Matthew Keys, an online whiz kid, has moved easily between two digital subcultures for years. A social-media journalist, he prodigiously tweeted news links and nuggets on behalf of the Reuters news service. He also was immersed in the shadowy world of computer hackers, chatting with them in secret forums and reporting from within their ranks.
In late 2010, the two lines in Keys’ life crossed into something illegal, the federal government says.
In a development that shocked Keys’ colleagues and counterparts, prosecutors on Thursday charged that the 26-year-old California native helped a hacker break into and vandalize the Los Angeles Times’ website in late 2010.
The alleged crime — Keys faces charges that are punishable by up to 25 years in prison — was stunning enough. Moreso was Keys’ supposed co-conspirator: a member of Anonymous, the notorious collective of hacker-activists that has disrupted private and public computer systems for years.
The story behind the indictment appears to be a tale of payback, counter-payback and perhaps naivete by a young man considered a rising star in the new-media world.
Federal authorities say they suspect Keys helped the Anonymous hacker, known as Sharpie, in order to get back at a former employer, TV station KTXL in Sacramento. Keys had worked at the station, owned by Tribune, as a web producer until he was terminated in October 2010 under circumstances the station has declined to discuss. The Los Angeles Times is also owned by Tribune.
Keys, who joined Reuters last year, allegedly shared a user name and password in an online chat with Sharpie and encouraged him to enter the Tribune’s digital-publishing system to deface news stories on the Times site. While Sharpie’s mischief appears to have caused minimal damage — one altered story appeared online for about a half-hour before the break-in was discovered — the government says the Times subsequently spent thousands of dollars to change passwords and beef up its computer security.
A Department of Justice spokeswoman won’t say how authorities came to suspect Keys, but the trail appears to lead back to an Anonymous hacker known as Sabu.
In March 2012, Keys disclosed his interactions with Sabu — the handle of Hector X. Monsegur — in a blog post for Reuters. Keys wrote that he had gained access to a chat room known only to an inner circle of hackers, including Sabu and other members of Anonymous.
Sabu, Keys wrote, had bragged in one chat that he would never cooperate with law enforcement officials if arrested. In fact, Sabu had been arrested that month, and Keys noted somewhat derisively that Sabu had turned into an FBI informant. “Sabu’s fate — indicted and talking — is a long way from how he led me to believe he would act if he ever ended up face-to-face with the law,” Keys wrote.
It’s likely, journalists who know Keys say, that Sabu led the FBI back to Keys and that federal authorities are now threatening Keys with prison in order to get him to disclose more information about the members of Anonymous.
Keys “can be very brash and cocky at times, and he’s very young, so anything is possible,” said a colleague, who spoke on the condition of anonymity because he is Keys’ friend.
One theory about the allegations, he said, is that Keys turned over his password to the Anonymous hacker to curry favor with the group in hopes of making a name for himself by covering it. He added: “That might be wishful thinking on some people’s part who don’t want to contemplate the possibility that he’s just a disgruntled former employee.”
But Adam Clark Estes, the former social-news editor at the Huffington Post, said Keys may not have realized the severity of his alleged actions. Comparing the defacement to “cyber graffiti,” said Estes, a contributing writer to the Atlantic Wire: “It’s like a guy with a can of spray paint in his backpack who hands it off [to a vandal]. He may not have made the connection that he was doing something damaging.”
Keys’ attorney, Jay Leiderman, could not be reached for comment. Keys, who has been suspended with pay by Reuters, has made one public comment — via Twitter, of course. “I am fine,” he wrote Thursday. “I found out the same way most of you did: From Twitter. Tonight I’m going to take a break. Tomorrow, business as usual.”