Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 1 of 69 1 2 3 4 5 6 7 8 9 JASON S. LEIDERMAN, SBN 203336 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 jay@criminal-lawyer.me TOR EKELAND, PRO HAC VICE MARK JAFFE, PRO HAC VICE tor@torekeland.com mark@torekeland.com TOR EKELAND, P.C. 195 Plymouth Street Brooklyn, NY 11201 Tel: 718-737-7264 Fax: 718-504-5417 10 11 Pro Bono Attorneys for Defendant MATTHEW KEYS 12 13 UNITED STATES DISTRICT COURT 14 EASTERN DISTRICT OF CALIFORNIA 15 16 17 THE UNITED STATES OF AMERICA, 18 19 20 21 Plaintiff, v. MATTHEW KEYS Defendant. 22 23 24 25 ) ) ) ) ) ) ) ) ) ) ) ) )_ ) Case No.: 2:13-CR-00082 (KJM) SENTENCING MEMORANDUM Date: Time: Place: MARCH 23, 2016 9:00 am Courtroom 3 Defendant MATTHEW KEYS (“Defendant” or “Keys” or “Matthew”) states the following for the Court’s consideration in determining his sentence: 26 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 1 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 2 of 69 1 INTRODUCTION 2 In late 2010 the loosely knit hacking collective Anonymous was in the news. Anonymous 3 launched cyber-attacks against Visa, MasterCard, PayPal and Amazon.com. These attacks were 4 political protests supporting Julian Assange and WikiLeaks. WikiLeaks had published State Department 5 cables on its site and because of this, the companies refused to process donations for WikiLeaks. 6 Because of this, numerous reporters sought access to Anonymous. Matthew Keys was one of 7 them. Matthew gained access to a top level Anonymous Internet chat room, then known as Internet 8 Feds. In the room were hackers that would become famous, infamous, celebrated, prosecuted and 9 ultimately sentenced by either the US, English or Irish courts. The period of 2010 through early 2012 10 was one of recklessness and whim on the Internet – the Internet had arrived in a new way in popular 11 culture. Articles about the people Matthew Keys met in Internet Feds now number over 9,000. 12 Recently a play at the Royal Court Theater in London, “Teh Internet is Serious Business (sic)” depicted 13 the exploits of the denizens of Internet Feds – Kayla, T-Flow (known as Chronom in Internet Feds), 14 Sabu (cast as the villain), PwnSauce and other Internet Feds participants. Internet Feds turned into its 15 more famous successor-LulzSec. Matthew Keys had access to Internet Feds only for a short while, 16 before the transformation into Lulzsec. His conviction rests upon this time in Internet Feds, essentially 17 for the passing of a username and password to the content management system for the Los Angeles 18 Times resulting in minor changes to a minor website story on tax cuts that were easily restored in 19 roughly 40 minutes. For this he faces a statutory maximum of 25 years in jail and $750,000.00 in fines. 20 He has been on supervised release for this entire case without any violations, has appeared every time he 21 was required, and has respected every order of this Court. Therefore, for the reasons stated below, he 22 asks the Court to impose a non-custodial sentence. 23 STATEMENT OF THE CASE 24 This case stems from minor edits to the headline of a trivial story on the Los Angele Times 25 website on December 14, 2010. That day, using the Los Angeles Times/Tribune Company’s content 26 management system (“CMS”), the user “ngarcia” altered a few words in a latimes.com story on tax cuts. 27 Because of this, Matthew was convicted of one count of conspiracy to violate the Computer 28 Fraud and Abuse Act (“CFAA”), in violation of 18 U.S.C. §§ 371 and 1030(a)(5)(A); one count of DEFENDANT’S SENTENCING MEMORANDUM Page 2 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 3 of 69 1 knowingly transmitting a code with the intent to cause damage to a protected computer in violation of 18 2 U.S.C. § 1030(a)(5)(A); and one count of attempt to transmit a code with the intent to cause damage to a 3 protected computer in violation of 18 U.S.C. § 2 and 1030(a)(5)(A). 4 For this he faces a maximum sentence of 25 years in jail, $750,000 in fines, 9 years of supervised 5 release, and criminal forfeiture. U.S. v. Keys, Superseding Indictment, 2:13-CR-00082 (Dec. 4, 22 2014) 6 (ECF # 44). (See generally, Pre-Sentence Report, ECF No. 127 (PSR).) 7 8 The PSR recommends an unconscionable sentence of 87 months and a 2-year term of supervised release. Even the government believes this is too much: 9 The statutory maximum for Keys's crimes is 25 years, but in a statement given after the trial, a spokesperson for the US Attorneys Office said Keys would likely face less than five years. 10 11 12 "While it has not been determined what the government will be asking the court for, it will likely be less than 5 years," the spokesperson said. 13 "This is not the crime of the century," [United States Attorney and the Prosecutor in this case Matthew] Segal said, adding that nonetheless Keys should not get away with his acts. At minimum, he may receive probation.1 14 15 16 MATTHEW KEYS’ BIOGRAPHY 17 Matthew Keys has pursued journalism most of his life. A cursory glance at his record shows an 18 19 20 intense dedication to bringing stories of importance to light — sacrificing his time and resources, and in some cases, his money and health. In recent years, Matthew’s sacrifices have paid off in the form of impactful journalism that has 21 22 23 24 received national attention. His stories have encouraged discourse, influenced policy and won the attention and accolades from his peers in the industry, public interest groups and even law enforcement officials. His desire to pursue stories began in elementary and middle school where he both created and 25 26 served as editors to two school news bulletins. In high school, he was one of eight contributors toward 27 28 Sarah Jeong, “Former Reuters Journalist Matthew Keys Found Guilty of Three Counts of Hacking,” available at http://motherboard.vice.com/read/former-reuters-journalist-matthew-keys-found-guilty-of-hacking-faces-25-years 1 DEFENDANT’S SENTENCING MEMORANDUM Page 3 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 4 of 69 1 his school’s first long-form newspaper and later served as a news editor for it. At the age of 16, he was 2 the youngest journalist to serve as a correspondent to the homecoming of former prisoners of war from 3 the 507th Maintenance Company at Fort Bliss, Texas during Operation Iraqi Freedom. During the 4 homecoming, he was interviewed by reporters and photographers from other news organizations, 5 including Amber Rupinta of WCAU-TV (now at WTVD) and freelance journalists working for Harpo 6 Studios, the television production company run by Oprah Winfrey. He was also one of two students to 7 work on the television broadcast team, and as a senior was drafted to help instruct a handful of 8 journalism classes at his school. 9 In college, he started a blog, RadioMatthew.com, which initially began as a space to write on 10 personal topics but later grew to become an influential digital publication covering media and local news 11 in the Sacramento area. His readers included newspaper reporters, television anchors and broadcast 12 producers throughout the area. His writings led Brandon Mercer, the former news director at KTXL 13 FOX40, to hire him as the station’s first web producer. Mr. Keys left college in 2008 to focus on his job 14 at FOX40 full time. He subsequently closed his blog, which prompted a newspaper article in the 15 widely-read Sacramento Bee.2 16 A. At FOX40 News 17 Matthew’s first job was to transform FOX40’s website — which until that point had been used as 18 a promotional platform for the station — into a local news publication. He was instructed to build a 19 website that incorporated both written stories and videos from various sources, including the station’s 20 own news broadcasts, the Associated Press, Reuters News, CNN, the FOX News Channel and other 21 Tribune media properties. He was asked to find new and compelling ways to promote the station’s news 22 content so that it would reach as many local viewers as possible and compete against three other 23 broadcast news properties in the Sacramento television market. He was asked to grow the FOX40 24 website to one million page views3 within a one-year period. 25 26 2 27 28 Rachel Leibrock. "RadioMatthew Calls It a Day." The Sacramento Bee (Oct. 14, 2013), available at http://blogs.sacbee.com/ticket/archives/2008/05/radiomatthew-ca.html. 3 A “page view” is a metric used to measure the amount of traffic, or viewership, a website receives. One page view is the equivalent of a person viewing a page on a website once. Page views are sometimes colloquially referred to in the online industry as “clicks.” DEFENDANT’S SENTENCING MEMORANDUM Page 4 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 5 of 69 1 Matthew was hired by FOX40 in June 2008. The station used Adobe software called Omniture 2 to measure the amount of traffic their website received, with measurements available in hourly, daily, 3 weekly, monthly and yearly increments. When Matthew started, FOX40’s website received just under 4 300,000 monthly page views. By November 2008, this figure grew to over 400,000 page views; in April 5 2009, FOX40’s website received more than one million page views, and registered another six million 6 the following month. The goal that Matthew was tasked to achieve — one million monthly page views 7 within one year — was completed in ten months, and was sustained throughout the remainder of his 8 career with the station.4 9 Mr. Keys achieved the goals set by his employer by experimenting with new forms of 10 storytelling, emerging technologies and by adopting an aggressive, play-to-win attitude. Two months 11 into his employment, he registered Twitter and Facebook accounts for FOX40 using his personal e-mail 12 accounts as an experiment in reaching new audiences through the Internet. Despite initial concerns by 13 his direct supervisor over the approach, Mr. Keys built a healthy following on both social media 14 platforms — because of his efforts, FOX40 was the first station in Northern California to have a 15 presence on Twitter, and his work on Facebook was emulated by the station’s competitors in the 16 following months. He also regularly trained other employees — including reporters and photographers — on the 17 18 best social media practices to maximize exposure and attract new followers and viewers. Today, many 19 of the reporters he trained have healthy followings on their personal and professional social media 20 accounts. 21 While at FOX40 News, Matthew covered some of the most-memorable stories of his career. In 22 March 2009, he led a station-wide initiative to create a news website separate from FOX40.com that 23 published stories and information on a missing 8-year-old girl named Sandra Cantu. Matthew 24 successfully lobbied the station to run the website as an advertisement-free public service while at the 25 same time committing both human and financial capital to the effort. Members of the community used 26 the website to learn about the latest developments, get information on contacting law enforcement and 27 28 4 See Page Views Report 2008, available at https://www.dropbox.com/s/xujyvdpe0p1b7kz/FOX40-Metrics-2.pdf?dl=0. DEFENDANT’S SENTENCING MEMORANDUM Page 5 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 6 of 69 1 organize search rallies. A company called ButtonWorks created shirt buttons featuring the address of 2 the website, and Home Depot donated thousands of fluorescent-colored missing posters again 3 emblazoned with the address of the website. The website was turned into a digital memorial when it 4 was tragically discovered that Cantu had been murdered by her former Sunday school teacher. At the 5 suspect’s murder trial, Cantu’s family testified that they learned about developments in the search and 6 subsequent arrest by watching FOX40. In September 2009, a wildfire broke out near Auburn, California. The so-called “49 Fire”5 7 8 erupted on a Saturday when Matthew and other newsroom employees were typically not at the station. 9 After learning about evacuations in the community, he not only went to the station on his day off, but 10 provided up-to-the-minute coverage of the fire well into the next morning. He remained at the station 11 until the following afternoon, providing more than 18 hours of coverage. He and others at the station 12 received e-mails from evacuees and concerned loved ones throughout the country praising FOX40’s 13 continuous updates on-air, online and on social media. 14 As part of his job duties, Matthew regularly communicated with law enforcement officials in 15 order to provide accurate and timely information to FOX40’s news audience. He also provided law 16 enforcement information that led to criminal arrests. In December 2009, while researching exercise 17 equipment on Craigslist, he came across a listing where someone was trying to illegally sell prescription 18 pain medication. Matthew contacted the seller and was able to get an e-mail address and a phone 19 number. He researched the phone number and came across a social media profile where the seller 20 claimed to have ties with the Norteno6 gang. He collected his research and contacted general 21 assignment reporter Rowena Shaddox, enlisting her help to contact local law enforcement. 22 Shaddox and Matthew contacted Norm Leong, then a sergeant and police spokesperson with the 23 Sacramento Police Department. With FOX40 present, Sacramento police organized a sting to 24 apprehend the individual responsible for the attempted illegal transaction. Police also learned that the 25 26 5 27 28 According to statistics released by Cal Fire, the 49 Fire burned over 340 acres, destroyed 63 homes, and significantly damaged six businesses. Hundreds of people were evacuated from affected communities. The cause of the fire remains unknown. See Incident Information, Forty Nine (49) Fire, Cal Fire Website, available at http://cdfdata.fire.ca.gov/incidents/incidents_details_info?incident_id=380. 6 THE omnibus Northern California prison gang; Nortenos control all street gang activity in Northern California. DEFENDANT’S SENTENCING MEMORANDUM Page 6 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 7 of 69 1 suspect, who was a juvenile, was wanted for a string of local burglaries and was also attempting to sell 2 stolen merchandise. The police department credited the arrest to the initial research performed by 3 Matthew, Shaddox and FOX40. 4 Matthew’s work diligently at FOX40. As the station’s sole employee for online and digital 5 initiatives, he often worked at night and on weekends from his home. The station encouraged this work 6 by providing him with a mobile Internet card, and he was expected to check his e-mail and answer the 7 phones when he was off-the-clock. 8 As a consequence of his long hours and the accompanied stress, he suffered from severe, cystic 9 acne and was prescribed the potent drug Accutane on two occasions. He was also diagnosed in August 10 11 2010 with mild insomnia and prescribed the sedative Trazodone. That same month, he was told during a meeting with his supervisor that the station did not feel 12 he was ready to take on managerial role, and that they would be looking to hire someone to oversee the 13 station’s website and other digital initiatives. Discouraged by the lack of opportunity at the station in 14 spite of his achievements, he left the station following a newsroom dispute in October 2010. 15 After FOX40 16 From late October 2010 to April 2011, Matthew worked as a self-published freelance journalist, 17 covering stories he felt would be both interesting, important and impactful. He used his knowledge and 18 experimentation with emerging social medium platforms to showcase his newsgathering and storytelling 19 abilities. 20 In December 2010, in pursuit of a story on Anonymous, he was invited into the Internet chat 21 room Internet Feds. His reporting helped the public better learn and understand who Anonymous was 22 and what their intentions were at the time. Information he learned from his observation of the group was 23 used by reporters for the PBS NewsHour, Gawker, and for a book on Anonymous authored by Forbes 24 reporter Parmy Olson. His research would also be the focal point of a story published by Reuters in 25 March 2012. 26 In January 2011, he covered the shooting of former U.S. Representative Gabrielle Giffords. He 27 utilized the social platforms Twitter and Tumblr to deliver short updates on the shooting and subsequent 28 investigation in real-time for more than three weeks. He used the same technique to cover social unrests DEFENDANT’S SENTENCING MEMORANDUM Page 7 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 8 of 69 1 in the Middle East and a powerful earthquake and subsequent tsunami in Japan. He was profiled by the 2 website AdWeek7 for his work on those stories, and was nominated for an Online News Association 3 award for his storytelling on the Japan earthquake. 4 His use of social media to cover stories impressed colleagues across the country, and it led to two 5 additional job opportunities: In May 2011, he was hired as a weekend news producer for KGO-TV in 6 San Francisco, and seven months later he accepted a different job working as a journalist for the Reuters 7 News Service in New York City. While at Reuters, he covered a number of significant stories of 8 national and international interest, including the 2012 London Olympics, the Colorado movie theater 9 shooting, the presidential election, the Sandy Hook massacre and the appointment of Pope Benedict 10 XVI. And despite living within the impact zone, he provided rolling coverage of Hurricane Sandy in 11 November 2012 from his home until his electricity went out. 12 During his time at Reuters he was asked to provide commentary and insight on a number of 13 emerging digital media trends and technologies. The Huffington Post declared him a must-follow 14 journalist for news on Facebook,8 Time Magazine named him one of the 140 best Twitter feeds to 15 follow in 2012,9 and the website Journalism.co.uk declared him one of the 100 people every journalism 16 student should follow.10 17 Reuters terminated Matthew as an employee in early 2013 after his indictment. Despite 18 significant resource and financial hardships since then, he remained committed to journalism and 19 continued covering important news stories. And, even while under indictment, some of his stories had a 20 significant impact on public discourse and policy. 21 22 In June 2013, the Guardian and Washington Post newspapers broke numerous stories disclosing clandestine — and in some cases, illegal — wiretapping and surveillance operations by the National 23 24 25 26 27 28 , Ethan Klapper “Meet Producer Matthew, Aggregation Journalist.” AdWeek (Mar. 21, 2011), available at http://www.adweek.com/fishbowlny/meet-producer-matthew-keys-aggregation-journalist/243891. 8 “50 People in Media You Should Subscribe to on Facebook” The Huffington Post (Apr. 30, 2012), available at http://www.huffingtonpost.com/2012/04/30/facebook-subscribe-suggestions-50-inmedia_n_1464571.html#gallery/223172/29. 9 Amy Lombard “The 140 Best Twitter Feeds of 2012” Time (Mar. 15, 2012), available at http://techland.time.com/2012/03/21/the-140-best-twitter-feeds-of-2012/slide/matthew-keys/. 10 Sarah Marshall “100 Twitter Accounts Every Journalism Student Should Follow” journalism.co.uk (Sept. 24, 2012), available at https://www.journalism.co.uk/news/100-twitter-accounts-every-journalism-student-should-follow/s2/a550471/. 7 DEFENDANT’S SENTENCING MEMORANDUM Page 8 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 9 of 69 1 Security Agency (NSA). In November 2013, under a presidential order, the Foreign Intelligence 2 Surveillance Court released a trove of documents related to their approval of some NSA operations. 3 Matthew reviewed those documents and determined that between the years 2005 and 2011, every 4 request by the NSA to conduct surveillance had been approved by the court11. This research was later 5 used for journalist Glenn Greenwald’s book No Place to Hide. Greenwald credited Keys for his 6 research.12 7 In mid-2013, a hacker group known as the Syrian Electronic Army made international headlines 8 after compromising numerous social media accounts used by news websites. While news publications 9 widely reported what the Syrian Electronic Army had done, few looked deeper into who the group was 10 or what their intentions were. In May 2013, Matthew became the first journalist to conduct an interview 11 with a representative of the Syrian Electronic Army.13 In December 2013, he produced the first live 12 conversation14 with the same representative. His research helped de-bunk widely-reported assertions 13 that the hacker group was tied to the Syrian government and gave the public greater insight into the 14 collective and their ambitions. 15 In November 2013, Matthew obtained radio dispatches related to a fatal incident involving a 16 BART commuter train and two maintenance employees weeks earlier. His story revealed that there 17 were numerous problems involving both the train “lookout” method and the radio equipment used by the 18 workers that day. The audio tapes Matthew obtained were widely cited by local media, including the 19 San Francisco Chronicle15. They were also solicited from him for a pending lawsuit filed by one of the 20 family members of a BART employee killed that day. Matthew provided the tapes to the family upon 21 their request, and absorbed the expenses in doing so. 22 23 24 25 26 27 28 11 Matthew Keys, Twitter Feed (7:23am Nov. 19, 2013), available at https://twitter.com/MatthewKeysLive/status/402774028898672640. 12 Glenn Greenwald “No Place to Hide: Booknotes”, available at http://glenngreenwald.net/#BookNotes. 13 Matthew Keys “A Conversation with the Syrian Electronic Army” The Desk (May 14, 2013), available at http://thedesk.matthewkeys.net/2013/05/a-conversation-with-the-syrian-electronic-army/. 14 Id at http://thedesk.matthewkeys.net/2013/12/a-live-conversation-with-the-syrian-electronic-army/. 15 Demian Bulwa “BART Workers on Tracks Don’t Get Train Warnings” SFGATE (Oct. 21, 2013), available at http://www.sfgate.com/bayarea/article/BART-workers-on-tracks-don-t-get-train-warnings-4914319.php. DEFENDANT’S SENTENCING MEMORANDUM Page 9 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 10 of 69 1 In March 2014, he began a 14-month investigation into clandestine cellphone surveillance 2 devices used by law enforcement known as a “StingRay.” During his investigation, he successfully 3 landed an on-the-record interview with a police spokesperson in which the officer admitted the devices 4 were used in numerous criminal investigations. The admission countered assertions at the time by 5 federal agents that Stingrays were limited in use to homeland security investigations. His report on the 6 acknowledgement was used in a letter filed by the American Civil Liberties Union16 on the topic several 7 months later. Matthew’s investigation concluded when the Federal Communications Commission released a 8 9 heavily-redacted manual related to the StingRay device.17 Although the manual contained little 10 additional insight into how law enforcement obtained or used them, it was the first public 11 acknowledgement by the FCC of the device’s existence. Matthew filed more than two dozen stories on 12 the topic during his investigation, and his research and reporting was cited by Vice News 18, Slate19, the 13 International Business-Times20 and others. 14 In August 2014, Matthew investigated comments made by then-Ferguson Police Chief Thomas 15 Jackson as to why he released a surveillance tape depicting slain 18-year-old Michael Brown, Jr. 16 minutes before he was shot by a Ferguson police officer. Jackson told reporters at a press briefing that 17 the tape was released pursuant to numerous open records requests filed by members of the media. After 18 researching, Matthew discovered that the Ferguson police had received no specific requests for the tape 19 from any reporter. In September, Matthew broke the story that Jackson had lied about receiving 20 21 22 23 24 25 26 27 28 16 Letter form Laura W. Murphy, Director, ACLU Washington Legislative Office, to The Honorable Tom Wheeler, Chairman, FCC (Sept. 17, 2014), available at https://www.scribd.com/doc/240893938/ACLU-calls-on-FCC-to-investigateStingray-manufacturer-Harris. 17 “Exclusive: Stingray Maker Asked FCC to Block Release of Spy Gear Manual” the blot magazine (Mar. 26, 2015), available at http://www.theblot.com/exclusive-stingray-maker-asked-fcc-to-block-release-of-spy-gear-manual-7739514. 18 Lucy Steigerwald “Everything We Know About the Singray, the Cops’ Favorite Cell Phone Tracking Tool” Vice (Apr. 13, 2015), available at http://www.vice.com/read/everything-we-know-about-the-stingray-cops-favorite-cell-phone-tracking-tool413. 19 Lily Hay Newman “FCC Finally Releases (Heavily Redacted) Manual for Controversial Surveillance Device” Slate (Mar. 27, 2015), available at http://www.slate.com/blogs/future_tense/2015/03/27/fcc_releases_heavily_redacted_stingray_manual_to_the_blot.html. 20 Jeff Stone “Sweeping ‘Stingray’ Surveillance Technology Has No Restrictions, Despite Serious Privacy Concerns: Police” International Business Times (Jul. 7, 2014), available at http://www.ibtimes.com/sweeping-stingray-surveillance-technologyhas-no-restrictions-despite-serious-privacy-1631448. DEFENDANT’S SENTENCING MEMORANDUM Page 10 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 11 of 69 1 requests for the tape, calling into question the Ferguson Police Department’s motive for releasing it. His 2 report received national attention as was covered by the Huffington Post21, MSNBC22 and others. 3 Matthew was commended by Brown’s family attorney Benjamin Crump for his investigation, and his 4 story was used as the foundation of a letter urging Jackson to resign.23 5 Finally, in June 2015, a startup news organization called Grasswire hired Matthew to be a 6 managing editor. In November 2015, he began an investigation into a surveillance tape that depicted the 7 beating of a suspect by Alameda County, California sheriff’s deputies at the end of a pursuit. The police 8 severely beat that suspect, later identified as Stanislav Petrov. 9 While working on the investigation, Grasswire ran into financial difficulties. Two days before 10 Christmas, the website’s editor-in-chief announced that all paid staffers were to be laid off effective 11 immediately. Despite losing his job, and at considerable financial expense, Matthew published the 12 findings of his two-month investigation into the Petrov beating.24 His story contained numerous 13 previously-undisclosed facts, including the identities of the two deputies who appeared on the 14 surveillance tape. His story was cited by the San Francisco Chronicle25 and other newspapers26, and his 15 investigation was praised by Alameda County Public Defender Brendon Woods.27 16 Despite his indictment, Matthew continued to report on matters of crucial public interest, 17 bringing to light important facts on critical matters that, without his reporting, may never have seen the 18 light of day. Taken as a whole, his commitment to journalism also demonstrates a commitment to 19 public service. At a time when other journalists concern themselves with which burrito restaurant a 20 21 22 23 24 25 26 27 28 Simon McCormack “Ferguson Police Chief Lied About Why He Released Alleged Michael Brown Robbery Tap: Report” The Huffington Post (Sept. 6, 2014),available at http://www.huffingtonpost.com/2014/09/05/ferguson-chief-lied-aboutmichael-brown-tape_n_5773420.html. 22 All In With Chris Hayes, NBC New Show, Transcript (Sept. 5, 2014), available at http://www.nbcnews.com/id/56008773/ns/msnbc-all_in_with_chris_hayes/. 23 Jackson resigned as Ferguson’s police chief eight months later. 24 Matthew Keys, “Grasswire Investigates: Alameda County Deputies Involved in November Beating Named” Grasswire (Dec. 24, 2015), available at https://medium.com/grasswire-blog/grasswire-investigates-alameda-county-deputies-involvedin-november-beating-named-d0ca44d399e2#.luij65y4a. 25 Vivian Ho, Twitter Feed (6:59pm Dec. 24, 2015), available at https://twitter.com/vivianho/status/680176029093072898. 26 Katrina Cameron, “Alameda County Deputies Involved in San Francisco Beating Identified” Times#Standard News (Dec. 24, 2015), available at http://www.times-standard.com/general-news/20151224/alameda-county-deputies-involved-in-sanfrancisco-beating-identified/1. 27 Brendan Woods, Twitter Feed (3:20am Dec. 25, 2015) available at https://twitter.com/BrendonWoodsPD/status/680302139114041344. 21 DEFENDANT’S SENTENCING MEMORANDUM Page 11 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 12 of 69 1 presidential candidate patrons28 or the numerous antics of a real estate mogul-turned-politician,29 it 2 someone who has dedicated serious personal and professional effort, sometimes at his own considerable 3 expense, to research and publish impactful stories on topics that matter to the public, should not be 4 incarcerated. If he were to be sentenced to any prison term, people in positions of authority who will go 5 unchecked and stories of public importance that will go untold. 6 BACKGROUND30 7 In the latter part of 2010, Matthew Keys entered an Internet chat room populated by high-level 8 and highly skilled hackers belonging to the loosely knit hacking collective “Anonymous.” He was 9 invited in as a journalist. He had been in another, larger chat room where people were discussing large 10 scale attacks on Visa, Master Card, Amazon and PayPal as revenge for a banking blockade on the 11 whistleblowing site WikiLeaks. There was no bigger Internet news in early December 2010 and as a 12 journalist, Matthew wanted in on the ground floor of the story. 13 Though the hacking world, the language and the activities of Internet chat rooms were all foreign 14 to Matthew, reporting was not. In 2004, at the age of 17,31 Mr. Keys started his own news network. At 15 present, he has his own news network with numerous subscribers and followers. He has spent night and 16 day since he was 17 dedicating himself to the pursuit of delivering the news to the public. Now, he 17 faces an end to any reporting for potentially greater than 7 years, as recommended by the PSR. 18 The charges in this case stem from minor edits to the headline of a story on the Los Angeles 19 Times website on December 14, 2010. That day, using the Los Angeles Times/Tribune Company’s 20 21 22 23 24 25 26 27 28 Maggie Haberman, “Hillary Clinton, Just an Unrecognized Burrito Bowl Fan at Chipolte” New York Times (Apr. 13, 2015), available at http://www.nytimes.com/2015/04/14/us/politics/on-the-road-hillary-clinton-stops-for-lunch-at-chipotleand-goes-unrecognized.html?_r=0. 29 Maggie Haberman “Donald Trump did Stay at a Holiday Inn Express on Friday Night” New York Times (Jan. 24, 2016), available at(http://www.nytimes.com/politics/first-draft/2016/01/24/donald-trump-did-stay-at-a-holiday-inn-express-onfriday-night/. 30 All facts relating to the hackers discussed throughout this brief have been checked the person at issue except for: Hector Monsegur (A journalist familiar with Monsegur verified Monsegur’s present employment), Ryan Ackroyd, Ryan Cleary (though their co-defendants verified the facts related to both the case and to them personally), some of the PayPal 14, all but one of the Payback 13, Christopher Weatherhead’s co-defendants in the English PayPal case, John Borell, Jon Cowden (facts verified by his girlfriend as correct), Jeremy Hammond (though Attorney Leiderman consulted on the case and knows the facts to be true), and Cody Kretsinger (due to Leiderman’s representation of Royal Rivera, Kretsinger’s co-defendant, Leiderman knows the facts to be accurate). 31 The Skylark Network. See http://skylark1348.tripod.com/id12.html 28 DEFENDANT’S SENTENCING MEMORANDUM Page 12 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 13 of 69 1 content management system (“CMS”), the user “ngarcia” altered a paragraph of an latimes.com story. 2 The article’s headline, deck and byline originally appeared as follows: 3 Pressure builds in House to pass tax-cut package 4 5 House Democratic leader Steny Hoyer sees ‘very good things’ in the taxcut deal, which many representatives oppose. But with the bill set to clear the Senate, reluctant House Democrats are feeling the heat to pass it. 6 By Lisa Mascaro, Tribune Washington Bureau32 7 After the minor edits by ngarcia, the article’s title and byline allegedly read: 8 Pressure builds in House to elect CHIPPY 1337 9 10 House Democratic leader Steny Hoyer sees ‘very good things’ in the deal cut which will see uber skid Chippy 1337 take his rightful place, as head of the Senate, reluctant House Democrats told to SUCK IT UP. 11 By CHIPPYS NO 1 FAN, Tribune Washington Bureau 12 No alterations were made to the text of the actual article, meaning that one who proceeded past 13 the joke headline received the proper information about Steny Hoyer and the Democrats’ tax-cut deal. 14 Website administrators restored the original in less than 40 minutes. For this, Matthew was convicted of 15 three felony counts of violating the Computer Fraud and Abuse Act (CFAA). 16 Count one, the conspiracy under 18 USC § 371 in this case was largely due to logs showing that 17 AESCracked passed credentials to an Anonymous member named “Sharpie” and while saying “go fuck 18 some shit up.” 19 Count two, transmission of a code with the intent to cause unauthorized damage to a computer in 20 violation of 18 U.S.C. 1030(a)(5)(A) also rests upon the evidence at trial that Matthew passed login 21 credentials to the Tribune Co. content management system and the statement: “go fuck some shit up.” 22 Count three, attempt to cause damage to a computer, rested again on the same basic set of facts. 23 Sprinkled in for prejudicial flavor at trial were emails from email addresses based on “X-Files” 24 characters to Matthews’ former employer, FOX40 in Sacramento. They made vague threats about 25 26 27 The original article is still available on the Los Angeles Times website, See Lisa Mascaro, “Pressure builds in House to pass tax-cut package.” Los Angles Times (December 14, 2010), available at http://articles.latimes.com/2010/dec/14/news/lapn-hoyer-tax-vote-20101215 32 28 DEFENDANT’S SENTENCING MEMORANDUM Page 13 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 14 of 69 1 exposing that FOX40’s give-away contests were fixed and that the computer security of the station was 2 suspect. 3 Internet Feds and LulzSec, 2010-1011: Popular Culture and the Hacktivist as Celebrity 4 The CFAA violations and U.K.’s Computer Misuse Act (the U.K. analogue of the CFAA) 5 violations committed by the members of “Internet Feds,” later to be named “LulzSec,” shed light on the 6 instant crime as well as the times that this crime occurred. September 2010-March 2012 was marked by 7 an explosion of aberrant computer hacking behavior, the likes of which the world had never seen; a 8 behavior that became infectious, a matter of media curiosity, and behavior that was roundly cheered by 9 the online community. It is important to see the zeitgeist of this period for what it is – the world being 10 swept up in a world marked by a groupthink of hacking madness. The acts of this period had a social 11 and political significance. They also spoke to a herd mentality – those that got swept up in the 12 September 2010 to March 2012 era played to a popular and new ethos. The Internet was awash in 13 hacker news. There was tremendous competition for publicity. There was tremendous publicity. 14 Multiple documentary films were made. Books were written about the exploits – including one by 15 Forbes Technology lead reporter, Parmy Olson. Matthew contributed his Internet Feds logs for her 16 book.33 Insight into this zeitgeist is found in Janet Maslin’s review of Olson’s book for the New York 17 18 Times: 23 A lively, startling book that reads as 'The Social Network' for group hackers. As in that Facebook film the technological innovations created by a few people snowball wildly beyond expectation, until they have mass effect. But the human element - the mix of glee, malevolence, randomness, megalomania and just plain mischief that helped spawn these changes - is what Ms. Olson explores best...We Are Anonymous also captures the broad spectrum of reasons that Anonymous and LulzSec attracted followers.34 24 Lulzsec Sentences Compared to Keys’ PSR Guideline Sentence35 19 20 21 22 25 26 Parmy Olsen, “We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Global Cyber Insurgency.” Janet Maslin "The Secret Lives of Dangerous Hackers: 'We Are Anonymous' by Parmy Olson.” New York Times (May 31, 2012), available at http://www.nytimes.com/2012/06/01/books/we-are-anonymous-by-parmy-olson.html?_r=0. 35 See, e.g., “LulzSec Hackers Handed Down Prison Terms, Suspended Sentence, In Britian.” RT (May 16, 2013), available at https://www.rt.com/news/lulzsec-sentence-jail-davis-376/. 33 27 28 34 DEFENDANT’S SENTENCING MEMORANDUM Page 14 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 15 of 69 Lulzsec or “Lulz Security” were a small offshoot of Anonymous that gained their heights of 1 2 fame in 2011 for “hacking the planet,” as the Internet community puts it. There were a series of high 3 profile cyber-attacks carried out by Lulzsec beginning in May 2011. Targets included Sony Pictures’ 4 internal database, the CIA’s website, the FBI’s contractor InfraGard, the British equivalent of the FBI, 5 “SOCA,” the Westboro Baptist Church, Frontline, Fox News, and several of Rupert Murdoch’s 6 properties. Although the group officially announced its retirement in June 2011 they reunited to hack 7 Murdoch’s “Sun” newspaper in July 2011. Members of LulzSec included “Topiary” and “Palladium.” 8 The Sun front page was defaced to show a photoshopped prone Murdoch, who had suddenly passed 9 away in his topiary from a lethal dose of Palladium. Nonetheless, Matthew faces a much harsher 10 sentence than those meted out to Lulzsec. All the members of LulzSec/Internet Feds combined received 11 sentences in the aggregate that barely exceeded the recommended sentence in this sentence. 12 Comparatively, Keys’ PSR guideline sentence of 87-108 months is excessive and disparate. 13 LulzSec periodically released stolen information from websites. They posted the stolen data on 14 their website in .txt files, on the web app pastebin aka pastebin.com, in torrents on their page, or in 15 downloadable files on the BitTorrent website the Pirate Bay. Releases often were posted on Fridays and 16 thus they made a hash tag called “#fuckfbifriday” that they use to tweet with for their “fuck the FBI 17 Fridays.” LulzSec, like Internet Feds before them, used Distributed Denial of Service36 actions 18 and SQL injections37 to take down websites. The group was motivated in part by political causes related 19 to economic and social justice, but also seemed to appreciate hacking for pure entertainment. (See 20 also: #OpSony)38 21 22 23 24 25 26 27 28 36 This tactic, known as a DDoS, overwhelms a website with traffic such that it collapses under the weight of the DDoS. While it does no lasting harm to a website, it can knock a website offline for minutes, hours or days. 37 SQL or sequel injections are incursions into a website after a vulnerability has been discovered. A sequel injection can lead to the compromise of an entire website. On multiple occasions, LulzSec used SQL injections to harvest databases and all of the contents of websites. 38 Many news agencies incorrectly reported that LulzSec was responsible for the more damaging and headline-grabbing Sony Play Station intrusion. A few days before the Sony Pictures intrusion charged herein, Play Station was breached. A reported 77 million accounts were compromised. The damage was so extensive that Play Station was offline for approximately six weeks. See the website “Absolute Sownage” for a chart and explanation of the Sony hacks that surrounded this case. There were so many that a score sheet literally became necessary. http://attrition.org/security/rant/sony_aka_sownage.html DEFENDANT’S SENTENCING MEMORANDUM Page 15 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 16 of 69 1 On May 5th, 2011, the earliest known hack attributed to Lulzsec began against Fox Broadcasting 2 Company,39 which resulted in the breach of TV talent show X Factor contestant’s database and 73,000 3 applicants’ personal information. On May 10th, FOX.com's sales database and users’ personal 4 information was released. Between late May and early June 2011, international media company Sony’s database was 5 6 attacked by hackers who took thousands of users’ personal data including “names, passwords, e-mail 7 addresses, home addresses dates of birth.” Lulzsec claimed that it used a SQL injection attack and was 8 motivated by Sony’s legal action against the original iPhone jailbreak hacker George Hotz, who 9 revealed similar information of Sony’s PlayStation 3 console in December 2010. 10 LulzSec breached databases include Sony Music Japan, Sony Pictures, SonyBMG Netherlands 11 and SonyBMG Belgium. The group claimed to have compromised over 1,000,000 accounts, though 12 Sony claims the real figure was around 37,500.40 Some of the compromised information has been 13 reportedly used in scams.41 14 On May 29th, 2011, LulzSec managed to compromise several PBS web properties including 15 PBS’s official website and Twitter account. The PBS homepage was defaced with an image of famous 16 Internet meme Nyan Cat and the words “all your base are belong to lulzsec” referencing another Internet 17 meme: All Your Base Are Belong To Us. Lulzsec claimed it was in response to a biased documentary 18 about Wikileaks that had aired on an episode of PBS Frontline. They also were responsible for an 19 article which claimed that 2Pac, a rapper who died back in 1996, was still alive and was found living in 20 New Zealand with another famous dead rapper, Biggie Smalls. 21 22 LulzSec took responsibility for taking down the United States Central Intelligence Agency website in a tweet on June 15th, 2011. 23 24 On June 15th, 2011, an article was posted to the website VentureBeat claiming that LulzSec was starting to attack users of the website 4chan.org and Anonymous. The sparring began when LulzSec 25 26 39 27 28 Internet Feds hacking activities began in December 2010, the time that Keys was in the chatroom. Keys’ attorney Jay Leiderman represented one of the people charged in this SQL injection case. The true number is less than 37,000. Though there was over $600,000.00 in damage and personal credit information was posted publicly, Matthew faces over 7 times the punishment given out to the two defendants in Los Angeles. 41 There was never any proof of this claim, and Leiderman was privy to the discovery in that case. 40 DEFENDANT’S SENTENCING MEMORANDUM Page 16 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 17 of 69 1 initiated a “DDoS Party,” which was a set of large-scale distributed denial of service attacks on several 2 gaming servers and websites that brought a lot of games offline. EVE Online, League of Legends and 3 Minecraft all faced outages or significant latency problems. 4 5 On June 19th, 2011, LulzSec posted a statement on the pastebin website announcing that they will be teaming up Anonymous to attack government agencies: 6 Welcome to Operation Anti-Security (#AntiSec) – we encourage any vessel, large or small, to open fire on any government or agency that crosses their path. We fully endorse the flaunting of the word “AntiSec” on any government website defacement or physical graffiti art. We encourage you to spread the word of AntiSec far and wide, for it will be remembered. To increase efforts, we are now teaming up with the Anonymous collective and all affiliated battleships. 7 8 9 10 11 12 On June 20th, 2011, LulzSec managed to take down the United Kingdom’s Serious Organized Crime Agency (SOCA) website with a DDoS attack as part of Operation Anti-Security. 13 On June 21st, 2011, a South American branch of Lulzsec group (@LulzSecBrazil) launched 14 DDoS attacks against the portal of Brazilian government websites and the homepage of the President 15 under the banner of Operation Anti-sec. The denial-of-service attacks came following the 16 announcement on June 19th of a joint operation seeking to “steal and leak any classified government 17 information, including email spools and documentation.”42 18 From the onset of Operation Anti-sec, LulzSec’s support base expanded from small unknown 19 groups to an international network of Anonymous activists and regional Lulzsec chapters in Brazil and 20 Colombia, as well as the Iranian Cyber Army. 21 On June 23rd, Lulzsec released a new set dubbed “Chinga La Migra,” a Spanish phrase meaning 22 “fuck the border patrol,” which reveals hundreds of private intelligence bulletins, personal information 23 of police officers and confidential documents including training manuals and personal email 24 correspondence.43 In the press release, the group cited the legislation of SB1070 (Support Our Law 25 Enforcement and Safe Neighborhoods Act), a controversial anti-immigration law that was passed in the 26 27 28 42 43 http://venturebeat.com/2011/06/22/lulzsec-brazil-hack-government/ http://www.lataco.com/hacker-group-announces-chinga-la-migra-releases-classified-arizona-police-info/ DEFENDANT’S SENTENCING MEMORANDUM Page 17 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 18 of 69 1 state of Arizona in April 2011, as their primary motive behind targeting the Department of Public 2 Safety.44 The documents classified as “law enforcement sensitive”, “not for public distribution”, and 3 “for official use only” are primarily related to border patrol and counter-terrorism operations and 4 describe the use of informants to infiltrate various gangs, cartels, motorcycle clubs, Nazi groups, and 5 protest movements.45 6 On June 25th, 2011, LulzSec released a statement on pastebin saying that after 50 days of 7 hacking, they will be going into retirement. The farewell statements were accompanied by about 458 8 MB of data from AOL, AT&T, Navy.mil, pilimited.com, and many other websites that they uploaded 9 from their Pirate Bay account. 10 On July 13th, 2011, LulzSec announced that once the @pastebin Twitter account reached 75,000 11 users they would embark on a mystery operation that would “cause mayhem.” After their 12 announcement, @pastebin received about 10,000 followers in 6 days. 13 On July 18th, 2011, the Lulzsec resumed its activities when they reportedly edited the entire 14 homepage – the front page - of News International-owned The Sun to display a fake story about 15 NewsCorp’s CEO Rupert Murdoch’s death from a drug overdose. As the volume of requests exploded 16 on the news site, the group then redirected its homepage to their Twitter account. LulzSec also 17 confirmed its responsibility for the hack and released a number of e-mails and passwords presumably 18 associated with The Sun employees via Twitter. The tech blog Gizmodo also reported that one of the 19 passwords tweeted out by “Anonymousabu” (Hector Monsegur) belongs to the arrested and now 20 convicted (From the British phone hacking scandal) News International chief Rebekah Brooks: visited 21 The Sun before we did this (may God have mercy on your soul) clear your cache so the redirect 22 works. #MurdochMeltdownMonday. “Both Sides of the Atlantic” 23 24 The Lulzsec members in England were charged under the U,K’s Computer Misuse Act. The 25 language of the Computer Misuse Act and the conduct it prohibits are similar to the CFAA. Indeed, 26 27 28 44 45 Id. http://www.digitaltrends.com/computing/lulzsec-hits-arizona-police-computers-reveals-sensitive-data/ DEFENDANT’S SENTENCING MEMORANDUM Page 18 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 19 of 69 1 written in 1990, it appears Parliament reviewed the CFAA when drafting the Computer Misuse Act. 46 2 Accordingly, the crimes for which British Internet Feds/LulzSec members were convicted are analogous 3 to the crimes that American participants of these groups committed. The sentences are thus relevant to 4 determine a comparison between what actions and crimes were undertaken by these groups and how the 5 punishments for those crimes would compare to a 87-108 month sentence meted out to Matthew for 6 conduct that is, by comparison, de minimus. As the prosecution admits, “[t]his is not the crime of the 7 century.”47 Yet he faces a far more severe sentence than any member of Lulzsec served. 60 months, 8 which the Government seeks, would be more than any person engaged in hacking crimes during this 9 period – by about double! Sentence of Lulzsec Member Hector Xavier “Sabu” Monsegur: 7 months 10 11 The most active member and the identified leader of both Internet Feds and LulzSec was Hector 12 Xavier Monsegur, who was in his mid to late 20’s during his most active period. Monsegur is more 13 famously known on the Internet as “Sabu.” He is the same Sabu from the Internet Feds chatroom. After 14 being arrested by the FBI in 2011, he cooperated heavily with the FBI and took a plea. In his plea he 15 admitted participating in the Los Angeles time story prank.48 16 Indeed, in relation to Count 2 in his case, Sabu admitted to unlawful access of the Tribune 17 Company’s CMS, along with “attacks” on HBGary, a cyber security firm. In the HBGary hack, Sabu 18 and Internet Feds co-conspirators appropriated and publicly released 70,000 emails. They infiltrated all 19 parts of the company by “rooting” or gaining root access to all of HBGary’s systems. The CEO of 20 HBGary Federal, a division of HBGary, was fired. His personal iPhone, router, email, Twitter, 21 Facebook, World of Warcraft and other accounts were appropriated. He also admitted to a hack of 22 Fox’s website, accessing the contestant list for the X-Factor TV show and releasing tens of thousands of 23 contestant’s information. The motivation for the hack was said to be that the CEO of HBGary Federal 24 25 46 26 27 28 Compare, Computer Misuse Act 1990, available at http://www.legislation.gov.uk/ukpga/1990/18/contents, with 18 U.S.C. § 1030 (CFAA). 47 Amul Kalia, “The Punishment Should Fit the Crime: Matthew Keys and the CFAA” Electronic Frontier Foundation, available at https://www.eff.org/deeplinks/2015/12/punishment-should-fit-crime-matthew-keys-and-cfaa. 48 See, e.g. Anna Merlin, “Former Hacker Hector “Saabu” Monsegur Gets Time Served After “Extraordinary” Cooperation with Feds” Village Voice (May 28, 2014), available at http://www.villagevoice.com/news/former-hacker-hector-sabumonsegur-gets-time-served-after-extraordinary-cooperation-with-feds-6718582. DEFENDANT’S SENTENCING MEMORANDUM Page 19 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 20 of 69 1 was going to meet with the FBI in an attempt to unmask members of Anonymous. This behavior relates 2 to only count two of a twelve count complaint, and but one complaint of 4 across the country, including 3 one in the Eastern District of California. 4 Sabu additionally admitted hacks unrelated to Anonymous or LulzSec where he stole from 5 people’s bank accounts. He also admitted to selling drugs. Furthermore, he admitted participation and 6 leadership in the following hacks49: The Visa, MasterCard, PayPal and Amazon hacks called Operation 7 Avenge Assange50, attacks against the Tunisian Government in support of the Arab Spring uprising,51 8 attacks against the Algerian government as part of the Arab Spring uprising, attacks against the Yemeni 9 government, again as part of the Arab Spring uprising, attacks against the Zimbabwean government, and 10 the later “dump” all the Zimbabwean data into the public sphere, Sony (multiple times including Sony 11 Music, Sony Pictures and several foreign Sony companies), PBS, video game company Nintendo, the 12 Georgia division of Infraguard (Infraguard is an FBI contractor), Unveillance (a cybersecurity 13 company), the United States Senate (confidential information was downloaded and shared with the 14 public),52 video game company Bethesda Softworks, a hack of an automotive company in New York in 15 which he, acting alone, was able to swindle the company out of 4 automobile engines worth 16 approximately $3,500.00, fraud involving “dozens” of fraudulent or stolen credit cards upon which he 17 personally made fraudulent charges, bank fraud committed upon the accounts of private citizens, and, 18 finally, aggravated identity theft. The property crimes were not done in connection with Internet Feds or 19 LulzSec. 20 Monsegur had 4 indictments total filed against him and dismissed in favor of the Southern 21 District of New York plea. Monsegur pled guilty to 12 counts carrying with them a total maximum of 22 122 ½ years.53 Additionally, “Monsegur also admitted to hacking thousands of computers between 1999 23 24 25 26 27 28 49 See generally, United States v. Hector Xavier Monsegur, 11-CR-666 (LAP) (S.D.N.Y.), and exhibita 2 and 3. Operation Avenge Assange was mentioned in Matthew’s trial and was discussed as a substantial motivating factor for Matthew wanting to report on, and joining Internet Feds. He was invited into the room by Sabu. 51 This act was also occurring during Matthews’ time in Internet Feds. Though not discussed at trial, this event was also very newsworthy and Matthew was attempting to get information about these politically motivated acts. 52 Monsegur was not charged with the CIA or Britain’s Serious Organized Crime Agency hacks. 53 See, e.g., Nate Anderson “Great Personal Danger: Inside Hacker Sabu’s Guilty Plea Hearing” Arstechnica (May 9, 2012), available at http://arstechnica.com/tech-policy/2012/03/great-personal-danger-inside-hacker-sabus-guilty-plea-hearing/. 50 DEFENDANT’S SENTENCING MEMORANDUM Page 20 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 21 of 69 1 and 2004, engaging in various hacktivism activities as well as carding activity — stealing and selling 2 credit card information for financial gain or to pay off his own bills. He also admitting to selling a 3 controlled substance, illegally possessing an unlicensed firearm, and purchasing stolen electronics and 4 jewelry.”54 5 Monsegur only served 7 months because of violation s of his supervised release including 6 picking up a new charge (impersonating an FBI agent). He also violated his computer restrictions. But 7 at sentencing he was given only 7 months with credit for 7 months served for violating the terms of his 8 release. 9 10 Sentences for Lulzsec Members Darryn “PwnSauce” Martyn aka and Donncha “Palladium” O’Cerbagill: A $5,000.00 Euro Fine and a “Restorative Justice” class. 11 Lulzsec members Darryn Martin and Donncha O’Cerbagill were college students in Ireland at 12 the time of their offenses. They were both around 19 years old. They pleaded guilty in July 2013 to 13 criminal damage to the www.finegael2011.ie website. On January 9, 2011 the site was defaced, had its 14 database stolen and was knocked offline for 24 hours - seven weeks before the general election.55 15 Both Martin and O’Cerbagill were also indicted in the Southern District of New York for 16 computer crimes involving Internet Feds and LulzSec. Neither have been extradited, nor has extradition 17 been sought for them or any of the members of Internet Feds and LulzSec that were indicted in the US 18 but live in Britain. 19 20 Both Martin and O’Cerbagill are currently finishing up their college degrees. Sentence for Ryan Ackroyd “Kayla” 30 months56 of prison time. 21 Lulzsec member Ryan “Kayla” Ackroyd was co-defendants with fellow Lulzsec members Jake 22 Davis, Mustafa Al-Bassam and Ryan Cleary in the U.K.’s prosecution for violations of the Computer 23 Misuse Act. The British prosecution’s sentencing summary listed some of the hacks Ackroyd, then 25, 24 and his co-defendant’s committed: The HBGary/HBGary Federal/Aaron Barr hack, Sony (multiple 25 26 27 28 See Kim Zetter, “Government Seeks Seven-Month Sentence for LulzSec Leader ‘Sabu,’” Wired (May 24, 2014), available at http://www.wired.com/2014/05/sabu-time-served-sentence/. 55 See, e.g., “Fine Gael website hackers spared jail sentences” RTE News (October 8, 2013), available at http://www.rte.ie/news/2013/1008/479105-fg-website-hackers-spared-jail-sentences/ 56 But See Jake Davis’ statement: It was very[,] very unfortunate that Ryan Ackroyd did not wear a tag too for all of his police bail as he would have served considerably less. But the tag is highly disagreeable so I don't blame him one bit. 54 DEFENDANT’S SENTENCING MEMORANDUM Page 21 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 22 of 69 1 times including Sony Online Entertainment, Sony Music, Sony Pictures and several foreign Sony 2 companies, resulting in 12 days of outage time and a $20 Million loss), the Westboro Baptist Church 3 (website defaced), video game company Nintendo, the Georgia division of Infraguard (Infraguard is an 4 FBI contractor), Unveillance (a cybersecurity company), the United States Senate (confidential 5 information was downloaded and shared with the public), video game company Bethesda Softworks, 6 News International (Rupert Murdoch) “stable of websites,” causing multiple high-profile news sites to 7 go offline for hours57 and for harvesting data from those companies, including the deface of the Sun in 8 which Murdoch was declared dead, the Pentagon, wherein administrators were unable to access their 9 accounts, causing 5 people to work for one month to remedy the problem, $100,000.00 in economic loss 10 and $50,000.00 in new equipment needed to be purchased, 20 th Century Fox’s website, accessing the 11 contestant list for the X-Factor TV show and releasing tens of thousands of contestants information, Eve 12 Online, a gaming company, disrupting play for participants, SOCA, the British “Serious Organized 13 Crimes Agency,” the CIA, the British National Health Service, The Arizona State Police, which 14 unleashed secret police data and information about the officers and ongoing investigations, along with 15 information about police informants, and this is not an exhaustive list.. Mustafa recently was invited to 16 10 Dowing Street, home of the British Prime Minister, as part of a organization that is a “network of 17 most promising entrepreneurial talent in technology.”58 18 Ackroyd was trained on computers during his time in the British Army. He had previously 19 participated in hacking groups that downed other targets, most notably “gn0sis.” He had a virtual 20 machine, and set up his equipment such that it would disable itself if a wire was touched. He was home 21 when he was raided and tripped the wire himself. Scotland Yard was able to remove enough data from 22 his virtual machine’s memory to point clearly to Ackroyd’s identity as “Kayla.” “Kayla” was an 23 assumed identity of a 16 year old girl. It was effective in throwing people off his trail. Additionally, many of LulzSec’s targets were taken out by Ryan Cleary (ViraL)’s use of a 24 25 botnet. A botnet (also known as a zombie army) is a number of Internet computers that, although their 26 27 28 57 In contrast to Keys, who never downed a network, but, rather, was convicted of aiding in a 40 minute edit of a minor article. 58 Mustafa Al-Bassam, Twitter Feed (6:22am Mar. 4, 2016), available at https://twitter.com/musalbas/status/705715136393297920. DEFENDANT’S SENTENCING MEMORANDUM Page 22 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 23 of 69 1 owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other 2 computers on the Internet. A botnet is typically acquired by installing a “Trojan Horse” or “Trojan” on 3 someone else’s computer. The most common way this is done is to send an email and have the recipient 4 click on a link or open an attachment. Cleary’s botnet allegedly included 100,000 computers and was 5 used to DDoS sites. It literally turned websites into smoking craters in cyberspace within seconds. This 6 botnet was used on SOCA and the CIA, among other targets. 7 Ackroyd was sentenced to 30 months in prison. Ackroyd received a higher sentence than his co- 8 defendants because he declined to wear an ankle monitor while on police bail (our equivalent of O.R.). 9 Had he done so, his sentence would have been greatly reduced. British prison time is served at 50% if 10 the prisoner is on good behavior. Additionally, Ackroyd was older and was a senior member of 11 LulzSec, second only to Monsegur, and was considered Monsegur’s ‘Lieutenant.” He personally found 12 most of the vulnerabilities in the websites attacked. He was trained by the army and was presumed to 13 know better than to use his skills in this manner. Acroyd and Keys fought in the Internet Feds chatroom, ultimately leading to Keys’ expulsion 14 15 from the room. Keys was accused by many in the room of providing information to the media, thus 16 violating the trust and security of the group. 17 Sentence for Jake Davis “Topiary” – 24 Months (half on probation) 18 LulzSec member Jake Davis was sentenced to a total of 24 months in the U.K., with 50% to 19 serve in prison and 50% on probation. Electronic tag time knocked off all but 38 days of the first 50% 20 prison time, hence 38 days remaining in prison, followed by 365 days on probation.59 Davis was not a participant of Internet Feds at the time Matthew was in the chat room. Davis’s 21 22 involvement began with the HBGary hack in February 2011. Davis was also convicted of all LulzSec 23 Counts (aside from Monsegur no one in Internet Feds/LulzSec was involved in the conduct for which 24 Keys was convicted). His computer had storage on it that included close to a million people’s personal 25 information. None of that information had been released to the public. 26 27 28 59 Email from Jake Davis to Jay Leiderman. DEFENDANT’S SENTENCING MEMORANDUM Page 23 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 24 of 69 1 Davis was responsible for LulzSec’s witty antics on Twitter and elsewhere. He was the so-called 2 spokesman for Internet Feds / LulzSec. He wrote the press releases for all of the operations and was the 3 public voice of LulzSec. He is now a student studying theater. Davis is doing very well in school and 4 his future looks rather bright. 5 6 Sentences for Mustafa Al-Bassam “T-Flow” “Chronom” (Internet Feds) –2 years suspended sentence. 7 Lulzsec member Mustafa Al-Bassam was a brilliant young coder who was an integral part of 8 Internet Feds and LulzSec. He was present for all of the LulzSec crimes. Al-Bassam’s crimes are 9 almost identical to those of Ackroyd. 10 11 Matthew and Al-Bassam started to get along poorly in the Internet Feds’ chatroom. Along with “Kayla,” “Chronom” was a big reason that Keys’ access to the room was revoked. 12 13 Al-Bassam is now a student at a London University. Like Davis, he is doing very well in school and his future looks bright. 14 15 Because Al-Bassam was a minor at the time of his arrest, details of the events that led to his arrest were never released. 16 17 Lulzsec Member Ryan Cleary “ViraL” [LulzSsec botnet herder]-32 months for 2 separate cases 18 Ryan “ViraL” Cleary was with LulzSec for only a short while, but his emergence marked their 19 most “destructive” period. He was responsible for being the “bot herder” 60 that took down the SOCA 20 and CIA sites. He was also said to be behind the U.S. Senate hack. Cleary was between 19 and 20 years 21 old during the relevant periods. Cleary rented his botnet out for cash. He allowed anyone to use it for any reason. Indeed, he 22 23 had brokers taking a cut of the fee to help him keep it rented out. He had access to certain information 24 involving true names behind XMPP61 handles and IP addresses for those that put up text on 25 Pastebin.com. Cleary used that information to cause negative consequences to people. For example, 26 60 27 28 One who wields a botnet. Extensible Messaging and Presence Protocol (XMPP) is a communications protocol, much like IRC. People can chat privately or securely or small groups can have chats. People use handles in XMPP that look like email addresses, as opposed to IRC, where just the handle itself is used. For example, if AESCracked wanted to use XMPP he or she may choose AESCracked@jabber.ccc.de. Or AESCracked@duck.go or any other extension compatible with XMPP. 61 DEFENDANT’S SENTENCING MEMORANDUM Page 24 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 25 of 69 1 when someone ran afoul of LulzSec, he gave personal information to Monsegur. The person’s home 2 was raided and his personal identity as well as all identifying information was made public. 3 He was arrested shortly after the SOCA and CIA attacks. Cleary did surprisingly little to hide 4 his identity. He was released on his own recognizance and sent back home. He was rearrested later in 5 2011 for contacting Monsegur, then an FBI informant and asking Monsegur to help rehabilitate his 6 reputation. As Cleary made it clear that he intended to use his reputation online again, he was remanded 7 into custody before doing any damage. 8 9 Cleary was also found with locked portions of his hard drive. Based upon searches of his browser history, police believed him to be in possession of child pornography. They were unable to 10 unlock his encrypted files. Eventually, faced with the threat of significant prison time, Cleary decrypted 11 the files. It was never made public whether unlawful images were located. 12 It was also revealed that Cleary was involved in many other types of hacking activities and other 13 unlawful conduct on the internet not involving his botnet. For example, he had been buying narcotic 14 pills online. Much of Cleary’s internet criminality was driven by his hatred of other Internet denizens. Based upon the illegal pornographic images and the deadly botnet, along with Cleary’s other 15 16 aggravating conduct, Cleary was sentenced to 30 months. He and Ackroyd received the harshest 17 sentences – though they were well less than half of what is proposed for Matthew.62 This transcends the 18 colloquialism “it hardly seems fair.” 19 Reports are that Cleary has grown up a lot since this incident, or at least he is trying. He has 20 asked his co-defendants, who are all doing well, for help getting his life on track. One week prior to his 21 arrest, Cleary was diagnosed with Asperger’s disease. He had been living in his room as a recluse for 22 years. He did not attend school. He was on his computer all day and night. His windows were even 23 covered with tinfoil. 24 25 62 26 27 28 Reports from the time of sentencing: Cleary, 21, who also pleaded guilty to possession of images showing child abuse, was sentenced to 32 months, of which he will serve half. He also pleaded guilty to hacking and multiple counts of launching cyber-attacks against organizations, including the CIA and the UK’s Serious Organized Crime Agency (SOCA), as well as hacking into US Air Force computers at the Pentagon; see generally, “LulzSec hackers handed down prison terms, suspended sentence in Britain” (May 16, 2013) Russia Today, (May 16, 2013), available at http://rt.com/news/lulzsec-sentence-jaildavis-376/; Susan Watts “Former Lulzsec hacker Jake Davis on his motivations” BBC News (May 16, 2013), available at http://www.bbc.co.uk/news/technology-22526021. DEFENDANT’S SENTENCING MEMORANDUM Page 25 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 26 of 69 1 He has since started making strides to a better existence. It will not be easy for Cleary, but he is 2 seeking help. As with all of the other LulzSec and Anonymous defendants, he has rejoined society in a 3 positive way. 4 No Charges for George David Sharpe aka “Sharpie” George David “Sharpie”. Sharpie was the individual who actually accessed the Tribune 5 6 Companies CMS and caused the damage Matthew was convicted for. Sharpe was never charged on 7 either side of the Atlantic. He was visited once at his home in Scotland by the FBI and Scotland Yard. 8 He spoke to them and that was the last of his contact with this case. 9 The PayPal 14 The original “Operation Payback,” discussed herein and at Keys’ trial was an Anonymous 10 11 operation that sought to counter a DDoS campaign by an Indian company who was said to have been 12 hired by the “Bollywood” companies who were displeased with sites that did not take down copyrighted 13 material quickly enough for their tastes. The company hired by “Bollywood” launched sustained DDoS 14 traffic against many different sites, including the torrent website the Pirate Bay, because the Pirate Bay 15 allows some users to download copyrighted material. That “Op” began in September 2010. Foreign 16 companies continued to DDoS the Pirate Bay other sites and Anons63 continued to counter-attack 17 companies including law firms, the Recording Industry of America, and other pro-copyright sites. Op 18 Payback lasted all the way until mid-December 2010. 19 In early December 2010, a banking blockade was formed with the intent that no donations were 20 to be processed for the WikiLeaks “truth-telling” or “whistleblower” site. Op Payback quickly morphed 21 into an action against donation payment processors PayPal, Visa, MasterCard and Amazon. Most 22 people still called the DDoS protests against the banking blockade “Op Payback” but the operation was 23 actually truly named “Op Avenge Assange,” though so-called by few. These terms were used 24 interchangeably throughout Matthews’ trial, but were often just referenced as actions involving 25 WikiLeaks or Assange. 26 27 28 63 The colloquialism for those that self-identify as members of Anonymous DEFENDANT’S SENTENCING MEMORANDUM Page 26 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 27 of 69 1 Operation Payback members used a modified version of the Low Orbit Ion Cannon (LOIC) tool 2 to execute the DDoS attacks. The LOIC operates by targeting a particular website with “junk” traffic. 64 3 The user types the site’s URL into a bar on the LOIC and then clicks the “imma chargin mah lazer” 4 button. 65 Junk packets are then sent to the target site. The net effect is that a website essentially 5 refreshes itself over and over. By itself, the LOIC traffic is like throwing a pebble at a plate glass 6 window. It is almost certain to do no damage. In September 2010, a "Hive Mind"66 mode was added to 7 the LOIC. While in Hive Mind mode, the LOIC connects to an Internet Relay Chat room, where it can 8 be controlled remotely. This allows computers with LOIC installed on them to behave as if they were a 9 part of a botnet. Utilizing this tool, the coordinators of Operation Payback were able to quickly take 10 down websites belonging to anti-piracy groups. While tossing one pebble at a plate glass window may 11 do nothing, tossing between 8,000 and 30,00067 at once will likely have effect. 12 In January 2011, 40 warrants were executed in America in relation to the PayPal DDoS. In July, 13 charges were filed against 14 people under the CFAA for their roles in the PayPal DDoS protest. It is 14 estimated that between 8,000 and 30,000 people took place in the PayPal protest. 15 The PayPal defendants pled guilty to one felony CFAA count. They were placed on supervised 16 release for one year with only one condition – do not commit any new crimes.68 After a year, they were 17 allowed to withdraw their felony plea. Misdemeanor pleas were entered. One or two of the defendants 18 did not want to be placed on supervised release for a year, in that they had other criminal cases pending 19 in State Courts in different jurisdictions, so they asked to be sentenced to 90 days in jail for an 20 immediate misdemeanor. This plea was accepted by the District Court Judge in the Northern District of 21 22 23 24 25 26 27 28 When one clicks on a link, a website is typically being asked to engage in a “handshake” with the requesting site. Then the requesting site may access the content of the linked site. Junk packets seek no handshake, they just cause the website’s attention to be turned toward nothing of import. 65 The tech staff at the Tribune Company at one point created their own DDoS tool called "bees with machine guns" that functioned in the exact same way as LOIC. Not only did they create it, they released it publicly with reckless abandon and even an acknowledgement that it could be used for illicit activities. (See “Bees with machine guns! Low-cost, distributed load-testing using EC2” Chicago Tribune, New Apps Blog, available at http://blog.apps.chicagotribune.com/2010/07/08/bees-with-machine-guns/. 66 Many Anonymous chat logs during this period have the refrain “you have angered the hive.” 67 The estimated number of participants in the PayPal DDoSings. 68 See, e.g., Ryan J. Reilly “PayPal 14 Plea Deal Lets Hacktivists Avoid Felonies, Which is Pretty Much the Best They Could Hope For” The Huffington Post (Dec. 5, 2013), available at http://www.huffingtonpost.com/2013/12/05/paypal-14-pleadeal_n_4392521.html. 64 DEFENDANT’S SENTENCING MEMORANDUM Page 27 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 28 of 69 1 California. Other than that, no one did a day in jail for a 4 day DDoS on PayPal that caused the world’s 2 largest online payment processor repeated outages during the holiday gift buying season. PayPal listed 3 their damages at $5.6 million. The ultimate restitution figure settled on by the parties was just under 4 $90,000.00, joint and several.69 5 6 The members of the PayPal 14 that have remained in the public sphere all are doing well, and have mostly gone back to their lives as they were before. 7 Vincent Kershaw, after sentencing but while still on the one-year probation, bought his first 8 house in Colorado. He has stayed in the family landscape design/install business which he will be 9 taking over later this year when his father retires. 10 11 Mercedes Haefer is working for an IT repair/service company in Las Vegas, continuing her studies at UNLV and, according to one of her co-defendants “basically being awesome.” 12 Keith Downey roamed Europe looking for work for a few months but was unfortunately unlucky 13 and didn’t find employment. He moved back to Florida and is working at a hardware store saving 14 money to get back to Europe. 15 Unfortunately, PayPal 14 defendant Dennis Collins, described below in the Payback 13 16 prosecution, has passed away. 17 The original Operation Payback and PayPal (Avenge Assange) in England, 4 more defendants 18 According to his court conviction after a trial in England, Christopher “nerdo” Weatherhead 19 played a large role in Operation Payback (aka Operation Avenge Assange), described above. According 20 to news reports, Weatherhead reportedly was instrumental in bringing down PayPal, resulting in 21 £3.5million70 in losses for the company. Weatherhead reportedly ran the AnonOps server. News reports 22 alleged that some of the harmful packets that were sent to PayPal and others travelled through the 23 servers he owned and operated. Per Weatherhead, it is not true that any harmful traffic travelled his 24 servers, and this was not among the allegations levelled at him in his trial. If these news reports were 25 correct, one would assume he would have been accused of those actions during his trial. 26 27 According to Christopher Weatherhead, discussed below in the British PayPal prosecutions, “$4.2 million was consultancy fees, $185,000 was operational losses of the $5.6 million quoted by PayPal.” 70 This tracks with the $5.6M figure PayPal provided in the US case. 69 28 DEFENDANT’S SENTENCING MEMORANDUM Page 28 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 29 of 69 1 In January 2013, Weatherhead was sentenced to 18 months in prison for his part in the denial-of- 2 service attacks on PayPal, Visa and MasterCard in December 2010, as well as attacks on music, movie 3 and other pro-copyright websites. 4 Also sentenced by the same English judge was Ashley Rhodes, 28. Rhodes was sentenced to 5 seven months in prison for his role. A third man, Peter Gibson, 24, was given a suspended six-month 6 prison sentence for his part in the Anonymous operations. The sentencing of a fourth man, Jake 7 Burchall, 18, was adjourned. 8 9 The four men were each convicted of attacking anti-piracy and financial companies between August 201071 and January 2011. “Prosecuting, Joel Smith, said the four men were "not simply involved 10 in the attacks, but played roles in maintaining the infrastructure used by other Anonymous members to 11 coordinate attacks".”72 12 Weatherhead was described during his trial as a high-ranking member of Anonymous who 13 owned two servers, ran private chat rooms and acted as a press spokesman to the world's media, 14 including the BBC and Al Jazeera. The court heard that Weatherhead enjoyed such seniority that he 15 held an election of Anonymous members to decide who or what would be the hackers' next target. 73 16 Weatherhead is gainfully employed and had no issues with the law since being released from 17 prison. 18 Payback 13 19 2 years after the PayPal 14 case first came to court, and after the re-pleader plea agreement was 20 reached, the DOJ filed charges against 13 individuals in connection with the Visa and MasterCard DDoS 21 protests in the Eastern District of Virginia. Pleas of 24-months prison time per defendant were offered 22 to all 13 defendants. When the Judge Liam O’Grady was advised of the proposed pleas he erupted in 23 anger at the government, demanding to know why the same crime would not be similarly punished as 24 25 26 27 28 71 It appears that news reports might have that fact wrong, as all evidence points to the Anonymous activity beginning on September 21, 2010. 72 See Josh Holiday “Anonymous hackers jailed for cyber attacks” The Guardian (Jan. 24, 2013), available at http://www.theguardian.com/technology/2013/jan/24/anonymous-hackers-jailed-cyber-attacks. 73 Id. DEFENDANT’S SENTENCING MEMORANDUM Page 29 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 30 of 69 1 those in the Paypal 14 prosecution. 74 Weeks later, all 13 “Payback” defendants had pled guilty to a 2 felony. The plea included a provision that after a year of supervised release wherein the only term was 3 to not commit any new offenses, the felony plea would be withdrawn and a misdemeanor substituted 4 therefor. The damage in that case was reportedly $8,917,010.82.75 No one went to prison in that case. 5 Adam Bennett aka “Lorax”; Anonymous Australia Website Hacks, November 5, 2012 6 Over in Australia, Adam John Bennett, 42, who went by the handle “Lorax” was given a two 7 year suspended sentence earlier this month (March 3, 2016) for six charges including aiding another 8 person to cause the unauthorized impairment of electronic communications. In his case he admitted to 9 charges that there were plans for a "mass defacement" of sites planned to mark Guy Fawkes' Day in 10 2012.76 At sentencing the court was told Bennett helped an Australian juvenile dubbed 'Juzzy' to hack 11 into a variety of sites, including those operated by the Australian Agency for Education and Training, 12 the Australian Film Institute, Anchor Foods, and the Food Industries Association of Queensland. When 13 the public tried to access a hacked sites, they found a message from the group in red text on a black 14 background. 15 Prosecutor Patricia Aloi told the court "the plan was to get a much larger number of sites". She 16 said the "impact could be described as a nuisance, could be described as lost productivity", and such 17 offending could escalate.77 18 Bennett will end up doing 200 hours of community service for his juvenile nuisance behavior. 19 The case in Australian bears many similarities to that of the instant case. This is especially so in light of 20 the fact that “[Count 6] involved the website of Bennett's employer Cancer Support WA and that of 21 HotCopper.” Bennett tested the sites for vulnerability to the Heartbleed security bug, and tried to access 22 confidential information. 23 24 25 26 27 28 See, e.g., “Felony charges? Harsh! Alleged Anon hackers lead guilty to misdemeanours” The Register (Aug. 20, 2014), available at http://www.theregister.co.uk/2014/08/20/anonymous_hackers_guilty_misdemeanours/; Attorney Leiderman has confirmed this with attendants of the hearing. 75 See, e.g., “Payback 13: Last of Anonymous anti-copyright hacktivists sentenced in Virginia” RT (Feb. 20, 2015), available at https://www.rt.com/usa/234191-anonymous-payback-collins-blake/. 76 Guy Fawkes Day, November 5th, is a day celebrated by Anonymous as sort-of “their holiday.” Many “ops” are set for the 5th of November. The date stems less from British traitor Fawkes himself, but rather from the movie “”V” for Vendetta.” 77 See “Former Anonymous member Adam John Bennett given suspended sentence for website hacking” ABC News Australia (Mar. 3, 2016), available at http://www.abc.net.au/news/2016-03-03/accused-hacker-adam-john-bennett-suspendedsentence/7217466 74 DEFENDANT’S SENTENCING MEMORANDUM Page 30 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 31 of 69 1 Like the members of Internet Feds/LulzSec, minus Monsegur, Bennett is a high-profile and quite 2 beloved member of Anonymous. He hosts a very popular talk “Lorax Live” show on AnonOps Radio. 3 Jonathan Cowden; Op Free Palestine 4 Jonathan Cowden, 27, was convicted in Federal Court in St. Louis, MO in 2013 for using online 5 tools to attack Nefesh B’Nefesh, an Israeli organization started by and named for an Israeli rapper that 6 assists immigrants to that country, between November 2011 and Jan. 17, 2012, and of hacking the 7 Mayor of St. Louis. Cowden admitted he stole data, damaged computers and boasted about his exploits 8 on Twitter as “_AnonymouSTL_” and elsewhere. Cowden worked for a company that advertises its 9 ability to keep companies’ online data safe. In at least one online profile, he bills himself as a “White 10 Hat” hacker, someone who helps organizations identify security vulnerabilities.78 11 Cowden, for all of his various hacking activities detailed below, was sentenced to serve 15 12 months in a Federal prison and pay $22,000.000 in restitution. He gave an interview to Anonymous 13 prison support network FreeAnons79: 14 Question: Hi Jon, can you tell us about your case that resulted in your arrest and incarceration? Was your arrest related to OpPalestine? Answer: I was arrested and charged with one count of Computer Fraud – Access to a protected Computer causing $5,000 or more in damage. I plead to two infractions under that statute. One was for the attack on Nefesh B’ Nefesh and one was for hacking Mayor Francis Slay. Nefesh B’Nefesh was part of a “fire sale” hacking campaign that I, myself completed against the Nation State of Israel. I also hacked TopLinks (Major News and Marketing),The Bar-Ilan University’s Geography and Environment Department (Land, Oil, Diamonds and GPS) The Israel Institute of Technology: Techinon and their Cancer and Vascular Biology Research Center (Technology and Health ILAN (Charity Foundation – PsyOps) and SNIP (more news). What was not mentioned was that I also hacked SALT.IL (their LARGEST export) as well as the Israeli site of ARCO Oil. (Another of the TOP exports.) So you can see… I attacked LAND (GPS, Geology), Exports (SALT and Oil), Technology (Institute of Tech), Struck Fear (Charity) and took down News (Toplinks and SNIP). 15 16 17 18 19 20 21 22 23 24 25 26 Robert Patrick “Feds say St. Louis man hacked Israeli group's data” St. Louis Post-Dispatch (Feb. 1, 2013), available at http://www.stltoday.com/news/local/crime-and-courts/feds-say-st-louis-man-hacked-israeli-group-s-data/article_f220d5ab8b8e-5d50-b87b-3fb63d7465c9.html 79 Freeanons, “Welcome Home Jon Cowden: Life after Prison #OpPalestine ” Freeanons.org (November 3, 2014), available at https://freeanons.org/welcome-home-jon-cowden-aka-_anonymousstl_-life-prison/ 78 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 31 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 32 of 69 My hacking was not related to OpFreePalestine. As you trace back on Hackmageddon I WAS OpFreePalestine in the beginning. *** The hack on Mayor Slay of St. Louis was to demand the control of his officers during the eviction of the Occupy camp after the Occupy camps of Oakland, LA, and NY all went south. Being that St. Louis officers are notorious for brutality [ ] I felt it was required of me. It worked… Only a handful were peacefully arrested and released that night. 1 2 3 4 5 Cowden got 15 months, yet Matthew’s guideline range is between 70 and 87 months and his 6 7 PSR states that no Booker variance is appropriate. This interview should cause the Court to reject the 8 guidelines entirely and start thinking about what type of Booker variance is appropriate. The 9 comparative analysis of like cases shows that Keys’ conduct was de minimus. Cowden violated the terms of his supervised release by having an internet-accessible tablet and a 10 11 pocket knife.80 He was returned to custody. As one newspaper put it: “Jon explained to us at one point 12 that even McDonalds wouldn’t hire him because they use computers and they would have to be 13 monitored. His self-confidence was squashed in prison and he suffered PTSD also as a result of his 14 incarceration. [Cowden had many mental health issues prior to entering prison, and is now participating 15 in counselling]81 Jon was beginning to feel better about himself. With the help of his beloved dog 16 Chazz, an incredibly supportive girlfriend and a job in the works, life was finally looking up for our 17 Anon that the world had forgotten.82 All of that came to an abrupt halt on 10/25/2015 when Jon was 18 arrested for violation of probation for being in possession of a pocket knife and a tablet computer. 19 20 21 22 23 24 25 26 27 28 Per an email from Cowden’s girlfriend: “With respect to recidivism (not sure if this helps your case or not) his only actual violation was that the pocket knife that was in my office (we weren't dating at the time - I'd set up an air mattress in there for him while he needed a place to stay) was slightly over the maximum length. He was allowed to have internet accessible devices (and he was allowed internet access) - he just had to have some spyware on whatever devices he used to access the Internet.” The spyware to which she was referring was the monitoring software used by Supervised Release. He failed to inform supervised release of his new device. 81 Per the same email: “So plenty of non-Anonymous factors that would have made him more likely to re-offend/differentiate himself from Keys.” See note 85 as support of this claim. 82 Cowden is known as the “Forgotten Anon” because his case received so little publicity in the Anon community. Through the work of FreeAnons, people have come to know who he is. As stated in an email by his girlfriend: “And for what it's worth, Jon's been dubbed "The Forgotten Anon" because no one knew about his initial arrest & incarceration until after he was released. So the only recidivist happens to be the only one who didn't have any support or contact with Anonymous from his arrest until after his release.” Though Keys has no Anonymous support, the journalism community has been there for him, as has his amazing grandmother. His support network, primarily, is his work. He has always been there for journalism, and it has always been there for him. 80 DEFENDANT’S SENTENCING MEMORANDUM Page 32 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 33 of 69 1 Monsegur and Cleary violated terms of their pre-trial releases. Cowden is the only one that has 2 violated terms of his supervised release and been returned to custody. It is rather noteworthy that 3 everyone involved with Anonymous-related computer crime has returned to a happy and productive life. 4 The recidivism rates among non-Anons and Anons are widely disparate. Recidivism rates in California 5 are 61%.83 Anons are, thus far, one out of dozens. That Keys has every prospect of living a crime-free, 6 law-abiding life militates toward a conclusion that it is unnecessary to imprison him for any period of 7 time. Keys’ contrast with Cowden is among the starkest of contrasts that we will see in this comparative 8 section. 9 Other instances of digital intrusions on Tribune Company 10 11 The alleged computer intrusion of December 2010 involving the LA Times compares with another type of intrusion that struck the Tribune Company more than 20 years earlier. 12 On November 22, 1987, the broadcast signal of Tribune-owned WGN-TV was briefly 13 interrupted during a late evening newscast when a video pirate hijacked the signal to air videotape of a 14 satirical parody involving a well-known television character known as Max Headroom. 15 According to engineers at WGN-TV as retold by the Chicago Tribune, an unidentified individual 16 overpowered the television station's broadcast signal — likely through the use of sophisticated 17 transmission equipment and technical knowledge of radio frequencies — gaining brief control of WGN- 18 TV's airwaves. The intruder replaced WGN-TV's signal with his own, airing a videotape of someone 19 dressed in a Max Headroom costume for about 30 seconds before WGN-TV's engineers were able to 20 retain control of their airwaves. More precisely, during highlights from the Chicago Bears' 30–10 home 21 victory over the Detroit Lions that afternoon in the sports report, the screen went black for 15 seconds, 22 then returned with a person wearing a Max Headroom mask and sunglasses, moving around and 23 jumping. His head was in front of a sheet of moving corrugated metal, which imitated the background 24 effect used in the Max Headroom TV and movie appearances. There was no audio other than a buzzing 25 noise and an oscillating sound. 26 27 28 Department of Corrections And Rehabilitation - State of California, “2013 Outcome Evaluation Report” Office of Research (January, 2014), available at http://www.cdcr.ca.gov/Adult_Research_Branch/Research_Documents/ARB_FY_0809_Recidivism_Report_02.10.14.pdf 83 DEFENDANT’S SENTENCING MEMORANDUM Page 33 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 34 of 69 1 The incident left sports anchor Dan Roan bemused, saying, "Well, if you're wondering what's 2 happened, so am I." He then unsuccessfully tried to repeat what he was saying before the incident 3 occurred, having succumbed to laughter.84 4 The Max Headroom incident made national headlines and was reported on the CBS Evening 5 News the next day. Not long after the incident, WMAQ-TV humorously inserted clips of the hijacking 6 into a newscast during Mark Giangreco's sports highlights. "A lot of people thought it was real – the 7 pirate cutting into our broadcast. We got all kinds of calls about it," said Giangreco. 85 8 9 A few hours after the WGN-TV signal intrusion, another signal hijacking occurred, this time on public broadcaster WTTW during the airing of an episode of "Doctor Who." This time, the individual 10 was able to gain control of WTTW's airwaves for close to two minutes (WTTW would later 11 acknowledge it had no engineers on staff at the time who were capable of overriding the pirate's signal). 12 Because Doctor Who was a popular program at the time, a number of people had taped the episode 13 involving the signal interruption; copies of the incident were made available to local news broadcasters 14 in the days to come, and have been preserved in recent years on websites like YouTube. 15 The so-called "Max Headroom pirate incident" was dismissed by the Chicago Tribune 16 newspaper as a "silly stunt involving a parody of a parody," and the alleged pirate was referred to as a 17 "joker" with a "strange sense of humor." But the Federal Communications Commission, the federal 18 agency in charge of regulating television broadcasts among other things, did not find it to be strange or 19 humorous: An immediate investigation was launched to determine the source of the signal intrusion and 20 to identify those responsible for it.86 21 22 The Max Headroom incident is still the subject of prankster-fueled comedy. The most famous usage of the incident is probably when parts of the video were included in some episodes of the 23 24 25 26 27 28 84 See "WTTW Chicago - The Max Headroom Pirating Incident." YouTube. The Museum of Classic Chicago Television, 22 Nov. 1987. Web. 09 Mar. 2016. https://www.youtube.com/watch?v=cycVTXtm0U0 ; see also "Captain Midnight, HBO, 1986." YouTube. N.p., 27 Apr. 1986. Web. 09 Mar. 2016. ; see also "ABC News Report on HBO's "Captain Midnight"" YouTube. ABC, Apr. 1986. Web. 09 Mar. 2016. https://www.youtube.com/watch?v=xcQHc1zASDw . 85 Id. 86 See “Dr. Who And The Electronic Pirate” Chicago Tribune (November 30, 1987), available at http://articles.chicagotribune.com/1987-11-30/news/8703300133_1_max-headroom-stunt-invader. DEFENDANT’S SENTENCING MEMORANDUM Page 34 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 35 of 69 1 animated talk show, Space Ghost Coast to Coast. One can see the bobbing figure of the Max Headroom 2 intruder going by when Moltar, a character in the show who is a kind of assistant to the main character , 3 is switching feeds to get Space Ghost, the talk show host, his next guest.87 4 Though these intrusions were then and are now seen as harmless pranks, broadcast signal 5 intrusions — in many ways, a form of television "hacking" — can have serious consequences. Had a 6 local, state or national emergency occurred at the time of the signal intrusion, the two broadcasters in 7 question who were hijacked would likely not have been able to invoke the Emergency Broadcast 8 System, which could have jeopardized the safety and security of their viewers. Additionally, because 9 signal intrusions at the time required pirates to overpower a frequency with more radiative power, the 10 possibility of damaging broadcast equipment in this case was very real (neither broadcaster, in this case, 11 reported damage to their equipment and, in fact, continued broadcasting as normal after the signal 12 intrusion). Unlike hijacking a TV signal, altering the content of one LA Times article did not render the 13 rest of the website inaccessible, posed no immediate or future danger or threat to the public and did not 14 — by the government's own admission — cause any lasting damage to the computer equipment used to 15 operate the website or the website itself. 16 Although the Max Headroom pirates were never found, their punishments would have likely 17 mirrored that of another signal pirate: One year earlier, satellite engineer John R. MacDougall briefly 18 overpowered the broadcast signal of the Home Box Office (HBO) as protest to the network's decision to 19 begin charging satellite customers for HBO by encryption what had otherwise been a freely-available 20 channel to them. 21 The incident became known as the "Captain Midnight signal intrusion" because of MacDougall's 22 use of the moniker Captain Midnight. MacDougall used his position as a broadcast engineer and his 23 advanced technical skill of signals and frequencies to overpower HBO's broadcast in the evening of 24 April 27, 1986, causing customers to lose access to HBO programming for a few seconds.88 25 26 MacDougall was arrested following a year-long FBI investigation. Despite the FBI and FCC's assertion at the time that broadcast signal intrusions were serious crimes that carried severe 27 28 87 88 https://en.wikipedia.org/wiki/Max_Headroom_broadcast_signal_intrusion This illustrates a true use of a “special skill” within the meaning of the sentencing guidelines. DEFENDANT’S SENTENCING MEMORANDUM Page 35 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 36 of 69 1 consequences and threatened national security, MacDougall was sentenced to serve one year of 2 probation and ordered to pay a $5,000 fine. In a phone interview 25 years after the signal intrusion, he 3 offered no remorse for his actions, saying he did "not regret trying to get the message out to corporate 4 America about unfair pricing and restrictive trade practices." 89 5 These pranks, while potentially serious, highlight an important dichotomy. There is a difference 6 in intent. Monsegur had malice in his heart when he stole engines and used citizen’s credit cards. 7 Though there were consequences to Tribune Co. from the intrusion in this case, it came at a time and 8 place where pranks were the norm. The very essence of “Chippy 1337” is, at its heart, a joke. In 9 contrast to the WGN signal intrusion, the LA Times edit would have been lost to history if the LA Times 10 themselves did not print an article with a screen capture of the initial edit. 11 Attorney Jay Leiderman has surveyed every prosecution and sentence for a member of 12 Anonymous globally that he could find.90 None come near the recommended PSR sentence for 13 Matthew. Besides this glaring fact, other factors argue for a downward departure from the guidelines 14 range. 15 Keys did not believe the login credentials used to access the LA Times would work 16 While barely awake, Keys gave an interview to the FBI. He was under the influence of 17 medication. Still, per the government he was able to accurately describe events. If that is so, it is 18 important to note the following from the recorded interview as transcribed in the FBI’s “302” report on 19 the interrogation: 20 John Cauthen (JC): "You were not a hacker, per se, but at the end of the day, you did take e-mails from FOX40 that you shouldn't have, OK? And screw with them and cause them consternation." 21 22 Matthew Keys (MK): "Hey, I really didn't take —" 23 24 JC: "Well, stop for a second." (continues) 25 [later] 26 27 28 Paul McNamara, “Captain Midnight: 'No regrets' about jamming HBO back in '86,” Networkworld (April 26, 2011), available at http://www.networkworld.com/article/2229101/security/captain-midnight---no-regrets--about-jamming-hboback-in--86.html 90 See the more extensive white paper, attached hereto as Exhibit 1. 89 DEFENDANT’S SENTENCING MEMORANDUM Page 36 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 37 of 69 1 2 JC: "I don't know all of the details, so, we're going, I mean, what we'd like to do—" 3 MK: "I, unfortunately, don't remember all of the details." 4 JC: "We'll refresh your memory of what we know." 5 [later] 6 7 MK: "I…told him that I had credentials for their CMS…and he asked for them…and I gave them to him…um…" 8 JC: "Why did you do that?" 9 MK: "Because I thought they didn't work." 10 Use of a VPN (Overplay) 11 12 13 14 15 16 17 18 19 20 21 22 23 Matthew did have access to a VPN service, but he used that service primarily in his capacity as a journalist for FOX40. The program, called Overplay, was installed on at least two computers at FOX40, and may have been installed on other computers. The program was also, for a time, installed on Keys’ home computer. As far as Matthew knows, the program was not removed from any of FOX40's computers upon his exit, and because the account remained active, it is reasonable to assume that someone at FOX40 could have accessed it in the way they accessed any other program on the computer. This illustrated that Overplay was not used solely for nefarious purposes. There are many legitimate uses for a VPN, and the installation of Overplay at FOX40 shows legitimate use. Overplay was software Matthew used during the course of his employment at FOX40 in order to watch geoblocked news channels from other countries. One thing that no one can dispute is that Matthew is a massive news junkie, and that he spends all day every day searching the four corners of the Earth to find and scoop a story. Screen Shots 24 25 26 27 Per the Government’s objections to the PSR: "Keys further admitted taking screenshots of Internet chats he wished to retain, and acknowledged participating in the chat referenced in the search warrant application." 28 DEFENDANT’S SENTENCING MEMORANDUM Page 37 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 38 of 69 1 This is part true. He did create screenshots of his observation of Anonymous from various 2 online chat rooms, including "Internet Feds." He also accepted logs — including screen shots — taken 3 by others as part of his research into the story. He also downloaded logs that had been made freely 4 available on the Internet that referenced activity that he had not observed. 91 Some of these logs were 5 accessible on an external hard drive that was seized by the FBI in October 2010; some of them were not 6 kept after his story ended in 2011 and are presumed gone for good. However, the FBI has also produced 7 logs and screenshots it claims he created and/or had on an external hard drive seized that he had not seen 8 before, including logs that reference the criminal allegations against him. 9 Keys wrote stories or provided information to journalists about Internet Feds 10 Matthew, as a serious journalist, was in the Internet Feds chat room to gather information for a 11 news story. His access to the upper echelon of Anonymous was unprecedented. The information he 12 passed on to other news sites was valuable in helping the world understand who these mysterious 13 politically-motivated pranksters were. Additionally, he provided information to Parmy Olson, a Forbes 14 journalist, for her aforementioned book on Anonymous and LulzSec. His provision of this information 15 is what initially brought the FBI to his door. As a journalist he declined to reveal his sources for whom 16 he granted protection as a condition of receiving information for his reporting. Matthew has made plain 17 in the press that he believes this is what made him a target for prosecution.92 18 For the PBS NewsHour, Matthew provided three pages of documents taken from a Pastebin.com 19 file that circulated in the InternetFeds chatroom. On the Gawker.com story, Matthew provided 20 background information — based on what he knew — about a computer intrusion involving Gawker's 21 comment database, but he did not provide any logs or material documents to Gawker. For Reuters, 22 23 24 25 26 27 28 A person named Laurelai Bailey logged a section of the chats in Internet Feds and released them publicly. “Bailey says Lulz Security hackers hold a grudge against her for leaking logs from the secret chat room in which they planned the HBGary hack—which she says she did in retaliation for them harassing some of her friends.” http://www.wired.com/2011/06/lulzraid/ 92 See Hari Sreenivasan “Gawker Data Breach Could Lead to Attacks on Government Agencies” PBS NewsHour (Dec. 12, 2010), available at http://www.pbs.org/newshour/rundown/gawker-data-breach-could-lead-to-attacks-on-governmentagencies/; John Cook and Adrian Chen “Inside Anonymous’ Secret War Room” Gawker (Mar. 18, 2011), available at http://gawker.com/5783173/inside-anonymous-secret-war-room; Matthew Keys “The InternetFeds: Inside hacker Sabu’s war room” Reuters (Mar. 7, 2012), available at http://webcache.googleusercontent.com/search?q=cache:THzn_4yj1b8J:blogs.reuters.com/matthew-keys/2012/03/07/theinternetfeds-inside-hacker-sabus-war-room/+&cd=1&hl=en&ct=clnk&gl=us&client=opera. 91 DEFENDANT’S SENTENCING MEMORANDUM Page 38 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 39 of 69 1 Matthew filed a story one day after it was announced that Monsegur and others had been arrested at the 2 request of a Reuters editor. A second editor re-wrote the majority of the story; he appears uncredited. 3 4 FOX News is not related to FOX40 Sacramento Matthew worked for FOX40, the Sacramento affiliate of Fox. As was explained at trial, it is not 5 a Fox station. FOX40 used Fox programming that it purchased from FOX. It had local news and had no 6 relation to Fox News. As we know, FOX40 was owned by Tribune Media Company. 7 8 9 It was stated at trial that Matthew said in Internet Feds: “[i]f you want to attack FOX News, pm me, I have a user [name and] password for their CMS." But Matthew never worked for FOX News, and did not have access to their CMS, except for 10 access to a video distribution system provided to affiliates that was only accessible on a special 11 computer connected to an internal network. 12 13 Keys statement to the FBI accepts responsibility During his interview with Agent Cauthen, Matthew explained why he wanted to talk with the 14 FBI: “This is one of the reasons why I'm talking to you as opposed to saying, you know, I want a lawyer 15 or I want to talk to, you know, counsel at Tribune or -- again, I'm sorry, counsel at Reuters -- or anything 16 like that is because, you know, I did it." 17 18 The edited LA Times.com story was never unavailable in its original form The contention has been made by the Government that: "Defendant fails to address the fact that 19 when he conspired to alter the contents of the Los Angeles Times, the original, unaltered content was 20 therefore unavailable to the newspaper's readers." 21 This is incorrect. Articles that appear on the Los Angeles Times website also, at that time, 22 appeared in syndication on every Tribune website property. An alteration to an article on one website 23 did not impair the ability to read the articles on other websites. In any case, articles that appear on the 24 Los Angeles Times website also appear on non-Tribune websites (through the Tribune Wire Services), 25 in print (both in the Los Angeles Times and other papers both owned and not owned by the Los Angeles 26 Times) and elsewhere (on their phones, in apps, etc.) where the article would have presented in its 27 original form. Unless users have a special internet connection that forces them to read Los Angeles 28 DEFENDANT’S SENTENCING MEMORANDUM Page 39 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 40 of 69 1 Times stories on the Los Angeles Times website, they are free to access the same story elsewhere and in 2 other forms. 3 4 AESCracked Matthew told FBI agents that he had selected the moniker AESCracked in order to appear 5 authentic or knowledgeable to hackers...and although he did not know what AES was, he knew that 6 Anonymous would. 7 This is true. He did use "AESCracked" in some of his interactions with members of Anonymous, 8 and especially in the Internet Feds chatroom. He also used various other nicknames. None of the 9 nicknames were locked with a password, meaning they were freely available for anyone to use on that 10 particular IRC network. For most public IRC networks, using a password with a nickname — 11 "reserving" — is optional, and that was the case here; he did not set a password because he did not 12 believe other people would use it, though other people were certainly free to use it if they wished. He 13 later learned, because of this case, that employees at Tribune Company who had administrative access to 14 all websites were also mingling among Anonymous members. The allegation is not that Tribune 15 employees had anything to do with AESCracked, but simply that the monker was available for anyone 16 who wished to use it. 17 18 FBI Agent John Cauthen Based on trial testimony, FBI Agent John Cauthen attempted to contact Matthew at his 19 apartment in Sacramento, then attempted to gain entry to the apartment and collect information on 20 Matthew by visiting the leasing office. When that failed, Cauthen called Matthew while he was en route 21 to his new home (coincidentally, Matthew was moving the day Cauthen came to his apartment, and the 22 apartment was vacated by the time he arrived). 23 During the phone call, Cauthen advised Matthew he was conducting an investigation and was 24 interested in speaking with him. When Matthew asked what the investigation was about, Cauthen said 25 he could not say. When Matthew ventured a guess and asked if it was about recent news reports he had 26 worked on concerning Anonymous, Cauthen again said he could not say. 27 28 During the call, Cauthen asked if Matthew would be able to meet with him in his office or at another location, whichever was convenient for Matthew. He asked if Matthew could bring his DEFENDANT’S SENTENCING MEMORANDUM Page 40 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 41 of 69 1 computer for examination because Cauthen felt it might be able to assist with an active FBI 2 investigation. When Matthew told him he would be unable to provide Cauthen any material concerning 3 any reports for which Keys provided sources confidentiality, Matthew again asked if Keys would be 4 willing to meet him with his computer. 5 At that point, Matthew told Cauthen he would have to end the phone call because he was driving, 6 but that Keys would be happy to assist him if Matthew could provide some information about his 7 investigation and so long as it did not involve violating journalistic ethics. A few hours later, KGO-TV 8 contacted Matthew regarding an application of employment, and Keys forgot about Cauthen's call. 9 Cauthen e-mailed Matthew a few weeks later to ask about a home address and other contact 10 information for Matthew. Matthew opened the e-mail while he was at work, and intended to respond 11 when he got home, but forgot about the message. 12 In March 2012, the dat it was revealed that Hector Monsegur had been cooperating with the 13 Government for the better part of a year, Matthew learned that six suspected members of Anonymous 14 had been arrested, including some he recognized from Internet Feds. Some of the conduct alleged 15 included an attack on a computer system based in Sacramento belonging to a government contractor. In 16 an attempt to get more information as part of his job duties at Reuters, he e-mailed Cauthen from his 17 work e-mail address to inquire about the arrests and investigation in Sacramento. Cauthen did not 18 respond. 19 Cauthen was present when the search warrant was executed, and asked many of the questions 20 during the 2.5 hour interview/interrogation of Matthew. Cauthen recorded portions of the interview, and 21 did not record other portions, including a portion during which Cauthen shadowed Matthew as he made 22 a written statement. 23 24 No criminality before or since The acts for which Matthew was convicted stem from the end of 2010. This brief is dated March 25 9, 2016. 5½ years later. Matthew has no criminal record and is a criminal history category zero. In the 26 interceding 5 ½ years Matthew has committed no crimes. He has appeared in this Court every time he 27 was required to, complied with every order, and never violated the terms of his supervised release. This 28 militates strongly toward the conclusion that Matthew needs no custodial sanction. DEFENDANT’S SENTENCING MEMORANDUM Page 41 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 42 of 69 1 2 The CFAA is flawed and punishments are disproportionate to the crimes themselves and the true harm caused; true, this is “Not the case of the century.” 3 Based upon enhancement levels for loss, sentences for CFAA crimes that may otherwise seem de 4 minimus, like this case, for example, are beset with guideline ranges that are grossly disproportionate to 5 the actual crime itself. The crime, in that it leaves such unfettered discretion and carries such harsh 6 penalties, has been referred to privately as the “Prosecutor’s best friend”.93 According to Digital rights group and the leading authority on cyber-law, the Electronic Frontier 7 8 Foundation, commonly known as the EFF: “One of the basic tenets of a civilized society is that the 9 punishment should be proportionate with the crime. What essentially amounts to vandalism should not 10 result in even the remote possibility of a 25-year jail sentence. But that very possibility is on the table in 11 the government’s case against journalist Matthew Keys, whose sentencing hearing is about one month 12 off. The case is an illustration of prosecutorial discretion run amok—and once again shows why reform 13 of the federal anti-hacking statute, the Computer Fraud and Abuse Act (CFAA), is long overdue.” 94 The EFF op-ed piece goes on to state, as Assistant U.S. Attorney Matthew Segal put it: 14 15 “This is not the crime of the century.” But the government still charged Keys with three federal felony violations of the CFAA …. Keys was convicted … and faces a maximum punishment of 25 years in federal prison—10 years each for the first two offenses and 5 years for the third. This case underscores how computer crimes are prosecuted much more harshly than analogous crimes in the physical world.”95 “It’s true that Matthew Keys’ actual potential jail sentence could be significantly less than 25 years. The government has actually signaled— but not promised—that it will "likely" seek less than 5 years. And it’s conventional wisdom that maximum punishments may sometimes be a ploy to capture the public’s attention …. But as [the EFF has] explained before, the maximum punishment can impact calculations pursuant to the United States Sentencing Guidelines. For instance, many prosecutors and judges use the maximum punishment as an indicator of how serious the crime is. They also ratchet up pressure on defendants to plea bargain or 16 17 18 19 20 21 22 23 24 25 26 27 28 See, e.g., Kim Zetter “Hacker Lexicon: What is the Computer Fraud and Abuse Act?” Wired (Nov. 28, 2014), available at http://www.wired.com/2014/11/hacker-lexicon-computer-fraud-abuse-act/. 94 Amul Kalia “The Punishment Should Fit the Crime: Matthew Keys and the CFAA” Electronic Frontier Foundation (Dec. 16, 2015), available at https://www.eff.org/deeplinks/2015/12/punishment-should-fit-crime-matthew-keys-and-cfaa. 95 Id. 93 DEFENDANT’S SENTENCING MEMORANDUM Page 42 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 43 of 69 settle—after all someone facing 25 years is more likely to agree to serve five than someone facing a maximum of five year penalty.”96 1 2 Such is the case here. Matthew took not only a great risk, but a courageous stand in taking this 3 case to trial. It is everyone’s right to take a case to trial. It is a constitutional right to put the 4 Government to their burden of proof. Matthew should not suffer additional consequences for putting the 5 Government to task. If the Government believes this is a just law, that it is something they should stand 6 behind, and they should be proud to take the case to trial and defend the law as written. Moreover, it is 7 not logical to assume that one who takes a case to trial will, before an appeal is heard, will express an 8 acceptance of responsibility. If the case is remanded for a new trial, Matthew would be stuck with his 9 statements of remorse and contrition. He intends to appeal, and intends not to do anything to harm his 10 chances on appeal. 11 To be sure, the Government will likely argue that his failure to plead guilty evinces a lack of an 12 acceptance of responsibility. But in the face of an unjust, out of date law with punishments far 13 exceeding the nature of the crime, it is the duty of conscientious Americans to challenge the law. One 14 does so by taking the case to trial. This is hardly failing to accept responsibility; it is taking on a greater 15 responsibility. It is sacrificing ones’ self at the altar at liberty97 to draw attention to a manifest injustice. 16 THE CFAA seems to change with each appeal. Matthew’s case should be no different. Whether his 17 case helps him or not, it will help clarify a muddy, out of date law. 18 The CFAA was written in 1984, largely as a response to the movie “War Games.” It was written 19 when the internet was in its nascency. In 1984, one had to use a modem to dial up a particular computer 20 network to access their information. To gain information from, for example, Stanford University, you 21 had to seek out the University itself, dial it up like a telephone number, and access it, and only it. You 22 were, in essence, going to a stand-alone store to shop. 23 In 1991, http protocol was invented. At that time, one could simply type Stanford.edu into a 24 browser and – bingo – your computer was connected to Stanford University. HTTP protocol and 25 browsers made the internet more akin to shopping at a mall, one could roam from store to store freely 26 27 96 Id. See Andrew Auernheimer’s speech as he’s going to prison in “The Hacker Wars,” a documentary on hactivists: https://www.youtube.com/watch?v=ku9edEKvGuY Matthew declined to be interviewed for the movie. Though Auernheimer is seen by many as less than a great individual, the quote is apropos. 97 28 DEFENDANT’S SENTENCING MEMORANDUM Page 43 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 44 of 69 1 and conveniently. 1984 was a whole different world than March 2016, or even December 2010. Yet the 2 harsh online civilization of 1984 is still being revisited in 2016 via the CFAA. Despite the wild variance 3 in the types of crimes committed in 1984 and 2010, the elements of the crimes and the punishments 4 remain the same. Again and again, computer criminals are treated like thought criminals and are sent off 5 to the proverbial Room 101. 6 These inequitable penological results are a direct correlation to the fact that we are using horse 7 and buggy laws to handle a jet plane society. On that fact alone Matthew deserves a Booker variance. 8 9 10 ARGUMENT Mr. Keys requests custodial release for the following reasons: 11 1. The guidelines range calculations apply inappropriate conduct-based 12 enhancements, 13 2. Mr. Keys did not employ “sophisticated means” in these offenses, 14 3. Mr. Keys did not exercise managerial or supervisory authority over any 15 conspiracy, 16 4. The loss calculations in the PSR are contrary to sentencing law and policy, 17 5. Numerous factors under 18 U.S.C. § 3553(a) merit a downward departure 18 from the guidelines range, 6. The Defendant’s personal and professional history merit downward departures 19 20 from the guidelines range, 21 7. A sentence under the guidelines range would not satisfy the traditional goals 22 of a criminal sentence, and 23 8. A downward departure is necessary to prevent a disparity in sentences for 24 similar or more serious offenses. 25 I. BASELINE GUIDELINES SENTENCE LEVEL 26 When imposing a sentence, a court should start by calculating the applicable Sentencing 27 Guidelines range. Gall v. United States, 128 S. Ct. 586, 596 (2007). The base offense level for a 28 conspiracy (18 U.S.C. § 371) to damage a protected computer (18 U.S.C. § 1030(a)(5)(A)) is 6. DEFENDANT’S SENTENCING MEMORANDUM Page 44 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 45 of 69 1 U.S.S.G. § 2B1.1(a)(2); see also id. § 2X1.1(a) (base offense level for conspiracy identical to base 2 offense level for substantive offense). The loss, estimated in the PSR at $249,956 adds 10 levels. Id. 3 § 2B1.1(b)(1)(F). The Guidelines add 2 levels each for obtaining/disseminating personal information 4 and for use of special skills. Id. §§ 2B1.1(b)(16), 3B1.3. Mr. Keys alleged role in the conspiracy, a 5 supervisor or manager of a conspiracy involving five or more participants, adds 3 levels. USSG § 6 3B1.1(b). There is no victim related enhancements, obstruction of justice, or acceptance of responsibility 7 enhancements added to recommended sentence. (PSR at 8). The applicable offense level, therefore, 8 totals 29. (PSR at 3). The offense level of 27, absent any prior criminal history, is accompanied by 70-87 9 months of imprisonment, 1-3 years of supervised release, and 1-5 years of probation. The probation 10 office recommended penalties, however, that are on the lower end of the guidelines. The PSR only 11 recommends 70 months of imprisonment, 2 years of supervised release, and no probation. (PSR at 3). 12 13 A. SOPHISTICATED MEANS The PSR enhances Keys’ sentencing on the basis that he “intentionally engaged in or caused the 14 conduct constituting sophisticated means” under U.S.S.G. § 2B.1(b)(1). According to the PSR, the 15 “sophisticated means” consisted of only these uses: 1) “fake email addresses;” 2) use of a proxy service; 16 and 3) “enlist[ing] the services of highly skilled hackers.” However, none of these is a sophisticated 17 means within the meaning of the Sentencing Guidelines. In fact, the USSC amended the definition of 18 “sophisticated means” to “narrow” (its own words) its scope to avoid precisely this kind of application. 19 The PSR’s conclusion is wrong because: 1) the USSC declined to include proxy servers in its definition 20 of definition of “sophisticated means;” 2) the USSC narrowed the definition of sophisticated means to 21 cases where the defendant “intentionally engaged” in the sophisticated means, so as to enhance based on 22 the defendant’s own culpability rather than the device used; 3) proxy servers are commonplace and 23 widely used for predominantly legal and ethical purposes; and 4) the use of an alias in an email address 24 is also a common practice and does not make it a “fake email address.” 25 26 1. The USSC Decided Not to Include Use of Proxy Servers in its Definition of “Sophisticated Means” 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 45 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 46 of 69 1 To conclusively define Keys’ use of a proxy server for his personal use as a “sophisticated 2 means” is inconsistent with the USSC’s intent, as they previously considered adding proxy servers to the 3 definition, and declined to do so. 4 On March 17 and 18, 2009, the USSC held public hearings on proposed amendments to the 5 Sentencing Guidelines, including a proposal to include use of a proxy service in connection with the 6 charged offenses.98 Specifically, the proposed language would read: “In a scheme involving computers, 7 using any technology or software to conceal the identity or geographic location of the perpetrator 8 ordinarily indicates sophisticated means.”99 Thus, had that language been introduced, the burden would 9 have shifted away from the government merely because the defendant had used some kind of proxy 10 service. 11 The USSC heard numerous speakers on the issue, including representatives from the Department 12 of Justice, Identity Theft Resource Center, Federal Public and Commffakeunity Defenders, and the 13 Electronic Frontier Foundation.100 After considering the arguments, including those of its proponents, 14 the USSC declined to add use of proxy server to the definition. The definition of “sophisticated means” 15 has since been amended to narrow its scope (see below), but without this addition. 16 The reasons why the USSC decided not to include this addition are evident from the testimony 17 before the USSC. Most people who use proxy servers do so for legitimate and ethical purposes. Many 18 use them without knowing at all how they work, or even that they are using them at all. These services 19 are installed, often by others, and many forget that they are even using one. As the Federal Defender 20 testified, penalizing the use of a proxy “will absolutely sweep in conduct that is not especially complex 21 or especially intricate,” adding that the DOJ “would have us believe that any technology or software to 22 hide identity or location meets that test, and it is simply not true.”101 Even the DOJ, when pressed, 23 24 25 26 27 28 98 United States Sentencing Commission, Public Hearing, March 17 and 18, 2009, available at . 99 United States Sentencing Commission, Proposed 2009 amendment to Application Note for Sophisticated Means Enhancement under Subsection (b)(9), January 27, 2009, available at http://www.ussc.gov/sites/default/files/pdf/amendment-process/reader-friendlyamendments/20090127_RFP_Amendments.pdf. 100 Id. 101 United States Sentencing Commission, Public Hearing, pg. 36 DEFENDANT’S SENTENCING MEMORANDUM Page 46 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 47 of 69 1 acknowledged that use of proxies is not in of itself illegal, agreeing with the EFF that any use of a proxy 2 service must be analyzed on a “case-by-case” basis.102 3 But the PSR concludes, without explanation, that the use of the proxy service alone requires an 4 enhanced sentence, merely because the server itself was located in Switzerland. (PSR at 8). This is the 5 overbroad conclusion that the USSC was asked to avoid, because it “would create a wholesale 6 presumption in conflict with actual evidence” and “relieve the government of proving the purportedly 7 aggravating fact in any given case and shift the burden to the defendant to prove that the enhancement 8 should not be followed.”103 The conclusion ignores the fact that proxies are used for a wide variety of 9 activity, much of which is not criminal, and generally do require any kind of technical sophistication. 10 For instance, Matthew used a VPN proxy server in his capacity as an employee at Fox40, with 11 the knowledge and approval of Fox40’s IT Manager, to follow international news feeds which might 12 otherwise have been unavailable due to geographic blocking. Fox40 installed the software on 13 Matthew’s computer. Other employees used a VPN as well, because it is a valuable investigative and 14 journalistic tool. 15 There is no evidence that Keys employed any sophistication with his use of a VPN. The VPN is 16 merely a tool that had been installed on his computer, for investigative and privacy purposes. The 17 presumption that its general use categorically requires enhanced sentencing was rejected by the USSC. 18 Thus, the government’s reliance on the proxy server as a sentencing factor is unsupported. 2. Neither the PSR Nor the Government has Established that Keys “Intentionally Engaged” 19 20 in the Sophisticated Means, as Required by the U.S.S.G. 21 The USSC declined to amend the Sentencing Guidelines so broadly as to include proxy servers, 22 and in fact amended the definition of sophisticated means to narrow its scope. Under the amendment, 23 the guidelines clarify that the “defendant intentionally engaged in or caused the conduct constituting the 24 sophisticated means.” U.S.S.G. § 2B.1(b)(10)(C). The USSC stated the amendment was intended to 25 “narrow” the offense characteristic because “prior to the amendment . . . court had applied this 26 27 28 102 103 Id. at 50. Id. at 37. DEFENDANT’S SENTENCING MEMORANDUM Page 47 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 48 of 69 1 enhancement on the basis of the sophistication of the overall scheme without a determination of whether 2 the defendants’ own conduct was ‘sophisticated’.”104 Thus, the clarified enhancement “better reflects 3 the defendant’s culpability and will appropriately minimize application of this enhancement to less 4 culpable offenders.”105 5 6 Here, there is no evidence that Matthew intentionally engaged in use of a proxy server in order to conceal himself to the objects of the charged conspiracy. An assessment of Matthew’s intent is crucial here, because, as discussed above, he had been 7 8 using proxy servers long before the charged acts, when one was installed on his computer by an IT 9 Manager at Fox40. Moreover, his initial stated intent was to watch foreign news on his computer, a 10 valid and common purpose for a VPN. There is no showing, not even circumstantially, of his intent. 11 There has been no showing that he created the code for the proxy server, or that he installed it, or that 12 the means of installing it or using it were complex. 3. There was no Showing of Keys’ Specific Intent that he Engaged in or Caused the 13 14 Sophisticated Means 15 It is for this same reason that Matthew’s sentence cannot be enhanced based on his “enlist[ing] 16 the services of highly skilled hackers to carry out his ploy.” (PSR at 8). The precise intent element 17 added to the guidelines requires that the defendant himself must have engaged in or caused the 18 sophisticated means. The PSR makes no mention of what sophisticated means the “hackers” used as 19 part of the scheme, nor does it explain how any of that behavior would be attributable to Matthew. 20 Without showing this specific intent, others’ use of sophisticated means cannot form the basis of a 21 sophisticated means enhancement for him. 22 4. Use of Proxy Servers are Common and Ordinary 23 The use of a proxy server is not categorically a sophisticated means, because it is so common and 24 ordinary that an enhancement on this basis is unjustified.106 Moreover, VPN proxy servers are typically 25 used in the course of business, for legitimate and legal purposes. 26 27 28 104 United States Sentencing Commission, 2015 amendment to §2B1.1(b)(10)(C), April 30, 2015, pg. 29 available at . 105 Id. at 30. 106 All of Matthew’s lawyers uses VPN. DEFENDANT’S SENTENCING MEMORANDUM Page 48 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 49 of 69 A “proxy server” is merely a mechanism where one computer communicates with another, the 1 2 “proxy” and that proxy computer acts on behalf of the original user and sends the results to the user. It 3 has the effect of creating another layer of identification, or protection, for the original user, but does not 4 make detection impossible. Moreover, this layer of identity protection is not the only reason that these 5 services are used. For instance, many companies use VPNs for security and convenience, such as 6 allowing employees remote access to the company’s servers when they travel. Of course, these 7 employees are using laptops which may also be used for personal purposes. VPN programs often run 8 transparently, as a background process on the computer. Thus, many users of proxy servers are hardly 9 aware that they are using them. Employees at FOX40, the victim in the charged offenses, used the same 10 kind of proxy devices, which were installed by FOX40’s IT Manager for investigative and journalistic 11 uses. 12 A proxy server requires no technical sophistication on the part of the user, no more than for any 13 of the technologies we all use on a regular basis. We all use sophisticated technology. The computers 14 we use are sophisticated, and so are our smartphones. The cars we used to get here are sophisticated, as 15 are the many computerized features in the car. There are sophisticated security features enabled on each 16 of these devices, to prevent theft, identify fraud, and other abuses of our privacy. We even use 17 sophisticated technology to keep our homes safe, and while this technology is becoming increasingly 18 more advanced, is also becoming more commonplace and easy to use. To argue that each of these uses 19 is a “sophisticated means” would mean that ordinary everyday behavior, otherwise protected and even 20 encouraged, is appropriate to enhance a criminal sentence. 21 The “sophisticated means” enhancement could not possibly have been intended to encompass 22 such commonplace use of a device that requires no sophistication on the users’ part. The amendments to 23 the Sentencing Guidelines reflect that this enhancement was meant to be narrow, so as to exclude from 24 its scope this type simple behavior that is not ordinarily discouraged. Thus, it is an error to enhance 25 Keys’s sentence based on his use of a proxy server. 26 27 28 5. Fake Email Addresses Lastly, the PSR reflects that Keys’s use of “fake email addresses” as a factor in determining that he used sophisticated means in connection with the charged offense. If, by “fake email address,” the DEFENDANT’S SENTENCING MEMORANDUM Page 49 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 50 of 69 1 PSR means the use of aliases like “cancerman4099” and “foxmulder4099” in his email addresses, there 2 is nothing “fake” or sophisticated about using a clever alias for an email address. For instance, in the 3 email list of FOX40 viewers introduced as Government Exhibit 108, the email addresses include 4 thevulture209@yahoo.com and jumpy_frogs_17@yahoo.com. This type of alias is common in email 5 addresses, especially on publicly available email services such as Yahoo! mail or Gmail. There has been 6 no evidence to show that there is anything out of the ordinary, let alone sophisticated or “fake”, in using 7 these kinds of email addresses. Even council uses fake email addresses to send spam messages to such 8 that they do not clog up his inbox. 9 10 B. THERE IS NO BASIS FOR AN ENHANCEMENT FOR AN “AGGRAVATING ROLE,” 11 BECAUSE THE ACTIVITY DID NOT INVOLVE FIVE OR MORE PARTICIPANTS 12 AND KEYS DID NOT EXERCISE MANAGERIAL OR SUPERVISORY CONTROL 13 The PSR recommends a three level enhancement on the basis that Keys “was a manager or 14 supervisor of criminal activity involving five or more participants” under § 3B1.1(b). Its justification is 15 that the “defendant obtained access into a chat room and communicated with at least five 16 members/associates of Anonymous, whom he encouraged to deface the Los Angeles Times website.” 17 (PSR at 8). This enhancement is improper because it includes numerous people who bear no criminal 18 responsibility for the charged offenses, played no role in the conspiracy, and were not members of any 19 conspiracy. This inclusion contradicts the Sentencing Guidelines. Moreover, Keys’s activity does not 20 rise to the level of management or supervision. 21 1. The Charged Activity Did Not Involve Five or More Participants Under the Sentencing 22 Guidelines, Because Mere Presence in a Chatroom Cannot Make Someone Bear 23 Criminal Responsibility 24 To qualify as a “participant” for the purposes of this enhancement factor, it is not sufficient to 25 have been in a chatroom where the “criminal activity” was discussed. The Commentary to the 26 Sentencing Guidelines states that a “‘participant’ is a person who is criminally responsible for the 27 commission of the offense…”, adding that “[a] person who is not criminally responsible for the 28 offense…is not a participant.” §3B1.1, Commentary, Application Note 1. DEFENDANT’S SENTENCING MEMORANDUM Page 50 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 51 of 69 1 Thus, the USSC has emphasized that participants are limited to those who are criminally 2 responsible for the commission of the offense. See, e.g. United States v. Anderson, 942 F.2d 606, 3 616 (9th Cir. 1991) (“Based on this construction of the guideline, we have to conclude that the district 4 court incorrectly applied § 3B1.1(c) so as to adjust Anderson's offense level upward by two points on 5 the assumption that the person with respect to whom he was a leader, organizer, supervisor or manager 6 need not have been criminally responsible for the commission of the offense”); United States v. Ware, 7 577 F.3d 442, 453, 2009 BL 176479, 11 (2d Cir. 2009) (“the record does not indicate that they could be 8 considered "participants" within the above Guidelines definition of that term, for we see no indication in 9 the record that they would be criminally liable”). To be a participant, a party must not only have been 10 aware of the objective, but must have knowingly offered their assistance. 107 However, the only person who contributed anything to the charged offenses was “sharpie,” the 11 12 chatroom participant who accessed the system to “deface” the LA Times website, and who has 13 otherwise not been identified, and “sabu,” who subsequently became a government informant. There 14 were other usernames in the chatroom, but none of them had any active participation in accessing the 15 Fox40’s Content Management System. Some of them did no more than make a glib comment, or 16 express words of approval. There is little communication between AESCracked, the username 17 attributed to Matthew Keys, and most of the other persons in the chatroom. None of the usernames in 18 the chatroom have been identified, and there is no way of even knowing if they are separate individuals. 19 It is insufficient that they appear to have cheered on the activity, because in order to be a participant one 20 must have actively participated. In order to find that “AESCracked” was the manager or supervisor of five or more participants, 21 22 the PSR must determine that each of these usernames bore criminal responsibility for the charged 23 offenses. This would be online equivalent of finding that each of ten persons in a room was responsible 24 for crimes that only two or three of them discussed and planned, merely because they were in listening 25 distance and they were presumed to be sympathetic to the true participants. See United States v. Mann, 26 161 F.3d 840, 867 (5th Cir. 1998) (“A finding that other persons ‘knew what was going on’ is not a 27 28 107 See United States Sentencing Commission, Aggravating and Mitigating Role Adjusting Printer, available at http://www.ussc.gov/sites/default/files/pdf/training/primers/Primer_Role_Adjustment.pdf DEFENDANT’S SENTENCING MEMORANDUM Page 51 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 52 of 69 1 finding that these persons were criminally responsible for commission of an offense.”). But at least in a 2 physical world example, each person can be identified and their actual activities assessed. In a virtual 3 chatroom, the “presence” itself cannot be counted as participation. In fact, it is not even known for sure 4 how many usernames represent unique individuals. The enhancement factor could not possibly have 5 been meant to sweep this broadly. 6 2. Keys Did Not Supervise or Manage Participants in Criminal Activity 7 Moreover, there is no evidence that Matthew “supervised” or “managed” any individuals. See, 8 e.g. United States v. Woods, 335 F.3d 993 (9th Cir. 2003) (finding that enhancer did not apply because 9 defendant did not manage or supervise participants). In order for this enhancement factor to apply, the 10 court must identify a participant over whom defendant exercised managerial or organizational control. 11 See United States v. Helmy, 951 F.2d 988, 997 (9th Cir. 1991) (“Consistent with the purposes of Part B, 12 we hold that in order for a defendant to receive an adjustment under § 3B1.1(b) for his role as a manager 13 or supervisor, the defendant must have managed or supervised at least one other participant--that is, a 14 person who was criminally responsible for the commission of the offense”). The adjustment does not 15 apply to a defendant who “merely suggests committing the offense.” USSG §3B1.1, Commentary, 16 Application Note 4. 17 As discussed above, most of the so-called “participants” in the offense were merely usernames in 18 a chatroom that did little more than comment on the ongoing discussion. AESCracked did not have any 19 managerial control over them, and neither did Matthew. He did not know who they were, and did not 20 interact directly with most of them. The only people with whom he discussed the activities were 21 “sharpie” and, to a lesser extent, “sabu” and “kayla.” Only one of those individuals, based on the 22 evidence, actually entered into the Content Management System. Matthew did not manage or control 23 “sharpie” when the CMS was entered. 24 3. The Activity was Not “Otherwise Extensive” 25 Although the PSR does not mention it, the Government may argue that, although there were 26 fewer than five participants, the managerial control was “otherwise extensive” under § 3B1.1(b). 27 However, this subcategory generally requires that there are multiple participants and that there is 28 managerial and supervisorial control. As discussed above, neither of these is true. Most of the Courts of DEFENDANT’S SENTENCING MEMORANDUM Page 52 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 53 of 69 1 Appeals follow the test expressed by the Second Circuit in United States v. Carrozzella, 105 F.3d 796 2 (2d Cir. 1997), which held that “otherwise extensive” requires, at a minimum, “a showing that an 3 activity is the functional equivalent of an activity involving five or more participants.” There is no 4 functional equivalent to such an activity, where only one participant in the chatroom actively 5 participated in the activity encouraged by AESCracked, the rest of the persons were merely commenting 6 about it in a chatroom. 7 Thus, there is no basis for the three-point enhancement under § 3B1.1(b). 8 9 C. THE PSR LOSS CALCULATION IS CONTRARY TO SENTENCING LAW AND 10 POLICY AND SHOULD BE REDUCED 11 The loss enhancements under USSG §2B1.1 were initially designed to address traditional theft, 12 fraud, and embezzlement offenses. These offenses traditionally result not just in a loss for the victim, 13 but also a gain for the perpetrator. While certain offenses under the CFAA may involve an analogous 14 transfer of funds, or an intentional destruction of valuable property, the statute's broad nature covers 15 many offenses which do not. See 18 U.S.C. § 1030. Here, the offenses charged are far more similar to 16 vandalism or trespassing than theft or fraud, and are not warranted as a matter of policy. They will also 17 have an extremely disproportionate effect on the sentencing range. With what is essentially “digital 18 vandalism,” it is arguable no loss was intended, and certainly a loss in the amount claimed here was 19 neither intended nor reasonably foreseeable. It is also incredibly difficult to establish, and has not been 20 established here, whether the alleged loss included only the reasonable costs to a victim. Applying these 21 enhancement levels for speculative, unintended, and unforeseeable costs and losses creates a perverse 22 sentencing structure that unduly punishes otherwise de minimis CFAA offenses. 23 1. The Loss Calculations Fail to Meet Any Appropriate Burden of Proof 24 At trial, prosecution witnesses claimed the offenses caused over $900,000 in loss to the victim 25 companies. For sentencing purposes, the 9th Circuit generally accepts a preponderance of the evidence 26 standard as the burden at sentencing, however “a heightened burden may sometimes be required … to 27 satisfy due process concerns.” … where a sentencing factor would have an extremely disproportionate 28 effect on the sentence.” United States v. Staten, 466 F.3d 708, 717 (9th Cir. 2006); See United States v. DEFENDANT’S SENTENCING MEMORANDUM Page 53 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 54 of 69 1 Kilby, 443 F.3d 1135, 1140 n. 1 (9th Cir.2006). For factors which have an extremely disproportionate 2 effect on sentencing, the 9th Circuit applies a clear and convincing evidence standard. United States v. 3 Staten, 466 F.3d 708, 717 (9th Cir. 2006).108 Where a sentencing enhancement creates a greater-than- 4 four-level increase and more than doubles the potential sentence, that enhancement likely has a 5 disproportionate effect on sentencing. See United States v. Staten, 466 F.3d 708, 717-18 (9th Cir. 2006) 6 (finding disproportionate effect for a greater-than-four level enhancement that more than doubled the 7 sentence); see also United States v. Dare, 425 F.3d 634, 642 (9th Cir. 2005) (laying out a 7-factor 8 totality of the circumstances test for disproportionate effect). Here, the clear and convincing evidence 9 standard is appropriate, as the loss enhancement has just such a disproportionate effect. It represents a 10 10-level increase and nearly triples the recommended sentence, moving the guidelines range from level 11 19 (30-37 months) to 29 (87-108 months). (See PSR, p. 9, ¶ 24.) The evidence offered to support these 12 loss claims fails to meet either standard. 13 The prosecution’s evidence to support their loss claim fails to satisfy either standard. It includes 14 no billing records or other business records beyond an unattributed, undated spreadsheet and a handful 15 of emails. There is no way to tell whether these time entries were directly related to the response, or 16 how much of a given entry was directly related. The jury was never asked to endorse any specific 17 amount beyond the $5,000 minimum for a felony conviction, so the verdict does not endorse any 18 specific number for loss. The claimed losses are simply not established by the evidence, and certainly 19 fail to establish a loss amount by clear and convincing evidence. 20 2. Unrelated Costs Should be Excluded from the Loss Calculation 21 Additionally, under USSG §2B1.1, the loss amount must be reasonable, and should exclude, for 22 example, frivolous or unnecessary costs or those not reasonably necessary for incident response or 23 investigation. The Court should look to the fair market value of any “property unlawfully taken … or 24 destroyed” or, for proprietary information, the “cost of developing that information or the reduction in 25 value … that resulted from the offense.” See U.S.S.G. § 2B 1.1 cmt. n.3 (C)(i), (ii); United States v. 26 27 108 28 Although United States v. Jenkins suggests this standard is not applied for conspiracy offenses, that case did not feature a loss calculation which had an extremely disproportionate effect on sentencing, and is thus distinguishable from Mr. Keys’s matter. See 633 F.3d 788, 808 (9th Cir. 2011) DEFENDANT’S SENTENCING MEMORANDUM Page 54 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 55 of 69 1 Nosal, No. CR-08-0237 EMC, 2014 WL 121519, at *3 (N.D. Cal. Jan. 13, 2014). Additionally, for 2 CFAA related loss, the Court should consider “only those costs that were ‘reasonably necessary,’ and 3 only those costs that would ‘resecure’ the computer to avoid ‘further damage.’” United States v. 4 Middleton, 231 F.3d 1207, 1213 (9th Cir. 2000). Where the prosecution has not established that certain 5 costs meet one or the other of these criteria, those costs should be excluded from the loss calculation. 6 The PSR rightly disregards the companies' most nebulous loss claims, such as a decline in 7 morning television news ratings and a vague “database loss in iPad contest.” (See PSR, p. 7, ¶ 15.) 8 However, it incorrectly includes several loss claims that either fail to meet the appropriate burden of 9 proof or are beyond the scope of loss under USSG §2B1.1. 10 The PSR incorrectly includes the costs associated with “rebuild[ing] the database.” Id. Nowhere 11 does it say which database. The undated spreadsheet does not specify this either. In fact, nowhere else 12 in the record seems to clarify what database this cost may refer to. Nowhere does the record establish 13 that any database was “deleted” or needed to be rebuilt. The record contains few mentions of databases 14 at all, and none are alleged as deleted or lost. One database mentioned at trial was the Green Links 15 email address database, and Brendan Mercer admits he was unaware of any deletion of that database or 16 any of its entries. (TR, p. 149; p. 177.) Another witness, Mr. Comings of Tribune Publishing Co., later 17 described the CMS as sharing “a common database.” (TR, p. 248). At one point, a witness describes the 18 email list database being “compromised” but in context it is clear they mean the database's information 19 was accessed, not that the database or any information within was deleted. (TR, p. 707). At most, the 20 record supports that the CMS database, “Green Links” email address database, or both may have been 21 accessed, but nowhere does the record suggest any database was deleted. 22 The Final PSR Response letter itself notes that the “$200,000 figure to 'locate vendor and rebuild 23 new database.'” is uncorroborated by any documents from the victim. These documents have not been 24 provided, nor does the record reflect any database deletion. (See U.S. Probation Office Response to 25 Objections, Dec. 30, 2015 (ECF # 127-3), at p. 2.) Where there is no proof of deletion, and no deletion 26 is described in the record, it would be improper to include this figure in Matthew loss or restitution 27 amounts. 28 DEFENDANT’S SENTENCING MEMORANDUM Page 55 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 56 of 69 1 The PSR also mistakenly includes the time-value of “telephone calls, meetings, and emails,” 2 which are not contemplated by USSG §2B1.1. These are outside the realm of “reasonable costs to any 3 victim” under the guideline section for 18 USC § 1030 offenses, which includes costs directly related to 4 incident response, but not peripheral or administrative activities. See USSG §2B1.1, Application Note 5 6 7 8 9 10 3(A)(v)(III). Including these peripheral activities in the loss calculation would encourage unscrupulous victims to increase their restitution through unrelated or unnecessary meetings and correspondence. Sentencing policy and the balance of justice weigh against applying these enhancements in a minor CFAA offense such as this. However, if the enhancements for loss are to be strictly applied according to the guidelines, they should be similarly limited by those guidelines and the relevant burden 11 12 of proof. These loss entries, for an unspecified and unsupported database “deletion” and for 13 administrative tasks at most peripheral to incident response, should not be included in the final loss 14 number. To include them would be unjust, unsupported by the evidence, and against both the spirit and 15 letter of the Sentencing Guidelines. 16 With these items excluded, assuming the other loss items can be established by clear and 17 18 convincing evidence, the correct loss amount would be at most $19,591.00, resulting in a 4-point 19 enhancement. See USSG §2B1.1(b)(1). This number best reflects a strict adherence to the Sentencing 20 Guidelines, exclusive of unsupported or out-of-scope loss claims. 21 22 23 24 II. THE STATUTORY SENTENCING FACTORS IN 18 U.S.C. § 3553(a) REQUIRE A SENTENCE BELOW THE GUIDELINES RANGE. The Sentencing Guidelines are not mandatory. It is always within the discretion of the court to 25 avoid injustice which would result from their rigid application. In fact, it constitutes reversible error for 26 27 28 a court to treat the guidelines as mandatory and fail to acknowledge any mitigating factors. “[i]t would be procedural error for a district court to fail to calculate — or to calculate incorrectly — the Guidelines range; to treat the Guidelines as LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 DEFENDANT’S SENTENCING MEMORANDUM Ventura, California 93003 Page 56 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 57 of 69 1 2 mandatory instead of advisory; to fail to consider the § 3553(a) factors; to choose a sentence based on clearly erroneous facts; or to fail adequately to explain the sentence selected, including any deviation from the Guidelines range. United States v. Autery, 555 F.3d 864, 869-870, (9th Cir. 2009).” 3 4 Under § 3553, a court considers the following factors: 5 1. the nature and circumstances of the offense and the history and characteristics of the defendant 6 2. the need for the sentence imposed to: (A) reflect the seriousness of the offense, to promote 7 respect for the law, and to provide just punishment for the offense; (B) to afford adequate 8 9 deterrence to criminal conduct; (C) to protect the public from further crimes of the defendant; 10 (D) and to provide the defendant with needed educational or vocational training, medical care, or 11 other correctional treatment in the most effective manner; 12 13 3. the kinds of sentences available; 4. the kinds of sentence and the sentencing range established for…the applicable category of 14 15 offense committed by the applicable category of defendant as set forth in the guidelines; 16 5. any pertinent policy statement issued by the Sentencing Commission 17 6. the need to avoid unwarranted sentence disparities among defendants with similar records who 18 19 have been found guilty of similar conduct; and 7. the need to provide restitution to any victims of the offense. 20 21 A. THE NATURE AND CIRCUMSTANCES OF THE OFFENSE AND THE HISTORY 22 AND CHARACTERISTICS OF THE DEFENDANT. 23 Under 18 U.S.C. § 3553(a)(1), the court is required to consider “the nature and circumstances 24 25 of the offense and the history and characteristics of the defendant.” 1. THE OFFENSE. 26 As discussed above, the offense at issue here involves the changing of a few words in a Los 27 Angeles Times website article that was easily restored within 40 minutes. The only reason it took 3 28 DEFENDANT’S SENTENCING MEMORANDUM Page 57 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 58 of 69 1 minutes to restore, and not 15 seconds, is because the editor on duty decided to re-write the headline 2 several times. 3 4 2. THE DEFENDANT. Matthew’s background as a journalist is discussed above in the facts section. Matthew is not a 5 “hacker.” He is not a member of Anonymous, and never has been. The story told by the Government at 6 trial is one of someone who used his journalistic skills to infiltrate into a closely knit group of 7 newsworthy persons, communicate with a couple of members, and develop a story. The Government’s 8 story is of someone who, at beat, unfortunately, got carried away with his work. See, e.g. United States 9 v. Autery, 555 F.3d 864, 875 (9th Cir. 2009) (affirming District Court’s departure from the sentencing 10 guidelines in child pornography case because defendant “did not fit the profile of a pedophile” and thus 11 did not pose a great threat to society as others who the court had sentenced under the crime). If Matthew 12 is given probation, he will only do what he has been doing for more than a decade, before and after his 13 prosecution – engage in journalism. See, e.g. United States v. Johnson, 391 Fed. Appx. 659, 660 (9th 14 2010) (affirming District Court’s departure from the Guidelines where defendant’s “post-arrest conduct 15 had been ‘very impressive,’ ‘unique,’ and ‘extraordinary’” and co-defendants continued to engage in 16 criminal activity). 17 B. 18 U.S.C. § 3553(a) Factors 18 Witnesses testified at trial that the change to the Los Angeles Times headline was viewable to the 19 public for a total of approximately 40 minutes. The body of the article was not edited. Additionally, 20 witnesses testified that because of the lapse of security in the Content Management System, they 21 conducted many hours of work in order to fix a system, mostly implementing security measures that 22 should have been in place in the first instance but were not. They also testified that they received the 23 email from a colleague at Fox40 to record all their time so that they can hand to the federal authorities, 24 because they needed to bulk up their “loss” numbers in order to prosecute Matthew. Altogether, the 25 defense agrees with the government that “this not the crime of the century.” 26 Moreover, there is no deterrent purpose in Matthew’s imprisonment that is proportionate to the 27 harm caused to Fox40 or that justifies the damage that a lengthy prison sentence will do to Matthew. His 28 journalism career, to which he has dedicated his whole life, has been undermined. He lost his job at DEFENDANT’S SENTENCING MEMORANDUM Page 58 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 59 of 69 1 Reuters. The Department of Justice, along with his former colleagues who testified against him, have 2 branded him as nothing more than a criminal. 3 In any circumstance similar to Matthew’s, a former employee suspected of causing harm to a 4 company, the imposition of draconian prison sentences will not further the purposes of criminal justice. 5 The vast majority of companies under similar circumstances may, at most, seek civil damages against 6 the former employee for their perceived losses. Most people involved in these kinds of disputes do not 7 want their former employees to go to jail, even if they are angered by the employee’s actions. The 8 knowledge that a criminal investigation can lead to prison sentences greater than five years will deter 9 many people, including employers, from coming forward to the authorities – that is, all but the ones with 10 the most personal of axes to grind. Thus, the supposed deterrent effect of a lengthy prison sentence 11 results in the unintended consequence of fewer prosecutions for harmful activity. 12 Matthew has no criminal record, and has never engaged in the activity he was convicted for 13 either before or after the events in question. He wants nothing more than to continue being a journalist. 14 A sentence of probation, with a strict warning from the court on the consequences of any criminal 15 activity, will be sufficient to deter him. See Autery, 555 F.3d at 876 (“It is said that there is nothing like 16 being sentenced to hang in the morning to focus a man's thoughts, and it is improbable that the district 17 court's stern warning will be an ineffective deterrent in this case”). 18 Specific deterrence is neither appropriate nor necessary in this case. Nor is general deterrence 19 appropriate in that we have extensively traced the history of Anonymous prosecutions above and shown 20 that the aims of general deterrence have already been served, and they have been served effectively. 21 Those that did not receive prison time have fared as well as those who did. General deterrence has 22 undisputedly not only been served by those punished before him, but those prosecutions have been so 23 widely publicized in news articles, books, and documentaries that if general deterrence was not effective 24 in those prosecutions it will not be effective at all. Matthew’s conviction comes out of a time and public 25 perception that caused a group mentality which not only allowed such actions, but even cheered them 26 on. Those days have passed. With the March 6, 2012 revelation that Monsegur was a government 27 informant, the reckless and unabated hacking of the Anonymous “hacktivist” era ended. General 28 deterrence has been served by other, more serious, cases that have come before Matthew’s. DEFENDANT’S SENTENCING MEMORANDUM Page 59 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 60 of 69 1 The events at issue here occurred in the winter of 2010. It is now 2016. He is at no risk of 2 reoffending. Matthew was in the Internet Feds chatroom as a journalist. It was important for him to 3 participate in chats as an embedded journalist to gain the trust of the subjects he was writing about. 4 Indeed, his information was used widely and led to a greater understanding of a mysterious and shadowy 5 hacker collective. With the exception of the conviction here, Matthew has no criminal history. 6 The public needs no protection from Matthew. Rather, he has sought to benefit the public by 7 exposing truth through his journalism. He has shown over the last 5and 1/2 years that the need for 8 rehabilitation is not present in this case. 9 10 Borrowing from United States v. Bergman, 416 F.Supp. 496, 498-99 (S.D.N.Y. 1976), which some say is the quintessential judicial sentencing memorandum, defendant offers the following: “The court agrees that this defendant should not be sent to prison for ‘rehabilitation.’ Apart from the patent inappositeness of the concept to this individual, this court shares the growing understanding that no one should ever be sent to prison for rehabilitation. [See 28 U.S.C. § 994(k).] That is to say, nobody who would not otherwise be locked up should suffer that fate on the incongruous premise that it will be good for him or her. Imprisonment is punishment. Facing the simple reality should help us to be civilized. It is less agreeable to confine someone when we deem it an affliction rather than a benefaction. If someone must be imprisoned for other, valid reasons we should seek to make rehabilitative resources available to him or her. But the goal of rehabilitation cannot fairly serve in itself as grounds for the sentence to confinement. 11 12 13 14 15 16 Equally clearly, this defendant should not be confined to incapacitate him. He is not dangerous. It is most improbable that he will commit similar, or any, offenses in the future. There is no need for ‘specific deterrence.’” 17 18 19 Matthew understands that if he is to be imprisoned in this case it will be to serve the ends of 20 “general deterrence,” which is to say that it will exemplify that this is a wrong that one cannot commit 21 without suffering sanction of a penal nature in addition to the other sanctions that naturally and 22 judicially flow from the sort of act that defendant has been convicted of committing. 109 Even so, it is of 23 great consequence that Matthew is now a felon. None of the top news organizations will now touch 24 25 26 27 28 109 Subections 3553(a)(2)(A) and (B) track this line of thought. Whatever the court decides in terms of punishment, it will not alter the fact that Mr. Keys is a felon, and will suffer the consequences thereof over the rest of his life. This act, committed at 23 years old, will likely ruin his prospects of doing the important work at the pinnacle of his profession that he dreamed of doing. DEFENDANT’S SENTENCING MEMORANDUM Page 60 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 61 of 69 1 him. He had already been employed by Reuters, the largest news organization in the world. Now he is 2 relegated to self-published freelance journalism and companies willing to take risks. 3 4 Once again, defendant borrows from United States v. Bergman, supra, 416 F.Supp. at 498-99, to offer the following: 5 In cases like this one, the decision of greatest moment is whether to imprison or not. As reflected in the eloquent submissions for defendant, the prospect of the closing prison doors is the most appalling concern; the feeling is that the length of the sojourn is a lesser question once that threshold is passed. Nevertheless, the setting of a term remains to be accomplished. And in some respects it is a subject even more perplexing, unregulated, and unprincipled. 6 7 8 9 Days and months and years are countable with a sound of exactitude. But there can be no exactitude in the deliberations from which a number emerges. Without pretending to a nonexistent precision, the court notes at least the major factors. 10 11 The criminal behavior, as has been noted, is blatant in character and unmitigated by any suggestion of necessitous circumstance or other pressures difficult to resist. However metaphysicians may conjure with issues about free will, it is a fundamental premise of our efforts to do criminal justice that competent people, possessed of their faculties, make choices and are accountable for them. 12 13 14 15 Matthew must reluctantly agree with the above statements and acquiesce that it would be unjust 16 to not hold him accountable in any respect. As the Government told the press, he will at least receive 17 probation. Notwithstanding the fact that he may disagree with the jury verdict, he respects the justice 18 system and accepts their judgment. He was found guilty at a jury trial. Accordingly, he stands before 19 the court a guilty man. Even so, the events here do not merit a sentence that includes actual 20 imprisonment. There are situations wherein the age, background, and specific criminality of a defendant 21 would militate towards a simple probationary sentence with conditions. This is just such a case.110 22 Matthew was significantly less culpable than any other participant in the criminality of Anonymous 23 during the entire “Hacktivist Era” of the collective, defined as September 21, 2010 to March 6, 2012. 24 Indeed, Matthew does not identify as a member of Anonymous, he identifies as a journalist who studied 25 Anonymous for less than a month in the Internet Feds chatroom. But when compared with each and 26 every other conviction, his actions were de minimus compared with any even remotely similar case. 27 28 110 See the Koon brief filed under seal concurrent herewith DEFENDANT’S SENTENCING MEMORANDUM Page 61 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 62 of 69 1 Matthew background, other good acts and prospects call out for him to not be removed from 2 society for any period of time, but rather to be placed on probation; or at most on house arrest for a 3 period of time. 4 For reasons discussed above, there is no reason to seek out the aims of general deterrence in this 5 case, as this time in hacking and computer misuse history has passed. Even so, it bears mentioning that 6 yielding to a prosecutor’s call to “send a message,” if any such call is to be made, with this sentence is 7 also improper. See, e.g., Sinisterra v. United States, 600 F.3d 900, 910-11 (8th Cir. 2010). A sentencing 8 is an individual determination, based on the facts of the crime and the life and background of the 9 offender. It is contrary to these purposes to ask the court to “make an example” of the defendant for the 10 purposes of deterring other people. Christopher Weatherhead’s case in the UK is such an example. His 11 presentence report recommended 3 months111 after his trial, but the Judge determined he would send a 12 message and sentenced him to 18 months. If a message needed to be sent, it was already received loud 13 and clear in Weatherhead’s case. 14 The need to protect the public from Matthew going forward is nonexistent. Accordingly, a 15 prison sentence would not achieve the aim of protecting the public from Matthew, and may even create a 16 risk where there was none before, prison being the sort of place that turns non-criminals into criminals 17 due to the association of people that don’t belong there with those that do. This is admittedly unlikely 18 here, since Matthew has matured and learned from these court proceedings. His interview with the 19 Syrian Electronic Army is a good example of how he has learned to keep an arm’s length between 20 himself and his subjects. 21 Looking at the totality of circumstances present before the court, a probationary sentence is the 22 most appropriate sentence here. Among other reasons, probation will allow the defendant to work and 23 be employed at a productive job, affording the best opportunity for at least some restitution to be swiftly 24 paid. Restitution in this case may be sizeable. Rest assured, restitution will be shouldered by Matthew 25 and it will be a debilitating factor for years, if not a lifetime. The PSR lists his monthly income at 26 approximately $1,700.00 before bills. 27 28 111 Weatherhead was unable to find his copy of the probation report from his case. His memory of the recommendation is crystal clear, 3 months was the recommendation. DEFENDANT’S SENTENCING MEMORANDUM Page 62 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 63 of 69 1 As stated in Bergman, the sentence should be calculated “with a sound of exactitude” such that 2 the sentence is no more than is absolutely necessary to send a general deterrent effect to the community, 3 if the court believes one is necessary. Every day counts, as every defendant counts every day they are 4 incarcerated. Looking at all of the relevant factors, zero days in prison should be the sentence affixed in 5 this case. Of course, Matthew could still be subject to house arrest or similar community-based 6 conditions, and would agree that such a punishment would not necessarily be unreasonable in this case. 7 8 C. THE KINDS OF SENTENCES AVAILABLE 9 As the PSR recognizes, the court has many sentencing options. It may within its statutory power 10 impose “(1) straight probation; (2) straight imprisonment; (3) a probationary sentence that includes 11 community confinement or home detention as a condition; or (4) a sentence of imprisonment followed 12 by a term of supervised release that includes community confinement or home detention as a condition.” 13 (PSR ¶ 95.) In no event may Defendant’s sentence exceed five years. 18 U.S.C. §§ 371. 14 Admittedly, the Guidelines prohibit a straight probation sentence except where the Guideline 15 range lands in Zone A or Zone B of the sentencing table. U.S.S.G. § 5B1.1(a). Because of the 16 enormous financial loss suffered by Sony Pictures, Defendant’s offense level is in Zone D. Thus, the 17 Guidelines do not authorize a probationary sentence. Of course, the Guidelines are advisory, not 18 mandatory. Booker, 543 U.S. 220. 19 Under the statutory provisions—which are mandatory—the court may impose straight probation 20 for a Zone D offense. The only offenses categorically ineligible for a probationary sentence are Class A 21 Felonies, Class B Felonies, and offenses which expressly preclude it. 18 U.S.C. § 3561(a). Conspiracy 22 is a Class D Felony and thus is statutorily eligible for probation. See 18 U.S.C. § 3559(a)(4). Moreover, 23 in the statutory section defining the duties of the Sentencing Commission, Congress explicitly stated its 24 preference for probationary sentences in cases such as this: 25 26 27 28 The Commission shall insure that the guidelines reflect the general appropriateness of imposing a sentence other than imprisonment in cases in which the defendant is a first offender who has not been convicted of a crime of violence or an otherwise serious offense, and the general appropriateness of imposing a term of imprisonment on a person convicted of a crime of violence that results in serious bodily injury. 28 U.S.C. § 994(j). DEFENDANT’S SENTENCING MEMORANDUM Page 63 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 64 of 69 1 The court has at its disposal a wide range of sentencing options, including straight probation. 2 Despite the Guidelines’ advice to the contrary, Congress’ explicit preference for probationary sentences 3 for nonviolent, first-time offenders should guide the court in making its choice here. 4 6 D. THE NEED TO AVOID UNWANTED SENTENCING DISPARITIES AMONG DEFENDANTS WITH SIMILAR RECORDS WHO HAVE BEEN FOUND GUILTY OF SIMILAR CONDUCT 7 The Supreme Court has emphasized that "extraordinary circumstances" are not a prerequisite to 8 upholding a sentence outside the Guidelines. Gall v. United States, 128 S.Ct. 586, 594 (2007). Indeed, 9 sentences outside the Guidelines are subject to the same abuse of discretion standard as those within the 10 Guidelines. Id. at 596 (noting that "abuse-of-discretion standard of review applies to appellate review of 11 all sentencing decisions — whether inside or outside the Guidelines range"). And where the sentence 12 under review is outside the Guidelines, we may not presume the sentence is unreasonable. Id. at 597. 5 13 Under § 3553(a)(6), the court must also consider sentences given to defendants with similar 14 records who engaged in similar conduct. As discussed above, the sentences meted out to LulzSec, and 15 other Anonymous hackers, for much worse conduct were significantly lighter than what the PSR 16 recommends. 17 The obvious starting point is to consider the sentences imposed on Internet Feds / LulzSec / 18 Anonymous persons who engaged in similar type conduct – or much worse conduct – but received more 19 reasonable sentences than the one proposed in the PSR – or even the one proposed by the Government. 20 21 22 Defendant deserves a much lighter sentence than the ones imposed on each and every member of Anonymous during the so-called hacktivist period of September 21, 2010 to March 6, 2012. “[A]s a further deterrent, the district court threatened that if Autery violated any of the conditions 23 of his probation, he would "be back before me and receive the maximum penalty allowed by law. It is 24 said that there is nothing like being sentenced to hang in the morning to focus a man's thoughts, and it is 25 improbable that the district court's stern warning will be an ineffective deterrent in this case.” United 26 States v. Autery, 555 F.3d 864, 876 (9th Cir. 2009) 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 64 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 65 of 69 1 Though Autery was convicted of a computer crime, it a crime that was manifestly different than 2 this one in terms of the conduct, but the offender shares some positive personal characteristics that bear 3 upon this case. As the judge described in that case: 4 The court began its analysis of the appropriate sentence by noting that Autery's was "a 5 very difficult case" because there was "no evidence that [Autery] was purchasing evident 6 child pornography involving real children"[Fn. 2: The court may have been referring to 7 the images that Autery received in the government sting operation, images which the 8 government stated were not of real children. Count 3 of the indictment, to which Autery 9 pled guilty, alleges that Autery possessed "visual depictions of actual minors."] (although 10 the court stated that Autery believed they were real children). The court also noted that 11 there was no evidence of Autery's ever abusing family members and that he did not "fit 12 the profile of a pedophile."112 These facts, the court concluded, made Autery "totally 13 different than what ... [the] court has normally experienced with people who are ordering 14 this sort of child pornography." 15 16 The court also described what it considered to be Autery's redeeming personal 17 characteristics: no history of substance abuse, no "interpersonal instability," no 18 "sociopathic or criminalistic attitudes," and that he was motivated and intelligent. 113 The 19 court thought it critical that Autery enjoys the continuing support of his family, especially 20 his wife and children. 21 22 The court acknowledged that child pornography is "terrible stuff" and that it believed 23 Autery "ordered it knowing that it was wrong and illegal." But the court found that in 24 25 26 27 28 112 Like the fact that Keys does not fit the profile of either a hacker or a member of Anonymous. He fits the profile of a journalist. 113 The factors are likewise applicable to Keys. DEFENDANT’S SENTENCING MEMORANDUM Page 65 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 66 of 69 1 several ways, Autery's case differed from the "hundreds and hundreds" of other child 2 pornography cases the court had adjudicated.114 3 4 The court also believed that Autery could not "be accommodated adequately in a federal 5 institution," and that he needed "outpatient psychiatric monitoring and management" 6 instead. Concluding its sentencing justification, the court stated that it decided on a 7 sentence of probation only "after a lot of soul-searching." It further determined that 8 imposing prison time would create "a much more disruptive situation and, actually, could 9 be more damaging than the rehabilitation [regime the court believed would] work." The 10 court also opined in its written "Statement of Reasons" that the sentence "is fully justified 11 in this exceptional case." 12 13 The court observed that the five-year probationary sentence "would be subject to some 14 very special conditions of supervision." It also warned Autery, saying, "believe me, if 15 you have any violation [of those conditions], you'll be back before me and receive the 16 maximum penalty allowed by law."115 Some of the conditions of probation included a 17 prohibition on viewing any pornography whatsoever and on being within 100 feet of 18 places where minors congregate unless approved by his probation officer. Autery was 19 also not permitted to travel outside the State of Oregon without prior approval. He was 20 required to participate in mental health evaluation and counseling, including 21 psychotherapy, and to take any prescription drugs as directed. He was not permitted to 22 possess any firearm, or to use any computer except for work, or, without approval, any 23 other electronic media — such as a personal digital assistant or cellular phone — with 24 Internet capability. In addition, Autery was not permitted to have "direct or indirect" 25 26 27 It is important to note that Keys’ conduct differed in that of any other like person described herein in that it was on a single occasion and not part of a pattern or spree of criminality that others described herein engaged in. 115 Keys would not object to such a warning. 114 28 DEFENDANT’S SENTENCING MEMORANDUM Page 66 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 67 of 69 1 contact with anyone under the age of eighteen, except his own children. Finally, Autery 2 was required to register with the state sex offender registry. 3 555 F.3d 864, 867-868 4 It is appropriate for a court to take into account other like cases to arrive at a just sentence that is 5 not out of proportion with other apposite cases. In this brief, we have traced what defendants that are 6 similarly situated to Keys have received. The courts have allowed judges to use “their experience of 7 imposing sentences in past, relevant cases as an element in determining the fairness of the sentence for 8 the individual defendant before them. This approach is encouraged by statute, which states that a judge 9 should consider "the need to avoid unwarranted sentence disparities among defendants with similar 10 records who have been found guilty of similar conduct."” 18 U.S.C. § 3553(a)(6). United States v. 11 Sanchez-Martinez, 537 Fed. Appx. 693, 695, 2013 BL 211009, 2 (9th Cir. 2013)116 (“The court simply 12 relied on a formalized version of what all district judges rely upon: their experience of imposing 13 sentences in past, relevant cases.”). 14 Moreover, the facts in Sanchez-Martinez were in Matthews’ favor. That the Court relied upon a table 15 of cases that both sides were not permitted to see. Here, Matthew has laid out the case that he wishes the court to 16 consider in reaching a just sentence of probation with the possibility of house arrest. 17 Indeed, while the Court has not sentenced any of the defendants compared to Matthew 18 throughout this brief, the Court is now educated about the “going rate” for these cases around the globe, 19 and has the perspective of what is not just appropriate for the offender, but what is appropriate for the 20 offense when the two are considered together. 21 The sentencing judge is in the best position to find facts and judge their import under § 3553(a) 22 in the individual case. The judge sees and hears the evidence, and copious evidence has been introduced 23 in this brief of the factors, circumstances and players surrounding the events at issue in this trial. The 24 trial Judge has the superior ability to makes credibility determinations, has full knowledge of the facts 25 and gains insights not conveyed by the record. "The sentencing judge has access to, and greater 26 27 116 28 See Rule of Appellate Procedure 32.1: (a) Citation Permitted. A court may not prohibit or restrict the citation of federal judicial opinions, orders, judgments, or other written dispositions that have been: (i) designated as “unpublished,” “not for publication,” “non-precedential,” “not precedent,” or the like; and (ii) issued on or after January 1, 2007. DEFENDANT’S SENTENCING MEMORANDUM Page 67 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 68 of 69 1 familiarity with, the individual case and the individual defendant before [her] than the Commission or 2 the appeals court." Rita v. United States, 551 U.S. 338, 127 S.Ct. 2456, 2469, 168 L.Ed.2d 203 (2007)) 3 Mr. Keys, like almost all of the defendants described herein, has no prior criminal record. This 4 should be considered in Keys case as it was in so many of the other cases involving Anonymous 5 computer activities. It is appropriate to do so not just because it was done for other like defendants, but 6 because a criminal history category of 1 can sometimes account for defendants with some criminal 7 history. IT is not well taken that the criminal history has already been calculated into the guidelines and 8 is therefore not a mitigating circumstance as well. “This argument overlooks the fact that a defendant 9 with a minor criminal history can still fall within Criminal History Level I. See U.S. Sentencing 10 Guidelines Manual § 4A1.1 & Ch. 5, Pt. A (2007). Therefore, because Autery's Criminal History Level I 11 did not fully account for his complete lack of criminal history, considering it as a mitigating factor was 12 not redundant or improper. See United States v. Rowan, 530 F.3d 379, 381 (5th Cir.2008) (holding 13 probation reasonable for defendant convicted of possessing hundreds of hardcore child pornography 14 images where defendant had no criminal history).” 15 Keys will not recount the sentences received on three continents by similarly situated defendants 16 who all engaged in significantly more serious and prolific criminality, as it has been so thoroughly 17 briefed and argued supra that we do not wish to inundate the court with dualistic facts and arguments. 18 All that remains to be said is that if he receives a guidfeline sentence, or even a 60 month sentence, as 19 the Government has said it will seek, a great and comparative injustice will have been done. 20 21 22 23 CONCLUSION For the above reasons, the Court should impose a non-custodial sentence. 24 25 26 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 68 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280 Case 2:13-cr-00082-KJM Document 146 Filed 03/09/16 Page 69 of 69 1 2 Dated March 9, 2016 3 4 LAW OFFICES OF JAY LEIDERMAN 5 6 By:/s/Jay Leiderman Jason S. Leiderman Pro Bono Attorney for Defendant MATTHEW KEYS 7 8 9 10 TOR EKELAND, PC 11 12 13 By: Tor Ekeland Mark Jaffe Pro Bono Attorneys for Defendant MATTHEW KEYS 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 DEFENDANT’S SENTENCING MEMORANDUM Page 69 LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 Tel: 805-654-0200 Fax: 805-654-0280