Reuters social-media editor indicted in hack of L.A. Times site

A Reuters deputy social-media editor was indicted by a federal grand jury Thursday on charges connected to a hack of the Los Angeles Times’ website in 2010.

Matthew Keys, who tweets as @TheMatthewKeys and has more than 23,000 followers, faces charges of conspiracy to cause damage to a protected computer and transmission of malicious code. In a news release, the Justice Department said Keys faces up to 10 years in prison, three years of supervised release and a fine of $250,000 for each of the three counts he faces.

After news of the indictment broke, Keys’ normally active account fell silent. Some supporters compared his prosecution to that of Aaron Swartz, a popular hackivist who faced dozens of years in prison for mass-downloading scholarly articles before committing suicide. Federal computer-crimes laws have since come under intense scrutiny.

Keys, an influential figure in the digital breaking-news landscape, used to be a Web producer for the Sacramento TV station KTXL FOX 40.

The station is owned by the Tribune Company, as is the Los Angeles Times, and uses a content-management system for publishing stories online that is shared by the company’s outlets.

According to an indictment filed in the U.S. Eastern District of California, after Keys lost his job at FOX 40, he gave members of the Internet hacker collective Anonymous a username and a password for the system and told them to “go f--- some s--- up” in an Internet-relay chat.

An unidentified hacker then gained access to the Tribune’s system, created another username and edited a Los Angeles Times story to say, “Pressure builds in House to elect CHIPPY 1337,” according to the indictment.

The indictment included the following chat that officials say was between Keys (username “AESCracked”) and the unidentified hacker (“sharpie”) after Tribune administrators kicked the hacker out of the system.

AESCracked: I can grant you access again
sharpie: that would be great
sharpie: I know ho to use it now
AESCracked: Standby
AESCracked: Have to VPN to cover my tracks.
AESCracked: Oh I already am, nvm
sharpie: and I see that you can do a bunch of different layouts on different papers
AESCracked: damn they cut off my account

In the same chat, AESCracked mentioned having Tribune data stowed away on a hard drive, while the hacker added:

sharpie: that was such a buzz having my edit
sharpie: on the LA Times
AESCracked: Nice

According to the indictment, the Tribune Company spent more than $5,000 responding to the breach.

Keys had previously blogged in March 2012 about his connections with Anonymous, in which he acknowledged being in chats with high-level Anonymous members who were planning hacks. He wrote that he’d provided Gawker with dozens of logs from two months’ worth of chats with Anonymous members.

“I identified myself as a journalist during my interaction with the top-level Anonymous hackers and at no time did I offer said individuals any agreement of confidentiality,” Keys’ post said. “In fact, I asked several of them for their feelings should they be exposed. They seemed, by and large, indifferent.”

A year earlier -- a few months after the Times hack -- a notorious Anonymous-affiliated Twitter account tweeted that Keys was behind the breach.

Keys did not respond to a phone message or email seeking comment.

The Tribune Company and the Los Angeles Times will have no comment, said Nancy Sullivan, The Times’ vice president of communications.

Reuters said in a statement that it was aware of the charges, but did not comment specifically on Keys’ standing with the wire service.

“Any legal violations, or failures to comply with the company’s own strict set of principles and standards, can result in disciplinary action,” the statement said. “We would also observe the indictment alleges the conduct occurred in December 2010; Mr. Keys joined Reuters in 2012, and while investigations continue we will have no further comment.”

Hanni Fakhoury, a staff attorney for the Electronic Freedom Foundation -- which has offered to help Keys -- called the indictment “crazy.”

“The way I read the indictment, what the DOJ is saying is that the username and password was effectively like a malicious code that Keys was attempting to distribute,” Fakhoury said. “That’s pretty unprecedented.”

Fakhoury said the possible prison term carried by each of the three charges, which could total 25 years, was too severe. “Here’s another example of how the law is overly broad and insane, and we’re just going to add Matthew Keys to the list of people who are reasons that the system needs to be changed.”

Journalists reacted with shock and a little awkwardness after the announcement.

A few hours after the indictment was announced, Keys made a statement on Twitter:

Read the indictment below.

The Matthew Keys Indictment