
Feds Never Charged the Real Hacker in the Matthew Keys Case - baldfat
http://www.wired.com/2015/11/matthew-keys-case-feds-know-who-the-real-hacker-sharpie-is/
======
jackgavigan
To be fair, if the hack was carried out by a Scottish hacker, from Scotland,
then he should be prosecuted in Scotland. The UK's policy with regards to this
sort of thing is an absolute shambles, as illustrated by the Gary McKinnon
affair[1].

If the FBI simply failed to supply any evidence to support a prosecution, one
has to ask why they victimised Keys, while letting the actual perpetrator off
scot-free. No pun intended.

1: There waws absolutely no reason why McKinnon couldn't have been prosecuted
in the UK but when his solicitor claimed that no crime had been committed in
the UK because the computers McKinnon had hacked were outside the UK (which is
incorrect - the Computer Misuse Act applies to hacks where _either_ the
perpetrator or the target is in the UK), they made the monumentally stupid
decision to try to extradite him, with the end result that he was never
prosecuted or punished for his criminal activity.

------
tlrobinson
By "hacked" does Wired really just mean "used the credentials to access a
Tribune server and make a minor alteration to the headline of a Los Angeles
Times news story" or did anyone in this case do any actual hacking?

~~~
chatmasta
Maybe describing this act as "hacking" is over-inclusive. But the fact is,
this guy logged into a website that was not his, with credentials he should
not have had, and changed a headline without authorization. He clearly knew
what he was doing was illegal. I have no sympathy for him.

~~~
austenallred
The person who logged in and made the changes is not the person being
prosecuted.

~~~
chatmasta
No, it's the person who knowingly gave credentials that did not belong to him
to someone else.

If I'm cat sitting for my friend, and she makes a copy of her house keys for
me, and when I'm done catsitting, I give those keys to some random guy on the
street in a hooded sweatshirt... who is liable if he uses the keys to enter
her house? I'm pretty sure she would blame me.

------
peterwwillis
> Matthew Keys is facing up to 25 years in prison after his conviction last
> month on conspiracy charges related to a 2010 hack of the Los Angeles Times
> web site.

> A hacker going by the name “Sharpie” then used the credentials to access a
> Tribune server and make a minor alteration to the headline of a Los Angeles
> Times news story.

That, along with "sending harassing emails" and "locking a co-worker out of
their workstation", is why this guy [not the hacker] is getting 25 years.

Meanwhile, the people who caused the largest financial crash in recent history
have not gone to jail.

~~~
austenallred
Actually the trial doesn't technically involve sending harassing emails. Those
weren't officially entered into evidence, so it's literally for the headline
change.

~~~
peterwwillis
Well it was part of their damages estimation, even though he wasn't charged
with it.

~~~
austenallred
Right, which is why that part is in the appeals court right now. (Matthew is
one of my employees, so I know way more about this than most people should.)

------
dopamean
25 years for this seems a bit harsh.

~~~
mikecb
That's a statutory maximum, not a guideline or even remotely likely sentence.

~~~
baldfat
BUT that is what the Federal Prosecutor will ask for. Aaron Swartz was told
that they were pursuing the maximum sentence. It isn't even fair how these
things are handled against our own fellow citizens.

~~~
tzs
The prosecutors were seeking around 7 years in the Swartz case at trial, and
offering a few months for a plea bargain.

~~~
baldfat
This was the original published statement:

If convicted on these charges, SWARTZ faces up to 35 years in prison, to be
followed by three years of supervised release, restitution, forfeiture and a
fine of up to $1 million.

[https://web.archive.org/web/20120526080523/http://www.justic...](https://web.archive.org/web/20120526080523/http://www.justice.gov/usao/ma/news/2011/July/SwartzAaronPR.html)

Yes they offered him 6 months finally but that is not how it starts. Plus in
this country you get caught red handed you get a nice plea bargain and get
less time than someone who might be innocent and they went to trial because
they don't feel guilty and boom higher sentence for not taking the plea
bargain.

90% of cases never go to trial.
[http://www.pbs.org/wgbh/pages/frontline/criminal-
justice/the...](http://www.pbs.org/wgbh/pages/frontline/criminal-justice/the-
problem-with-pleas/)

My friend who swore he was innocent and went to trial on a he said she said
had zero evidence was offered 18 months went to trial and got 12 years. That
was more than some murders, man slaughter and rape. If you have a FBI trial
your defense will cost millions or you take the plea bargain. Justice system
is broken.

~~~
tptacek
The DOJ's press release isn't a binding legal document, and there is no
calculation under the CFAA sentencing guidelines that gets you anywhere near
35 years. The 35 year number is simply a lie.

~~~
baldfat
> The 35 year number is simply a lie

Are you saying the DOJ is lying or that the fact that Aaron Swartz was told he
could be facing 35 years in jail?

This is so odd. I feel like people are down voting me to defend the DOJ's
handling of Aaron Swartz?

~~~
tptacek
The DOJ is lying, and lies routinely about this. A link to Popehat, the blog
of a former federal white-collar crimes prosecutor who writes about civil
liberties, was provided upthread and explains it in detail.

There is no substance whatsoever to the "35 years" figure.

The reality is that we don't really have to ask what Swartz was thinking,
because after his death, his lawyer wrote up his predicament. The trial would
have been ruinously expensive, but there was a very good chance that _even if
he was found guilty_ , he would serve no custodial sentence.

You can back that up by finding the federal sentencing guidelines, lookup up
the CFAA guidelines, and applying them to Swartz, who had no previous criminal
record, caused no significant damage in his offense, and sought no profit from
his crimes (all factors considered by the guidelines).

It's very hard to shoot down an urban myth as virulent as "Swartz faced 35
years in prison", though. Especially when so many people want it to be true.

~~~
baldfat
I agree with you except for one thing.

> It's very hard to shoot down an urban myth as virulent as "Swartz faced 35
> years in prison"

Because that is in fact what the DOJ sent out to the press in this document
stating the non-mythical number 35.

Trying to understand why 35 years is a myth the public continues to hold on
to: Pragmatically you are saying that could not happen but the empirical
evidence of DOJ communication to the public is 35 years.

~~~
tptacek
I don't really care who's to blame.

I'm certainly not defending the DOJ. A very thorough and compelling study of
mass incarceration published earlier this year suggests that prosecutorial
overzealousness probably accounts for more of our prison population than any
other factor.

But the "35 year sentence" claim has nothing to do with Swartz's predicament.
He had excellent legal representation, both formally (he had a series of well-
qualified criminal defense attorneys) and informally (he had a support system
compromised of several of the most respected legal scholars in the country).
Every one of them would have told him that he could, and should, ignore the
"35 year" figure from the DOJ's press release --- the DOJ writes a similar
press release for every headline prosecution, and in each case applies the
same absurd heuristic of adding up the maximum possible sentence for all
counts, ignoring the sentencing guidelines and offense grouping rules.

The 35-year sentence is also mooted by Heymann's own initial negotiation with
Swartz, where he threatened Swartz with a 7-year sentence. 7 years was his
_ambit claim_ ; it was the worst possible case Heymann could generate, and a
fabulously unrealistic one given the CFAA sentencing guidelines.

