Feds Ask For 5 Years In Jail For Matthew Keys Giving Up Tribune Account Password; Still Don't Care About Actual Hacker

from the something-seems-off-here dept

Fri, Mar 11th 2016 12:48pm — Mike Masnick

We've written a few times now about the somewhat bizarre Matthew Keys case. While he still denies having done anything, he has been found guilty under the CFAA for sharing the login information to the Tribune Company's computer systems, which apparently resulted in someone hacking a story on the LA Times website. The hack was nonsensical and lasted for all of about 40 minutes. There's no indication that this bit of vandalism did any actual harm -- or even that very many people saw it. And yet... the Feds had to work overtime to figure out how to turn this minor bit of vandalism (which everyone agrees Keys did not actually do directly) into nearly $1 million in damages (thanks to emails that the Tribune Company says were worth $200+ each, and random claims about "ratings declines" due to a separate incident involving Keys and the Tribune-owned TV station Keys used to work for).

When he was found guilty, the prosecutors told the press that they would likely ask for "less than five years" at sentencing, but apparently that's been turned into asking for exactly five years. You can read the full filing here:

The United States recommends that the Court impose a sentence of sixty months imprisonment. The Probation Department’s recommendation of eighty-seven months is reasonable and the best way to promote sentencing uniformity. But this prosecutor has been with this case since its inception in 2010 and submits that a five-year sentence as sufficient, but not greater than necessary, to comply with the purposes of sentencing. A sentence of five years imprisonment reflects Keys’s culpability and places his case appropriately among those of other white collar criminals who do not accept responsibility for their crimes.

Even assuming that the DOJ's claims about what Keys did are entirely accurate, Keys comes off as an immature jackass, rather than some sort of criminal hacking mastermind. It's difficult to see how that is worth five years in jail. Much of the DOJ's reasoning is because Keys has continued to assert his innocence. And while the DOJ does seem to have a fair amount of evidence that Keys did some fairly stupid and immature stuff, insisting he is innocent shouldn't be a reason to lock him up longer. The DOJ keeps going back to some stupid stuff Keys was accused of doing with a database of information he apparently had access to from the TV station -- including emailing people in the TV station's database with misleading messages -- but even the DOJ admits that this wasn't what the trial was about, and much of the evidence related to it was "redacted before it went to the jury" because it "created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense."

So the DOJ recognizes that... but still argues he should be sentenced for those very same things that are not elements of the offense he's been charged with.

“Worried” would be an understatement for the emotions of at least one Fox 40 viewer. The Court will recall that Mercer told “Cancer Man” that Mercer had just talked down a tearful elderly woman who had been having a “panic attack” over the emails while her husband was in kidney failure. The Court ordered this and Keys’s reaction redacted before it went to the jury. The Rule 403 exclusion meant that the Court thought the unredacted email would have created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense. The Government respects the Court’s ruling. The way Keys reacted shows he is a different and worse kind of person. Keys ridiculed the station for “reporting to the old folks home” and casually passed judgment on the poor woman for having her priorities “in the wrong place there.” ... Keys’s haughty, cold reaction to that woman’s suffering was the other reason that Mercer said he came to take a personal interest in the outcome of this case.... The Court should sentence to reflect the characteristics of the Defendant.... Keys’s characteristics include narcissism and an arrogant indifference to the suffering of innocent and vulnerable people.

Again, from all of this, Keys clearly comes off as an immature jackass -- but that's not necessarily a reason to lock someone up.

Meanwhile, Keys' lawyer has filed a much longer sentencing memorandum arguing for no jail time at all for Keys, still arguing that Keys' actions were all part of an investigative reporting effort. Considering that the court has pretty much already rejected this line of thinking, I'm not sure it's going to be very effective here either. There's a huge section in the memorandum about Keys' history working in journalism (going back to school), most of which I'm guessing the court will ignore as well -- though the detailed explanations of his more recent investigative reporting does act as something of a counterbalance to the DOJ presenting him as nothing more than a petty internet vandal, annoyed at his former employer.

Despite his indictment, Matthew continued to report on matters of crucial public interest, bringing to light important facts on critical matters that, without his reporting, may never have seen the light of day. Taken as a whole, his commitment to journalism also demonstrates a commitment to public service. At a time when other journalists concern themselves with which burrito restaurant a presidential candidate patrons or the numerous antics of a real estate mogul-turned-politician, it someone who has dedicated serious personal and professional effort, sometimes at his own considerable expense, to research and publish impactful stories on topics that matter to the public, should not be incarcerated. If he were to be sentenced to any prison term, people in positions of authority who will go unchecked and stories of public importance that will go untold.

Frankly, I find this stuff to be about as relevant as the stuff about Keys being kind of a jerk to his former employer. Neither thing is at issue in this case. So it shouldn't be reflected in the sentencing either.

What seems much more relevant is discussions about people who actually were breaking into computers and doing forms of computer vandalism... and who weren't penalized nearly as much as the DOJ is seeking for Keys, who is charged with just handing over a login and encouraging people to hack stuff (which only resulted in very minor vandalism).

But the biggest issue of all is the fact that, despite all of this, no one has ever gone after the actual hacker who did the vandalism, who goes by the name "sharpie." UK officials apparently know who sharpie is and told the FBI (it's someone in Scotland), and yet, still, no one has done anything about it If what Keys did is deserving of five years in jail, why does no one even think about going after the person who actually made the edits to the Tribune website?

George David “Sharpie”. Sharpie was the individual who actually accessed the Tribune Companies CMS and caused the damage Matthew was convicted for. Sharpe was never charged on either side of the Atlantic. He was visited once at his home in Scotland by the FBI and Scotland Yard. He spoke to them and that was the last of his contact with this case.

Either way, this case, yet again, demonstrates the ridiculousness of the Computer Fraud and Abuse Act (CFAA). Even if we accept that Keys did some immature things, this case is about a minor vandalism of a website. Hell, many years back, someone hacked into Techdirt and did much more serious vandalism (deleting the most recent 10 stories and all the comments), and if whoever did that was ever found, I wouldn't even want them sent to jail at all. That seems like a pretty extreme punishment for what honestly amounts to little more than internet graffiti.

If I had to guess, I'd predict that the judge will side with the DOJ, because that's what judges quite frequently do. The DOJ has done a good job distracting from the actual issues involved in this case and focusing it on other, unrelated issues, while painting Keys as something of a jerk. But on the actual issue of the CFAA, the whole thing seems like a massive stretch. Unfortunately, I think Keys' lawyers own filing is somewhat weak. It should have focused much more clearly on a few issues, rather than overloading it with what feels like a rambling attempt to throw every possible idea at the wall to reduce the jail term. His lawyer correctly notes that if the DOJ's focus is on "deterrence" that has already happened. Keys was fired from his job at Reuters, and no major news organization will hire him these days. That seems like plenty of deterrence for his activities. What, exactly, is five years in jail going to do at this point?

DOJ-Sentencing-Memorandum-for-Keys (PDF)DOJ-Sentencing-Memorandum-for-Keys (Text)

Keys-Sentencing-Memorandum (PDF)Keys-Sentencing-Memorandum (Text)

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cfaa, cfaa reform, doj, hacking, matthew keys
Companies: tribune company

28 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

PRMan (profile), 11 Mar 2016 @ 1:16pm

Prosecutors
Prosecution these days seems to boil down to "You made me angry." There seems to be no other factor.
[ link to this | view in thread ]
That Anonymous Coward (profile), 11 Mar 2016 @ 1:28pm

Thou shalt not trouble a corporation, lest ye invoke the wrath of the system.
Thou shalt not question the system, lest ye invoke the wrath of the system.

Invented damages, things he did that weren't part of this case, they sure seem to be trying hard to get a sticky gold star in the win column. They had a slam dunk case, and they keep running up the score. Shame they aren't this tenacious when corporate citizens harm the little people.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 1:38pm

Jury Nullifcation
It exists for a reason. It really doesn't matter if he is guilty of one of the hundreds of laws that the prosecution can argue. They are there to say doesn't matter not guilty if they don't feel right about convicting him.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 1:50pm

Re: Jury Nullifcation
Yay, I am so glad to see someone else besides me championing Jury Nullification!

Jury Nullification was meant to be there to serve as a hammer against corrupt DA's and Rogue courts! Spread the word!
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 2:01pm

How many years do you get for not changing the passwords of a former employee?
[ link to this | view in thread ]
Daniel (profile), 11 Mar 2016 @ 2:01pm

Re: Jury Nullifcation
While a great tool, Jury Nullification has been mostly nerfed over the decades. Most people don't know about it. Defense teams aren't usually allowed to let the jury know such a tool exists or even mutter the name and any jurors who might know themselves are usually weeded out at pretrial.
[ link to this | view in thread ]
Rekrul, 11 Mar 2016 @ 2:18pm

Even assuming that the DOJ's claims about what Keys did are entirely accurate, Keys comes off as an immature jackass, rather than some sort of criminal hacking mastermind. It's difficult to see how that is worth five years in jail. Much of the DOJ's reasoning is because Keys has continued to assert his innocence.

Well there's his real crime right there; He defied the will of the government. Whether or not a person is guilty doesn't really matter to them. The important thing is that they can claim a win and they will use any dirty tricks they can think of to make that happen.
[ link to this | view in thread ]
CanadianByChoice (profile), 11 Mar 2016 @ 2:25pm

Different Day, Same Shit
Remember what they were doing to Aaron Swartz ....
This is what they DO. Catching actual criminals is too difficult for them, so they get anyone in a vaguely "grey" area (or, failing at that, simply make stuff up) and do a pile on with charges.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 2:46pm

The point is...
...that investigating and prosecuting actual real live violent criminals is tedious. Investigating and prosecuting boneheads who engage in inconsequential hacking is trivial.

So from their point of view, it's better to ignore rape and murder and assault and kidnapping and lynching (yes, that's still a thing) (look it up) and horrible police misconduct while focusing in on some random mostly-harmless hacker of no consequence.

It's just good business.
[ link to this | view in thread ]
Zonker, 11 Mar 2016 @ 3:45pm

The Court should sentence to reflect the characteristics of the Defendant.... Keys’s characteristics include narcissism and an arrogant indifference to the suffering of innocent and vulnerable people.
Wouldn't most of todays CEOs, politicians, and presidential candidates qualify for this form of enhanced sentencing for acts of immature jackassery as well?

Oh right: one rule for thee, but not for me.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 3:56pm

Re: Jury Nullifcation
Jury Nullification applies to the "fact finding" stage, where the Jury announces "guilty" or "not guilty". See this for an example.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 4:44pm

Network administration
From the govenment's sentencing memorandum, p.9—
D. Network Administrator Misconduct Must be Answered with a Deterrent Sentence.

. . . All over the economy, network administrators are trusted to safeguard sensitive information and maintain essential systems. . . .
All over the United States, the National Security Agency runs the network now. The NSA is responsible for backups, patching, and upgrades. They can do cabling as well. Makes life a lot easier for everyone else. Things run more smoothly. Your tax dollars working hard! So smile, you're probably on camera, too.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 4:48pm

Re: Re: Jury Nullifcation
Are you daft? The article you linked does not even agree with you.

Maybe you mean to say it "Also applies" instead?

According to the Founding Fathers, the Jury system was created to prevent the judiciary from being used to apply tyranny to the people.

A jury can nullify for any reason they deem necessary, without legal risk. A lot of people in this nation have long since forgotten that it is supposed to take a lot of work to convict someone of a crime, because it is better for the guilty to walk free than to allow a system that constantly places the innocent in shackles like we mercilessly do now.

A jury can decide the law itself is bad and refuse to convict.
A jury can decide the DA is corrupt and refuse to convict.
A jury can decide that Judge is unfit, unfair, or harsh and refuse to convict.
A jury can decide the arresting officer was out of line and refuse to convict.

Jury Nullification is the goto tool for citizens to tell the government FUCK YOUR BULLSHIT!!!

And it only takes 1 person to hang it all up! And pretty much everyone is ignorant of it, and only evil people try to hide it or punish those talking about it.
[ link to this | view in thread ]
Paraquat (profile), 11 Mar 2016 @ 5:25pm

We need more prison labor
In today's free-trade world economy, the USA is clearly falling behind in manufacturing. We cannot compete with China, especially since they can use nearly free prison labor. Slowly but surely, the US industrial base has crumbled.

Happily, our political leaders have a plan to solve this problem. Newly privatized prisons can supply cheap labor. Unfortunately, in the past it was a problem because real criminals usually aren't the brightest bulbs. But now thanks to national security laws, intelligent computer-literate individuals can be made into criminals. Think of all those kids who took out loans to attend college, only to graduate and are unable to find jobs. Now, by making them into prisoners, they can become productive. Furthermore, the 40 cents per day they earn in prison factories can be directly applied to repaying their college loans.

The only thing we need to change is to get a law passed so that when they die, their kids inherit the loan. Also, we'd better get a law that denies the right to have a passport to anyone with a college loan, so that they don't try to flee the country. Better yet, make it a crime to apply for a passport if you've got an unpaid college loan - that way we can recruit more prison workers to make our proud nation competitive.

Full employment, a profitable military-industrial complex second to none, and we can give China the finger. Looks like a win-win to me.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 5:34pm

Re: Network administration
… network administrators…
“Jury Convicts Former Fox 40 Web Producer for Conspiring to Hack into and Alter Los Angeles Times Servers”, DoJ USAO EDCal Press Release, Oct 7, 2015
A former web producer . . .
So which was it? network admin? or web producer?

Jack of all trades? I personally don't make a lot of distinctions between network admin and sys admin, but I think I know shops that do.
[ link to this | view in thread ]
Anonymous Coward, 11 Mar 2016 @ 6:08pm

Idiot
He should have plead guilty and added he did it because he wanted foreign hackers to takeover the system so they could steal nuclear weapon secrets. That way he would only get 2.5 years and a fine.*

But I guess letting someone deface a news article for 40 minutes is way more dangerous than someone launching nuclear missiles via remote access or whatever those guys could have done.

* http://arstechnica.com/tech-policy/2016/02/former-energy-department-employee-admits-trying-to-spear- phish-coworkers/
[ link to this | view in thread ]
That One Guy (profile), 11 Mar 2016 @ 10:53pm

Re: Jury Nullifcation
Nice idea in theory, the problem is that judges and prosecutors absolutely loathe the idea since it takes the power out of their hands and places it in the hands of the jury, and any potential juror who so much as mentions that they know about it are likely to be struck from the pool of jurors immediately.
[ link to this | view in thread ]
That One Guy (profile), 12 Mar 2016 @ 12:02am

Re:
Exactly so, the real 'crime' in the DOJ's eyes isn't that his action led to a temporary disruption of a site, it's that he refuses to be a good little peon and plead guilty, and instead insists on making them work for the conviction. Punished for exercising his rights basically.
[ link to this | view in thread ]
Anonymous Coward, 12 Mar 2016 @ 4:14am

Re: We need more prison labor
The sarcasm is strong with this one.
[ link to this | view in thread ]
Anonymous Coward, 12 Mar 2016 @ 4:21am

Appears to be a kangaroo court, let this be a lesson to all - stay in line, shutup or they will get hopping mad.
[ link to this | view in thread ]
art guerrilla (profile), 12 Mar 2016 @ 5:27am

Re: Re: Jury Nullifcation
about tired of your spot-on observations, bubble-bursting logic, and sardonic deconstruction of greedtards...

but leaves the rest of us with nothing left to add...
hee hee hee

was going to make those very points, but scrolled down to see that one mofo had already done so...

would only add that i believe techdirt has covered a LONG time jury nullification activist (TLTG*), i think in new yuck, who was repeatedly arrested and hassled for trumped up crap because he was handing out jury nullification flyers in front of the courthouse...
as i recall, i think he ultimately prevailed, legal-wise, but not sure if anyone was ever able to use nullification ideas work there, or much of anywhere...

(*Too Lazy Too Google)

recently, there was a teeny, tiny, eensy, teensy 'victory over (in)justice system' of sorts, where a jury 'nullified' 'interfering with a donut eater' or some such claptrap, because she stepped between her dog and a goon with a gun and a badge who was about to shoot the dog (oh, and get this, kop later testified it was SOP to shoot the dog!)...

she was arrested on a bunch of shit, video showed the kop was totally lying in his arrest record/testimony (OF COURSE, no repercussions!), and the jury had a moment of sanity and found her not-guilty...
'course, now the piggies will be -figuratively, if not literally- gunning for her and her family...
...and her little dog, too ! ! !

if you have no shame for how your country is treating people, you have no shame, period...
[ link to this | view in thread ]
That One Guy (profile), 12 Mar 2016 @ 9:10am

Re: Re: Re: Jury Nullifcation
(*Too Lazy Too Google)

No worries, quick search on TD found the article I'm guessing you were thinking of, along with a NYTimes article that seems to confirm that the case against him was indeed dismissed.
[ link to this | view in thread ]
Anonymous Coward, 12 Mar 2016 @ 11:22am

Damned terrorists, something really needs to be done. Take the cost of housing him for five years out of their pay.
[ link to this | view in thread ]
morganwick (profile), 12 Mar 2016 @ 12:27pm

Re: Re: Re: Jury Nullifcation
How was jury nullification supposed to work, considering how easy it is for the powers that be to prevent people from knowing about it and punishing those who do (see Daniel's comment)? Or is this just another case where the Founding Fathers failed to take into account the many ways checks and balances get eroded?
[ link to this | view in thread ]
Anonymous Coward, 13 Mar 2016 @ 1:19pm

What have they got to hide
[ link to this | view in thread ]
Anonymous Coward, 14 Mar 2016 @ 5:24am

Chances are the actual hacker was hired by the GCHQ.

And this case does substantively discredit the DoJ's efforts to appeal to the InfoSec community. Their 2015 Black Hat keynote speech rings hollow given their insistence on arbitrary and capricious application and enforcement of the CFAA.
[ link to this | view in thread ]
Anonymous Coward, 14 Mar 2016 @ 7:09am

"you made us look bad so we are going to abuse our athority and punish you out of spite"

These are the people the average public trusts the safeguard their lives.
[ link to this | view in thread ]
Anonymous Coward, 14 Mar 2016 @ 9:10am

I have a theory - the US cyberwarfare division was struggling to find recruits so the FEDs set up a special 'prison' where instead of doing laundry, roads and numberplates they get the geeks in and put them to work hacking - then they just needed the 'staff'.
[ link to this | view in thread ]