LA Times hack: Security breach or harmless prank?

SAN FRANCISCO -- Federal prosecutors say Reuters' deputy social media editor conspired with a notorious hacker network to cause an online security breach that should be punished by decades in federal prison.

Fervent online supporters of Matthew Keys say the journalist was just taking part in an online prank that briefly altered the Los Angeles Times' website, and he shouldn't ever have been suspended from his job.

In an age when the line between tech superstardom and outright hacking grows increasingly blurry, the case against Keys, 26, lays bare sharp divisions about what constitutes Internet crime and how far the government should go to stop it.

"Congress wants harsh penalties doled out for these crimes because they don't want people defacing websites, but there has to be a way that we can bring the law into harmony with the realities of how people use technology today," said Hanni Fakhoury, an attorney at the San Francisco-based not-for-profit Electronic Frontier Foundation.

Keys, a well-known figure in the Twitterverse, was charged Thursday with conspiring with the hacking group Anonymous to alter a Times news story in late 2010.

The federal indictment accuses Keys of giving hackers information they needed to access the computer system of Times' parent company, Tribune Co. Tribune also owns a Sacramento television station Keys had been fired from months earlier.

An attorney for Keys said he is not guilty, and that the government is overreaching in its zeal to prosecute Internet pranks.

"No one was hurt, there were no lasting injuries, no one's identify was stolen, lives weren't ruined," his Ventura, Calif.-based attorney, Jay Leiderman, said on Friday. "Mr. Keys was no different than any other embedded journalist. The story he was going after was inside this chat room, and he went there."

Keys was hired in 2012 as deputy social media editor for the Reuters news service. He didn't return a phone call seeking comment.

"I'm okay," he tweeted Friday in response to a journalism colleague wondering how he was doing.

According to Keys' Facebook profile, he is single and works at Thomson Reuters Corp.'s New York office, where "I get paid to use Twitter and Facebook at work."

He was suspended with pay late Thursday, said Reuters spokesman David Girardin, who did not elaborate. A spokesman for the Chicago-based Tribune Co. declined to comment.

According to the indictment, a hacker identified only as "Sharpie" used information Keys supplied in an Internet chat room and altered a headline on a December 2010 Times story to read "Pressure builds in House to elect CHIPPY 1337." The reference was to another hacking group credited with defacing the website of video game publisher Eidos in 2011.

Keys is charged with one count each of conspiracy to transmit information to damage a protected computer, as well as transmitting and attempting to transmit that information. If convicted, prosecutors say the Secaucus, N.J., resident faces a combined 25 years in prison and a $500,000 fine if sentenced to the maximum for each count.

However, first-time offenders with no criminal history will typically spend much less time in prison than the maximum sentence, said Mary Fan, a former federal prosecutor who specializes in criminal law and procedure at the University of Washington School of Law.

Keys' arraignment is scheduled for April 12 in Sacramento, Calif.

His indictment comes after recent hacks into the computer systems of two other U.S. media companies that own The New York Times and The Wall Street Journal. Both newspapers reported in February that their computer systems had been infiltrated by China-based hackers, likely to monitor media coverage the Chinese government deems important.

Anonymous and its offshoot, Lulz Security, have been linked to a number of high-profile computer attacks and crimes, including many that were meant to embarrass governments, federal agencies and corporate giants. They have been connected to attacks that took data from FBI partner organization InfraGard, and they've jammed websites of the CIA and the Public Broadcasting Service.

Keys' indictment also follows the suicide of Aaron Swartz, a 26-year-old Internet activist who was found dead in his Brooklyn apartment Jan. 11 as a trial loomed in his future.

Family and friends say Swartz killed himself after he was hounded by federal prosecutors. Officials say he helped post millions of court documents for free online and that he illegally downloaded millions of academic articles from an online clearinghouse.

"In the wake of the Aaron Swartz case, we really thought that Justice would kind of catch their breath and maybe understand that they had erred in pushing these cases forward in such an aggressive manner for what are essentially pranks," Leiderman said.

Keys' Facebook page says he worked as an online news producer for Tribune-owned FOX affiliate KTXL from June 2008 to April 2010.

After that, he worked briefly in San Francisco as the tech industry began its latest ascent.

Today, top software companies often sponsor `hackathons,' weekends of intense work and little sleep, to get free outside programming help to solve problems or advance products.

Sometimes, coding straddles the lines between what's legal and illegal.

The hacking crimes Keys is charged are laid out in the Computer Fraud and Abuse Act, which was enacted in the 1980s.

Federal prosecutors use the act to go after a wide range of Internet crimes, but the law may not reflect how our behavior online has changed over the last three decades, Fan said.

"Some might say if you take someone's property or break into a private place without permission, we don't get upset about prosecutions, so why would we be upset about these prosecutions if the trespass happened online?" Fan said. "Others might say is what happened in this case really even a problem? It's kind of a culture clash."

------

Follow Garance Burke at http://twitter.com/garanceburke .