United States v. Matthew Keys
The case arises out of Matthew Keys turning over the username and password of the content management system of his former employer, the Tribune Company, to members of Anonymous in an online chat room. An individual going by the name of “Sharpie” then used the credentials to log into the Tribune Company's content managemen system and made some relatively silly changes to an Los Angeles Times article—such as changing the title from “Pressure builds in house to pass tax-cut package” to “Pressure builds in House to elect CHIPPY 1337.” The original article was restored in approximately 40 minutes, and the Tribune Company blocked access to its content management system.
The government charged Keys with three felony violations of the federal anti-hacking statute, the Computer Fraud and Abuse Act (CFAA): conspiracy to cause damage to a protected computer, transmission of computer code that resulted in unauthorized damage, and attempted transmission of malicious code to cause unauthorized damage. The government argued that the Tribune Company incurred losses of $929,977.00 as a result of the defaced article. Keys faced a maximum punishment of 25 years in federal prison—10 years each for the first two offenses and 5 years for the third—for what essentially amounts to online vandalism. The case underscores how computer crimes are prosecuted much more harshly than analogous crimes in the physical world and is an illustration of why CFAA reform is long overdue.
Keys was convicted on all three counts in October 2015 and sentenced by a federal district court judge in April 2016 to two years in federal prison.