Policy —

Journalist sentenced to 24 months in prison after hacking-related conviction

Even after being found guilty, Matthew Keys still denies he gave up CMS login.

Matthew Keys talks to reporters after he was sentenced in April 2016 to two years in prison, surrounded by his lawyers, including Mark Jaffe (far left).
Matthew Keys talks to reporters after he was sentenced in April 2016 to two years in prison, surrounded by his lawyers, including Mark Jaffe (far left).
Cyrus Farivar

SACRAMENTO, Calif.—A federal judge sentenced journalist Matthew Keys to two years in prison Wednesday after he was convicted last year of three counts of conspiracy and criminal hacking.

Prosecutors had asked the judge to impose a sentence of five years, while Keys’ attorneys asked for no prison time.

"When this court tries to make sense of what Mr. Keys did for a limited period of time, it was out of pique, it was out of anger at his former employer," US District Judge Kimberly J. Mueller said at the conclusion of the hours-long hearing.

"He arrogated to himself the decision to affect the content of a journalistic publication. In practical effect, at least with respect to the Los Angeles Times webpage, the effect was relatively modest and did not do much to actually damage the reputation of that publication. But the intent was to wreak further damage which could have had further consequences."

As Ars reported earlier, Keys was accused of handing over a username and password for former employer KTXL Fox 40's content management system (CMS) to members of Anonymous and instructing people there to "fuck some shit up." Ultimately, that December 2010 incident resulted in someone else using those credentials to alter a headline and sub-headline on a Los Angeles Times article. (Both Fox 40 and the Times are owned by Tribune Media.) The changes lasted for 40 minutes before editors reversed them.

The 29-year-old journalist continues to maintain that he did not hand over any CMS logins, and his lawyers vowed an appeal. Jay Leiderman, one of Keys' attorneys said the legal team may even try to appeal up to the Supreme Court as a way to challenge the law Keys was charged under, the Computer Fraud and Abuse Act, a notorious anti-hacking law that dates back to 1984.

"It is a horse and buggy law in a jet plane society," Leiderman told the court. "It doesn't account for the modern Internet, the punishments do not fit the crime."

More than five years after the alleged crime took place, Keys sees himself as a victim: a journalist standing up against what he views as overzealous prosecution of a relatively minor computer crime. He continues to maintain that the FBI is punishing him for his journalistic work of investigating the Anonymous collective and for not cooperating with the FBI when it first contacted him in April 2011.

Keys said that he was given three plea deals, all of which he turned down. (Two sets of what appear to be internal FBI documents, including the plea deals, an audio recording, and handwritten FBI notes related to Keys, were leaked to the website Cryptome.org. Assistant United States Attorney Matthew Segal told Ars that he is "not authenticating anything from third parties.")

"I took this case to trial because I feel it can have a serious impact on this law that is really broken," Keys said, referring to the CFAA.

"I would hope through this experience, there are people who are out there that look at this and go: ‘You know what, this is bullshit," he said. "It’s bullshit that the government is invoking national security and terrorism laws and they do it all the time, and they’re doing it here. Where’s the bottom?’"

Keys was allowed to remain out of custody until June 15, 2016, when he is to report to a federal prison in Lompoc, California. However, Keys' attorney, Leiderman, said that he would move to have the incarceration stayed pending appeal.

"He's not a journalist, he's a terrorist"

During the heart of the sentencing hearing, AUSA Segal read from a statement written by Brandon Mercer, Keys’ former boss at Fox 40. (Mercer was unable to appear in person due to a previously scheduled trip to Siberia.)

Mercer, who hired Keys, said that Keys’ actions were "done with malice to cause harm." Mercer argued that while the public-facing damage on the Los Angeles Times’ site was short-lived, there was much more behind-the-scenes investigation and anguish that Keys’ earlier alleged threatening e-mails caused.

Prior to the Times defacement, in December 2010, a number of e-mails were sent to Fox 40 from various @yahoo.co.uk e-mail accounts that bore the names of X-Files characters, including Fox Mulder and Walter Skinner. These e-mails taunted Fox 40 for its lax security and claimed to have taken a number of Fox 40 viewers' e-mail addresses from a company marketing database, criticized the company, and then contacted some of those viewers directly. Mercer had a phone call with Keys, who specifically denied that he was Fox Mulder—but Keys warned Mercer that Keys' own reporting on Anonymous suggested that the Times could soon be a target.

In the statement that Segal read, Mercer described a woman who had called the station "scared to death" that "Fox Mulder" had somehow compromised her online accounts. Mercer tried to reassure her, and added he would do his best to get to the bottom of it.

Still, he did not mince words for Keys: "He's not a journalist, he's a terrorist."

The court also heard from Dan Gaines, a former senior deputy editor at the Los Angeles Times, who spoke on behalf of the paper and articulated that even a momentary disruption was notable as an injury to the entire idea of a free press.

"We are accustomed to horrible news events and we can work efficiently under high pressure, but losing control of the site is a much more basic matter and it cuts to the foundation of our ability to work, especially today when technology has been rapidly disrupting the ability to deliver news," he said.

Segal, in his final statement to the judge, lambasted Keys, pointing directly at him several times.

"This is a person, for whom his own aggrandizement, is willing to attack any institution that threatens him: the press, broadcast media, print media, law enforcement, the jury system," he said. "This wasn't mischief, this was a rage driven by profound narcissism."

Appeal, appeal, appeal

For his part, Leiderman, who did the bulk of the arguing on behalf of Keys, admitted that his client was "immature" at the time of the conduct for which he was convicted. He even noted that Keys had recently applied for a job as a records clerk at the Vacaville Police Department, and that they were apprised of his legal situation.

"An apology is impossible at this point because we're going to appeal," Leiderman said. "At some point these [CFAA] cases are going to go to the Supreme Court, and frankly why not us?"

After the conclusion of the hearing, Leiderman expanded on that point, indicating that the defense was hoping for a retrial.

"What happens if he appeals, and he wins, and we have a trial, and he’s standing outside here apologizing?" he told Ars. "I mean it makes no sense that he would apologize knowing that we’re going to appeal challenging the law and the nature of this, so how could he possibly apologize knowing that an appeal is coming? And [the judge] got that."

Judge Mueller noted that Keys has been a "contributing member of society from a very young age," and she said that he was "unlikely to reoffend."

In explaining her decision to essentially halve the government’s recommendation of five years, she acknowledged that Keys had not done anything else since the conduct he was convicted of. Nonetheless, his behavior, which rustled up people in Anonymous, could have been much worse, she said.

"The intent was to wreak further damage which could have had further consequences," she said. "The same kind of access that Mr. Keys used in venting his anger enabled him to use contact information for customers of his former employer, hiding behind a screen.

"That use not only did affect his former supervisor, his former coworkers, viewers, not an insignificant subset of viewers, and the mask that Mr. Keys put on appeared to allow a heartless character to utter lines that are unbecoming of a professional journalist, the kind that he holds himself out to be and the kind that he is, in most respects," she said.

Channel Ars Technica