Matthew Keys Gets 2 Years In Jail For 40 Minute Web Defacement He Didn't Even Commit

from the punishment-fitting-the-crime? dept

The latest in the Matthe Keys case is that Keys has been sentenced to two years in federal prison for his involvement in a minor incomprehensible web defacement of an LA Times story that lasted for all of about 40 minutes. The prosecution was asking for 5 years, while Keys' lawyers asked for nothing more than probation. As we noted, the whole thing seems fairly crazy. It is entirely possible that Keys acted like an immature jackass regarding his former employer, but the actual case revolved around a single action: the claimed sharing of login credentials for the content management system of the Tribune Company, which another person (who is apparently known to law enforcement, but has never been charged with anything) used to do a minor defacement of a single story to have the headline read: Pressure builds in House to elect CHIPPY 1337.

This minor defacement was up for about 40 minutes before being taken down. When the government tried to add up the damages, the Tribune Company at first admitted that there were basically none. After being pushed, they "found" more damages and somehow it turned into nearly a million dollars, by making emails that "cost" $225 and talking about something totally unrelated to this hack -- some alleged harassment Key did by emailing people in a database from his former employer. If he actually did this (he denies it), it was a really shitty thing to do, but it also was not what he was on trial for.

Either way, the government needed the number to be at least $5000 so it could use the CFAA (Computer Fraud and Abuse Act) against Keys. From the sound of things at the sentencing hearing (mainly via reporter Sarah Jeong's excellent tweets), the judge initially did sound fairly skeptical about the government's arguments, but eventually went with 24 months in prison. Somewhat incredibly, someone from the LA Times even presented that this minor bit of digital vandalism was "an attack" on the entire journalism field, and since there's already difficulty in figuring out what news is real, this was a true threat to credibility for journalism as a whole. Really, now?

The prosecution also apparently whined to the judge that Keys has been talking publicly about his case, which, last I checked, is protected free speech:

Prosecutor does not like that Keys has been tweeting and giving interviews as follows pic.twitter.com/jdG5eUHkC2

— sarah jeong (@sarahjeong) April 13, 2016

While the judge at least indicated she didn't care about all that -- she still sentenced him to two years in prison.

And, really, that's the crux of the issue here. For everything that Matthew Keys was accused of doing -- and some of it was undoubtedly obnoxious -- the single thing he was charged with was violating the CFAA by distributing a username and password. And he's now been sentenced to two whole years in jail for that. How in the world does the punishment here fit the crime? As David Graham noted, this is basically the same sentence (actually slightly longer) that the "affluenza teen" received on the same day for killing four people while driving drunk. Or, as Adam Steinbaugh notes, Keys will end up spending about 18 days in prison for every minute that the LA Times defacement (which, again, he didn't actually do) remained online.

Matthew Keys will spend ~18 days in prison for every sixty seconds that the LA Times said Chippy 1337 might pass in the House.

— Adam Steinbaugh (@adamsteinbaugh) April 13, 2016

And while Keys still maintains his overall innocence, even if he did exactly what he's accused of doing this sentence is absolutely insane and highlights just how ridiculous the CFAA is as a law -- and why it's so beloved by prosecutors who can use it to go after lots of people for doing really small things.

Filed Under: cfaa, cfaa reform, defacement, doj, jail, matthew keys, vandalism
Companies: tribune company

Matthew Keys Found Guilty Of Criminal 'Hacking' For Sharing News Company Login

from the seems-extreme dept

Two and a half years ago, we wrote about former Reuters editor Matthew Keys being indicted based on charges that he'd shared the login information for the content management system to his former employer, the Tribune Company, in an online forum and then encouraged members of Anonymous in that forum to mess things up. Some people used that access to change a story on the LA Times website. Keys insists that he didn't do this and the feds have no direct evidence linking him to whoever leaked the login (he also claims at the time of the leak he no longer had access to the Tribune Company's systems).

As we noted at the time, if we accept the DOJ's version of what happened, what Keys did definitely was the wrong thing to do. But the result was little more than annoying vandalism -- and nothing Keys did should qualify as "criminal hacking." The changes to the LA Times were up for less than an hour and quickly reverted. There was little evidence that it created any real damage, and certainly no lasting damage. And yet, because this is a "computer crime," the feds came down on Keys as if he was part of some massive criminal conspiracy. In order to use the already problematic CFAA, it needed to show more than $5,000 worth of damage, which is crazy. Even crazier... is that the feds argued $929,977 worth of damage, based on some ridiculously exaggerated estimates of the amount of time people had to work on this issue.

And now a jury has convicted Keys on all three counts. Sentencing will be in January, and while lots of people are throwing around the statutory maximum of 25 years in jail, prosecutors have said they'll likely ask for "less than 5 years" according to Motherboard's Sarah Jeong, who was at the courthouse.

I think it's clear that Keys was in the wrong in handing out the login to the Tribune's systems, if he actually did it. But should that equate to criminal hacking charges and jailtime, because it resulted in a bit of online vandalism and some annoyance for a sys admin somewhere? That seems doubtful. As Keys himself points out in a pinned tweet in his Twitter feed, if sharing logins is a criminal act, all of you who share your HBO Go or Netflix logins may want to be careful.

The problem, once again, comes back to the ridiculous CFAA and the bogeyman of "computer hackers." It was wrong to give out the login, but the idea that it did even $5,000 in damage (as required by the CFAA), let alone nearly a million in damages, is ludicrous. It's even more ludicrous that this should be a criminal offense with any jailtime at stake. Go after him in a civil case for actual damages (of which there would be very little) and move on. Keys, for his part, has said the verdict is "bullshit" and he's planning to appeal.

It's way past time that we fixed the CFAA, and the Matthew Keys verdict is just yet another reminder that Congress needs to do something.

Filed Under: anonymous, cfaa, defacement, hacking, login, matthew keys, vandalism
Companies: tribune company