The FBI Wears Many Faces via Brian Klug on Flickr

Matthew Keys’ fate is out of his hands. Possibly for the next several decades.

Keys, a self-made meteor who’d rocketed to significant heights in the social media news desk firmament, was arrested in March of 2013 in connection with a December 2010 hack of the LA Times website, a hack he’d actually reported for Reuters. If indeed he was the mastermind and instigator behind the hack, as prosecutors allege, he left that part out. His editors would no doubt have a stern word with him, if they hadn’t fired him subsequent to his arrest.

And what was this dastardly hack?

One article on the LA Times site was temporarily altered, changing the author, headline, and a few words to turn a dry political story into a paen to the internet godhood of one “CHIPPY 1337”. Staff noticed, and fixed it within 40 minutes.

Matt Keys case screenshot of the LA Times deface hack via Morgan Little on Twitter

In March of 2013 Keys was charged with Conspiracy to cause damage to a protected computer, Transmission of malicious code, and Attempted transmission of malicious code. Each charge is a felony, and punishable by up to ten years (Conspiracy is only five!) in prison as well as a $250,000 fine and a three year probationary period after release. Restitution is a possibility as well, and the Tribune company (parent of the LA Times) sternly insists that it cost them more than $5,000 to fix the edit job.

Prosecutors claim that as a disgruntled ex-employee of Fox40 television, Keys had access to the Tribune parent company’s various web properties including the LA Times, and that in a retroactively-ironically-titled IRC (chatroom) called #internetfeds, he, using the nick AESCracked, gave to one Sharpie the user ID anon1234 and password common2, exhorting him to “go fuck shit up!” According to the prosecutors, the idea to hack the site originated with Keys, the tools to hack it originated with Keys, and later the information that he had done it originated, you guessed it, with Keys. But before Keys was (allegedly) telling on keys, someone else was snitching him out all over the Internet.

Since every Anonymous story that occurred in 2010 seems to involve infamous FBI informant and LulzSec/AntiSec/Anonymous turncoat Hector “Sabu” Monsegur, this story involves him too, in amazingly meta and recursive ways.

First, that “Sharpie” that AESCracked was talking to in #Internetfeds (didn’t I say it was ironic?) was none other than Sabu.

Second, Sabu spent a considerable amount of effort trying to get Keys arrested not long after the hack.

I was there, and I remember arguing with Anons about it at the time, less than six months after the hack. Silly me, I’d thought the rumour originated with a jealous colleague of Keys’, as he was seen as something of a wunderkind in social media news circles. Unless you count a couple of stunt reviews for the Daily Dot, Sabu is not a journalist.

He told Parmy Olson, a Forbes writer who was working on a book about Anonymous:

“During operation payback matthew keys came on IRC with the nick ‘AESCracked’. He said he wanted to contribute something to the cause so he went into #operationpayback #hackers and other channels and literally was giving away administrator access to tribune’s ENTIRE CMS. In return for giving away his former employee’s admin access he wanted to hang out in our channel.”

“And let me tell you, when I tell you full admin access, I MEAN FULL ADMIN ACCESS. Example. We had/have full list of ALL affiliate reporters and users of all tribune affiliate, INCLUDING BUT NOT LIMITED TO FOX40 (which he worked for) LATimes.com, fox.com affiliates. We could reset any reporters password, add admin users, modify pages, etc.”

At the time, Keys denied Sabu’s claim. Unfortunately for him, he sang a different tune to the investigators who finally came for him at home two years later. Groggy from sleep deprivation and a double dose of an antidepressant and sleeping pill, Keys, having been Mirandized and on video, blurted out, “I did it. I can’t deny it. I’m not going to lie about it now.”

Keys didn’t take the stand in his five-day trial. No-one did. Neither the prosecution nor the defence called any witnesses, including the accused. The defence didn’t even bother getting a transcript of the trial. As Keys lawyer Jay Leiderman told us, it’s a case that will be decided on appeal.

Not wasting any time, Leiderman and fellow defence attorney Tor Ekeland have already attempted to get the digital evidence from Keys’ computer and logs thrown out as “fruit of the poison tree” which is to say they believe the evidence resulted from a search and seizure that is itself illegal  and thus are inadmissible. They were unsuccessful, the evidence was allowed, as was the video confession.

They had sought to have that ruled inadmissible on the grounds that Keys was too groggy from lack of sleep and psychoactive meds to give informed consent, understand or exercise his rights. You can read that motion here. They also assert that the financial repercussions of the damage (one edited minor article on a busy news website) and a simple edit job did not rise to the level of felony.

Tuesday the trial wrapped up. Wednesday, Keys sits in his lawyer’s office waiting, like the rest of hacktivist journalism, to hear what’s next for Matthew Keys.

Now it’s up to the jury to decide whether Keys goes back to his job at Grasswire, a crowdsourced news startup, back to jail, or just back to Leiderman’s office to work on the expected appeal.

Meanwhile, there’s Twitter. Keys is already back at it.

UPDATE: Well, that didn’t take long.

Categories: Anonymous, AntiSec, Crime, Defaces, FBI, Hackers, Hacktivism, Hector Xavier Monsegur, Informants, Journalists, LulzSec, News, OpPayback, Politics, Sabu, Social Media, Twitter