Activists rally to support Matthew Keys, claiming he is a victim of CFAA

Reuters deputy social media editor Matthew Keys, who could be facing up to 25 years in prison for helping the hacker collective Anonymous, has gained the sympathy of online activists who say he is another victim (like online activist Aaron Swartz) of legal bullying by federal prosecutors.

Keys was indicted on Thursday afternoon, with the Department of Justice alleging that Keys handed over log in credentials for administrator access KTXL Fox 40 in Sacramento to Anonymous. The credentials had been provided to him while working for Fox 40, which is owned by Los Angeles Times parent company Tribune Co.

The indictment alleges that using the name “AESCracked” in an Anonymous internet relay chat (IRC), Keys handed over user names and passwords to hackers, granting them access to administrator accounts for LAtimes.com. 

More from GlobalPost: EU lays groundwork for continent-wide ban on pornography

“I can grant you access again,” said AESCracked in an IRC chat log. 

“Damn they cut off my account,” AESCracked went on to say, adding, “Let me see if I can find some other user/pass I created while there. All those other accounts were dead in minutes and they found ngarcia damn quick.”

When another hacker using the name "sharpie" indicated that he had defaced LATimes.com, AESCracked responded by saying, “Nice.”

During the attack, one hacker posted a fake news story to LATimes.com under the headline “Pressure builds in House to elect CHIPPY 1337.”

Keys has been charged with 1) conspiracy to transmit information to damage a protected computer, 2) transmitting information to damage a protected computer and 3) attempted transmission of information to damage a protected computer, and faces up to 25 years in prison and a $750,000 fine.

Keys is being charged under the Computer Fraud and Abuse Act (CFAA) under the general federal conspiracy statute.

Federal prosecutors had used the same law to charge Aaron Swartz, a prolific computer programmer and open internet activist. Facing 13 felony counts of fraud for breaking into and downloading several articles from academic journal database JSTOR, Swartz hanged himself in January.

Activists and lawmakers are calling for reform of the CFAA, a law that they say disproportionately punishes individuals who gain unauthorized access to computers and servers. Swartz faced up to 35 years in prison.

According to Swartz’s attorney, prosecutors were seeking to lessen his sentence to six months as part of a plea bargain.

Law enforcement officials may be hoping to use similar tactics against Matthew Keys to pressure him into divulging information regarding individuals associated with Anonymous or other hacker collectives. 

The amount of prison time Keys faces prompted further online protests over procedures used by law enforcement in prosecuting suspects charged under the CFAA. 

“Anyone horrified by the amount of jail time @TheMatthewKeys faces can go here to tell Congress we need CFAA reform: http://bit.ly/TWuRvg,” tweeted Trevor Trim, a blogger at the Electronic Frontier Foundation. 

Hanni Fakhoury, an EFF staff attorney and former federal public defender noted that a vandalism conviction can be a felony or misdemeanor but gets offenders no more than three years of jail time. Under the CFAA, gaining unauthorized access to computer systems to engage in digital vandalism, however, is punishable by up to 10 years in prison and a $250,000 fine. 

As some commenters noted, Keys would have faced a less severe punishment if he had elected to physically assault his old boss to express his displeasure over the termination of his employment. In New York, aggravated assault is punishable by up to 25 years in prison and a $5,000 fine.

Like Swartz, Keys is an active member of several online circles and social media platforms. Keys enjoys a large Twitter following and his account is receiving even more attention as advocates express their concerns using social media.

Keys’ Twitter account was active early Friday morning.

More from GlobalPost: Muslim hackers target US banks in third round of cyberattacks

“I am fine. I found out the same way most of you did: From Twitter. Tonight I'm going to take a break. Tomorrow, business as usual,” he stated from his Twitter account @TheMatthewKeys.

A Reuters spokesman indicated that they were aware of the indictment.

“Any legal violations, or failures to comply with the company’s own strict set of principles and standards, can result in disciplinary action. We would also observe the indictment alleges the conduct occurred in December 2010; Mr. Keys joined Reuters in 2012, and while investigations continue we will have no further comment,” read a statement issued by Reuters. 

Hours after the indictment was made public, Reuters suspended Keys with pay for an unspecified period of time. His work station was reportedly dismantled, and his security pass was deactivated.

According to an FBI affidavit obtained by Reuters, a former coworker suggested that Keys took part in the hack because he refused to hand over control of company Facebook and Twitter accounts after his employment was terminated. 

More from GlobalPost: Bitcoin: Online retailers push for virtual currency's legitimacy

Individuals associated with the Anonymous hacker collective made no indication as to whether or not the allegations against Keys were true but did point out that his indictment was the result of information given to the FBI by Hector “Sabu” Monsegur, a LulzSec and Anonymous hacker turned FBI informant. 

Before his arrest in June of 2011, Sabu alleged that Keys had been working with Anonymous.

“Matt Keys was former producer for Tribune sites. Gave full control of LATimes.com to hackers,” tweeted @anonymousSabu on March 21, 2011. 

Information provided by Sabu to law enforcement agencies has led to the arrest of five suspected hackers associated with Anonymous, LulzSec and Antisec.