Journalist Might Look at 7 Years Prison in LA Times 'Hacking' Case

This story's headline has been updated.

In October 2015, journalist Matthew Keys was convicted of three counts under the Computer Fraud and Abuse Act. His presentence report is now suggesting a total of 87 months in prison—a little over seven years—and "roughly $250,000" in restitution to the Tribune Company. His crime: dropping a username and password into an Anonymous chatroom, resulting in a 40-minute defacement of a Los Angeles Times article.

After the verdict, the US Attorney's Office told me that they would be seeking a sentence "likely under five years." The statutory maximum is 25 years, but as with many crimes, sentencing guidelines give a wide spectrum of possible sentences depending on the severity of the crime. In this case, the recommended sentence is heavily tied to a loss estimate: how much money the Tribune Company, which owns the LA Times, lost because of the hack.

The final loss estimate in the Keys case is still being disputed, which is why sentencing has been rescheduled from January to March. But the present figure being cited in the presentence report is just under $250,000.

Loss estimates cited by the government in the Keys docket have ranged wildly. In the trial brief, prosecutors told the judge that the a witness would be testifying to the jury that "Tribune Company spent $1.5 million on information technology improvements in response to this incident." Another document estimated loss at $929,977.00. Meanwhile, a 2013 email from Keys's former boss, Brandon Mercer, told an FBI agent that "The hours calculated so far add up to: $3,583.91."

For the Tribune Company, the damage that Keys inflicted wasn't just 40 minutes of a defaced headline, it was also the technical incident response, the massive company-wide panic that engulfed even high-paid executives, and the complete overhaul of the Tribune CMS afterwards. On top of that, some of the loss calculations being thrown around prior to trial included the cost of nasty emails that Keys had been sending to his former workplace, Sacramento TV station KTXL Fox 40, which, like the Los Angeles Times, is owned by the Tribune Company.

At trial, the government told a story about a vengeful ex-employee who waged a campaign of terror against his former workplace. (Keys has admitted to nothing).

According to prosecutors, he left his job under acrimonious circumstances, and shortly thereafter began sending out angry emails under pseudonyms taken from the X-Files (Fox Mulder, Walter Skinner, and the Cancerman). Eventually he emailed a massive list of viewers with a litany of wrongs committed by the station.

"I hope you're proud of yourself," his former boss, Brandon Mercer, wrote back on December 3, 2010. "I just had to talk down a crying senior citizen whose husband is in kidney failure. She's having a panic attack on the phone because of you. She's so scared of your stupid emails that she's in tears talking with me."

If things had ended there, Matthew Keys probably would have never ended up in a federal court, being tried for computer hacking. But on December 8, he dropped a username and password for the Tribune Company CMS into a chatroom, and told the others to "go fuck some shit up!"

The shit that got fucked lasted maybe 40 minutes, and was fixed in three. While the facts of the case don't look good for Keys, there's no wonder that loss calculation is currently being disputed. "Imposing a sentence of over seven years and roughly $250,000.00 in speculative restitution is a draconian sentence for a minor occurrence that could have been more appropriately handled by a civil lawsuit instead of three federal felony criminal convictions," said the defense in their response to the presentence report.

The defense also noted that revenge porn site operator Hunter Moore, who has openly called himself a "professional life-ruiner," had recently been sentenced to 2 ½ years in prison under the CFAA, the very same statute that Matthew Keys has been convicted under. "Mr. Moore's behavior was far worse and far more harmful than what Mr. Keys has been convicted of, as it involved the ongoing, massive exploitation of women on the Internet, rather than an innocuous and short-lived edit to an LA Times story on tax cuts," the defense wrote.

Sentencing is currently set for March 23.

Correction: The original version and headline of this article stated that prosecutors were asking for a 7-year prison sentence, based on the presentence report. However, the presentence report is prepared by the probation office, not prosecutors. The story has been corrected to reflect this.