(1 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 1 of 6

NOT FOR PUBLICATION
UNITED STATES COURT OF APPEALS

FILED

FOR THE NINTH CIRCUIT
JUN 26 2017
MOLLY C. DWYER, CLERK

UNITED STATES OF AMERICA,
Plaintiff-Appellee,

No.

16-10197

U.S. COURT OF APPEALS

D.C. No.
2:13-cr-00082-KJM-1

v.
MEMORANDUM*

MATTHEW KEYS,
Defendant-Appellant.

Appeal from the United States District Court
for the Eastern District of California
Kimberly J. Mueller, District Judge, Presiding
Argued and Submitted June 13, 2017
San Francisco, California
Before: SCHROEDER and N.R. SMITH, Circuit Judges, and BATTAGLIA,**
District Judge.
Defendant Matthew Keys appeals his conviction and sentence under the
Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. We affirm.
1.

Keys was not subjected to a constructive amendment, which occurs

*

This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.
**

The Honorable Anthony J. Battaglia, United States District Judge for
the Southern District of California, sitting by designation.

 (2 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 2 of 6

when (1) the government presents at trial “a complex of facts . . . distinctly
different” from those in the indictment, or (2) the trial proof or jury instructions
alter the crime charged, making it “impossible to know whether the grand jury
would have indicted for the crime actually proved.” United States v. Mancuso, 718
F.3d 780, 792 (9th Cir. 2013) (citation omitted). Neither standard is met here.
The superceding indictment alleged that, after Keys’s employment ended, he
“kept and used, for malicious purposes, login credentials to the Tribune
Company’s CMS [(content management system)]”; “identified . . . Fox 40 . . . as [a
target] for online intrusion and web vandalism”; “obtain[ed] control of at least one
additional username and password . . . to log in and make changes to Tribune
Company’s CMS”; and intended “to damage computer systems used by Tribune
Company.” These allegations encompassed Keys’s conduct prior to December 8.
Because, after this date, Keys used credentials he created well after his
employment ended, the allegation that he used credentials he kept after his
employment necessarily refers to prior conduct, such as the Fox 40 emails and
creating back-door access. Importantly, the superseding indictment expanded
Count II’s date range. The only practical purpose of this expansion was to add
Keys’s conduct between October 28 and December 8. A common-sense reading of
the indictment as a whole, including facts that were necessarily implied, see United
2

 (3 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 3 of 6

States v. Livingston, 725 F.3d 1141, 1148 (9th Cir. 2013), shows that the
government tried Keys only on facts presented to the grand jury. Therefore, the
government did not prove a complex of facts distinctly different from those in the
indictment. See Mancuso, 718 F.3d at 792.
The government did not try Keys for unauthorized access, because Keys’s
use of back doors was CFAA “damage.” 18 U.S.C. § 1030(e)(8). Keys’s illicit
conduct for the entire period of Count II stemmed from the facts that he “kept and
used . . . login credentials to the Tribune Company’s CMS,” and “obtain[ed]
control of at least one additional username and password.” Acquiring and creating
passwords that can be used as back-door access points to a computer system in the
future impair the security of that system. See United States v. Middleton, 231 F.3d
1207, 1212 (9th Cir. 2000);1 Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887,
894–95 (N.D. Cal. 2010). Prior to Keys’s conduct, the CMS existed in a certain
state of security. Keys made the CMS far weaker by taking and creating new user
accounts. This manipulation of user accounts and login credentials (not Keys’s
access) impaired the system.
2.

The district court did not allow the jury to consider harms not

1

Although the provision defining “damage” was amended after Middleton,
“[t]he new [CFAA] version defines ‘damage’ the same way [as the prior version].”
Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 934 (9th Cir. 2004).
3

 (4 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 4 of 6

cognizable as CFAA damage or loss. Keys makes a scattershot of arguments
concerning damage and loss, none of which is persuasive. Keys’s taking and
creating new user accounts (not downloading the email list) was the CFAA
damage. Middleton, 231 F.3d at 1212. His conduct directly resulted in the damage;
therefore, the damage was not “speculative harm,” as argued by Keys.
The district court did not err in declining to instruct the jury that information
altered by a defendant was not damaged under the CFAA, if the original version
was not permanently lost. We are not persuaded by the out-of-circuit district court
cases Keys cites, none of which involve circumstances analogous to the alteration
of the L.A. Times website. The temporary unavailability of the original article, and
the posting of an altered version, fall within the statutory definition of “damage”:
“impairment to the integrity or availability of data, a program, a system, or
information.” 18 U.S.C. § 1030(e)(8). The website was not able to function as
intended while the customers could not access the article. The district court
properly instructed the jury using the statutory definitions of “damage” and “loss.”
3.

By re-styling his contentions on the issues above, Keys argues the

district court admitted unfairly prejudicial evidence. We reject these arguments.
4.

Concerning the attempt charge, the government presented evidence

sufficient for the jury to find that Keys had the required intent and took a
4

 (5 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 5 of 6

substantial step toward the offense. See United States v. Gracidas-Ulibarry, 231
F.3d 1188, 1192 (9th Cir. 2000) (en banc). At the time of Keys’s December 15
chatroom discussion with the hacker, Keys knew the hacker had attacked the L.A.
Times only hours earlier. Thus, when the hacker told Keys he was going to alter
the entire front page, Keys knew the hacker was capable. Possessing this
knowledge, Keys showed the required intent when he made an unsolicited offer to
get the hacker back into the CMS and then actually tried to do so.
Although Keys argues his efforts to get the hacker back into the system
amount only to unauthorized access, gaining access to the CMS is a substantial
step toward accomplishing the damage. In fact, providing access to more skilled
hackers was as far (toward the initial L.A. Times alteration) as Keys was able to
go, based on his computer skills. Although signing into his VPN to cover his tracks
was mere preparation for Keys, by affirmatively trying to take what he knew would
be his final step toward completing the damage, Keys took a “substantial step.” See
United States v. Still, 850 F.2d 607, 609–10 (9th Cir. 1988). The fact that
something outside his control prevented the offense from going forward does not
save him.
5.

The district court found the amount of restitution by a preponderance

of the evidence, considering evidence with “sufficient indicia of reliability.” See
5

 (6 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-1, Page 6 of 6

United States v. Waknine, 543 F.3d 546, 556–57 (9th Cir. 2008) (citation omitted).
Concerning employee response time, the district court did not abuse its discretion
by relying on loss estimates based on employees’ testimonies or on the worksheet
prepared by a Fox 40 executive. In response to Keys’s challenge to inconsistences
in the employee salary evidence, the district court appropriately re-reviewed the
trial testimony and considered the amount in light of national statistics on the value
of non-liquid employee benefits.
The government presented evidence that nearly all of the 20,000 Fox 40
Rewards Program members cancelled their participation in response to Keys’s
conduct. Starting essentially from square one, the database took three years to
rebuild. The district court did not abuse its discretion in relying on the Fox 40
executive’s representation that this process cost $200,000. It was appropriate for
the district court to order restitution in the amount it cost Fox 40 to replace the
member database, as it would be difficult to determine the fair market value of
such an asset. See United States v. Kaplan, 839 F.3d 795, 801–02 (9th Cir. 2016).
The restitution was reasonably based on Fox 40’s actual losses and did not
result in a windfall to the victims. See id. at 802. Keys’s arguments to the contrary
are unpersuasive.
AFFIRMED.
6

 (7 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-2, Page 1 of 5

United States Court of Appeals for the Ninth Circuit
Office of the Clerk
95 Seventh Street
San Francisco, CA 94103
Information Regarding Judgment and Post-Judgment Proceedings
Judgment
•

This Court has filed and entered the attached judgment in your case.
Fed. R. App. P. 36. Please note the filed date on the attached
decision because all of the dates described below run from that date,
not from the date you receive this notice.

Mandate (Fed. R. App. P. 41; 9th Cir. R. 41-1 & -2)
•
The mandate will issue 7 days after the expiration of the time for
filing a petition for rehearing or 7 days from the denial of a petition
for rehearing, unless the Court directs otherwise. To file a motion to
stay the mandate, file it electronically via the appellate ECF system
or, if you are a pro se litigant or an attorney with an exemption from
using appellate ECF, file one original motion on paper.
Petition for Panel Rehearing (Fed. R. App. P. 40; 9th Cir. R. 40-1)
Petition for Rehearing En Banc (Fed. R. App. P. 35; 9th Cir. R. 35-1 to -3)
(1)

A.
•

•

B.
•

Purpose (Panel Rehearing):
A party should seek panel rehearing only if one or more of the following
grounds exist:
►
A material point of fact or law was overlooked in the decision;
►
A change in the law occurred after the case was submitted which
appears to have been overlooked by the panel; or
►
An apparent conflict with another decision of the Court was not
addressed in the opinion.
Do not file a petition for panel rehearing merely to reargue the case.
Purpose (Rehearing En Banc)
A party should seek en banc rehearing only if one or more of the following
grounds exist:

Post Judgment Form - Rev. 08/2013

1

 (8 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-2, Page 2 of 5
►
►
►

Consideration by the full Court is necessary to secure or maintain
uniformity of the Court’s decisions; or
The proceeding involves a question of exceptional importance; or
The opinion directly conflicts with an existing opinion by another
court of appeals or the Supreme Court and substantially affects a
rule of national application in which there is an overriding need for
national uniformity.

(2)

Deadlines for Filing:
•
A petition for rehearing may be filed within 14 days after entry of
judgment. Fed. R. App. P. 40(a)(1).
•
If the United States or an agency or officer thereof is a party in a civil case,
the time for filing a petition for rehearing is 45 days after entry of judgment.
Fed. R. App. P. 40(a)(1).
•
If the mandate has issued, the petition for rehearing should be
accompanied by a motion to recall the mandate.
•
See Advisory Note to 9th Cir. R. 40-1 (petitions must be received on the
due date).
•
An order to publish a previously unpublished memorandum disposition
extends the time to file a petition for rehearing to 14 days after the date of
the order of publication or, in all civil cases in which the United States or an
agency or officer thereof is a party, 45 days after the date of the order of
publication. 9th Cir. R. 40-2.

(3)

Statement of Counsel
•
A petition should contain an introduction stating that, in counsel’s
judgment, one or more of the situations described in the “purpose” section
above exist. The points to be raised must be stated clearly.

(4)

Form & Number of Copies (9th Cir. R. 40-1; Fed. R. App. P. 32(c)(2))
•
The petition shall not exceed 15 pages unless it complies with the
alternative length limitations of 4,200 words or 390 lines of text.
•
The petition must be accompanied by a copy of the panel’s decision being
challenged.
•
An answer, when ordered by the Court, shall comply with the same length
limitations as the petition.
•
If a pro se litigant elects to file a form brief pursuant to Circuit Rule 28-1, a
petition for panel rehearing or for rehearing en banc need not comply with
Fed. R. App. P. 32.

Post Judgment Form - Rev. 08/2013

2

 (9 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-2, Page 3 of 5

•

•

The petition or answer must be accompanied by a Certificate of Compliance
found at Form 11, available on our website at www.ca9.uscourts.gov under
Forms.
You may file a petition electronically via the appellate ECF system. No paper copies are
required unless the Court orders otherwise. If you are a pro se litigant or an attorney
exempted from using the appellate ECF system, file one original petition on paper. No
additional paper copies are required unless the Court orders otherwise.

Bill of Costs (Fed. R. App. P. 39, 9th Cir. R. 39-1)
•
The Bill of Costs must be filed within 14 days after entry of judgment.
•
See Form 10 for additional information, available on our website at
www.ca9.uscourts.gov under Forms.
Attorneys Fees
•
Ninth Circuit Rule 39-1 describes the content and due dates for attorneys fees
applications.
•
All relevant forms are available on our website at www.ca9.uscourts.gov under Forms
or by telephoning (415) 355-7806.
Petition for a Writ of Certiorari
•
Please refer to the Rules of the United States Supreme Court at
www.supremecourt.gov
Counsel Listing in Published Opinions
•
Please check counsel listing on the attached decision.
•
If there are any errors in a published opinion, please send a letter in writing
within 10 days to:
►
Thomson Reuters; 610 Opperman Drive; PO Box 64526; St. Paul, MN 551640526 (Attn: Jean Green, Senior Publications Coordinator);
►
and electronically file a copy of the letter via the appellate ECF system by using
“File Correspondence to Court,” or if you are an attorney exempted from using
the appellate ECF system, mail the Court one copy of the letter.

Post Judgment Form - Rev. 08/2013

3

 (10 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-2, Page 4 of 5
Form 10. Bill of Costs ................................................................................................................................(Rev. 12-1-09)

United States Court of Appeals for the Ninth Circuit
BILL OF COSTS
This form is available as a fillable version at:
http://cdn.ca9.uscourts.gov/datastore/uploads/forms/Form%2010%20-%20Bill%20of%20Costs.pdf .
Note: If you wish to file a bill of costs, it MUST be submitted on this form and filed, with the clerk, with proof of
service, within 14 days of the date of entry of judgment, and in accordance with 9th Circuit Rule 39-1. A
late bill of costs must be accompanied by a motion showing good cause. Please refer to FRAP 39, 28
U.S.C. § 1920, and 9th Circuit Rule 39-1 when preparing your bill of costs.
9th Cir. No.

v.
The Clerk is requested to tax the following costs against:

Cost Taxable
under FRAP 39,
28 U.S.C. § 1920,
9th Cir. R. 39-1

REQUESTED
(Each Column Must Be Completed)
No. of
Docs.

Pages per
Doc.

TOTAL
COST

Cost per
Page*

ALLOWED
(To Be Completed by the Clerk)
No. of
Docs.

Cost per
Page*

Pages per
Doc.

TOTAL
COST

Excerpt of Record

$

$

$

$

Opening Brief

$

$

$

$

Answering Brief

$

$

$

$

Reply Brief

$

$

$

$

Other**

$

$

$

$

TOTAL: $

TOTAL: $

* Costs per page: May not exceed .10 or actual cost, whichever is less. 9th Circuit Rule 39-1.
** Other: Any other requests must be accompanied by a statement explaining why the item(s) should be taxed
pursuant to 9th Circuit Rule 39-1. Additional items without such supporting statements will not be
considered.
Attorneys' fees cannot be requested on this form.
Continue to next page

 (11 of 11)
Case: 16-10197, 06/26/2017, ID: 10487587, DktEntry: 58-2, Page 5 of 5
Form 10. Bill of Costs - Continued

I,

, swear under penalty of perjury that the services for which costs are taxed

were actually and necessarily performed, and that the requested costs were actually expended as listed.

Signature
("s/" plus attorney's name if submitted electronically)
Date
Name of Counsel:

Attorney for:

(To Be Completed by the Clerk)
Date

Costs are taxed in the amount of $
Clerk of Court
By:

, Deputy Clerk