his wife was a pediatrics professor at Harvard Medical School and because Gorton had ties to a seafood-industry group - he is also part of the family that founded Gorton's of Gloucester - that was promoting some a healthy-eating program in Roxbury with Brigham and Women's at the time.

The court also rejected Gottesfeld's final argument - that the fact that the last of his four lawyers before and during his trial kept trying to quit - should count for something. The court noted that after his third lawyer quit, because the two could not agree on legal tactics, the judge agreed to appoint a fourth lawyer, but on the condition that that was it - Gottesfeld would get no further lawyers.

Shortly before the trial was due to start, though, the fourth lawyer said he could not represent a man who was going online to disparage him and his firm - Gorton refused to let him quit - several times - saying it was too late and that he had confidence the lawyer could still do a good job. After Gottesfeld was convicted, but before he was sentenced, the lawyer tried again, but Gorton again rejected the request, in part because Gottesfeld said he did not want the lawyer to leave, just to do his job.

The court said it saw no evidence that, despite the acrimonious relationship with his client, the lawyer did anything wrong. It added:

To rule otherwise would be to rule that a defendant in a criminal case need simply attack his own lawyer online in order to force the court's hand in making rulings that could then themselves be attacked on appeal.