Lawyers for computer hacker Andrew “Weev” Auernheimer said they were racing to get him out of prison after a circuit judge on Friday vacated his conviction on identity theft and conspiracy charges.

Auernheimer, a self-described internet troll and hacker, was found guilty in November 2012 conspiracy to gain unauthorised access to AT&T public servers, after he obtained thousands of email addresses of iPad owners. He currently is serving a 41-month federal prison term in Pennsylvania.

On Thursday, the US court of appeals for the third circuit threw out Auernheimer’s conviction, ruling that New Jersey, where he was tried, was an improper venue for the case. The issue of venue is particularly sensitive in computer fraud trials, which by nature transcend physical jurisdictions.

“We’re scrambling right now to figure out how to get him out,” said defense attorney Tor Ekeland in a telephone interview. “Right now we’re just focused on getting him out, because they’ve been holding him in a special housing unit, which is a 6x11 cell, where he only gets out one hour a day.”

Ekeland, who took on Auernheimer’s case in November 2011 after his wife met Auernheimer at the Occupy Wall Street protest, said the defense team was gratified by the circuit court’s decision.

“It’s awesome news. It’s everything we’ve been working really hard for for the last couple years,” Ekeland said. “We always said, from day one, that the venue was improper in New Jersey, it was one of the first things we raised with the government. We stuck with that through trial.”

Auernheimer was charged with a felony under the Computer Fraud and Abuse Act (CFAA), the same statute that was used to prosecute internet activist Aaron Swartz. Critics say the law was meant to prosecute larger crimes and its use in hacking cases was an intimidation tactic by the government.

Auernheimer’s legal team argued at trial that his prosecution under the CFAA was improper, but Ekeland said he was just as happy to see the conviction vacated on venue grounds.

“In terms of venue, it’s an incredibly important concept, and the government’s prosecution here just threw that out the window,” Ekeland said.

“If the court had ruled the other way, you would have had universal venue in these kinds of cases, computer fraud and abuse cases, and that would have had huge implications for the Internet and computer law.

“I think this is a very, very important venue decision when it comes to the Internet and computer law, and I’m quite happy about it.”

Ekeland said he never got a full explanation from the government of why it brought the case in New Jersey. The circuit court found an “absence of any apparent connection to New Jersey, noting that at the time of the alleged crime, an alleged accomplice of Auernheimer’s “was in San Francisco, California, and Auernheimer was in Fayetteville, Arkansas. The servers that they accessed were physically located in Dallas, Texas and Atlanta, Georgia.”

“When I asked them about [venue] in one of our first meetings, I thought they would show me something,” Ekeland said. “But they never showed me anything, so I kept pushing it all the way through trial.

“And we pushed it on appeal, and we won on it.”