SAN FRANCISCO (CN) – Former Tribune Publishing employee Matthew Keys is not off the hook for helping hackers from the group Anonymous tamper with the Los Angeles Times website seven years ago, the Ninth Circuit ruled Monday.
Although U.S. Circuit Judge N. Randy Smith had expressed some inclination at a hearing earlier this month to overturn parts of Keys' 2015 conviction under the Computer Fraud and Abuse Act, the three-judge panel ultimately affirmed both the conviction and a restitution award of $249,956.
"Keys was not subjected to a constructive amendment," the panel wrote in an unsigned memorandum issued Monday.
In pushing to overturn the conviction, Tor Ekeland, Keys' attorney, had told the panel that the government constructively amended his client’s indictment by introducing irrelevant evidence at trial about Keys’ conduct that differed from and occurred before the conduct described in the indictment.
Constructive amendment occurs when the government presents at trial facts that differ from those in an indictment, or when the trial proof or jury instructions alter the crime charged, making it "impossible to know whether the grand jury would have indicted for the crime actually proved," according to the panel's five-page memorandum.
Ekeland declined to comment by phone Monday until he reviewed the decision, but said Keys would be considering his options for moving forward.
Keys was sentenced last year to two years in prison for helping Anonymous break into the Los Angeles Times website in 2010 to make changes to online versions of a news feature.
He was also ordered to pay $249,956 in restitution for accessing a list of Sacramento’s KTXL Fox 40 viewer email addresses – some of which had credit card information attached to them –through Tribune Publishing’s content management system (CMS). He used the addresses to send emails to viewers “taunting” them about having access to the network, court records show.
Keys was the web news producer for KTXL and a site administrator for the Tribune CMS until he quit in October 2010 following a newsroom spat with his boss. Tribune Publishing owns both KTXL and the Los Angeles Times, and they share the same CMS.
A federal jury convicted Keys in October 2015 on three counts of the Computer Fraud and Abuse Act. He had asked the Ninth Circuit to overturn two of those counts and vacate the restitution award.
At the hearing, Ekeland said the government's indictment included only the conduct surrounding the edit to the Los Angeles Times story. Nonetheless, he said, the government told the jury that Keys stole the KTXL email addresses and created backdoor login credentials on Tribune’s CMS that he gave to Anonymous, all of which occurred before the 2010 hack.
Judge Smith had seemed to side with Ekeland, telling Justice Department attorney Matthew Segal that the indictment concerned only the Los Angeles Times, and that a superseding indictment lacked any mention of Keys’ KTXL email campaign and creation of login credentials on Tribune's CMS.
Segal replied that the conduct in question had been included in a superseding indictment by expanding the charging period to encompass it and adding the language: "After his employment was terminated, Matthew Keys kept and used, for malicious purposes, login credentials to the Tribune Company’s CMS."
Additionally, the indictment identified KTXL as a target for "online intrusion and web vandalism," Segal said, and Keys' intention "to damage computer systems used by Tribune Company," according to the panel's decision.
The panel agreed, acknowledging Monday that Keys' conduct with regard to KTXL and Tribune Publishing had been encompassed in Count II of the indictment.
"A common-sense reading of the indictment as a whole, including facts that were necessarily implied, shows that the government tried Keys only on facts presented to the grand jury," the panel wrote. "Therefore, the government did not prove a complex of facts distinctly different from those in the indictment."
The panel also refused to vacate the restitution award Keys must pay stemming from damage to KTXL's viewer rewards database.
Keys had challenged the trial judge's determination of the amount by noting purported inconsistencies in trial testimony. However, the panel found that the judge had fairly determined the amount by re-reviewing the testimony and by relying on an estimate by a KTXL executive that it would cost $200,000 and take three years to rebuild the database, after nearly all of the 20,000 viewers in the database cancelled their participation in response to Keys' conduct.
"It was appropriate for the district court to order restitution in the amount it cost Fox 40 to replace the member database," the panel wrote "The restitution was reasonably based on Fox 40’s actual losses and did not result in a windfall to the victims."
Both Segal and Justice Department spokeswoman Lauren Horwood declined to comment on the decision by phone Monday.
Senior U.S. Circuit Judge Mary Schroeder and U.S. District Judge Anthony Battaglia, sitting by designation from the Southern District of California, joined Smith on the panel.
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
