Matthew Keys Found Guilty Of Criminal 'Hacking' For Sharing News Company Login
from the seems-extreme dept
Two and a half years ago, we wrote about former Reuters editor Matthew Keys being indicted based on charges that he’d shared the login information for the content management system to his former employer, the Tribune Company, in an online forum and then encouraged members of Anonymous in that forum to mess things up. Some people used that access to change a story on the LA Times website. Keys insists that he didn’t do this and the feds have no direct evidence linking him to whoever leaked the login (he also claims at the time of the leak he no longer had access to the Tribune Company’s systems).
As we noted at the time, if we accept the DOJ’s version of what happened, what Keys did definitely was the wrong thing to do. But the result was little more than annoying vandalism — and nothing Keys did should qualify as “criminal hacking.” The changes to the LA Times were up for less than an hour and quickly reverted. There was little evidence that it created any real damage, and certainly no lasting damage. And yet, because this is a “computer crime,” the feds came down on Keys as if he was part of some massive criminal conspiracy. In order to use the already problematic CFAA, it needed to show more than $5,000 worth of damage, which is crazy. Even crazier… is that the feds argued $929,977 worth of damage, based on some ridiculously exaggerated estimates of the amount of time people had to work on this issue.
And now a jury has convicted Keys on all three counts. Sentencing will be in January, and while lots of people are throwing around the statutory maximum of 25 years in jail, prosecutors have said they’ll likely ask for “less than 5 years” according to Motherboard’s Sarah Jeong, who was at the courthouse.
I think it’s clear that Keys was in the wrong in handing out the login to the Tribune’s systems, if he actually did it. But should that equate to criminal hacking charges and jailtime, because it resulted in a bit of online vandalism and some annoyance for a sys admin somewhere? That seems doubtful. As Keys himself points out in a pinned tweet in his Twitter feed, if sharing logins is a criminal act, all of you who share your HBO Go or Netflix logins may want to be careful.
The problem, once again, comes back to the ridiculous CFAA and the bogeyman of “computer hackers.” It was wrong to give out the login, but the idea that it did even $5,000 in damage (as required by the CFAA), let alone nearly a million in damages, is ludicrous. It’s even more ludicrous that this should be a criminal offense with any jailtime at stake. Go after him in a civil case for actual damages (of which there would be very little) and move on. Keys, for his part, has said the verdict is “bullshit” and he’s planning to appeal.
It’s way past time that we fixed the CFAA, and the Matthew Keys verdict is just yet another reminder that Congress needs to do something.