How The Tribune Company And The DOJ Turned A 40 Minute Web Defacement Into $1 Million In 'Damages'
from the fudging-the-numbers dept
Last week we wrote about Matthew Keys being found guilty of three CFAA charges which will likely lead to some amount of jailtime for him (the prosecution has suggested it will ask for less than 5 years). While Keys still denies he did anything he’s accused of, the prosecution argues that he took a login to the Tribune Company’s content management system, handed it off to some hackers in an internet forum and told them to mess stuff up. And… so they made some minor vandalism changes to an LA Times article. It took the LA Times all of 40 minutes to fix it. Even if we assume that Keys did do this, we still have trouble seeing how it was any more than a bit of vandalism that deserves, at best, a slap on the wrist. Its ridiculous to say that it’s a form of felony hacking that requires a prison sentence. As we noted in our original article, the Tribune Company and the feds argued that the damage cost the company $929,977 in damage, well above the $5,000 threshold for the CFAA to apply. We still have trouble seeing how the $5,000 could make sense, let alone nearly a million dollars. And it’s important to note that the sentencing guidelines match up with the dollar amount of the “damages” so this actually matters quite a bit for Keys.
Sarah Jeong, who’s been doing an awesome job covering this for Motherboard, has a deep dive article looking at the case, which is totally worth reading. I wanted to dig in, though, just on the craziness of the $929,977 number and how that came about. First off, it appears that the feds pushed the Tribune Company to inflate the numbers. The original estimate from the Tribune Company turned out to be well below the $5,000 threshold, let alone the $900k+ number:
Again, assuming Keys actually did all these things, it would make him something of an immature jerk. But it still seems like a huge stretch to turn that into nearly a million dollars in damages, directly due to a CFAA violation. Either way, it’s yet another reminder that when the DOJ decides it wants to take you down, it can find almost anything to use against you.