SAN FRANCISCO (CN) – The Ninth Circuit cautiously signaled Tuesday that it may reverse parts of former Tribune Publishing employee Matthew Keys’ conviction for helping hackers from the group Anonymous deface the Los Angeles Times website in 2010.
A possible reversal is far from certain, however, with only one judge – U.S. Circuit Judge N. Randy Smith – on the three-judge panel expressing a concrete opinion on the case.
“I’m not buying it yet, but I’m listening very carefully,” Smith told Assistant U.S. Attorney Matthew Segal at Tuesday’s hearing. Segal had urged the panel to affirm Keys’ conviction.
Keys was sentenced last year to two years in prison for helping Anonymous break into the Los Angeles Times website seven years ago to makes changes to online versions of a news feature.
He was also ordered to pay $249,956 in restitution for accessing a list of viewer email addresses – some of which had credit card information attached to them – from KTXL Fox 40 in Sacramento through Tribune Publishing’s content management system (CMS), and sending pseudonymous emails to viewers “taunting” them that he had access to the network, court records show.
Keys was the web news producer for KTXL and a site administrator for the Tribune CMS until he quit in October 2010 following a newsroom spat with his boss. Tribune Publishing owns both KTXL and the Los Angeles Times, and they share the same CMS.
A federal jury convicted Keys in October 2015 on three counts of the Computer Fraud and Abuse Act. He is asking the Ninth Circuit to overturn two of those counts and vacate the restitution award.
On Tuesday, Keys’ attorney Tor Ekeland argued that the government constructively amended his client’s original indictment by introducing irrelevant evidence at trial about Keys’ conduct that differed from and occurred before the conduct described in the indictment.
Ekeland said the original indictment included only the conduct surrounding the edit to the Los Angeles Times story. But, he said, the government told the jury that Keys stole the KTXL email addresses and created backdoor login credentials on the Tribune’s CMS that he gave to Anonymous, all of which occurred before the 2010 hack.
“He’s got a constitutional right to be solely charged by the grand jury, and not by the government, and not by the court,” Ekeland said, adding that a criminal defendant has the right under the Fifth Amendment to have his conviction reversed when a constructive amendment is made to an indictment. “They are effectively trying my client for a crime he was not charged with.”
Segal countered that the government included the conduct in question in a superseding indictment, which expanded the charging period to encompass it and added the language: “After his employment was terminated, Matthew Keys kept and used, for malicious purposes, login credentials to the Tribune Company’s CMS.”
And in a court brief, the government said that although Keys objected to the new allegation in the superseding indictment, he did not submit a jury instruction to stop jurors from considering the evidence surrounding it.
Judge Smith, however, was not persuaded, telling Segal that the original indictment concerned only the Los Angeles Times, and that the superseding one lacked any mention of Keys’ KTXL email campaign and creation of backdoor login credentials to Tribune’s CMS.
“There’s only two changes in the superseder and … I still have a tough time understanding how those two changes would make a difference in what we’ve got to deal with,” Smith said. “If it isn’t sufficient in the first, you’re not gonna convince me that those two changes are gonna do it.”
Segal clarified that because the superseding indictment had charged Keys with keeping and maliciously using login credentials to the Tribune CMS, the indictment encompassed not just Keys’ conduct related to the Los Angeles Times, but also to KTXL and Tribune Publishing.
“The defendant can say this is only about the Los Angeles Times, but that is not consistent with the indictment,” he said. “The Los Angeles Times conduct is what’s charged most specifically, but the question, if you’re deciding a constructive amendment claim, is whether there was evidence presented that was outside the allegations. Unquestionably this indictment … specifically identifies Fox 40 as a target for online intrusion and vandalism.”
Keys is not challenging the first count of his conviction. That means that even if the Ninth Circuit overturns the other two counts, Keys will still serve the remainder of his sentence. He is set to be released on April 30, 2018.
Ekeland said Keys appealed to reduce the number of felonies on his record and the amount of restitution he must pay.
Senior U.S. Circuit Judge Mary Schroeder and U.S. District Judge Anthony Battaglia, sitting by designation from the Southern District of California, joined Smith on the panel.
It is unclear when the Ninth Circuit will issue its decision.