How The Tribune Company And The DOJ Turned A 40 Minute Web Defacement Into $1 Million In 'Damages'
Last week we wrote about Matthew Keys being found guilty of three CFAA charges which will likely lead to some amount of jailtime for him (the prosecution has suggested it will ask for less than 5 years). While Keys still denies he did anything he's accused of, the prosecution argues that he took a login to the Tribune Company's content management system, handed it off to some hackers in an internet forum and told them to mess stuff up. And... so they made some minor vandalism changes to an LA Times article. It took the LA Times all of 40 minutes to fix it. Even if we assume that Keys did do this, we still have trouble seeing how it was any more than a bit of vandalism that deserves, at best, a slap on the wrist. Its ridiculous to say that it's a form of felony hacking that requires a prison sentence. As we noted in our original article, the Tribune Company and the feds argued that the damage cost the company $929,977 in damage, well above the $5,000 threshold for the CFAA to apply. We still have trouble seeing how the $5,000 could make sense, let alone nearly a million dollars. And it's important to note that the sentencing guidelines match up with the dollar amount of the "damages" so this actually matters quite a bit for Keys.
Sarah Jeong, who's been doing an awesome job covering this for Motherboard, has a deep dive article looking at the case, which is totally worth reading. I wanted to dig in, though, just on the craziness of the $929,977 number and how that came about. First off, it appears that the feds pushed the Tribune Company to inflate the numbers. The original estimate from the Tribune Company turned out to be well below the $5,000 threshold, let alone the $900k+ number:
That's obviously not going to cut it, so they had to ratchet things up a bit. 
For what it's worth, Brandon apparently said on the stand that he was just joking, and he realizes that's not the best thing to joke about, but who are we to say anything about jokes who miss their mark? What we can say, however, is that the final numbers look absolutely ludicrous: 
Let's dig in a bit here, because suddenly I feel underpaid. Those emails are pricey! In case you're wondering the X Files references have to do with another thing that Keys apparently did: sending some nasty emails to people at the TV station after he left that job. From the look of it they were pretty obnoxious/childish behavior on the part of Keys (who eventually admitted to sending them), but they had absolutely nothing to do with the supposed CFAA violation. They were just nuisance emails, not any kind of hacking. However, to make the dollar value go up, the DOJ decided to lump this and some other incidents all together and asked the Tribune Company to add up all the time it was dealing with that issue, and so they did. Even to the point that they blamed ratings drops at the Fox channel that Keys used to work for on him as well, and put a dollar value on that.
Again, assuming Keys actually did all these things, it would make him something of an immature jerk. But it still seems like a huge stretch to turn that into nearly a million dollars in damages, directly due to a CFAA violation. Either way, it's yet another reminder that when the DOJ decides it wants to take you down, it can find almost anything to use against you.
Permalink | Comments | Email This Story
Sarah Jeong, who's been doing an awesome job covering this for Motherboard, has a deep dive article looking at the case, which is totally worth reading. I wanted to dig in, though, just on the craziness of the $929,977 number and how that came about. First off, it appears that the feds pushed the Tribune Company to inflate the numbers. The original estimate from the Tribune Company turned out to be well below the $5,000 threshold, let alone the $900k+ number:
That's obviously not going to cut it, so they had to ratchet things up a bit. For what it's worth, Brandon apparently said on the stand that he was just joking, and he realizes that's not the best thing to joke about, but who are we to say anything about jokes who miss their mark? What we can say, however, is that the final numbers look absolutely ludicrous: Let's dig in a bit here, because suddenly I feel underpaid. Those emails are pricey! In case you're wondering the X Files references have to do with another thing that Keys apparently did: sending some nasty emails to people at the TV station after he left that job. From the look of it they were pretty obnoxious/childish behavior on the part of Keys (who eventually admitted to sending them), but they had absolutely nothing to do with the supposed CFAA violation. They were just nuisance emails, not any kind of hacking. However, to make the dollar value go up, the DOJ decided to lump this and some other incidents all together and asked the Tribune Company to add up all the time it was dealing with that issue, and so they did. Even to the point that they blamed ratings drops at the Fox channel that Keys used to work for on him as well, and put a dollar value on that. Again, assuming Keys actually did all these things, it would make him something of an immature jerk. But it still seems like a huge stretch to turn that into nearly a million dollars in damages, directly due to a CFAA violation. Either way, it's yet another reminder that when the DOJ decides it wants to take you down, it can find almost anything to use against you.
Permalink | Comments | Email This Story