Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 1 of 55

No. 16-10197
IN THE UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
UNITED STATES,
Plaintiff-Appellee,
v.
MATTHEW KEYS,
Defendant-Appellant
Appeal from the United States District Court for the Eastern District of California
Criminal Case No. 2:13-CR-82 KJM (Hon. Kimberly J. Mueller)
APPELLANT’S OPENING BRIEF

Tor Ekeland
Mark H. Jaffe
TOR EKELAND, P.C.
195 Plymouth Street
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5417
tor@torekeland.com
mark@torekeland.com
Jason S. Leiderman, SBN 203336
LAW OFFICES OF JAY LEIDERMAN
770 County Square Drive #101
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
jay@criminal-lawyer.me
Pro Bono Attorneys for Appellant Matthew Keys

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 2 of 55

TABLE OF CONTENTS
TABLE OF CONTENTS ............................................................................................................. ii
JURISDICTION ........................................................................................................................... 1
DETENTION STATUS ................................................................................................................ 1
ISSUES PRESENTED .................................................................................................................. 2
STANDARD OF REVIEW .......................................................................................................... 2
A. Constructive Amendment ................................................................................................ 2
B. Relevance and Prejudice of the Evidence ....................................................................... 3
C. Restitution.......................................................................................................................... 4
D. Federal Rule of Criminal Procedure 29 Motion ............................................................ 5
E. Denial of Jury Charge ...................................................................................................... 6
F. Concurrent Sentences ....................................................................................................... 6
STATEMENT OF THE CASE .................................................................................................... 7
A. Indictment.......................................................................................................................... 7
B. Additional Conduct Introduced at Trial ...................................................................... 11
C. Use of the Cancer Man Emails at Trial and Objections.............................................. 13
D. Rule 29.............................................................................................................................. 14
E. Jury Instructions ............................................................................................................. 15
F. Verdict and Sentencing................................................................................................... 15
G. Restitution........................................................................................................................ 15
ARGUMENT SUMMARY ........................................................................................................ 16
ARGUMENT ............................................................................................................................... 17
I. THE GOVERNMENT CONSTRUCTIVELY AMENDED COUNT TWO OF THE
INDICTMENT AT TRIAL .................................................................................................... 17
A. Mr. Keys Preserved His Constructive Amendment Objection ..................................... 18
B. Conduct Related to the “Cancer Man” Emails Was Not Alleged in the Indictment, Yet
Was Used Extensively at Trial to Satisfy the Elements of Count Two ................................ 20
C. The Difference Between What Was Alleged in the Indictment and the Conduct
Presented at Trial Constitutes a Constructive Amendment .................................................. 24
II. THE JURY WAS PERMITTED TO CONSIDER HARMS NOT COGNIZABLE AS
CFAA DAMAGE AND LOSS ............................................................................................... 27
A. Mr. Keys Preserved His Objections as to CFAA Damage ........................................... 28
B. Copying an Email Address List is Not CFAA Damage ............................................... 28
C. CFAA Damage Should be Based on Actual Harm and Not Speculative Harm ........... 30
D. Creation of User Accounts is Not CFAA Damage Because It Does Not Delete Data,
Impair Data, or Access to Data, or System Functionality..................................................... 34
E. It Was Error to Deny a Jury Charge Stating That if the Jury Found the Data was
Backed up There was No CFAA Damage. ........................................................................... 35
F. The Rule of Lenity Requires a Narrow Interpretation of CFAA Damage .................... 36
G. The Jury Was Permitted to Consider Harms Not Cognizable as CFAA Loss .............. 37

ii

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 3 of 55

H. The Loss Numbers Were Speculative and No Expert Established that they Were
Reasonable ............................................................................................................................ 38
III. THE INTRODUCTION OF IRRELEVANT AND HIGHLY PREJUDICIAL
EVIDENCE REQUIRES REVERSAL ................................................................................. 38
IV. THE GOVERNMENT EVIDENCE WAS INSUFFICIENT TO PROVE THAT
MATTHEW KEYS ATTEMPTED TO DAMAGE TRIBUNE’S COMPUTER
SYSTEMS ................................................................................................................................ 41
V. THE RESTITUTION AWARD WAS NOT SUPPORTED BY THE
PREPONDERANCE OF THE EVIDENCE ........................................................................ 45
CONCLUSION ........................................................................................................................... 47

iii

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 4 of 55

TABLE OF AUTHORITIES
CASES
BHRAC, LLC v. Regency Car Rentals, LLC, No. CV 15-CV-865, 2015 WL 3561671 (C.D. Cal.
June 4, 2015) ............................................................................................................................. 37
Boyd v. City & County of San Francisco, 576 F.3d 938 (9th Cir. Cal. 2009) ............................ 3, 4
Chickasaw Nation v. United States, 534 U.S. 84 (2001) .............................................................. 30
Custom Packaging Supply, Inc. v. Phillips, No. 2:15-CV-04584, 2016 WL 1532220 (C.D. Cal.
Apr. 15, 2016) ..................................................................................................................... 29, 33
Dana Ltd. v. Am. Axle & Mfg. Holdings, Inc., No. 1:10-CV-450, 2012 WL 2524008 (W.D. Mich.
June 29, 2012) ........................................................................................................................... 35
Garelli Wong & Associates, Inc. v. Nichols, 551 F. Supp. 2d 704 (N.D. Ill. 2008) ..................... 31
Gen. Motors L.L.C. v. Autel. US Inc., No. 14-14864, 2016 WL 1223357 (E.D. Mich. Mar. 29,
2016) ......................................................................................................................................... 31
Grant Mfg. & Alloying, Inc. v. McIlvain, No. 10-CV-1029, 2011 WL 4467767 (E.D. Pa. Sept.
23, 2011) ................................................................................................................................... 35
Harman v. Apfel, 211 F.3d 1172 (9th Cir. 2000) ............................................................................ 4
Hernandez-Cruz v. Holder, 651 F.3d 1094 (9th Cir. 2011).......................................................... 43
Instant Tech., LLC v. DeFazio, 40 F. Supp. 3d 989 (N.D. Ill. 2014)............................................ 35
Jackson v. Virginia, 443 U.S. 307 (1979) ....................................................................................... 5
Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999) .................................................................... 4
LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009) ................................................... 36
McEuin v. Crown Equip. Corp., 328 F.3d 1028 (9th Cir. 2003) .................................................... 4
NetApp, Inc. v. Nimble Storage, Inc., No. 5:13-CV-05058, 2015 WL 400251 (N.D. Cal. Jan. 29,
2015) ......................................................................................................................................... 29
Old Chief v. U.S., 519 U.S. 172 (1997) .......................................................................................... 3
Ratzlaf v. U.S. 510 U.S. 135 (1994) .............................................................................................. 30
Resdev, LLC v. Lot Builders Ass'n, Inc., No. 6:04-CV-1374, 2005 WL 1924743 (M.D. Fla. Aug.
10, 2005) ................................................................................................................................... 32
Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F.Supp.2d
1121(W.D.Wash.2000) ............................................................................................................. 31
U.S. v. 20 Layton, 767 F.2d 549 (9th Cir. 1985)........................................................................... 40
U.S. v. Adamson, 291 F.3d 606 (9th Cir. 2002) .............................................................................. 2
U.S. v. Arreola, 446 F.3d 926 (9th Cir. 2006) ................................................................................ 3
U.S. v. Bland, 908 F.2d 471 (9th Cir. 1990) ................................................................................. 40
U.S. v. Brock-Davis, 504 F.3d 991 (9th Cir. 2007)....................................................................... 45
U.S. v. Curtin, 489 F.3d 935 (9th Cir. 2007) .................................................................................. 4
U.S. v. Clayton, 108 F.3d 1114 (9th Cir. 1997) .............................................................................. 4
U.S. v. De Bright, 730 F.2d 1255 (9th Cir. 1984) ........................................................................... 7
U.S. v Echeverry, 759 F.2d 1451 (9th Cir. 1985) ........................................................................... 6
U.S v. Ellis, 147 F.3d 1131 (9th Cir. Or. 1998) ............................................................................ 40
U.S. v. Gracidas-Ulibarry, 231 F.3d 1188 (9th Cir. 2000)........................................................... 42

iv

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 5 of 55

U.S. v. Hai Waknine, 543 F.3d 546 (9th Cir. 2008) ........................................................................ 4
U.S. v. Hugs, 384 F.3d 762 (9th Cir. 2004) .................................................................................... 3
U.S. v. Johnson, 820 F.2d 1065 (9th Cir. Wash. 1987) .................................................................. 4
U.S. v. Kenny, 645 F.2d 1323 (9th Cir.).......................................................................................... 6
U.S. v. Lloyd, 807 F.3d 1128 (9th Cir. 2015)................................................................................ 18
U.S. v. Makhlouta, 790 F.2d 1400 (9th Cir. Cal. 1986) .................................................................. 6
U.S. v. McConney, 728 F.2d 1195 (9th Cir.) .................................................................................. 3
U.S v. Menza, 137 F.3d 533 (7th Cir. 1998) ................................................................................. 45
U.S v. Nevils, 598 F.3d 1158 (9th Cir. 2010) .................................................................................. 5
U.S. v. Nosal, 676 F.3d 854 (9th Cir. 2012) ................................................................................. 33
U.S. v. Nosal, Nos. 14-10037, 14-10275, 2016 WL 3608752 (9th Cir. July 5, 2016).................... 5
U.S. v. Palomba, 31 F.3d 1456 (9th Cir. 1994) .............................................................................. 7
U.S. v. Pisello, 877 F.2d 762 (9th Cir. Cal. 1989) .......................................................................... 2
U.S. v. Still, 850 F.2d 607 (9th Cir. 1988) .................................................................................... 44
U.S. v. Waknine, 543 F.3d 546 (9th Cir. 2008) ....................................................................... 45, 46
U.S. v. Ward, 747 F.3d 1184 (9th Cir. 2014) .................................................................... 17, 20, 25
Worldspan, L.P. v. Orbitz, LLC, No. 05-CV-5386, 2006 WL 1069128 (N.D. Ill. Apr. 19, 2006)32
U.S. v. Yarbrough, 852 F.2d 1522 (9th Cir. 1988) ......................................................................... 5
U.S. v. Yossunthorn, 167 F.3d 1267 (9th Cir. 1999) ....................................................................... 5
STATUTES
18 U.S.C. § 1030(a)(2)(C) ...................................................................................................... 28, 29
18 U.S.C. § 1030 (c)(4)(A)-(G) .................................................................................................... 36
18 U.S.C. § 1030 (e)(8)............................................................................................................. 8, 30
18 U.S.C. § 1030(a)(5)(A) .................................... 1, 7, 8, 11, 14, 15, 27, 28, 29, 30, 31, 35, 36, 42
18 U.S.C. § 1030(c)(4)(B) .............................................................................................................. 8
18 U.S.C. § 1030(e)(11)............................................................................................................ 8, 37
18 U.S.C. § 3231 ............................................................................................................................. 1
18 U.S.C. § 3664(d)(6) ................................................................................................................... 5
18 U.S.C. § 3664(e) ........................................................................................................................ 4
18 U.S.C. § 371 ............................................................................................................................... 1
28 U.S.C. § 1291 ............................................................................................................................. 1
OTHER AUTHORITIES
Jack B. Weinstein & Margaret A. Berger, Weinstein's Federal Evidence, § 403.04 (Joseph M.
McLaughlin, ed., Matthew Bender 2d ed. 1997) ...................................................................... 38
Oxford English Reference Dictionary 731 (Rev. 2nd ed.2002).................................................... 32
THE NATIONAL INFORMATION INFRASTRUCTURE PROTECTION ACT OF 1995, S.
REP. N0.104-357 ...................................................................................................................... 31
U.S. Sentencing Guidelines, U.S.S.G. § 2B1.1(b)(18)(A)(2) ....................................................... 29
Webster's Third New International Dictionary 1174 (1971) ........................................................ 32
RULES
Fed. R. App. P. 4 (b)(1)(A) ............................................................................................................. 1
Fed. R. Crim. P. 29 ......................................................................................................................... 5
Fed. R. Evid. 401 ............................................................................................................................ 3

v

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 6 of 55

Fed. R. Evid. 403 ............................................................................................................................ 3
CONSTITUTIONAL PROVISIONS
U.S. Const. amend. V.................................................................................................................... 17

vi

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 7 of 55

JURISDICTION
This is an appeal of an Eastern District of California’s Trial Court’s (the
“Trial Court”) final judgment in a criminal case. The Trial Court had jurisdiction
under 18 U.S.C. § 3231 as the Indictment charged one count under 18 U.S.C. § 371
(conspiracy to cause unauthorized damage to a computer) and two counts under 18
U.S.C. § 1030(a)(5)(A)(transmission of a code that causes unauthorized damage to
a computer, both substantively and as attempt). This Court has jurisdiction under
28 U.S.C. § 1291, because the Trial Court’s judgment is an appealable final
decision. In a criminal case, a defendant’s notice of appeal must be filed in the
district court within 14 days after the later of (i) the entry of either the judgment or
the order being appealed; or (ii) the filing of the government's notice of appeal.
Fed. R. App. P. 4 (b)(1)(A). The Trial Court entered final judgment against Mr.
Keys on April 13, 2016. (ER at 176 (CR 175).) Mr. Keys filed a timely notice of
appeal on April 25, 2016. (ER at 168 (CR 154).)
DETENTION STATUS
On August 4, 2016, after spending over three years on minimal supervised
release without incident, Mr. Keys reported for his sentence as ordered by the Trial
Court. He is currently serving his two-year sentence at U.S. Penitentiary Atwater
and has a projected release date of April 30, 2018.

1

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 8 of 55

1.

ISSUES PRESENTED
Whether the Government constructively amended Count Two of the
Indictment with the introduction of irrelevant and highly prejudicial
evidence related to uncharged conduct not described in the Indictment?

2.

Whether the conviction should be reversed because the government
introduced highly prejudicial evidence in support of its Computer Fraud and
Abuse Act Damage allegations that was not within the scope of the legal
definition of CFAA Damage and Loss?

3.

Whether the conviction should be reversed because the introduction of
irrelevant and highly prejudicial evidence tainted the whole trial?

4.

Whether the evidence supported the allegation that Mr. Keys took a
substantial step to attempt to damage the LA Times website?

5.

Whether the preponderance of the evidence supports the Restitution Amount
of $249,956.00 based on alleged damage to a database unrelated to the
charged conduct when there is no evidence in the trial record that any email
address list was deleted or a database damaged?
STANDARD OF REVIEW
A. Constructive Amendment
Where a defendant raises a constructive amendment claim before the district

court, the claim is reviewed de novo. U.S. v. Adamson, 291 F.3d 606, 612 (9th Cir.
2002); U.S. v. Pisello, 877 F.2d 762, 764 (9th Cir. Cal. 1989); U.S. v. McConney,

2

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 9 of 55

728 F.2d 1195, 1201 (9th Cir.) (en banc), cert. denied, 469 U.S. 824 (1984).
However, if a defendant does not object to the district court’s jury instructions at
trial, his constructive-amendment claim is reviewed under the plain error standard.
U.S. v. Arreola, 446 F.3d 926, 934 & n.2 (9th Cir. 2006); U.S. v. Hugs, 384 F.3d
762, 766 (9th Cir. 2004). Because Counsel for Mr. Keys raised a constructive
amendment claim at trial, the de novo standard of review is appropriate for this
appeal.
B. Relevance and Prejudice of the Evidence
Only relevant evidence, which is defined as “evidence having any tendency
to make the existence of any fact that is of consequence to the determination of the
action more probable or less probable than it would be without the evidence,” is
admissible in federal court. Fed. R. Evid. 401. Evidence may be relevant even if it
is cumulative, redundant, or if it relates to undisputed facts. Old Chief v. U.S., 519
U.S. 172, 179 (1997); Boyd v. City & County of San Francisco, 576 F.3d 938, 943
(9th Cir. 2009). Relevant evidence may be excluded “if its probative value is
substantially outweighed by a danger of one or more of the following: unfair
prejudice, confusing the issues, misleading the jury, undue delay, wasting time, or
needlessly presenting cumulative evidence.” Fed. R. Evid. 403.
A district court need not state explicitly that the probative value of the
evidence substantially outweighs the danger of unfair prejudice, as long as it
appears from the record that the trial judge performed the balancing required by
3

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 10 of 55

Rule 403. U.S. v. Johnson, 820 F.2d 1065, 1069 (9th Cir. Wash. 1987). A district
court's decision to admit evidence is evaluated under an abuse of discretion
standard. See Kumho Tire Co. v. Carmichael, 526 U.S. 137, 152, (1999); U.S. v.
Curtin, 489 F.3d 935, 943 (9th Cir. 2007) (en banc). An appellate court will not
reverse a district court’s decisions under an abuse of discretion standard unless it is
“convinced firmly that the reviewed decision lies beyond the pale of reasonable
justification under the circumstances.” Harman v. Apfel, 211 F.3d 1172, 1175 (9th
Cir. 2000). A party seeking reversal for evidentiary error must show that the error
was prejudicial, and that the verdict was "more probably than not" affected as a
result. Boyd, 576 F.3d at 943; see also McEuin v. Crown Equip. Corp., 328 F.3d
1028, 1032 (9th Cir. 2003).
C. Restitution
Under 18 U.S.C. § 3664, a district court must resolve a dispute as to the
proper amount of restitution by a preponderance of the evidence. 18 U.S.C. §
3664(e); U.S. v. Hai Waknine, 543 F.3d 546, 556 (9th Cir. 2008); see also U.S. v.
Clayton, 108 F.3d 1114, 1118 (9th Cir. 1997). It is the Government’s burden to
prove that a person or entity is a victim for restitution purposes, and to prove the
amount of the loss. 18 U.S.C. § 3664(e). The district court is not obligated to make
explicit findings to justify a restitution order, but it "may refer any issue arising in

4

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 11 of 55

connection with a proposed order of restitution to a magistrate judge or special
master for proposed findings of fact." 18 U.S.C. § 3664(d)(6).
The legality of a district court’s restitution order is reviewed de novo. U.S. v.
Nosal, Nos. 14-10037, 14-10275, 2016 WL 3608752 at*16 (9th Cir. July 5, 2016).
Factual findings that support the order are reviewed under the clear error standard.
Id. If the order is "'within the bounds of the statutory framework, a restitution order
is reviewed for abuse of discretion.'" Id.
D. Federal Rule of Criminal Procedure 29 Motion
The test for determining whether to grant a motion for judgment of acquittal
under Fed. R. Crim. P. 29 is whether, viewing the evidence in the light most
favorable to the government, there was relevant evidence from which the jury
could reasonably find the accused guilty beyond a reasonable doubt of each
element of the crime charged. Jackson v. Virginia, 443 U.S. 307, 319
(1979) (sufficiency of the evidence standard); U.S. v. Yarbrough, 852 F.2d 1522,
1542 (9th Cir. 1988) “[E]vidence is insufficient to support a verdict where mere
speculation, rather than reasonable inference, supports the government’s case.” U.S
v. Nevils, 598 F.3d 1158, 1167 (9th Cir. 2010) (en banc).
Denied motions for acquittal are reviewed de novo. U.S. v. Yossunthorn, 167
F.3d 1267, 1270 (9th Cir. 1999), as amended (Mar. 31, 1999). The Court of
Appeals will uphold a conviction when, “viewing the evidence in the light most

5

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 12 of 55

favorable to the prosecution, any rational trier of fact could have found the
essential elements of the crime beyond a reasonable doubt. Id.
E. Denial of Jury Charge
A defendant is entitled to a jury instruction on "his theory of the case if it is
supported by law and has some foundation in the evidence." U.S. v Echeverry, 759
F.2d 1451, 1455 (9th Cir. 1985). The district court, however, may refuse a
proposed instruction so long as the instructions given, viewed as a whole, cover
that theory. U.S. v. Kenny, 645 F.2d 1323, 1337 (9th Cir.), cert. denied, 452 U.S.
920, 101 S. Ct. 3059, 69 L. Ed. 2d 425 (1981). A district court's formulation of
instructions are reviewed under the abuse of discretion standard. U.S. v.
Makhlouta, 790 F.2d 1400, 1405 (9th Cir. 1986). The jury must be instructed as to
the defense’s theory of the case, but the precise language proposed by the
defendant need not be used, and it is not error to deny a proposed instruction so
long as other instructions in their entirety cover the defense’s theory. U.S v.
Makhlouta, 790 F.2d at 1405; Kenny, 645 F.2d at 1337.
F. Concurrent Sentences
Mr. Keys was sentenced concurrently on all three counts. A conviction
sentenced to run concurrently is to be reviewed on the merits no differently from
other convictions. “It is preferable to address ourselves to the merits of all
convictions before us on appeal. This will guarantee that no individual will suffer

6

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 13 of 55

because of our inability to foretell the future effects of an unreviewed conviction.”
U.S. v. De Bright, 730 F.2d 1255, 1259 (9th Cir. 1984) (rejecting the concurrent
sentence doctrine); see also U.S. v. Palomba, 31 F.3d 1456, 1465 (9th Cir. 1994)
(noting that rejection is especially apt in light of the sentencing guidelines' criminal
history calculations and “three strikes” laws). Here, even if Mr. Keys' sentence
may not be directly reduced, each conviction appealed should be reviewed on its
merits.
As merited, Appellant will discuss the particularities of any given standard
of review below.
STATEMENT OF THE CASE
A. Indictment
On March 14, 2013 Mr. Keys was initially indicted for his role in the edit of
the Los Angeles Times website (“latimes.com”) headline, slug, and byline. (ER at
244 (CR 1).) On April 23, 2013, he made his initial appearance and was released
on minimal supervised release. On December 4, 2014 the Government superseded
the indictment (the “Indictment”), broadening the date range for Count Two but
otherwise leaving the original Indictment unchanged. (ER at 235 (CR 44).)
The Indictment alleges a conspiracy, an attempt, and an actual violation of
18 U.S.C. § 1030(a)(5)(A) of the Computer Fraud and Abuse Act (“CFAA”).
Section 1030(a)(5)(A) criminalizes the knowing “transmission of a program,
information, code, or command” the result of which “causes damage without
7

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 14 of 55

authorization, to a protected computer.” If the loss caused by the damage is more
than $5,000.00, then a violation of § 1030(a)(5)(A) becomes a felony. §
1030(c)(4)(B). Damage (“CFAA Damage”) is defined as “any impairment to the
integrity or availability of data, a program, a system, or information.” § 1030
(e)(8). Loss (“CFAA Loss”) is defined as “any reasonable cost to any victim,
including the cost of responding to an offense, conducting a damage assessment,
and restoring the data, program, system, or information to its condition prior to the
offense, and any revenue lost, cost incurred, or other consequential damages
incurred because of interruption of service.” § 1030(e)(11).
According to the Indictment, the conspiracy to violate § 1030(a)(5)(A)
occurred between December 8, 2010 and December 15, 2010. (ER at 236
(Indictment at p. 2 ¶ 2).) The object of the conspiracy was “to make unauthorized
changes to web sites that Tribune Company used to communicate news features to
the public; and to damage computer systems used by Tribune Company.” (ER at
237 (Indictment at p. 3 ¶ 3).) The Indictment lists the Tribune Company, local
Sacramento television station Fox 40, and the Los Angeles Times as targets of the
conspiracy. (ER at 237 (Indictment at p. 3 ¶ 4).) Fox 40 and the Los Angeles Times
were owned by the Tribune Company and utilized the Tribune’s Content
Management System (“CMS”) for much of their digital content and websites. (ER
at 236 (Indictment at p. 2 ¶ 1(c)-(d)).) The CMS would back up prior versions of

8

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 15 of 55

stories on the Los Angeles Times website and save new version if changes were
made. (ER at 92-93 (RT 228:15-229:9).)
The conspiracy was allegedly devised on an Internet Relay Chat (“IRC”)
between Matthew Keys and several co-conspirators claimed to be associated with
Anonymous, a decentralized movement of computer hackers. The overt actions
taken to carry out this conspiracy include a December 8th IRC communication in
which one of the co-conspirators expressed a desire to gain access to the computer
systems of Fox News. (ER at 237 (Indictment at p. 3 ¶ 9).) Mr. Keys allegedly
responded by offering login credentials from his former employer that would grant
access to the CMS. (ER at 237 (Indictment at p. 3 ¶ 10).) A second alleged overt
act was carried out between December 8 and December 14 when a member of the
conspiracy used username “anon1234” to reconnoiter the Tribune’s CMS. (ER at
238 (Indictment at p. 4 ¶ 12).) On December 11 a member of the conspiracy began
using the username “ngarcia” on the CMS. (ER at 238 (Indictment at p. 4 ¶ 13).)
The username “ngarcia” was eventually used to revise the title, slug, and
byline of a latimes.com story on or about December 14 or 15. (ER at 238
(Indictment at p. 4 ¶ 14).) The article’s title, slug and byline originally appeared as
follows:
Pressure builds in House to pass tax-cut package
House Democratic leader Steny Hoyer sees ‘very good things’ in the
tax-cut deal, which many representatives oppose. But with the bill
9

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 16 of 55

set to clear the Senate, reluctant House Democrats are feeling the heat
to pass it.
By Lisa Mascaro, Tribune Washington Bureau1
After the minor revisions by “ngarcia,” the article’s title and byline allegedly
read:
Pressure builds in House to elect CHIPPY 1337
House Democratic leader Steny Hoyer sees ‘very good things’ in the
deal cut which will see uber skid Chippy 1337 take his rightful place,
as head of the Senate, reluctant House Democrats told to SUCK IT
UP.
By CHIPPYS NO 1 FAN, Tribune Washington Bureau
The original was restored in approximately 40 minutes. (ER 94 (RT 295:1215).) The last alleged overt act was on December 15, an IRC conversation among
the conspirators discussing the alteration and acknowledging that they had been
locked out of the system. (ER at 238 – 239 (Indictment at p. 4-5 ¶ 15).) At trial
these facts were offered to support Count One, the conspiracy charge. (ER at 136 –
153 (RT 810-827).)
Count Two of the Indictment repeats the allegations contained in Count One,
while extending the date range to October 28, 2010 through on or about January 5,
2011. (ER 239 - 240 (Indictment at p. 5-6 ¶ 1-2).)

1

The original article is still available on the Los Angeles Times website, at
http://articles.latimes.com/2010/dec/14/news/la-pn-hoyer-tax-vote-20101215 (last
accessed (August 22, 2016).).

10

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 17 of 55

Count Three alleges an attempted violation of § 1030(a)(5)(A). Count Three
incorporates the allegations in Count One but adds that the attempt occurred on or
about December 15, 2010. (ER at 241 (Indictment at p. 6 ¶ 1-2).) The attempted
transmission is alleged to have been aimed at causing damage that would have
resulted in a loss to a person during a 1-year period aggregating at least $5,000 in
value.
B. Additional Conduct Introduced at Trial
Beyond the facts alleged in the Indictment, the Government introduced
additional conduct alleged to have been undertaken by Mr. Keys. Specifically,
beginning on October 28, 2010, the Government alleges that Mr. Keys downloaded
an email address list from the Tribune Company’s CMS and used that email
address list to send a series of emails from private Google and Yahoo email
accounts to his former boss Brandon Mercer and individuals who subscribed to the
mailing list. (ER at 6 – 8 (RT 11:21- 13:22); ER at 9-10 (RT 14:9-15:20).) Several
subscribers who received the emails expressed concern to Fox40. (ER at 43 – 44
(RT 87:23- 88:23).) None testified at trial and no evidence was introduced
demonstrating that any email addresses were deleted from the database they were
copied from, or that any damage was done to the email address database. (ER at 88
(RT 149:10-22).) The database was operated by a third party vendor called “Green
Links” (“Green Links Database”). (ER at 87 (RT 148:16-20).) Although this

11

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 18 of 55

course of conduct is not discussed in the Indictment, it was referred to by the
Government as relating to Count Two. (ER at 6-8 (RT 11:21- 13:22); ER at 9-10
(RT 14:9-15:20); ER at 153 (RT 827:9-24).)
The email campaign was generally referred to at trial as the “Cancer Man”
emails or the “Fox Mulder” emails. (ER at 15 (RT 25:9-18).) This is because
several of the aliases Keys used to carry out the email campaign,
cancerman4099@yahoo.co.uk, walterskinner@yahoo.co.uk, and
foxmulder4099@yahoo.co.uk, were derived from the Fox television show the XFiles which features a protagonist named Fox Mulder and an antagonists referred
to as the Cancer Man. (ER at 7 (RT 12:14-16).) For the sake of consistency, the
course of conduct relating to these emails will hereinafter be referred to as the
“Cancer Man” emails.
Additionally, the Government alleged that during the same time period as
that the Cancer Man emails were sent Mr. Keys locked Sam Cohen, a Fox 40
employee, out of her CMS account for roughly a week. (ER at 10 (RT 15:8-14).)
This conduct was also not mentioned in the Indictment but was referred to by the
Government as relating to Count Two as well. (ER at 128 (RT 767:10-24); ER at
143 (RT 817:2-25).) Upon cross examination Ms. Cohen admitted that whenever
she had difficulty with her username and password she simply requested a new
username and password that allowed her to gain access to the CMS. (ER at 106

12

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 19 of 55

(RT 477:7-20).) She also testified that those working with her had ready access to
the CMS, and contradicted her prior testimony that she had been locked out of
CMS access for roughly a week. (Gov. Ex. 112) She further testified that she had
not lost any documents or emails when she successfully logged back into the CMS.
(ER at 105 (RT 476:21-25).)
C. Use of the Cancer Man Emails at Trial and Objections
The Cancer Man emails were featured prominently in the Government’s
opening statements. (ER at 6-8 (RT 11:21-13:22); ER at 9-10 (RT 14:9-15:20).
The Defense objected to the relevance of these emails after the close of the
Government’s opening. (ER at 15 (RT 25:9-12).) The Cancer Man were also
introduced during testimony from Government’s first witness, Brandon Mercer,
Mr. Keys former boss at Fox40. (ER at 19 – 85 (RT 63-129).) Defense objected at
the beginning of Brandon Mercer’s testimony as to the Cancer Man emails
relevancy, (ER at 17 (RT 58:21-22), and again renewed its objection when
evidence specific to the emails was introduced during his testimony. (ER at 18 (RT
61:14-22).) The Court overruled all objections as to the relevancy of the Cancer
Man emails but granted the Defense a standing objection. (ER at 107 - 108 (RT
491:24-492:4).) Finally, the Cancer Man emails were discussed by Government’s
closing arguments as satisfying Count Two. (ER at 153 (RT 827); ER at 157 (RT
892).)

13

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 20 of 55

D. Rule 29
The Defense moved under Fed. R. Crim. P. 29 for a directed verdict on all
counts on the basis that the elements of each count had not been established. (ER at
115 (RT 724:2-6).)
On Count One and Two the Defense argued that CFAA Damage had not
been satisfied as the evidence showed that the CMS system operated securely,
properly, and none of the information stored by that system was lost. Any altered
information was immediately retrieved and, therefore, there was no damage under
§ 1030(a)(5)(A). (ER at 116 (RT 725:2-20).)
Further the defense argued that CFAA Loss had not been satisfied under
Count One and Two as testimony introduced to establish loss was based on
speculation, there was no expert testimony introduced to determine whether the
loss incurred was reasonable relative to the damage caused, loss was recorded an
imprecise manner, and most of the evidence introduced to establish loss was
attributed to conduct not alleged in the Indictment or not cognizable under the
CFAA. (ER at 116-117 (RT 725:21- 726:12).)
With regard to Count Three, the Defense argued that the Government had
not provided sufficient evidence of intent or a substantial step to establish liability
for the inchoate crime of attempt to damage a protected computer under §
1030(a)(5)(A). (ER at 116 (RT 725:3-10).)

14

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 21 of 55

The Court denied the motion. (ER at 119 (RT 731:25).)
E. Jury Instructions
The Defense requested that the Court have the Jury Instructions exclude
from consideration as to the elements of each offense harms not cognizable under
the CFAA. Specifically, the Defense asked the Court to exclude from consideration
alteration of data that was backed up and readily retrievable, (ER at 120 (RT
755:2-7), alleged harm to the CMS caused by the mere sharing of passwords or the
creation of additional accounts used by the co-conspirators to access the CMS, (ER
at 120 – 124 (RT 755:19-759:10), and harm caused by the sending of the Cancer
Man emails to Fox 40 viewers and Brandon Mercer. (ER at 84 (RT 128:15-23); ER
at 129 (RT 769:18-770:15).) The Jury Instructions adopted by the Court do not
caution the Jury about excluding these harms. (ER at 196 (CR 118).)
F. Verdict and Sentencing
Mr. Keys was found guilty on all three counts and was sentenced to a
custodial sentence of 24 months to be served concurrently and 24 months of
supervised release. (ER at 176 (CR 175).)
G. Restitution
Mr. Keys was ordered to pay $249,956.00 in restitution. (ER 176 (CR 175 at
6).) $200,000 relates to alleged damage to the Green Links Database, and $49,956
relates to “the value of employee time expended on responding to [Mr. Keys]

15

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 22 of 55

actions in telephone calls, meetings, e-mails, and the initial and subsequent
response to defacement of the Los Angeles Times website.” (ER at 283 (CR 168).)
The value of the Green Links Database “was calculated at $10.00 per
customer” although no testimony or evidence was offered at trial for this
proposition, and no receipts, invoices, spreadsheets or expert testimony were
offered at the restitution hearing to support this hearsay statement. (ER at 163 - 164
(Restitution RT 12:18-13:4); ER at 258 (GX 1002, at ¶ 4).) Additionally, no
credible evidence was offered, either at trial or the restitution hearing, that Fox40
“lost” $200,000 worth of customers and that Mr. Keys alleged access and copying
of an email address list from the Green Links Database necessitated hiring a new
vendor and rebuilding and entirely new database. (ER at 88 (RT 149:10-22).)
ARGUMENT SUMMARY
At trial, the Government, over a standing objection and repeated objections,
introduced irrelevant and highly prejudicial evidence of uncharged conduct.
Concurrent with this, it introduced, over objection, evidence of uncharged and
charged conduct relating to CFAA Damage and Loss that did not meet the legal
definition of those terms. The Government’s insistence on introducing evidence via
uncharged conduct mentioned nowhere in the Indictment resulted in a constructive
amendment of Count Two of the Indictment. Additionally, the introduction of
improper CFAA Damage and Loss evidence was confusing and prejudicial.
Furthermore, the Government failed to prove that Mr. Keys took a substantial step
16

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 23 of 55

in his attempt sufficient for a conviction under Count Three. Finally, the
Restitution Order should be vacated because it is not supported by the evidence.
ARGUMENT
I. THE GOVERNMENT CONSTRUCTIVELY AMENDED COUNT
TWO OF THE INDICTMENT AT TRIAL
The Government introduced a course of conduct materially distinct from the
course of conduct described in the Indictment involving wholly different victims
and instrumentalities of the alleged crime. The introduction of this distinct course
of conduct by the Government to satisfy the elements of Count Two of the
Indictment constructively amended the Indictment.
A criminal defendant’s right to have his conviction reversed when a
constructive amendment or variance occurs is derived from the Fifth Amendment
of the Constitution, which states that “[no] person shall be held to answer for a
capital, or otherwise infamous crime, unless on a presentment or indictment of a
Grand Jury.” U.S. Const. amend. V; see also U.S. v. Ward, 747 F.3d 1184, 1189
(9th Cir. 2014). This clause has been interpreted as making it the “exclusive
prerogative of the grand jury finally to determine the charges, and once it has done
so neither a prosecutor nor a judge can change the charging part of an indictment to
suit [his or her] own notions of what it ought to have been, or what the grand jury
would probably have made it if their attention had been called to suggested
changes.” Ward, 747 F.3d at 1189 (citing Ex parte Bain, 121 U.S. 1, 10 (1887).)

17

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 24 of 55

Although deriving from the same constitutional right, the standard for reversing a
criminal conviction is different whether the deviation is characterized as a
constructive amendment or a variance. Id. “[C]haracterizing an instruction as a
constructive amendment typically mandates reversal, while a variance requires
reversal only if it prejudices a defendant's substantial rights.” Id. Claims of
constructive amendment are only reviewed de novo where they have been raised at
trial. Id.
A. Mr. Keys Preserved His Constructive Amendment Objection
Defense’s objections on the record are sufficient to preserve an appeal based
on constructive amendment. The 9th Circuit in Ward found the defense’s
constructive amendment objection was preserved where the defendant asked for a
jury instruction prohibiting the Jury from considering uncharged conduct in
deciding whether the elements of the crime had been satisfied. Specifically,
Defense counsel stated “I'm very worried that they will look at this instruction, and
the jury will think that it can consider uncharged conduct, and whether there's
evidence that he might have known a different identity rather than one that's
charged.” Id. This objection to the Jury charges was enough to preserve the
objection despite counsel’s failure to explicitly cite the Fifth Amendment. Id. at
1188-89. Further, counsel also does not need to use the phrase “constructive
amendment” at trial to preserve the objection. U.S. v. Lloyd, 807 F.3d 1128, 1164
(9th Cir. 2015).
18

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 25 of 55

Counsel for Mr. Keys raised objections objections similar to those in Ward
during deliberations on jury instructions. Specifically, counsel asked the Trial
Court to instruct the Jury to ignore facts related to the Cancer Man emails in
deciding whether the elements of Count Two had been satisfied. (ER at 126-127
(RT at 765-66).) The Defense’s concern in allowing the introduction of the
“Cancer Man” emails was that “nothing regarding Cancer Man and Skinner emails, nothing that took place before December 8, nothing regarding e-mail
addresses attributed to [Fox 40 viewers] were included in the superseding
indictment.” (ER at 127 (RT 766:6-9).) Further, the defense expressed concern
“that so much of the facts and information and evidence . . . introduced [was]
unrelated to what was expected out of Count Two under the superseding
indictment” and that the Jury would inevitably render a decision on Count Two
influenced by evidence concerning unindicted conduct. (ER at 126 (RT 765:1417).)
The Judge agreed that the conduct relating to the Cancer Man emails was
mentioned nowhere in the Indictment, and that the only “notice” that the “Cancer
Man” emails would be used to satisfy Count Two was the date range that extended
beyond the edit of the latimes.com website article. (ER at 127 (RT 766:12-15).)
Although the Trial Court took Defense’s objections under advisement, the final
Jury charges did not caution the Jury against inclusion of the Cancer Man emails in

19

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 26 of 55

deciding whether Count Two had been satisfied. Rather Jury Instructions No. 21
and No. 22 instructed the Jury to consider conduct occurring outside the time of the
edit of the latimes.com article, from October 28, 2010 to January 5, 2011. (ER at
196 (CR 118 at 23-24).) Additionally, the Government frequently referred to the
Cancer Man emails in their opening and closing arguments when discussing what
the Jury should consider when deliberating on Count Two of the Indictment. (ER
at 135-155 (RT at 809 – 829).) Thus Mr. Keys constructive amendment claim is
preserved and must be reviewed de novo.
B. Conduct Related to the “Cancer Man” Emails Was Not Alleged in
the Indictment, Yet Was Used Extensively at Trial to Satisfy the
Elements of Count Two
A constructive amendment of the Indictment occurs “when conduct
necessary to satisfy an element of the offense is charged in the Indictment and the
government's proof at trial includes uncharged conduct that would satisfy the same
element.” Ward, 747 F.3d at 1191. Count Two of the Indictment does not allege
any additional facts beyond those alleged in Count One. The only difference
between Count Two and any of the other counts is the inclusion of the wider date
range. Because Count Two does not describe any additional facts, the court must
look to the facts alleged in Count One to establish what conduct is being charged
by Count Two.
Count One of the Indictment describes a course of conduct in which
Matthew Keys, using the alias “AESCracked” and “A2SCracked,” conspired to
20

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 27 of 55

“make unauthorized changes to web sites that Tribune Company used to
communicate news features to the public; and to damage computer systems used
by Tribune Company.” (ER at 237 (Indictment p. 3 ¶ 3).) This object was allegedly
achieved by Mr. Keys by in part identifying the Tribune Company, Fox 40, and the
Los Angeles Times as targets for “online intrusion and web vandalism.” (ER at
237 (Indictment p. 3 ¶ 4).) Mr. Keys also shared login credentials to “make
changes to Tribune Company’s CMS.” (ER at 237 (Indictment p. 3 ¶ 5).) Lastly, it
was part of the conspiracy to “alter the online version of a news feature published
on the website of the Los Angeles Times.” (ER at 237 (Indictment p. 3 ¶ 8).) The
Indictment then goes on to list all the overt acts of the conspiracy occurring
exclusively between December 8 and December 15, 2010. These overt acts are: a
discussion regarding “gain[ing] unauthorized access to computer systems of Fox”
(ER at 237 (Indictment p. 3 ¶ 9).); creating additional usernames and passwords
that would grant access to the CMS (ER at 238 (Indictment p. 3 ¶ 10).); issuing a
verbal command to cause damage to the CMS (ER at 238 (Indictment p. 4 ¶ 11).);
and a member of the conspiracy revising the latimes.com tax cut story. (ER at 238
(Indictment p. 4 ¶ 14).)
The facts alleged in Count One, realleged as the course of conduct satisfying
Count Two, tell a story of online intrusion and web vandalism of systems owned
and operated by the Tribune Company. The Trial Court read Count Two as only

21

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 28 of 55

relating to the revision of the latimes.com story. In her opening statement of the
case, Judge Mueller described Count Two as alleging “that Keys kept and used
usernames and passwords for malicious purposes to help another person alter a
story on the website of the Los Angeles Times.” (ER at 4-5 (RT 4:22 – 5:1).) This
reading is clearly encouraged by the conspicuous absence, among other things, of
any mention of emails, the email list obtained from Green Links Database, any
mention of the third party email services used to transmit the emails (Yahoo and
Google), the individuals who received the Cancer Man emails, or any of the aliases
used by Mr. Keys to send the Cancer Man emails.
The Government nevertheless used the Cancer Man emails to satisfy the
elements of Count Two. Count Two requires the (1) actual transmission of
information or a code that (2) causes damage without authorization and (3) for
felony liability, the damage must result in at least $5000 of loss. The Government
heavily implied throughout the course of the the trial that the sending of the Cancer
Man emails caused both damage and subsequent loss to Fox 40 and the Tribune
Company. In their opening statement, the Government described Mr. Keys sending
of the emails to his former boss and Fox 40 viewers as an “attack” that preceded
and was distinct from the attack he engaged in with his co-conspirators. (ER at 8
(RT 13:19-22).)

22

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 29 of 55

During its opening, the Government also told the Jury to consider the time
and money spent figuring out who was behind the Cancer Man emails, how to
respond, and how to make it stop. (ER at 9 – 10 (RT 14:9 – 15:20).) The
implication of this admonition being that Mr. Keys was culpable for purported
CFAA Damage and Loss resulting from this uncharged conduct. Defense counsel
raised numerous objections both in their motion in limine and during trial that the
Cancer Man emails were irrelevant and highly prejudicial. (ER at 15, 18, 27 (RT
25:4-12; 61:14-22; 71:15-18); ER at 232-233 (CR 69).)
During the first day of trial the Government elicited testimony from Brandon
Mercer that focused extensively on the sending of the Cancer Man emails and the
time and money spent responding to this uncharged course of conduct. (ER at 1985 (RT 63:4-129:18).) For example, Brandon Mercer was asked “[w]hat was the
effect when one of [the Cancer Man emails] would go to the entire newsroom?” To
which he responded “[i]t temporarily shut down people from doing their job.” (ER
at 32 (RT at 76:22-24).) Mr. Mercer was also asked to opine on the effect of the
emails on his business. He responded:
This was terrifying to the business. We were at a pivotal point in the
renaissance of Fox 40. We had put -- me personally -- blood, sweat
and tears for two years into this, and we are at a point now where we
were starting to really gain some traction. We had an iPad giveaway
coming out. We had a new website. We had new shows. And to have
something that would be communicated with the public of the nature
seen in the previous e-mails was -- there couldn't have been anything
more important at that moment for the station and for Tribune.”
(ER at 33-34 (RT 77:21 – 78:5).)
23

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 30 of 55

Again, the clear implication of this testimony being that the Cancer Man
emails, and the response to them, qualify as CFAA Damage and Loss. During
direct examination of Mr. Mercer, the Government introduced an itemized list of
time Mr. Mercer and other executives spent responding to the Cancer Man emails.
(ER at 253 (GX 127); ER at 55-56 (RT 99:16 – 100:15).) The itemized list
includes 2 hours for Brandon Mercer labeled “phone calls, emails to viewers,” 12
hours for Greg Saunders talking to Fox 40 viewers who received the Cancer Man
emails, and 10 hours by Sam Cohen responding to viewers. (ER at 253 (GX 127).)
Finally, during the Government’s closing arguments, the Government
specifically directs the Jury to consider the testimony of Brandon Mercer regarding
his time spent responding to the Cancer Man emails to calculate loss. (ER at 153
(RT at 827:9-24).). Further, the Government describes the Cancer Man emails as
being specifically “calculated” to waste employees of the Tribune Company’s time
and money and directs the Jury to take this into consideration when deliberating on
Count Two. (ER at 156-157 (RT at 891:22-892:2).)
C. The Difference Between What Was Alleged in the Indictment and the
Conduct Presented at Trial Constitutes a Constructive Amendment
The divergence described above between the Government’s Indictment and
their case at trial is analogues to 9th Circuit cases in which the Court found a
constructive amendment. The 9th Circuit in Ward summarized the principle that

24

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 31 of 55

runs though constructive amendment cases as requiring courts to have a
“sensitivity to both the jury instructions as a reflection of the indictment, and to the
nature of the proof offered at trial. More specifically, when conduct necessary to
satisfy an element of the offense is charged in the indictment and the government's
proof at trial includes uncharged conduct that would satisfy the same element, we
need some way of assuring that the jury convicted the defendant based solely on
the conduct actually charged in the indictment.” U.S. v. Ward, 747 F.3d 1184, 1191
(9th Cir. 2014). The Court in Ward determined that they were faced with a
situation where a constructive amendment had occurred because the defendant was
charged with identity theft as to two named individuals and evidence regarding
individuals not named in the Indictment was introduced at trial. This constituted a
constructive amendment as the “identity of the victims was necessary to satisfy an
element of the offense because aggravated identity theft requires proof that the
victim was a real person.” Id. at 1192.
Conversely, courts have declined to find a constructive amendment where
“the indictment simply contains superfluously specific language describing alleged
conduct irrelevant to the defendant's culpability under the applicable statute.” Id.
“In such cases, convictions can be sustained if the proof upon which they are based
corresponds to the offense that was clearly described in the indictment.” Id. at
1191. For example, there was no constructive amendment where the indictment

25

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 32 of 55

“alleged that the defendant had used two specific weapons—a Smith and Wesson
.357 and a Chinese model 9mm . . . [and] the evidence at trial matched the
allegations in the indictment, but a verdict form asked simply that the jury find
whether the defendant brandished a firearm.” Id. (citing U.S. v. Hartz, 458 F.3d
1011, 1020 (9th Cir. 2006).) The Court declined to find a constructive amendment
because “the verdict form did not alter the behavior on which the defendant could
be convicted, as no evidence was introduced that the defendant had used a weapon
other than the two referenced in the indictment, and use of either firearm would
have been sufficient to support conviction of the offense charged in the
indictment.” Id.
As used by the Government, the Cancer Man emails were not “conduct
irrelevant to the defendant's culpability under the applicable statute.” Id. Rather,
the Government used the Cancer Man emails to establish that Mr. Keys was
engaged in a campaign of CFAA Damage and Loss that occurred prior to and was
distinct from the campaign of damage and loss caused by the conspiracy to edit the
latimes.com website alleged in Count One. The loss and damage caused by the
Cancer Man campaign was in part due to the transmission of emails directed at
victims not associated with the Tribune Company and not named in the Indictment,
namely subscribers to the Fox 40 iPad contest giveaway email mailing list.

26

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 33 of 55

The Government presented the targets of the email campaign and the
methods Mr. Keys used to carry out that campaign as crucial to establishing every
element of Count Two. Specifically, for the Jury to find that that the Cancer Man
emails satisfy Count Two, they needed to find that sending harassing emails
constituted the “knowing[] . . . transmission of a program, information, code, or
command” designed to “intentionally cause[] damage without authorization, to a
protected computer.” § 1030(a)(5)(A). Because the Government framed the Cancer
Man conduct as satisfying the elements of § 1030(a)(5)(A) it is not clear whether
the Jury convicted on the basis of the website edit or the Cancer Man emails not
mentioned in the Indictment. Thus, Count Two of the Indictment should be
reversed due to the constructive amendment of the Indictment.
II. THE JURY WAS PERMITTED TO CONSIDER HARMS NOT
COGNIZABLE AS CFAA DAMAGE AND LOSS
Over a standing objection and repeated objections at trial, the Trial Court
allowed the government to introduce irrelevant and highly prejudicial evidence not
legally cognizable as CFAA Damage or Loss. Among other things, the
Government elicited testimony and introduced evidence of the following as
purported instances of CFAA Damage and resulting CFAA Loss: (1) the copying
of a Fox40 email address list from the Green Links Database (ER at 86-87 (RT
147:23 – 148:21).); (2) the mere threat of harm, as opposed to actual harm, to the

27

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 34 of 55

CMS (ER at 84 (RT 128:15-23).); and (3) the creation of “back door” user
accounts on the CMS. (ER at 100, 120-125 (RT 414:15-19; 755:2-760:6).).
A. Mr. Keys Preserved His Objections as to CFAA Damage
The Defense had a standing objection to the admission of any evidence
related to the Cancer Man emails. (ER at 107-108 (RT 491:24-492:4).)
Additionally, the Defense asked the Court to adopt jury instructions that would
have excluded from consideration the alteration of data that was backed up and
readily retrievable, (ER at 120 (RT 755:2-7), alleged harm to the CMS caused by
the mere sharing of passwords or the creation of additional accounts used by the
co-conspirators to access the CMS, (ER at 120 (RT 755:19-759:10), and harm
caused by the sending of the Cancer Man emails to Fox 40 viewers and Brandon
Mercer. (ER at 84 (RT 128:15-23); ER at 129-130 (RT 769:18-770:15).) The Jury
Instructions adopted by the Court do not caution the Jury about excluding these
harms. (ER at 196 (CR 118).)
B. Copying an Email Address List is Not CFAA Damage
Copying information from a database does not cause CFAA Damage. The
CFAA criminalizes the unauthorized access and copying of information under §
1030(a)(2)(C). Mr. Keys is charged in the Indictment under § 1030(a)(5)(A),
damaging a protected computer. If the unauthorized access and copying of
information constitutes CFAA Damage, this would subject conduct that violates §

28

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 35 of 55

§ 1030(a)(2)(C) to the higher sentencing maximum of § 1030(a)(5)(A). Section
1030(a)(2)(C) would also be rendered redundant.
Whether the copying of data can constitute CFAA damage in a criminal case
appears to be a matter of first impression for the Ninth Circuit and all the Federal
Appeal Courts. Several district courts across the country have ruled on the issue,
but only in the civil context. District Courts in the Ninth Circuit are split on the
matter, but the majority of the District Courts nationally have held that it does not.
See NetApp, Inc. v. Nimble Storage, Inc., No. 5:13-CV-05058, 2015 WL 400251,
at *11, 14 (N.D. Cal. Jan. 29, 2015)(“the mere copying of information does not
constitute a claim of 'damage' within the meaning of the CFAA”) (collecting
cases); see also Custom Packaging Supply, Inc. v. Phillips, No. 2:15-CV-04584,
2016 WL 1532220, at *4 (C.D. Cal. Apr. 15, 2016) (dismissing Plaintiff’s CFAA
damage claim because it was solely based on copying of files) (“Defendants cite
multiple cases holding that “damage” means actual harm to computers or networks
as a result of a defendant's unauthorized accessed to a protected computer, rather
than economic harm due to the commercial value of the data itself.”).
The majority view is correct in this instance, as allowing the copying of data
to constitute CFAA Damage runs the risk of making every CFAA unauthorized
access case involving the transfer data an unauthorized damage case. But this
cannot have been Congress’ intent, as it clearly delineated between unauthorized

29

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 36 of 55

access claims and unauthorized damage claims and provided for different penalties
for both. Compare 18 U.S.C. § 1030(a)(2)(C) with 18 U.S.C. § 1030(a)(5)(A). It is
a basic canon of statutory construction to avoid a reading of a statute that renders
sections redundant. See Chickasaw Nation v. U.S., 534 U.S. 84, 94 (2001), See also
Ratzlaf v. U.S., 510 U.S. 135, 140-41 (1994). Additionally, a charge under §
1030(a)(5)(A) automatically adds four points to a defendant’s U.S. Sentencing
Guidelines’ Calculation. (See U.S.S.G. § 2B1.1(b)(18)(A)(2).) The plain text of the
CFAA, as well as the Sentencing Guidelines, supports the common sense view that
unauthorized access is a separate crime from unauthorized damage, to be punished
in different ways.
Yet, by allowing a broad definition of CFAA Damage to include the mere
copying of data allows prosecutors to turn most CFAA unauthorized access cases
into unauthorized damage cases even where no data has been deleted, impaired, or
rendered inaccessible. This thwarts Congressional intent, and a plain text reading
of the CFAA, to limit the scope of unauthorized damage to some actual harm to a
computer or access to it and renders much of the CFAA superfluous as most
unauthorized access cases could simply be charged under § 1030(a)(5)(A).
C. CFAA Damage Should be Based on Actual Harm and Not
Speculative Harm
A lurking issue in this case is what it means for the “integrity” of the data to
be impaired. See 18 U.S.C. § 1030(e)(8) (“the term “damage” means any

30

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 37 of 55

impairment to the integrity or availability of data, a program, a system, or
information”). Implicit in the minority of cases that hold copying of data, and the
view that possession of usernames and passwords, impairs the integrity of the data
is a notion of integrity of the data being compromised by the mere unauthorized
possession of the data, or the threat that damage could occur even if it hasn’t. Some
courts point to a 1996 Senate Report that mentions this possibility in passing
without much analysis. See, e.g. Gen. Motors L.L.C. v. Autel. US Inc., No. 1414864, 2016 WL 1223357, at *10 (E.D. Mich. Mar. 29, 2016) (“the legislative
history of the [CFAA] supports the conclusion that intentionally rendering a
computer system less secure should be considered 'damage' under § 1030(a)(5)(A),
even when no data, program, or system, is damaged or destroyed.” (citation
omitted).); see also See S. REP. N0.104-357, at 11 (1994). But the CFAA has been
amended numerous times since 1996, and the view that the integrity of data or a
system can be impaired by the mere threat of harm is outdated, if it ever was a
valid concept to begin with.
Likewise, the 2000 case Shurgard Storage Centers, Inc. v. Safeguard Self
Storage, Inc., 119 F.Supp.2d 1121(W.D.Wash.2000), that is often cited for the
proposition that copying files can be CFAA Damage, is no longer good law
because of subsequent amendment to the CFAA. See Garelli Wong & Associates,
Inc. v. Nichols, 551 F. Supp. 2d 704, 710 (N.D. Ill. 2008) (“We also point out that

31

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 38 of 55

the CFAA was amended after the decision in Shurgard . . . . Reliance [on it] is no
longer compelling in light of the statutory amendments and other cases decided
post-amendment.”); Resdev, LLC v. Lot Builders Ass'n, Inc., No. 6:04-CV-1374,
2005 WL 1924743, at *5 (M.D. Fla. Aug. 10, 2005) (rejecting Shurgard). Given
the CFAA’s extensive history of amendment, a passing mention in a twenty-yearold Senate Report on the CFAA is not sufficient to broaden the definition of CFAA
Damage such that it vitiates a large portion of the statute by turning almost every
unauthorized access crime into an unauthorized damage crime merely because
information was obtained or new user accounts created.
Additionally, District Courts have rightly pointed out that Shurgard’s
definition of CFAA “integrity” runs counter to the plain dictionary meaning of
“integrity.” See Resdev, LLC v. Lot Builders Ass'n, Inc., No. 6:04-CV-1374, 2005
WL 1924743, at *5 (M.D. Fla. Aug. 10, 2005) (“Integrity however, ordinarily
means “wholeness” or “soundness,” Oxford English Reference Dictionary 731
(Rev. 2nd ed.2002), and contemplates, in this context, some diminution in the
completeness or useability of data or information on a computer system.”);
Worldspan, L.P. v. Orbitz, LLC, No. 05-CV-5386, 2006 WL 1069128, at *5 (N.D.
Ill. Apr. 19, 2006) (“The CFAA does not define “integrity,” but the dictionary
definition is “an unimpaired or unmarred condition: entire correspondence with an
original condition: SOUNDNESS.” Webster's Third New International Dictionary

32

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 39 of 55

1174 (1971) (emphasis in the original).). Shurgard and its progeny run contrary to
the majority of District Courts in the country that hold that CFAA damage must
involve some type of actual impairment to a computer or the rendering of that
system inaccessible. See Phillips, 2016 WL 1532220, at *4 (“Defendants cite
multiple cases holding that “damage” means actual harm to computers or networks
as a result of a defendant's unauthorized accessed to a protected computer, rather
than economic harm due to the commercial value of the data itself.”) (collecting
cases). Thus, for there to be CFAA Damage, there must be actual harm to a
computer system, whether through the deletion of data or rendering it inaccessible.
Finally, as this Court noted in U.S. v. Nosal, the CFAA is not a
misappropriation of information statute, it is for the most part an anti-hacking
statute. See U.S. v. Nosal, 676 F.3d 854, 863 (9th Cir. 2012) (“[T]he plain language
of the CFAA “target[s] the unauthorized procurement or alteration of information,
not its misuse or misappropriation.” (citation omitted).) Thus, because neither the
copying of data nor the creation of new usernames and password is not
unauthorized procurement of information, nor its alteration, copying data or the
creation of user accounts is not CFAA Damage. Consequently, no CFAA loss can
follow.

33

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 40 of 55

D. Creation of User Accounts is Not CFAA Damage Because It Does
Not Delete Data, Impair Data, or Access to Data, or System
Functionality
The creation of usernames and passwords is a basic function of many shared
computer systems or databases. At trial, the government introduced evidence
regarding the creation of user accounts by Mr. Keys, which the government
repeatedly called “backdoors,” as proof of CFAA Damage. The Trial Court at one
point commented that the creation of user accounts evidence could support the
charges in the Indictment. (ER at 99, 100, 134 (RT 353:4-18; 414:10-17; 801:2023).) As such the Trial Court endorsed the view that the creation of user accounts
could constitute CFAA damage by impairing the “integrity” of the data and/or
system. But, as discussed directly above, this runs contrary to the majority view of
CFAA Damage and the dictionary definition of “integrity.”
There was no testimony that any data was impaired, deleted, or rendered
inaccessible merely by the creation of the user accounts. Rather, new data was
added to the system - the new usernames and passwords - and the system
functioned normally as it would with the routine creation of any user account. It
may have been unauthorized access to enter the CMS and create the user accounts,
but the Government did not charge this. It charged unauthorized damage when
there was none.

34

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 41 of 55

E. It Was Error to Deny a Jury Charge Stating That if the Jury Found
the Data was Backed up There was No CFAA Damage.
The latimes.com website edit did not constitute damage as the “integrity or
availability” of the information was never impaired. Several District Courts have
agreed with the theory that deletion of data does not constitute CFAA Damage
where that information is otherwise available. For example, Instant Tech., LLC v.
DeFazio, 40 F. Supp. 3d 989, 1019 (N.D. Ill. 2014) aff'd, 793 F.3d 748 (7th Cir.
2015) held that there was no CFAA Damage where deleted information remained
available in email trash folder and on another computer accessible to the Plaintiff.
Grant Mfg. & Alloying, Inc. v. McIlvain, No. 10-CV-1029, 2011 WL 4467767, at
*8 (E.D. Pa. Sept. 23, 2011); aff'd, 499 F. App'x 157 (3d Cir. 2012) held that
because the records marked for deletion were still available and accessible there
was no CFAA damage. Cheney v. IPD Analytics, L.L.C., No. 08-CV-23188, 2009
WL 1298405, at *6 (S.D. Fla. Apr. 16, 2009) held that the “deletion of files alone
does not constitute damage. . . if the deleted data is still available to the plaintiff
through other means.”). Dana Ltd. v. Am. Axle & Mfg. Holdings, Inc., No. 1:10CV-450, 2012 WL 2524008, at *6 (W.D. Mich. June 29, 2012) held there was no
CFAA damage where deleted files could be recovered. Thus, it was error not to
permit the Jury to consider whether the existence of previous versions of the
latimes.com story meant there was no CFAA Damage.

35

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 42 of 55

Moreover, there was no testimony at trial that conclusively established that
any files were deleted. Rather, the trial testimony is consistent with the proposition
that the changes to the latimes.com website story simply constituted a new saved
version of the story, one that was easily restored to its prior version via the CMS, a
CMS system that did not have its functionality impaired in any way and functioned
at all relevant times as it was programed to do. (ER at 92-93 (RT 228:23 – 229:9).)
Thus, while Mr. Keys alleged actions may have been an instance of unauthorized
access, they did not cause CFAA Damage sufficient for a conviction under Section
1030(a)(5)(A).
F. The Rule of Lenity Requires a Narrow Interpretation of CFAA
Damage
The CFAA cases cited above that discuss the meaning of impairment to the
“integrity” of the data or system are all civil. Our research turned up no criminal
CFAA cases that analyzed whether copying data, creating new user accounts, or
the mere threat of harm to a system constituted CFAA Damage. Given the
ambiguity in the definition of CFAA Damage as evidenced by the above case-law,
the Rule of Lenity requires that CFAA Damage be interpreted narrowly because
“ambiguity concerning the ambit of criminal statutes should be resolved in favor of
lenity.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1134 (9th Cir. 2009); see
also Nosal, 676 F.3d at 863 (“We construe criminal statutes narrowly so that
Congress will not unintentionally turn ordinary citizens into criminals.”) Given the

36

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 43 of 55

District Courts nationally are divided on what it means to impair the “integrity” of
data, CFAA Damage should be construed solely to apply to instances where actual
harm to a computer occurs, or a computer is rendered inaccessible.
G. The Jury Was Permitted to Consider Harms Not Cognizable as
CFAA Loss
The penalties for a violation of § 1030(a)(5)(A) are determined in part by the
amount of “loss” established at trial. See § 1030 (c)(4)(A)-(G). In this particular
case, to establish felony liability, the Government needed to establish loss
exceeding $5,000. (ER at 219 (CR 118 at 24).). “Loss” is defined as “any
reasonable cost to any victim, including the cost of responding to an offense,
conducting a damage assessment, and restoring the data, program, system, or
information to its condition prior to the offense, and any revenue lost, cost
incurred, or other consequential damages incurred because of interruption of
service.” § 1030(e)(11). District Courts have limited cognizable loss to those
directly related to “computer impairment or computer damages.” Farmers Ins.
Exch. v. Steele Ins. Agency, Inc., No. 2:13-CV-00784-MCE, 2013 WL 3872950, at
*21 (E.D. Cal. July 25, 2013); see also BHRAC, LLC v. Regency Car Rentals,
LLC, No. CV 15-CV-865, 2015 WL 3561671, at *3 (C.D. Cal. June 4, 2015). This
interpretation excludes excludes business losses, or other loss revenue not directly
related to the computer impairment. Farmers, 2013 WL 3872950 at *21; see also
BHRAC, 2015 WL 3561671 at *3. To the extent that CFAA Loss in this case was

37

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 44 of 55

based on improper notions of CFAA Damage the Jury was presented with CFAA
Loss numbers that should have been excluded.
H. The Loss Numbers Were Speculative and No Expert Established that
they Were Reasonable
While it is not always necessary to have an expert testify to CFAA Loss
numbers, there should have been such testimony in this case given the highly
speculative nature of the loss numbers submitted to the Jury. As discussed above,
good deal of the alleged CFAA Loss numbers entered into evidence were related to
the response to the Cancer Man emails and included activities not related to
responding to a computer impairment such as phone calls, emails and meetings to
discuss the impact of the Cancer Man email campaign on subscribers or
employees. Additionally, a good deal of CFAA Loss testimony in this case was
based on Tribune Company employees testifying to their salary at the time and the
time they allegedly spent responding to the Cancer Man emails course of conduct
or the edit of the latimes.com story. No expert testimony established that any of
these loss figures were reasonably related to the intrusion, investigation, or
response to the latimes.com story edit.
III. THE INTRODUCTION OF IRRELEVANT AND HIGHLY
PREJUDICIAL EVIDENCE REQUIRES REVERSAL
"Unfair prejudice" refers to an "undue tendency to suggest decision on an
improper basis, commonly, though not necessarily, an emotional one" or "evidence
designed to elicit a response from the jurors that is not justified by the evidence." 2

38

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 45 of 55

Jack B. Weinstein & Margaret A. Berger, Weinstein's Federal Evidence, §
403.04[1][b] (Joseph M. McLaughlin, ed., Matthew Bender 2d ed. 1997). Here, the
cumulative impact of irrelevant and prejudicial evidence that was admitted against
Mr. Keys tainted the entire trial.
At the top of its opening statement the Government described to the Jury the
the Cancer Man email campaign. (ER at 7 (RT 12:9-22).) As discussed above, the
emails predate and are unconnected with the edit of the latimes.com story.
Moreover, as argued above, the Cancer Man emails did not damage any computer
systems. The emails at most exhibit misappropriation of information.
Alongside the Cancer Man email campaign, the Government presented to
the Jury evidence such as the copying of the Green Links Database email address
list and the creation of user accounts on the CMS that did not constitute CFAA
Damage. Not only was this information irrelevant to the Government’s actual
charges against Mr. Keys, but it was inflammatory and prejudicial. The
government’s reliance on uncharged conduct gravely enhanced the danger that
empaneled jurors viewed Mr. Key’s guilt to be established by evidence that was
unrelated to the offenses being tried. This danger was particularly apparent, given
the fact that final jury charges failed to caution the Jury from factoring the Cancer
Man email campaign into its final decision. Further, Jury Instructions No. 21 and

39

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 46 of 55

No. 22 instructed the Jury to consider conduct occurring outside the time frame in
which the latimes.com story was edited. (ER at 218-219 (CR 118 at 23-4).)
The Ninth Circuit has rightly been particularly cautious in safeguarding
against prejudicial evidence with minimal probative value. See U.S v. Ellis, 147
F.3d 1131, 1136 (9th Cir. Or. 1998). (reversing the conviction of defendant
charged with receiving and concealing stolen explosives due to improper
admission of evidence of the destructive capability of the stolen explosives); U.S.
v. 20 Layton, 767 F.2d 549, 553 (9th Cir. 1985)(reversing defendant’s conviction
due to unduly prejudicial tape recordings of multiple suicides).
In U.S. v. Bland, 908 F.2d 471, 474 (9th Cir. 1990), the defendant, like Mr.
Keys, waived his Miranda Rights when making a statement to the Government. Id.
at 472. The Ninth Circuit reversed the defendant’s conviction because at voir dire
the district court told the jury venire of the details underlying the warrant for the
defendant’s arrest. Id. Despite the defendant’s confession, the Court determined
that the district court’s error was not harmless: it held that these comments
influenced the jury to the extent that the defendant could no longer enjoy a fair
trial. Id.
As held in Bland, the admission of prejudicial and irrelevant evidence in the
instant case should not be characterized as harmless error simply because Mr. Keys
made a prior statement to the government. Rather, Mr. Keys is constitutionally

40

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 47 of 55

entitled to a fair trial, and was deprived of this right once the government elected to
rely on unindicted conduct to prove its case. The cumulative effect of all the
improperly introduced, highly prejudicial, evidence denied Mr. Keys’ right to a fair
trial by needlessly confusing the Jury.
IV. THE GOVERNMENT EVIDENCE WAS INSUFFICIENT TO
PROVE THAT MATTHEW KEYS ATTEMPTED TO DAMAGE
TRIBUNE’S COMPUTER SYSTEMS
Count Three of the Indictment alleges that Keys attempted to transmit a
program, information, code, or command intended to cause damage without
authorization to a protected computer that would have aggregated to at least $5000
in loss. (ER at 241 (Indictment at p. 6 ¶ 1-2).) At the close of trial, the Defense
moved for acquittal under Fed. R. Crim. P. 29 on the grounds that the Government
had not met its evidentiary burden for attempt. (ER at 115-116 (RT 724-725).) Mr.
Keys motion was denied. (ER at 119 (RT 731:25).) Denied motions for acquittal
are reviewed de novo. Yossunthorn, 167 F.3d at 1270. The Court of Appeals will
uphold a conviction when, “viewing the evidence in the light most favorable to the
prosecution, any rational trier of fact could have found the essential elements of the
crime beyond a reasonable doubt. Id. To prove attempt, the Government must
prove that Mr. Keys (1) had the specific intent to commit the charged crime, and
(2) he committed an overt act which was a substantial step towards committing the
charged crime. See U.S. v. Gracidas-Ulibarry, 231 F.3d 1188, 1192 (9th Cir.

41

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 48 of 55

2000). The Government’s evidence to satisfy either of these elements was
insufficient.
To establish attempt, the Government introduced an IRC conversation in
which Mr. Keys communicates to a co-conspirator, “Sharpie,” that he can grant
him access to the Tribune CMS again. (ER at 112 (RT 641:22-23); ER at 256 (GX
506).) While Mr. Keys is attempting to regain access to the Tribune CMS, Sharpie
discusses possible strategies for damaging Tribune’s computer systems, including
the possibility of replacing the “whole front page layout” of the Chicago Tribune.
(ER at 112-113 (RT 641-642); ER at 256 – 257 (GX 506, GX 507).) The
Government also introduced computer logs that show Mr. Keys actually engaged
in efforts to login to the Tribune CMS. (ER at 114 (RT 645:12-17).) The IRC
conversations, and the computer logs showing Mr. Keys trying to login to the
Tribune CMS, were the only evidence introduced by the Government to satisfy
attempt. (ER at 117-118 (RT 726-727).) This evidence is insufficient to establish
either element of the offense.
Proof of specific intent must be as to each element of the charged crime
“even when the statute [does] not contain an explicit intent requirement.”
Gracidas-Ulibarry, 231 F.3d at 1192 (citing U.S. v. Darby, 857 F.2d 623, 626 (9th
Cir. 1988).) Applying this principle to an attempt to commit § 1030(a)(5)(A), the
Government must prove that Keys intended to transmit a program, information,

42

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 49 of 55

code, or command, and that this transmission was intended to cause damage
without authorization to a protected computer. The only transmissions that Keys
actually made was directed at accessing the Tribune CMS. (ER at 114 (RT 645:1217).) Mr. Keys himself characterized these transmissions as intended to grant
Sharpie access to the system. (ER at 112-113 (RT 641-642); ER at 256-257 (GX
506, GX 507).) Thus the Government’s evidence, at best, establishes that Keys
intended to grant a third-party unauthorized access2 to the Tribune CMS, not that
he intended to damage the Tribune CMS.
The Government also failed to prove that Keys took a substantial step to
damage a protected computer. Actions that merely demonstrate Keys was
preparing to damage a protected computer are not sufficient. Hernandez-Cruz v.
Holder, 651 F.3d 1094, 1102 (9th Cir. 2011), as amended (Aug. 31, 2011) (“Mere
preparation to commit a crime does not constitute a substantial step.”). Rather, the
substantial step must be of a kind that it “unequivocally” demonstrates that a
protected computer would have been damaged “unless interrupted by independent
circumstances.” Id. Actions that are “necessary” to commit a crime, even when
undertaken with “unquestionably criminal” intent, are also not sufficient. Id. For
example, putting on a disguise in the parking lot of a bank was not considered
2

Access a computer without authorization is a separate crime under the CFAA, 18
U.S.C. § 1030(a)(2), and was not charged here.

43

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 50 of 55

sufficient even where the defendant admitted that his preparations were for the
purpose of robbing the bank. The court reasoned that for an action to be a
“substantial step” it must “establish a sufficiently clear external manifestation of
the suspect's specific intent to rob a particular bank in a particular manner in the
immediate future.” Id. at 1102–03 (citing U.S. v. Still, 850 F.2d 607, 609 (9th Cir.
1988).).
Mr. Keys’ attempt to login to the CMS, and ostensibly grant Sharpie access,
is analogous to the defendant discussed in Still and Hernandez-Cruz preparing a
disguise and weapons for use in the commission of the substantive offense. In
attempting to login, Mr. Keys was, at best, trying to lay the groundwork for
Sharpie to potentially carry out one of the various strategies for damaging
Tribune’s computer systems. (ER at 112-113 (RT 641-642); ER at 256-257 (GX
506, GX 507).) It is not clear, however, that once Sharpie got access whether he or
Keys would have sought to actually damage the Tribune’s front page, alter one
article as Sharpie had already done, or abandoned their plans to damage the
Tribune entirely. See Holder, 651 F.3d at 1103 (“[E]ven after extensive
preparations, a suspect could well decide to desist from his criminal endeavor.”).
Granting access was not a “clear external manifestation” of a specific intent to
damage a particular website or computer system much like preparing disguises was
not considered a clear manifestation to rob a particular bank. See id. Thus, the

44

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 51 of 55

Government has failed to establish that Keys took a substantial step towards
commission of the substantive crime, seeking to damage a particular protected
computer.
V. THE RESTITUTION AWARD WAS NOT SUPPORTED BY THE
PREPONDERANCE OF THE EVIDENCE
The Government's evidence submitted to support restitution does not satisfy
the preponderance of the evidence standard, and should be vacated or amended.
“[T]he district court [may] utilize only evidence that possesses ‘sufficient indicia
of reliability to support its probable accuracy.’” U.S. v. Waknine, 543 F.3d 546,
557 (9th Cir. 2008) (quoting U.S. v. Garcia-Sanchez, 189 F.3d 1143, 1148-49 (9th
Cir.1999)). Specifically, the Government “must provide the district court with
more than just the general invoices” identifying losses for restitution. U.S v.
Menza, 137 F.3d 533, 538-39 (7th Cir. 1998). The Government must also provide
“sufficient explanations (supported by evidence reflected in the record)” showing
those losses directly relate to the charged conduct. Id.; accord U.S. v. Brock-Davis,
504 F.3d 991, 1002 (9th Cir. 2007).
The Government presented no invoices or receipts documenting the
$200,00.00 of restitution it attributed to the alleged need to rebuild the Green Links
Database. (ER at 163 (Restitution RT 12:21-24).) Indeed, no evidence was
presented at trial that any “customers” were lost or that the Green Links Database
was deleted, or needed to be rebuilt, or was damaged in any way. (ER at 88 (RT

45

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 52 of 55

149:10-22).) The $200,000.00 figure was apparently calculated, according to
hearsay statements in an FBI 302 report submitted at the restitution hearing, on the
basis of $10 a lost “customer.” (ER at 163 (Restitution RT 12:18-13:4).)
Additionally, the Government’s evidence at trial contradicts some of the
evidence it presented at the restitution hearing. The calculations of hourly rates
used for the restitution calculations for some of the Tribune Company employees
contradicts their testimony as to the salaries they were paid. (ER at 160 – 162
(Restitution RT 8:14 – 10:14).)
Even if there was no contradiction in the numbers, they are improperly based
on a summary of alleged loss. It is error for the Trial Court to “rely[] exclusively
on the one-page loss summaries provided by the victims” Waknine, 543 F.3d at
546. The Trial Court adopted its Restitution amount based on a short summaries
provided by the Tribune Company to the Government that were then summarized
by the Government at the Restitution Hearing. (ER at 163-164 (Restitution RT
12:25 – 13:11).) In addition to contradicting testimony about employees' salaries,
these summaries do not provide the detailed explanation of loss required by
Waknine. See id.
The evidence presented to support restitution does not meet the relatively
lenient standard of a preponderance of the evidence. It is based on contradictory
testimony and documentation, and not supported by the trial record. The employee

46

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 53 of 55

time-cost documents are unreliable summaries, lacking specifics necessary to
satisfy the standard. The database loss sheet does not explain how the alleged
database loss could have resulted directly from the charged conduct. For the above
reasons, the restitution order should be remanded to the district court for rehearing.
CONCLUSION
For the forgoing reasons Mr. Key’s conviction should be reversed. In
the alternative, a new trial should be ordered and the restitution order against him
should be vacated, or the Court should order such relief as it sees just.

Dated: August 24, 2016

Respectfully Submitted,
By:

_/s/Tor Ekeland___________
Tor Ekeland
Mark H. Jaffe
TOR EKELAND, P.C.
195 Plymouth Street
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5417
tor@torekeland.com
mark@torekeland.com
Jason S. Leiderman, SBN 203336
LAW OFFICES OF JAY
LEIDERMAN
5740 Ralston Street, Suite 300
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
jay@criminal-lawyer.me
Pro Bono Attorneys for
Defendant Matthew Keys

47

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 54 of 55

CERTIFICATE OF SERVICE
I hereby certify that on August 24, 2016, I electronically filed the foregoing
with the Clerk of the Court for the U.S. Court of Appeals for the Ninth Circuit by
using the appellate CM/ECF system.
I certify that all participants in the case are registered CM/ECF users and
that service will be accomplished by the appellate CM/ECF system.

By:

_/s/Tor Ekeland___________
Tor Ekeland
TOR EKELAND, P.C.
195 Plymouth Street
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5417
tor@torekeland.com
Jason S. Leiderman, SBN 203336
LAW OFFICES OF JAY
LEIDERMAN
5740 Ralston Street, Suite 300
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
jay@criminal-lawyer.me
Pro Bono Attorneys for
Defendant Matthew Keys

48

 Case: 16-10197, 08/24/2016, ID: 10100046, DktEntry: 22, Page 55 of 55

Certificate of Compliance with Rule 32
Certificate of Compliance With Type-Volume Limitation, Typeface
Requirements, and Type Style Requirements
1.
This brief contains 12,745 words, excluding the parts of the brief
exempted by Fed. R. App P. 32(a)(7)(B)(iii).
2.
This brief complies with the typeface requirements of Fed. R. App. P.
32(a)(5) and the type style requirements of Fed. R. App. P. 32(a)(6) because this
brief has been prepared in a proportionally spaced typeface using Microsoft Word
for Mac Version 15.24 in 14 point Times New Roman font.
Dated: August 24, 2016
By:

/s/Tor Ekeland___________
Tor Ekeland
TOR EKELAND, P.C.
195 Plymouth Street
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5417
tor@torekeland.com
Jason S. Leiderman, SBN 203336
LAW OFFICES OF JAY
LEIDERMAN
5740 Ralston Street, Suite 300
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
jay@criminal-lawyer.me
Pro Bono Attorneys for
Defendant-Appellant Matthew
Keys

49