UNITED STATES OF AMERICA, 1 Plaintiff, V. MATTHEW KEYS, Defendant. Case Document 1 Filed 03/14/13 A Page 1 of 9 BENJAMIN B. WAGNER United States Attorney MATTHEW D. SEGAL Assistant United States Attorney 501 I Street, Suite 10-100 Sacramento, CA 95814 Telephone:_ (916) 554-2700 Facsimile: (916) 554-2900 MYTHILI RAMAN Assistant Attorney General Criminal Division, U.S. Department of Justice JAMES A. SILVER Trial Attorney Computer Crime and Intellectual Property Section 1301 New York Avenue, Suite 600 Washington, DC 20530 Telephone: (202) 514-1026 Attorneys for Plaintiff United States of America IN THE UNITED STATES DISTRICT COURT EASTERN DISTRICT OF CALIFORNIA 2113-' CR _.ooe2 rum CASENO. VIOLATIONS: 18 U.S.C. 371 -- Conspiracy to Cause Damage to a Protected Computer; 18 U.S.C. 103 of Malicious Code; 18 U.S.C. 1030(a)(5)(A) AND 103 0(b) --Attempted Transmission of Malicious Code; 18 U.S.C. 982 l030(i)(l)(A), AND 18 U.S.C. 982 Forfeiture Allegation INDICTMENT COUNT ONE: [18 U.S.C. 371 -- Conspiracy to Cause Damage to a Protected Computer] The Grand Jury charges: MATTHEW KEYS, defendant herein, as follows: . Indictment Case Document 1 Filed 03/14/13 Page 2 of 9 I. INTRODUCTION 1. At all times relevant to this Indictment: a. Defendant MATTHEW KEYS was an individual residing in Sacramento County in the State and Eastem District of California. b. Tribune Company was a Delaware corporation that owned, among other media outlets, the Los Angeles Times newspaper and the Sacramento, Califomia-based television station KTXL FOX 40 ("Fox c. 1 Tribune Company used a content management system to publish web versions of news stories from television stations and newspapers owned by Tribune Company. d. Internet Relay Chat was an Intemet-based system that allowed its users, lo-cated worldwide, to send and receive live messages to single or multiple recipients within various IRC channels, or discussion areas. e. Anonymous was a group of Internet users that had claimed responsibility for intruding into, vandalizing, and disabling computer systems of governments and private entities. f. "Sharpie" was the nickname of an Anonymous member. g. MATTHEW KEYS was a recently terminated employee of Fox 40 and used the nickname "AESCracked" for his IRC communications with members of Anonymous. II. CONSPIRACY 2. Between on or about December 8, 2010, andor about December 15, 2010, in the State and Eastem District of California and elsewhere, the defendant, MATTHEW KEYS, together with at least one other person, did conspire to knowingly cause the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally caused damage without authorization to a protected computer, causing loss to a person during a 1-year period aggregating at least $5,000 in value, in violation of 18 U.S.C. 1030(a)(5)(A) and all in violation of Title 18 United States Section, Code 371. Indictment 2 Case Document 1 Filed 03/14/13 Page 3 of 9 OBJECTS 3. The conspiracy had the following objects, among others: to make unauthorized changes to web sites that Tribune Company used to communicate news features to the public; and to damage computer systems used by Tribune Company. IV. MANNER AND MEANS OF THE CONSPIRACY The conspiracy used several means to accomplish the objects of the conspiracy, including the following: 4. Participants identified Tribune Company, Fox 40, and The Los Angeles Times as targets for online intrusion and web vandalism; 5. It was part of the conspiracy to share at least one usemame and 'password combination that could be used to log in and make changes to Tribune Company's 6. It was part of the conspiracy to obtain control of at least one additional usemame and password combination that could be used to log in and make changes to Tribune Company's 7. It was part of the conspiracy to login without authorization to Tribune Company's CMS for the purpose of learning how to alter and damage it; and 8. It was part of the conspiracy to alter the online version of. a news feature published on the web site of the Los Angeles Times. I V. OVERT ACTS In furtherance of the conspiracy, and to accomplish the objects of the conspiracy, at least one member of the conspiracy committed and caused to be committed various overt acts within the Eastern District of California and elsewhere, including, but not limited to, the following: 9. On or about December 8, 2010, individuals identifying themselves as members of Anonymous had a conversation in an IRC channel known as #internetfeds in which one conspirator expressed a desire to gain unauthorized access to computer systems of Fox, a media outlet. 10. Defendant MATTHEW KEYS, using the nickname AESCracked, responded that "it takes a while to grant one usemame permission to every site. I'm doing that now." Thereafter, KEYS was invited to join the IRC channel #internetfeds. Indictment 3 Case Document 1 Filed 03/14/13 Page 4 of 9 ll. Defendant MATTHEW KEYS then told the unidentified individuals that he was a former employee, proceeded to give them a usemame and password, and told them to "go fuck some shit up." 12. Between on or about December 8, 2010 and on or about December 14, 2010, at least one member of the conspiracy used the anonl234 username and corresponding password to reconnoiter the Tribune Company CMS to ascertain how it worked and how best to accomplish the objectives of the conspiracy. 13. On or about December 11, 2010, a member of the conspiracy began using the usemame ngarcia on the Tribune Company CMS. 14. On or about December 14 and 15, 2010, a member of the conspiracy used the username ngarcia to alter content in a Los Angeles Times news story published on the Tribune Company CMS to read as follows: 15. Pressure builds in House to elect CHIPPY 1337. House Democratic leader Steny Hoyer sees 'very good things' in the deal cut which will see uber skid Chippy 1337 take his rightful place, as head of the Senate, reluctant House Democrats told to SUCK IT UP. By CHIPPYS N01 FAN On or about December 15, 2010, defendant MATTHEW KEYS, who was using the online nickname "AESCracked," engaged in the following conversation and did the things reflected in the conversation: Indictment sharpie: http:// ADDRESS sharpie: I taught myself the dystem using ngarcia sharpie: *system AESCracked: LOL sharpie: and had a whole front page layout made for the chicago tribune AESCracked: Is it live? sharpie: but dam there sysadmins were good sharpie: nah they killed me sharpie: that was up for hr AESCracked: Screenshot? sharpie: no AESCracked: sucks sharpie: the I menat the LA Times was up for hr AESCracked: I can grant you access again sharpie: that would be great 4 sharpie: AESCracked: AESCracked: AESCracked: sharpie: AESCracked: sharpie: AESCracked: AESCracked: sharpie: AESCracked: sharpie: AESCracked: sharpie: sharpie: sharpie: AESCracked: sharpie: AESCracked: sharpie: AESCracked: sharpie: sharpie: sharpie: AESCracked: sharpie: AESCracked: sharpie: sharpie: AESCracked: sharpie: sharpie: Case Document 1 Filed 03/14/13 Page 5 of 9 I know ho to use it now Standby Have to VPN to cover my tracks. Oh I already am, and I see that you can do a bunch of different layouts on different papers . damn they cut off my account and have them all go live at the same time hang on. Nope, I'm locked out for good. fuck yeah Let me see if I can find some other users/pass I created while there. all those other accounts were dead in minutes and they found ngarcia damn quick I got to give props to the stsadmins *sysadmins LOL. anyjoy'? Not yet kay bro Will check a little later for sure afk 5 mins anyway cool '0 thanks Sure thing that was such a buzz having my edit on the LA Times Nice I could have done so much more if I'd known interface at the start it's both easy and complicated All in violation of Title 18, United States Code, Section 371. [18 U.S.C. 1030(a)(5)(A) and of Malicious Code] The Grand Jury further charges: A defendant herein, as follows: 1. MATTHEW KEYS, The allegations set forth in Paragraphs 1 and 3 through 15 of Count 1 are realleged as if fully set forth herein. Indictment I have a hard drive full of Tribune crap, but it's in another location. Case Document 1 Filed 03/14/13 Page 6 of 9 2. Between on or about December 8, 2010, and on or about December 15, 2010, within the State and Eastern District of California and elsewhere, the defendant, MATTHEW KEYS, did knowingly transmit a program, information, code, and command, and, as a result of such conduct, intentionally caused damage without authorization to a protected computer, and the offense caused loss to a person during a 1-year period from the defendant's course of conduct affecting a protected computer aggregating at least $5,000 in value, in that the Tribune Company spent over $5,000 responding to the attack, conducting a damage assessment, and restoring the system to its prior condition, in violation of Title 18 United States, Code, Section 1030(a)(5)(A), Section and 2. COUNT THREE: [18 U.S.C. 103 AND 1030 (b)-Attempted Transmission of Malicious Code] The Grand Jury further charges: A MATTHEW KEYS, defendant herein, as follows: 1. The allegations set forth in Paragraphs 1 and 3 through 15 of Count 1 are realleged as if fully set forth herein. 2. On or about December 15, 2010, within the Eastem District of California and elsewhere, the defendant, MATTHEW KEYS, did knowingly attempt to cause the transmission of a program, information, code, and command, and as a result of such conduct, intentionally to cause damage without authorization to a protected computer, which conduct would, if completed, have caused loss to a person during a 1-year period aggregating at least $5,000 in value, in violation of Title 18 United States Code, Section 1030(a)(5)(A), Section 2, and ORFEITURE ALLEGATION: [18 U.S.C. 982(a)(1), 1030(1), and 18 U.S.C. 982(a)(2)(A) -- Criminal Forfeiture] 1. Upon conviction of any of the offenses alleged in Counts One through Three of this Indictment, defendant MATTHEW KEYS shall forfeit to the United States of America, pursuant to Title 18 United States Code, Sections 982(a)(1) and 1030(i), all property, real or personal, used or intended to be used to commit or to facilitate the commission of such violation; and any property, real or personal, constituting or derived from any proceeds that he obtained, directly or indirectly, as a result of such Indictment 6 Case Document 1 Filed 03/14/13 Page 7 of 9 violation, including: a. One MacBook Pro, serial number and b. One Toshiba hard drive, 'serial number CHSEM8. 2. If any property subj ect to forfeiture, as a result of the offenses alleged in Counts One through Three of this Indictment: a. cannot be locatedupon the exercise of due diligence; b. has been transferred or sold to, or deposited with, _a third party; c. has been placed beyond the jurisdiction of the Court; d. has substantially diminished in value; or e. has been commingled with other property which cannot be divided without difficulty; it is the intent of the United States, pursuant to pursuant to 18 U.S.C. 982(b)(1) and 28 U.S.C. 2461(c), incorporating 21 U.S.C. 853(p), to seek forfeiture of any other property of said defendant up to the value of the property subject to forfeiture. A TRUE BILL. FOREPERSON I TN B. AGN United States Attorney Indictment 7 Case Document 1 Filed 03/14/13 Page 8 of 9 Penalty Slip Matthew Keys Count One Violation: 18 U.S.C. 371- Conspiracy to Cause Damage to a Protected Computer Penalty: A maximum of 5 years imprisonment, or A fine of $250,000 or, both 3 years of Term of Supervised Release Count Two Violation: 18 U.S.C. 1030(a)(5)(A)- Transmission of Malicious Code Penalty: A maximum of 10 years imprisonment, or A fine of $250,000 or, both 3 years of Term of Supervised Release Count Three Violation: 18 U.S.C. 1030(a)(5)(A) and 1030(b)- Attempted Transmission of Malicious Code Penalty: A maximum of 10 years imprisonment, or A fine of $250,000 or, both 3 years of Term of Supervised Release Forfeiture Allegation: Violation: 18 U.S.C. 982(a)(1), 2030(i)(1)(A), AND 18 U.S.C. Forfeiture Penalty: As indicated in the Indictment Special Assessment: $100.00 each count No. Documentl Filed Page9of9 UNITED STATES DISTRICT COURT Eastern District of California Criminal Division THE UNITED STATES OF AMERICA VS. MATTHEW KEYS 11:1 I I I 18 U.S.C. 371 - Conspiracy to Cause Damage to a Protected Computer; 18 U.S.C. 1030(a)(5)(A) - Transmission ofMa1icious Code; 18 U.S.C. 982 1030 AND 18 U.S.C. 982 - Forfeiture Allegation A true bill, Filed in open court this day of . GPO 863 525