Matthew Keys, the Reuters deputy social media editor charged with helping Anonymous attack the website of his former employer, acted as an “undercover" journalist when he communicated with members of the hacker group, his attorneys told The Huffington Post Friday.
“This is sort of an undercover-type, investigative journalism thing, and I know undercover -- I’m using that term loosely,” attorney Jay Leiderman said. “This is a guy who went where he needed to go to get the story. He went into the sort of dark corners of the Internet. He’s being prosecuted for that, for going to get the story.”
Keys's other attorney, Tor Ekeland, said Keys was "surprised" by the indictment Thursday and called the government’s case against him “a classic example of DOJ overreach."
"It looks like the government is essentially indicting a reporter under the [Computer Fraud and Abuse Act] for writing about Anonymous," Ekeland said.
Federal prosecutors, however, say Keys went beyond the basic tenets of journalism. They portray him as a disgruntled ex-employee who wanted hackers to deface the website of his former employer, a local Fox station in Sacramento.
Keys's attorneys dispute that he turned over login information for the company's content management system and argue the charges against him set a "really scary" precedent for journalists.
“It is telling journalists that you can’t do what you need to do to bring the Anonymous story to the forefront," Leiderman said. "This is a nasty shot across the bow for all journalists that would seek to cover Anonymous."
Leiderman, based in California, and Ekeland, of Brooklyn, are representing Keys pro bono. Keys was previously represented by a federal public defender who was working on the case pre-indictment, according to Leiderman.
Ekeland has also represented alleged members of Anonymous and Andrew Auernheimer, a hacker known as “Weev” who was convicted in November of conspiracy and identity theft after collecting thousands of email addresses from an AT&T server and disclosing them to the website Gawker. Auernheimer will be sentenced next week and faces up to 10 years in prison.
On Thursday, Keys’s current employer, Thomson Reuters, suspended him with pay, a spokesman said. Keys did not return phone calls or an email seeking comment.
Prosecutors appeared to anticipate his attorneys' argument that Keys was acting as a journalist. U.S. Attorney Ben Wagner, who is prosecuting the case, told Reuters that officials at Justice Department headquarters signed off on the indictment several times "out of an abundance of caution” because Keys is a journalist. A Justice Department spokeswoman told HuffPost there was “natural” consultation between the U.S. Attorney’s office and the Justice Department’s Criminal Division in D.C.
The federal investigation into Keys began on Dec. 1, 2010, when his former employer, Fox 40, noticed the station’s email contact list had been compromised and a producer received unsolicited emails from an unknown person who claimed to have the list, according to an FBI affidavit obtained by The Huffington Post.
The producer, who had fired Keys two months before, called the FBI and identified Keys as a potential suspect, according to the affidavit.
Keys, who had been in charge of the station’s social media, changed the passwords for Fox 40’s Twitter and Facebook accounts, preventing others from accessing them, according to the affidavit. Keys also deleted about 6,000 followers from the station's Twitter account. The producer regained control of the accounts four days later, the affidavit states.
On Dec. 12, 2010, Keys allegedly told the producer that he was communicating with members of Anonymous and "had access to future Anonymous operations including operations against PayPal, Amazon, the Los Angeles Times, Fox News and others." Two days later, a hacker defaced the Los Angeles Times' website and changed a headline.
In a chatroom with members of Anonymous known as #InternetFeds, Keys also allegedly asked if any of the hackers wanted his list of email addresses and access to the content management system belonging to Fox 40. The FBI says he urged hackers to send him a private message: "if you want to attack fox news, pm me. i have user/password for their cms."
More than a year later, members of Anonymous began discussing Keys’s role in the attack. A hacker who went by the screenname “Kayla” wrote in a March 2011 chat that Keys “was the one who gave us passwords for LA times, fox40 and some others,” according to the FBI.
The FBI said it also obtained an Internet chat log between Keys, who went by the screenname “AESCracked,” and Hector Xavier Monsegur, who went by the screenname “Sabu” and was a ringleader of LulzSec, an offshoot of Anonymous. Monsegur later became an undercover FBI informant on Anonymous.
The FBI alleges the chat between Keys and Monsegur went as follows:
Sabu: that would be nice to get access to fox. let me know if I can get access. I want to see if I can get further in.
AESCracked: I’m not a hacker.
AESCracked: I’m an ex-employee
Keys then revealed login information to Fox 40 parent company Tribune Co.'s computer server, giving hackers internal access to the website of the Los Angeles Times, the FBI says. After revealing the username and password, Keys allegedly told the hackers: “go f**k some s**t up!”
In January 2011, Keys was banned from the #InternetFeds chatroom after being accused of leaking information to the media, the FBI says.
On Oct. 4, 2012, federal agents searched Keys's apartment in Seacaucus, N.J. Afterward, Keys told a friend it had been a “rough day." Normally a constant presence on social media, Keys went quiet for four days. His first post on Facebook after federal agents searched his home was a quote from Conan O’Brien on his final day as host of "The Tonight Show."
"Nobody in life gets exactly what they thought they were going to get," Keys wrote, "but if you work really hard and you're kind, amazing things will happen."