On Wednesday afternoon, six months after he was convicted of a computer crime that barely warranted the distinction, journalist Matthew Keys was sentenced to serve 24 months in federal prison. Keys, who has worked for Reuters and the Tribune Company, was indicted in 2013 for conspiring to vandalize the website of the Los Angeles Times. The mischief that Keys enabled was confined to a single page on the Times’ website, was removed after 40 minutes, and did no lasting damage to the site. Nevertheless, the U.S. Attorney’s office in Sacramento, California, deemed it a “serious crime that requires strong deterrence,” and had recommended a five-year sentence for Keys. Two years is less than five, so that has to be some small comfort. But by any rational standard, it counts primarily as further proof that the law under which Keys was charged needs to be reformed.
Keys was convicted of violating America’s terrible Computer Fraud and Abuse Act, a federal computer-crime statute so broad and vague that you’ve probably already violated it several times this year. The CFAA—the same law that ensnared Aaron Swartz, Andrew “weev” Auernheimer, and other notable defendants—gives federal prosecutors the latitude to categorize a wide range of computer-related activity as felonious, and to willfully and regularly conflate the malicious with the innocuous. Have you ever used a friend’s password to access her Netflix or HBO Go accounts without paying for them, or used some other means to evade a paywall or otherwise violate a website’s terms of service? Congratulations! You’re a potential felon.
The Department of Justice doesn’t make a habit of prosecuting frugal cord-cutters, of course. But the CFAA is written broadly enough that a U.S. attorney could throw the book at you for so absurdly minor an infraction, if she wanted to. That’s precisely the problem: A law that qualifies basically everything as a crime means that ambitious computer-crime prosecutors can count anything one, and bring criminal prosecutions against people who have no business going to prison.
Keys was convicted of providing some random dude with backend login information that allowed him to briefly vandalize one article on the Los Angeles Times website. The sum total of the incursion was that a couple dozen words in a Times article were altered and the article’s headline was briefly changed to read, “Pressure builds in House to elect CHIPPY 1337.” (The hacker who actually changed the headline has been neither arrested nor charged.) Prosecutors portrayed Keys as a disgruntled ex-employee seeking revenge against the company responsible for his termination. The government alleged that Keys, bitter over being fired from his job at a television station owned by Tribune Company, repeatedly tried to get members of Anonymous to damage Tribune Company websites by offering them login credentials.
If the government’s case is accurate, then Keys is clearly guilty of something. But the damage was quickly fixed, at relatively minimal expense. No servers crashed as a result of this incursion. No lasting harm was done. So why go so hard at a journalist for such a minor offense? It’s possible to ascribe the case to inexperience—the district in which Keys was charged does not often handle computer-crime cases—and general prosecutorial intransigence. I think it’s just as likely that the prosecutors just didn’t care for Keys’ attitude. Keys has publicly criticized the case against him and the merits of the law under which he was charged—something prosecutors really don’t like defendants doiing. In his sentencing memorandum, Assistant U.S. Attorney Matthew D. Segal lambasted Keys’ “outsized, narcissistic sense of specialness” and readiness to defend himself in public. “It is exceptionally rare to see a defendant engage in an after-verdict press campaign to undermine public confidence in the jury’s verdict,” Segal wrote. “It is a direct attack on the work of the jury and the validity of the verdicts. It undermines respect for law at a time when the public seems more willing to credit strongly worded criticism of traditional institutions.” That’s nonsense. Bad, vague statutes that empower misguided, retributive prosecutions do more to undermine respect for the law than anything Matthew Keys has ever said or written.
