Is This Journalist Guilty of Low-Level Vandalism, or High-Damage Hacking?
Day two of the trial of Matthew Keys, accused of conspiring with Anonymous.
Matthew Keys with his defense team. Image: Sarah Jeong
A defense lawyer for Matthew Keys, a journalist charged with helping Anonymous "hack" the LA Times website, told a jury on Tuesday that his client was not guilty because he neither intended to cause damage, nor actually caused the amount of damage that the government alleges.
"Matthew Keys did not know as much as the government says he knew. He did not know the true capabilities of the others in the chatroom with him," defense attorney Jay Leiderman said during opening arguments.
A major issue in the case, according to Leiderman, is whether what Keys is alleged to have done was "low-level vandalism, or high-level, high-damage hacking." Keys has not admitted to anything, and the government must carry the burden of showing he violated the CFAA. Under the sections of the Computer Fraud & Abuse Act that the government is charging Keys with, they must show that Keys caused over $5,000 worth of damage—this is otherwise known as a jurisdictional minimum.
The defense will likely argue that the CFAA jurisdictional minimum has not been met, and that the costs for fixing the damage caused were not reasonably incurred, due to the use of overpriced consultants.
The trial began Monday, when prosecutors gave their opening arguments. Due to an unexpectedly long jury selection, the defense's opening arguments were moved to the following day.
The specific conduct alleged in the indictment involves, among a few other things, a briefly defaced internet article. Keys is alleged to have posted user credentials for the Tribune Company online content management system (CMS) in an Anonymous IRC channel. Shortly afterwards, an LA Times article was defaced, and according to the defense, the article was reverted to its previous state 40 minutes later.
Prosecutors say that the Tribune spent over $5,000 to respond to the "hack."
However, exhibits displayed during the defense's opening arguments show supposed emails from Brandon Mercer, Keys' ex-boss, saying, "If you bill a thousand dollars an hour, that will help us get it prosecuted," suggested the government is misrepresenting the true cost. In another email from the exhibits, Mercer estimated the damage at around $3,800.
Exhibits in opening and closing arguments are not considered to be entered into evidence, unless admitted separately during the rest of the trial, which means that the jury is not yet supposed to weigh these particular emails as relevant facts.
The defense argues that Keys was in the Anonymous IRC channel as a journalist, looking to write up a "headline-grabbing story" about the hacker collective. According to the defense, in December 2010, Anonymous had not yet achieved notoriety as a high-level group of hackers. Keys had no way of knowing at the time that the hackers he was interacting with—Sabu, kayla, and sharpie—would later become infamous. Sabu, also known as Hector Monsegur, became a FBI informant in 2011.
The defense will be taking special care to explain chan culture (the internet subculture coming out of 4chan, which has influenced several groups, including Anonymous) to the jury. Many of the government's exhibits, said Leiderman, were going to be screencaps of "very young people, chatting in rooms," where "the language is coarse and rough" and words are used but they don't mean what is said.
For example, Leiderman specifically pointed out the word "fag," saying that an "IRC expert" would explain its use to the jury. (In chan culture, "fag" is frequently used as a suffix for anyone or anything). Leiderman also attempted to explain the bizarre defacement of the LA Times article, saying that "Chippy thirteen thirty-seven" was "some sort of hacker mascot," before trailing off and quickly changing to a different point.
One point of contention between prosecutors and defense has been the use of the word "anonymous"/ "Anonymous." The lawyers on both sides will now be saying "Capital-A Anonymous" in order to distinguish the hacker collective from the general adjective.
The defense took care to distinguish Keys from that hacker collective. "One thing is indisputable," said Leiderman in his arguments. "Mr. Keys is a journalist. He was invited into the chatroom as a journalist."
Correction, Sept. 30: The third paragraph of this story originally read:
A major issue in the case, according to Leiderman, is whether what Keys did was "low-level vandalism, or high-level, high-damage hacking." Under the sections of the Computer Fraud & Abuse Act that the government is charging Keys with, they must show that Keys caused over $5,000 worth of damage—this is otherwise known as a jurisdictional minimum.
Some read this as meaning that Keys had admitted in court to hacking. No admissions have been made at this time, so the story has been changed to better convey this.