6 ms·

Feds Never Charged the Real Hacker in the Matthew Keys Case

34 points by baldfat 11y ago

deleted 11y ago
[deleted]
jackgavigan 11y ago
To be fair, if the hack was carried out by a Scottish hacker, from Scotland, then he should be prosecuted in Scotland. The UK's policy with regards to this sort of thing is an absolute shambles, as illustrated by the Gary McKinnon affair[1]. If the FBI simply failed to supply any evidence to support a prosecution, one has to ask why they victimised Keys, while letting the actual perpetrator off scot-free. No pun intended. 1: There waws absolutely no reason why McKinnon couldn't have been prosecuted in the UK but when his solicitor claimed that no crime had been committed in the UK because the computers McKinnon had hacked were outside the UK (which is incorrect - the Computer Misuse Act applies to hacks where either the perpetrator or the target is in the UK), they made the monumentally stupid decision to try to extradite him, with the end result that he was never prosecuted or punished for his criminal activity.
dopamean 11y ago
25 years for this seems a bit harsh.
- mikecb 11y ago
  That's a statutory maximum, not a guideline or even remotely likely sentence.
  - baldfat 11y ago
    BUT that is what the Federal Prosecutor will ask for. Aaron Swartz was told that they were pursuing the maximum sentence. It isn't even fair how these things are handled against our own fellow citizens.
    - tzs 11y ago
      The prosecutors were seeking around 7 years in the Swartz case at trial, and offering a few months for a plea bargain.
      - baldfat 11y ago
        This was the original published statement: If convicted on these charges, SWARTZ faces up to 35 years in prison, to be followed by three years of supervised release, restitution, forfeiture and a fine of up to $1 million. https://web.archive.org/web/20120526080523/http://www.justice.gov/usao/ma/news/2011/July/SwartzAaronPR.html https://web.archive.org/web/20120526080523/http://www.justic... Yes they offered him 6 months finally but that is not how it starts. Plus in this country you get caught red handed you get a nice plea bargain and get less time than someone who might be innocent and they went to trial because they don't feel guilty and boom higher sentence for not taking the plea bargain. 90% of cases never go to trial. http://www.pbs.org/wgbh/pages/frontline/criminal-justice/the-problem-with-pleas/ http://www.pbs.org/wgbh/pages/frontline/criminal-justice/the... My friend who swore he was innocent and went to trial on a he said she said had zero evidence was offered 18 months went to trial and got 12 years. That was more than some murders, man slaughter and rape. If you have a FBI trial your defense will cost millions or you take the plea bargain. Justice system is broken.
        tptacek 11y ago
        The DOJ's press release isn't a binding legal document, and there is no calculation under the CFAA sentencing guidelines that gets you anywhere near 35 years. The 35 year number is simply a lie.
        baldfat 11y ago
        > The 35 year number is simply a lie Are you saying the DOJ is lying or that the fact that Aaron Swartz was told he could be facing 35 years in jail? This is so odd. I feel like people are down voting me to defend the DOJ's handling of Aaron Swartz?
tlrobinson 11y ago
By "hacked" does Wired really just mean "used the credentials to access a Tribune server and make a minor alteration to the headline of a Los Angeles Times news story" or did anyone in this case do any actual hacking?
- jaynos 11y ago
  The "hack" in question was using credentials that should have been disabled once Matthew Keys was no longer employed by Tribune. Also, I don't believe Tribune Co was able to prove whether anyone outside of the company actually saw the altered headline before it was corrected. It's also interesting to follow how the cost to fix this "hack" (i.e. change the headline back and delete the credentials that should have already been deleted) kept going up over the course of the trial. Initially under $5,000, then $5,000 so that the FBI can get involved, then eventually $929,977.00 [0]. [0]http://motherboard.vice.com/read/why-the-government-went-after-matthew-keys http://motherboard.vice.com/read/why-the-government-went-aft... [1]https://gimletmedia.com/episode/43-the-law-that-sticks/ https://gimletmedia.com/episode/43-the-law-that-sticks/
- chatmasta 11y ago
  Maybe describing this act as "hacking" is over-inclusive. But the fact is, this guy logged into a website that was not his, with credentials he should not have had, and changed a headline without authorization. He clearly knew what he was doing was illegal. I have no sympathy for him.
  - austenallred 11y ago
    The person who logged in and made the changes is not the person being prosecuted.
    - chatmasta 11y ago
      No, it's the person who knowingly gave credentials that did not belong to him to someone else. If I'm cat sitting for my friend, and she makes a copy of her house keys for me, and when I'm done catsitting, I give those keys to some random guy on the street in a hooded sweatshirt... who is liable if he uses the keys to enter her house? I'm pretty sure she would blame me.
peterwwillis 11y ago
> Matthew Keys is facing up to 25 years in prison after his conviction last month on conspiracy charges related to a 2010 hack of the Los Angeles Times web site. > A hacker going by the name “Sharpie” then used the credentials to access a Tribune server and make a minor alteration to the headline of a Los Angeles Times news story. That, along with "sending harassing emails" and "locking a co-worker out of their workstation", is why this guy [not the hacker] is getting 25 years. Meanwhile, the people who caused the largest financial crash in recent history have not gone to jail.
- dragonwriter 11y ago
  > is why this guy [not the hacker] is getting 25 years. No, he is not getting 25 years. He is being sentenced for a crime whose statutory maximum punishment is 25 years, for an offense which, under the circumstances put forward by the prosecutors, has a base guideline sentence of about 5 years (which is also what prosecutors have said they will seek in sentencing.) The defense is likely to, in sentencing, challenge the prosecution position on damages, which may result in the guideline range being substantially lower. There is, basically, zero chance of a sentence anywhere close to 25 years here.
- austenallred 11y ago
  Actually the trial doesn't technically involve sending harassing emails. Those weren't officially entered into evidence, so it's literally for the headline change.
  - peterwwillis 11y ago
    Well it was part of their damages estimation, even though he wasn't charged with it.
    - austenallred 11y ago
      Right, which is why that part is in the appeals court right now. (Matthew is one of my employees, so I know way more about this than most people should.)

34 points by baldfat 11y ago

deleted 11y ago

[deleted]

To be fair, if the hack was carried out by a Scottish hacker, from Scotland, then he should be prosecuted in Scotland. The UK's policy with regards to this sort of thing is an absolute shambles, as illustrated by the Gary McKinnon affair[1]. If the FBI simply failed to supply any evidence to support a prosecution, one has to ask why they victimised Keys, while letting the actual perpetrator off scot-free. No pun intended. 1: There waws absolutely no reason why McKinnon couldn't have been prosecuted in the UK but when his solicitor claimed that no crime had been committed in the UK because the computers McKinnon had hacked were outside the UK (which is incorrect - the Computer Misuse Act applies to hacks where either the perpetrator or the target is in the UK), they made the monumentally stupid decision to try to extradite him, with the end result that he was never prosecuted or punished for his criminal activity.

dopamean 11y ago

25 years for this seems a bit harsh.

mikecb 11y ago
That's a statutory maximum, not a guideline or even remotely likely sentence.
- baldfat 11y ago
  BUT that is what the Federal Prosecutor will ask for. Aaron Swartz was told that they were pursuing the maximum sentence. It isn't even fair how these things are handled against our own fellow citizens.
  - tzs 11y ago
    The prosecutors were seeking around 7 years in the Swartz case at trial, and offering a few months for a plea bargain.
    - baldfat 11y ago
      This was the original published statement: If convicted on these charges, SWARTZ faces up to 35 years in prison, to be followed by three years of supervised release, restitution, forfeiture and a fine of up to $1 million. https://web.archive.org/web/20120526080523/http://www.justice.gov/usao/ma/news/2011/July/SwartzAaronPR.html https://web.archive.org/web/20120526080523/http://www.justic... Yes they offered him 6 months finally but that is not how it starts. Plus in this country you get caught red handed you get a nice plea bargain and get less time than someone who might be innocent and they went to trial because they don't feel guilty and boom higher sentence for not taking the plea bargain. 90% of cases never go to trial. http://www.pbs.org/wgbh/pages/frontline/criminal-justice/the-problem-with-pleas/ http://www.pbs.org/wgbh/pages/frontline/criminal-justice/the... My friend who swore he was innocent and went to trial on a he said she said had zero evidence was offered 18 months went to trial and got 12 years. That was more than some murders, man slaughter and rape. If you have a FBI trial your defense will cost millions or you take the plea bargain. Justice system is broken.
      - tptacek 11y ago
        The DOJ's press release isn't a binding legal document, and there is no calculation under the CFAA sentencing guidelines that gets you anywhere near 35 years. The 35 year number is simply a lie.
        baldfat 11y ago
        > The 35 year number is simply a lie Are you saying the DOJ is lying or that the fact that Aaron Swartz was told he could be facing 35 years in jail? This is so odd. I feel like people are down voting me to defend the DOJ's handling of Aaron Swartz?

tlrobinson 11y ago

By "hacked" does Wired really just mean "used the credentials to access a Tribune server and make a minor alteration to the headline of a Los Angeles Times news story" or did anyone in this case do any actual hacking?

jaynos 11y ago
The "hack" in question was using credentials that should have been disabled once Matthew Keys was no longer employed by Tribune. Also, I don't believe Tribune Co was able to prove whether anyone outside of the company actually saw the altered headline before it was corrected. It's also interesting to follow how the cost to fix this "hack" (i.e. change the headline back and delete the credentials that should have already been deleted) kept going up over the course of the trial. Initially under $5,000, then $5,000 so that the FBI can get involved, then eventually $929,977.00 [0]. [0]http://motherboard.vice.com/read/why-the-government-went-after-matthew-keys http://motherboard.vice.com/read/why-the-government-went-aft... [1]https://gimletmedia.com/episode/43-the-law-that-sticks/ https://gimletmedia.com/episode/43-the-law-that-sticks/
chatmasta 11y ago
Maybe describing this act as "hacking" is over-inclusive. But the fact is, this guy logged into a website that was not his, with credentials he should not have had, and changed a headline without authorization. He clearly knew what he was doing was illegal. I have no sympathy for him.
- austenallred 11y ago
  The person who logged in and made the changes is not the person being prosecuted.
  - chatmasta 11y ago
    No, it's the person who knowingly gave credentials that did not belong to him to someone else. If I'm cat sitting for my friend, and she makes a copy of her house keys for me, and when I'm done catsitting, I give those keys to some random guy on the street in a hooded sweatshirt... who is liable if he uses the keys to enter her house? I'm pretty sure she would blame me.

peterwwillis 11y ago

> Matthew Keys is facing up to 25 years in prison after his conviction last month on conspiracy charges related to a 2010 hack of the Los Angeles Times web site. > A hacker going by the name “Sharpie” then used the credentials to access a Tribune server and make a minor alteration to the headline of a Los Angeles Times news story. That, along with "sending harassing emails" and "locking a co-worker out of their workstation", is why this guy [not the hacker] is getting 25 years. Meanwhile, the people who caused the largest financial crash in recent history have not gone to jail.

dragonwriter 11y ago
> is why this guy [not the hacker] is getting 25 years. No, he is not getting 25 years. He is being sentenced for a crime whose statutory maximum punishment is 25 years, for an offense which, under the circumstances put forward by the prosecutors, has a base guideline sentence of about 5 years (which is also what prosecutors have said they will seek in sentencing.) The defense is likely to, in sentencing, challenge the prosecution position on damages, which may result in the guideline range being substantially lower. There is, basically, zero chance of a sentence anywhere close to 25 years here.
austenallred 11y ago
Actually the trial doesn't technically involve sending harassing emails. Those weren't officially entered into evidence, so it's literally for the headline change.
- peterwwillis 11y ago
  Well it was part of their damages estimation, even though he wasn't charged with it.
  - austenallred 11y ago
    Right, which is why that part is in the appeals court right now. (Matthew is one of my employees, so I know way more about this than most people should.)