On Wednesday, a jury in Sacramento, California, found Matthew Keys, former social media editor at Reuters and an ex-employee of KTXL Fox 40, guilty of computer hacking under the Computer Fraud & Abuse Act.
In 2010, Keys posted login credentials to the Tribune Company content management system (CMS) to a chatroom run by Anonymous, resulting in the defacement of an LA Times article online. The defacement was reversed in 40 minutes, but the government argued the attack caused nearly a million dollars in damage.
"The government wanted to send a clear message that if you want to cover a group they don't agree with, and you're not complicit with them [the government], they will target you," Keys told me after the trial.
When asked about claims that the prosecution was politically motivated, Assistant US Attorney Matt Segal replied, "I don't know what Keys's political beliefs are."
Keys was found guilty on all three counts he was charged with: conspiracy to commit computer hacking, transmission of malicious code causing unauthorized damage to a protected computer, and attempting to transmit malicious code to cause unauthorized damage to a protected computer. (The specific provisions of the CFAA are listed at the end of this article.)
The statutory maximum for Keys's crimes is 25 years, but in a statement given after the trial, a spokesperson for the US Attorneys Office said Keys would likely face less than five years.
"While it has not been determined what the government will be asking the court for, it will likely be less than 5 years," the spokesperson said.
"This is not the crime of the century," Segal said, adding that nonetheless Keys should not get away with his acts. At minimum, he may receive probation. Sentencing is scheduled for January 20, 2016.
Keys said he was disappointed with the verdict, and worried about the sentence affecting his ability to work. However, he also expressed his intention to appeal the conviction, and was optimistic it would be overturned.
Keys added that a few months after his first story about Anonymous, he was approached by the FBI, but Keys refused to allow them to scan his computer. He was indicted a couple of years later.
In order to be convicted under the CFAA, the damage had to exceed $5,000. The government claimed that Keys caused $929,977.00 worth of damage. During the trial, the defense tried to cast doubt on the total damages, claiming that the expenditures in response to the hack were not reasonable, and Tribune employees had grossly inflated the hours spent on incident response.
"This case demonstrates the FBI's commitment to identify and investigate those who harass former employers by using insider knowledge to intentionally exploit computer systems—whether directly or by proxy—to damage the reputation and operations of a business," said Special Agent in Charge Monica M. Miller of the FBI's Sacramento field office in a statement. "Individuals who use 'bully' tactics to attack computer networks will face justice for their actions."
The jury was composed of 11 women and 1 man. The government was represented by Assistant US Attorneys Matthew Segal and Paul Hemesath, along with James Silver, trial attorney for the Department of Justice Computer Crime and Intellectual Property Section. Matthew Keys was represented by Jay Leiderman, Tor Ekeland, and Mark Jaffe.
The charges against Matthew Keys:
Count 1: Conspiracy
18 USC 371
Count 2: Transmission of Malicious Code
Count 3: Attempted Transmission of Malicious Code
Update: This story was updated to include a statement from Special Agent in Charge Miller and further comment from case prosecutors. The original headline of the story has been changed to reflect the US Attorney's statement that the government would likely seek a sentencing of less than five years.