13 ms·

‘Beyond disgusting,’ says journalist Matthew Keys of his hacking conviction

89 points by ourmandave 11y ago

jug5 11y ago
Welcome to America, where petty crime is a life sentence if you're not wealthy.
sageabilly 11y ago
Wow, this guy sounds like a tool- zero remorse whatsoever for what he did, zero indication that he feels anything but completely entitled to a hand wave and a fine. No indication that he learned from his mistake, and no indication that he wouldn't do it again if he got fired from another job. 25 years is ridiculous, for sure. Honestly, prison time at all seems like crazy overkill. However Matthew Keys comes across like the definition of whiny entitled millennial. Any law-types able to weigh in on precedent in this sort of case? That might help to explain why they're pushing for such a ridiculous prison sentence.
- tptacek 11y ago
  He's not actually facing 25 years.
  - sageabilly 11y ago
    "But for journalist Matthew Keys, who prosecutors said illegally leaked the username and password needed to make the changes to the hacking group Anonymous, the end result may mean 25 years in prison." Probably not going to, but there's apparently a possibility or a precedent somewhere for that number to pop up.
    - tptacek 11y ago
      Yes, the story is wrong. It also contradicts itself on this point within a few grafs. https://popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://popehat.com/2013/02/05/crime-whale-sushi-sentence-el...
  - monstruoso 11y ago
    Actually he might. The way law is written, hackers are the closest thing to a terrorist. If Aaron Swartz is any indication, I expect an unfair ruling.
    - tptacek 11y ago
      Huh? Aaron Swartz never saw a ruling.
      - sarciszewski 11y ago
        Hold on, I can translate. "Because Aaron Swartz was treated badly, any time a `hacker` appears in court, they will be treated badly because $insert_tinfoil_here."
- EStudley 11y ago
  The fact that he's going to to have a really difficult time finding another job seems to be punishment enough..
- PhantomGremlin 11y ago
  Wow, this guy sounds like a tool He'd be smart to lose the attitude before sentencing. It all depends on the judge, but a lot of judges really really love to see groveling, remorse, repentance, contrition, etc. As others have said, he probably won't get 25 years. But maybe he does 3 years instead of 2 years. We'll see if he still thinks it's "bullshit" after he reports to prison.
  - sageabilly 11y ago
    If he serves time, he's probably more likely to think it's "bullshit".
  - spacecowboy_lon 11y ago
    yes going "F^%k you Judge" whilst on trial is going on doesn't go down well in any country
- jberryman 11y ago
  Is he a millenial? If so he looks awful. Anyway don't smear my(our?) generation, son.
eru 11y ago
jug5, you have been banned..
tptacek 11y ago
https://twitter.com/Popehat/status/651895735105929216 https://twitter.com/Popehat/status/651895735105929216
- TillE 11y ago
  So it's only five years in prison. Do you genuinely think that's appropriate punishment for some minor vandalism? Five years. I know American prison sentences are insane in general, but consider what that sentence actually means.
  - tptacek 11y ago
    We have no idea how long the sentence will be. Prosecutors said under 5 years. If I had to guess, it'll be closer to two years. I think the major problem with CFAA is the way in which sentences scale with damages. I generally think all criminal sentences are far too long. At the same time, this is a really unsympathetic defendant. It's not "minor vandalism" when the cleanup involves a $50,000 outside forensics investigation. I don't know if that's what Trib had to do, but much smaller companies than the Trib have had to pay much more in cleanup from otherwise innocuous breakins.
    - TillE 11y ago
      Popehat said "That's consistent with my calculation of 53-61 months guideline range." Two years is also a really, really long time. Who cares in the slightest if the defendant is or isn't an asshole? No, seriously. Empathy and basic humanity do not work that way.
      - tptacek 11y ago
        The court cares of the defendant is an asshole. You will get a higher sentence for being remorseless. I agree that two years is a really long time. But then, I think a single year in prison for dealing heroin on a corner is also a really long time, and the people who get imprisoned for doing that had far fewer options and opportunities than Keys did, so it's hard for me to imagine Keys being anyone's cause celebre.
tptacek 11y ago
Keys won't be sentenced to anything resembling 25 years. Even his prosecutors have said so. He's also far more responsible for his actions than Andrew Aurenheimer was. Keys, while working as a social media editor at Reuters, used his access from a previous job at a Tribune subsidiary to let anonymous Internet hackers break into the LA Times, one of the largest newspapers in the world; the attackers used it to modify stories. His "hack" was a straightforward abuse of the trust misplaced with him. Keys defense fixates on the rapidity with which those stories were taken down. But of course, that's not the whole story. The Tribune Corporation, like every major corporation, usually must follow a complex process after a breach. The cost far exceeds that of simply taking a story down. Keys has, by all accounts, fantastic attorneys. The sentencing phase of this trial is just now starting, right? How can they possibly be letting a freshly convicted felon talk like this? Isn't he harming his case here? Edit: my comment originally claimed, incorrectly, that Keys had used Reuters access to compromise the Tribune Company; he did not; rather: he used his access from a previous job at a Tribune subsidiary to do it.
- baldfat 11y ago
  To be fair the Tribune subsidiary should have revoked that access a LONG TIME AGO. The million dollars spent after the attack was to fix their security I bet. Don't think what he did was right and he did have someone illegally attack the LA Times but it does seem strange that this case is so big and the charges against him so large.
  - tptacek 11y ago
    You leave a job, you keep the keys to your office, your employer forgets to take them back, you then deliberately copy the keys and hand them out to vandals. What court in the world would put any of the responsibility for that on the company? Trib didn't spend millions in cleanup, but if any breach investigation were done --- to rule out the attackers having done things to retain access after credentials were revoked, and to ensure Trib's clients that no PII was taken --- would easily run into the mid tens of thousands.
    - 11y ago
cubano 11y ago
The 25-year "offer" from the prosecution is nothing but a scare tactic to make a defendant have to sit and think about all that time for awhile while they work on the other cases they have in the pipeline. It's a very standard practice and in no way indicates what the prosecution really wants to give him. In my recent experience, it works very well as it is no fun sitting around for months thinking about the possibility of doing all that time.
- tptacek 11y ago
  What "offer"? 25 years is the statutory maximum. Nobody "offered" it.
  - deleted 11y ago
    [deleted]
danso 11y ago
I sincerely hope Keys gets nothing more than probation. Mostly because this is the government's chance to make up for their colossal fuck up over Aaron Swartz. And because incarcerating Keys has so little value; he seems to have learned his lesson and in the time since his indictment has continued to do good journalism work, even landing new jobs. But if you believe the government's narrative isn't totally hocus pocus, that the IRC logs truly depict what they seem to, that Keys maintained the identity of "AESCracked" throughout the period of his alleged hacking...then to portray his actions as just helping to change a story's headline for the lulz is plain dishonest. Read the search warrant yourself [1], starting with page 39. He not only gives his credentials over; in the conversation, he talks about creating new accounts for hackers to use (yes, apparently an average web producer -- even after being fired -- has superuser privileges on the Tribune CMS). He then walks the other IRC users through how to navigate the CMS. He doesn't just encourage them to "go fuck some shit up!" on the LA Times, he then proceeds to enumerate every news site owned by Tribune, with particular instruction on which places should be hit for being "tribune's bread and butter assets". What really irks me is that hackers, page 47, then talk about rooting the Tribune server to gain access to to emails and everything else. And "AESCracked" is just sitting there, goading them along, giving them more information completely unprompted. It's hard for me to believe that any reporter who knows what "root access" means can say with a straight face that Keys is only guilty of a prank, that the possibility of an entire news organization's data -- including every reporter's email -- being captured and dumped like HBGary or Ashley Madison or Sony, is just no big deal. So why didn't that happen? Who knows -- but the fact that a company who granted superuser access to all web producers to their non-https publicly-exposed CMS, and had no process for revoking credentials, and did nothing even after noticing said superuser account was creating new unauthorized accounts -- managed to not get rooted after said credentials were given over is a bonafide Christmas miracle. One of the other IRC users (sharpie) decided on his/her own to fuck around with the LA Times in a way that was immediately obvious to the Tribune sysops, who then removed user privileges. Giving out superuser credentials to a hacker's group causes $0 worth of damage. Creating new user accounts (including another super user account) causes $0 of damage. Giving out every URL to the different CMSes, including the user manual about how to navigate their interfaces causes $0 of damage. Sure, it adds up to less than $5,000 of damage if you believe bits are just nothing but electronic blips. But let's not be dishonest and say that this was just a good ol' fun prank like the time when Woz programmed the campus computer system to bulk print "FUCK NIXON" [2] But yeah, the truth is that no real damage was caused despite the potential -- the $900K+ of damages cited was the money spent by Tribune to overhaul their system, including making CMS login URLs https. And hopefully, a better access-control system...and frankly, I'm OK with that kind of technicality allowing Keys to just get probation. Worser criminals have gotten acquitted for lesser reasons. But I don't feel it's right to gloss over his crime. IMO, what he did was not just less admirable than what Snowden and Aaron Swartz did, but more sociopathic than what weev was imprisoned for. According to the IRC transcript, Keys had no problem abetting a chatroom full of hackers with completely fucking his colleagues -- and any and all confidential sources for any ongoing journalism investigations. On a lighter note, page 46 of the search warrant is fun reading and I think sheds light on why the Tribune company didn't get completely owned. The hackers invite Keys to paste all the user credentials to their private hackerpad, and after doing so, Keys asks, "what's the govt passwords for? what lulz will be unleashed soon? or is that for me to not know? :p"...the responses in the IRC from the hackers after they realize what they've just let slip to a total stranger are just pure comedy. [1] http://www.laweekly.com/news/matthew-keys-helped-anonymous-hack-los-angeles-times-website-feds-allege-4175127 http://www.laweekly.com/news/matthew-keys-helped-anonymous-h... [2] https://books.google.com/books?id=Yd2Hm8BlzZUC&pg=PA162&lpg=PA162&dq=wozniak+fuck+nixon&source=bl&ots=KZdktxAOzS&sig=n5dM8cTZTNo9v_OM3Kg4XbIpXd4&hl=en&sa=X&ved=0CB4Q6AEwAGoVChMIlPPp8e6yyAIVkS2ICh3riARC#v=onepage&q=wozniak%20fuck%20nixon&f=false https://books.google.com/books?id=Yd2Hm8BlzZUC&pg=PA162&lpg=...
lowprestigetech 11y ago
Laws such as the CFAA that impose draconian penalties for what amount to harmless (or nearly so) infractions with computers are just another symptom of the low prestige of technology professionals. Yes, I know the offender in this case is a non-technical journalist and not a technology professional, but he is mere collateral damage and doesn't represent the people the CFAA was meant to keep in line, namely us. Contrast the legislative treatment we receive with that of doctors, who according to that same publication can apparently get away with literal murder and maiming for years before finally being punished: http://www.washingtonpost.com/news/morning-mix/wp/2015/08/25/sociopath-neurosurgeon-accused-of-intentionally-botching-operations/ http://www.washingtonpost.com/news/morning-mix/wp/2015/08/25...
CaiGengYang 11y ago
25 years jail for defacing a non-governmental website ? That seems like an incredibly harsh punishment ... I remember a previous case where Aaron Swartz was given 30 years for hacking into MIT website, after which he committed suicide by hanging himself ..
forgetsusername 11y ago
It's been posted a couple times by danso here, but it's worth posting again. Read the search warrant chat transcripts. They provide some insight into the case as well as his personality, and are good for a few laughs. They start on or about page 45: http://www.laweekly.com/news/matthew-keys-helped-anonymous-hack-los-angeles-times-website-feds-allege-4175127 http://www.laweekly.com/news/matthew-keys-helped-anonymous-h...
- matthewkeys 11y ago
  To be clear, federal authorities have already admitted altering chat log information in this case.
emidln 11y ago
I'm not actually clear what crime was committed. Divulging trade secrets or proprietary information is not a violation of the CFAA is it? Even so, how is divulging a (presumably expired) username and password any different than a security researcher releasing a PoC exploit? We don't (yet) prosecute researchers, even though they reasonably should know that their code could be used to exploit actual systems.
- wpietri 11y ago
  It's different in the same way that you giving your work keys to thieves is different than you writing a paper about potential flaws in a particular model of lock.
  - matthewkeys 11y ago
    Whether you believe in my innocence or not, the CFAA actually does have a line about "password trafficking," which was alleged by the government -- but not charged.
scelerat 11y ago
What would the charges be against Keys if he had knowingly given a set of keys to some vandals who came in and did several thousand dollars of damage? Whatever it is, it shouldn't be 25 years in prison, either.
- socalnate1 11y ago
  I don't know why this is getting downvoted, you are exactly right. Treating a crime committed "with a computer" with a totally different scale is idiotic.
Simulacra 11y ago
What concerns me about this is that people of the media seem to think that they are above reproach. A belief that their actions are always protected, and as a journalist, they should be given the benefit of the doubt. I know he has not made this claim directly, but I think this story would be vastly different had he not been a "journalist".

89 points by ourmandave 11y ago

jug5 11y ago

Welcome to America, where petty crime is a life sentence if you're not wealthy.

Wow, this guy sounds like a tool- zero remorse whatsoever for what he did, zero indication that he feels anything but completely entitled to a hand wave and a fine. No indication that he learned from his mistake, and no indication that he wouldn't do it again if he got fired from another job. 25 years is ridiculous, for sure. Honestly, prison time at all seems like crazy overkill. However Matthew Keys comes across like the definition of whiny entitled millennial. Any law-types able to weigh in on precedent in this sort of case? That might help to explain why they're pushing for such a ridiculous prison sentence.

tptacek 11y ago
He's not actually facing 25 years.
- sageabilly 11y ago
  "But for journalist Matthew Keys, who prosecutors said illegally leaked the username and password needed to make the changes to the hacking group Anonymous, the end result may mean 25 years in prison." Probably not going to, but there's apparently a possibility or a precedent somewhere for that number to pop up.
  - tptacek 11y ago
    Yes, the story is wrong. It also contradicts itself on this point within a few grafs. https://popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://popehat.com/2013/02/05/crime-whale-sushi-sentence-el...
- monstruoso 11y ago
  Actually he might. The way law is written, hackers are the closest thing to a terrorist. If Aaron Swartz is any indication, I expect an unfair ruling.
  - tptacek 11y ago
    Huh? Aaron Swartz never saw a ruling.
    - sarciszewski 11y ago
      Hold on, I can translate. "Because Aaron Swartz was treated badly, any time a `hacker` appears in court, they will be treated badly because $insert_tinfoil_here."
EStudley 11y ago
The fact that he's going to to have a really difficult time finding another job seems to be punishment enough..
PhantomGremlin 11y ago
Wow, this guy sounds like a tool He'd be smart to lose the attitude before sentencing. It all depends on the judge, but a lot of judges really really love to see groveling, remorse, repentance, contrition, etc. As others have said, he probably won't get 25 years. But maybe he does 3 years instead of 2 years. We'll see if he still thinks it's "bullshit" after he reports to prison.
- sageabilly 11y ago
  If he serves time, he's probably more likely to think it's "bullshit".
- spacecowboy_lon 11y ago
  yes going "F^%k you Judge" whilst on trial is going on doesn't go down well in any country
jberryman 11y ago
Is he a millenial? If so he looks awful. Anyway don't smear my(our?) generation, son.

eru 11y ago

jug5, you have been banned..

tptacek 11y ago

https://twitter.com/Popehat/status/651895735105929216 https://twitter.com/Popehat/status/651895735105929216

TillE 11y ago
So it's only five years in prison. Do you genuinely think that's appropriate punishment for some minor vandalism? Five years. I know American prison sentences are insane in general, but consider what that sentence actually means.
- tptacek 11y ago
  We have no idea how long the sentence will be. Prosecutors said under 5 years. If I had to guess, it'll be closer to two years. I think the major problem with CFAA is the way in which sentences scale with damages. I generally think all criminal sentences are far too long. At the same time, this is a really unsympathetic defendant. It's not "minor vandalism" when the cleanup involves a $50,000 outside forensics investigation. I don't know if that's what Trib had to do, but much smaller companies than the Trib have had to pay much more in cleanup from otherwise innocuous breakins.
  - TillE 11y ago
    Popehat said "That's consistent with my calculation of 53-61 months guideline range." Two years is also a really, really long time. Who cares in the slightest if the defendant is or isn't an asshole? No, seriously. Empathy and basic humanity do not work that way.
    - tptacek 11y ago
      The court cares of the defendant is an asshole. You will get a higher sentence for being remorseless. I agree that two years is a really long time. But then, I think a single year in prison for dealing heroin on a corner is also a really long time, and the people who get imprisoned for doing that had far fewer options and opportunities than Keys did, so it's hard for me to imagine Keys being anyone's cause celebre.

tptacek 11y ago

Keys won't be sentenced to anything resembling 25 years. Even his prosecutors have said so. He's also far more responsible for his actions than Andrew Aurenheimer was. Keys, while working as a social media editor at Reuters, used his access from a previous job at a Tribune subsidiary to let anonymous Internet hackers break into the LA Times, one of the largest newspapers in the world; the attackers used it to modify stories. His "hack" was a straightforward abuse of the trust misplaced with him. Keys defense fixates on the rapidity with which those stories were taken down. But of course, that's not the whole story. The Tribune Corporation, like every major corporation, usually must follow a complex process after a breach. The cost far exceeds that of simply taking a story down. Keys has, by all accounts, fantastic attorneys. The sentencing phase of this trial is just now starting, right? How can they possibly be letting a freshly convicted felon talk like this? Isn't he harming his case here? Edit: my comment originally claimed, incorrectly, that Keys had used Reuters access to compromise the Tribune Company; he did not; rather: he used his access from a previous job at a Tribune subsidiary to do it.

baldfat 11y ago
To be fair the Tribune subsidiary should have revoked that access a LONG TIME AGO. The million dollars spent after the attack was to fix their security I bet. Don't think what he did was right and he did have someone illegally attack the LA Times but it does seem strange that this case is so big and the charges against him so large.
- tptacek 11y ago
  You leave a job, you keep the keys to your office, your employer forgets to take them back, you then deliberately copy the keys and hand them out to vandals. What court in the world would put any of the responsibility for that on the company? Trib didn't spend millions in cleanup, but if any breach investigation were done --- to rule out the attackers having done things to retain access after credentials were revoked, and to ensure Trib's clients that no PII was taken --- would easily run into the mid tens of thousands.
  - 11y ago

cubano 11y ago

The 25-year "offer" from the prosecution is nothing but a scare tactic to make a defendant have to sit and think about all that time for awhile while they work on the other cases they have in the pipeline. It's a very standard practice and in no way indicates what the prosecution really wants to give him. In my recent experience, it works very well as it is no fun sitting around for months thinking about the possibility of doing all that time.

tptacek 11y ago
What "offer"? 25 years is the statutory maximum. Nobody "offered" it.
- deleted 11y ago
  [deleted]

danso 11y ago

I sincerely hope Keys gets nothing more than probation. Mostly because this is the government's chance to make up for their colossal fuck up over Aaron Swartz. And because incarcerating Keys has so little value; he seems to have learned his lesson and in the time since his indictment has continued to do good journalism work, even landing new jobs. But if you believe the government's narrative isn't totally hocus pocus, that the IRC logs truly depict what they seem to, that Keys maintained the identity of "AESCracked" throughout the period of his alleged hacking...then to portray his actions as just helping to change a story's headline for the lulz is plain dishonest. Read the search warrant yourself [1], starting with page 39. He not only gives his credentials over; in the conversation, he talks about creating new accounts for hackers to use (yes, apparently an average web producer -- even after being fired -- has superuser privileges on the Tribune CMS). He then walks the other IRC users through how to navigate the CMS. He doesn't just encourage them to "go fuck some shit up!" on the LA Times, he then proceeds to enumerate every news site owned by Tribune, with particular instruction on which places should be hit for being "tribune's bread and butter assets". What really irks me is that hackers, page 47, then talk about rooting the Tribune server to gain access to to emails and everything else. And "AESCracked" is just sitting there, goading them along, giving them more information completely unprompted. It's hard for me to believe that any reporter who knows what "root access" means can say with a straight face that Keys is only guilty of a prank, that the possibility of an entire news organization's data -- including every reporter's email -- being captured and dumped like HBGary or Ashley Madison or Sony, is just no big deal. So why didn't that happen? Who knows -- but the fact that a company who granted superuser access to all web producers to their non-https publicly-exposed CMS, and had no process for revoking credentials, and did nothing even after noticing said superuser account was creating new unauthorized accounts -- managed to not get rooted after said credentials were given over is a bonafide Christmas miracle. One of the other IRC users (sharpie) decided on his/her own to fuck around with the LA Times in a way that was immediately obvious to the Tribune sysops, who then removed user privileges. Giving out superuser credentials to a hacker's group causes $0 worth of damage. Creating new user accounts (including another super user account) causes $0 of damage. Giving out every URL to the different CMSes, including the user manual about how to navigate their interfaces causes $0 of damage. Sure, it adds up to less than $5,000 of damage if you believe bits are just nothing but electronic blips. But let's not be dishonest and say that this was just a good ol' fun prank like the time when Woz programmed the campus computer system to bulk print "FUCK NIXON" [2] But yeah, the truth is that no real damage was caused despite the potential -- the $900K+ of damages cited was the money spent by Tribune to overhaul their system, including making CMS login URLs https. And hopefully, a better access-control system...and frankly, I'm OK with that kind of technicality allowing Keys to just get probation. Worser criminals have gotten acquitted for lesser reasons. But I don't feel it's right to gloss over his crime. IMO, what he did was not just less admirable than what Snowden and Aaron Swartz did, but more sociopathic than what weev was imprisoned for. According to the IRC transcript, Keys had no problem abetting a chatroom full of hackers with completely fucking his colleagues -- and any and all confidential sources for any ongoing journalism investigations. On a lighter note, page 46 of the search warrant is fun reading and I think sheds light on why the Tribune company didn't get completely owned. The hackers invite Keys to paste all the user credentials to their private hackerpad, and after doing so, Keys asks, "what's the govt passwords for? what lulz will be unleashed soon? or is that for me to not know? :p"...the responses in the IRC from the hackers after they realize what they've just let slip to a total stranger are just pure comedy. [1] http://www.laweekly.com/news/matthew-keys-helped-anonymous-hack-los-angeles-times-website-feds-allege-4175127 http://www.laweekly.com/news/matthew-keys-helped-anonymous-h... [2] https://books.google.com/books?id=Yd2Hm8BlzZUC&pg=PA162&lpg=PA162&dq=wozniak+fuck+nixon&source=bl&ots=KZdktxAOzS&sig=n5dM8cTZTNo9v_OM3Kg4XbIpXd4&hl=en&sa=X&ved=0CB4Q6AEwAGoVChMIlPPp8e6yyAIVkS2ICh3riARC#v=onepage&q=wozniak%20fuck%20nixon&f=false https://books.google.com/books?id=Yd2Hm8BlzZUC&pg=PA162&lpg=...

lowprestigetech 11y ago

Laws such as the CFAA that impose draconian penalties for what amount to harmless (or nearly so) infractions with computers are just another symptom of the low prestige of technology professionals. Yes, I know the offender in this case is a non-technical journalist and not a technology professional, but he is mere collateral damage and doesn't represent the people the CFAA was meant to keep in line, namely us. Contrast the legislative treatment we receive with that of doctors, who according to that same publication can apparently get away with literal murder and maiming for years before finally being punished: http://www.washingtonpost.com/news/morning-mix/wp/2015/08/25/sociopath-neurosurgeon-accused-of-intentionally-botching-operations/ http://www.washingtonpost.com/news/morning-mix/wp/2015/08/25...

CaiGengYang 11y ago

25 years jail for defacing a non-governmental website ? That seems like an incredibly harsh punishment ... I remember a previous case where Aaron Swartz was given 30 years for hacking into MIT website, after which he committed suicide by hanging himself ..

forgetsusername 11y ago

It's been posted a couple times by danso here, but it's worth posting again. Read the search warrant chat transcripts. They provide some insight into the case as well as his personality, and are good for a few laughs. They start on or about page 45: http://www.laweekly.com/news/matthew-keys-helped-anonymous-hack-los-angeles-times-website-feds-allege-4175127 http://www.laweekly.com/news/matthew-keys-helped-anonymous-h...

matthewkeys 11y ago
To be clear, federal authorities have already admitted altering chat log information in this case.

emidln 11y ago

I'm not actually clear what crime was committed. Divulging trade secrets or proprietary information is not a violation of the CFAA is it? Even so, how is divulging a (presumably expired) username and password any different than a security researcher releasing a PoC exploit? We don't (yet) prosecute researchers, even though they reasonably should know that their code could be used to exploit actual systems.

wpietri 11y ago
It's different in the same way that you giving your work keys to thieves is different than you writing a paper about potential flaws in a particular model of lock.
- matthewkeys 11y ago
  Whether you believe in my innocence or not, the CFAA actually does have a line about "password trafficking," which was alleged by the government -- but not charged.

scelerat 11y ago

What would the charges be against Keys if he had knowingly given a set of keys to some vandals who came in and did several thousand dollars of damage? Whatever it is, it shouldn't be 25 years in prison, either.

socalnate1 11y ago
I don't know why this is getting downvoted, you are exactly right. Treating a crime committed "with a computer" with a totally different scale is idiotic.

Simulacra 11y ago

What concerns me about this is that people of the media seem to think that they are above reproach. A belief that their actions are always protected, and as a journalist, they should be given the benefit of the doubt. I know he has not made this claim directly, but I think this story would be vastly different had he not been a "journalist".