The indictment charged Keys with three criminal counts, including conspiracy to transmit information to damage a protected computer. The indictment said that he promised to give hackers access to Tribune Co websites and that a story on the Tribune’s Los Angeles Times website was later altered by one of them.
Keys did not respond to requests for comment. On Twitter, he posted a comment several hours after the indictment was handed down that stated: “I found out the same way most of you did: From Twitter. Tonight I’m going to take a break. Tomorrow, business as usual.”
The company did not comment on Keys’s employment status. However, a Thomson Reuters employee at the New York office where Keys worked said that his computer was being dismantled and that his security pass had been deactivated.
The documents in the case paint a picture of a disgruntled former Tribune employee who fell in with some of the most notorious hackers in the country—and then worked with them, as well as against them.
The case began in early December 2010, when Fox 40, a Tribune-owned television station in Sacramento, Calif., received emails saying someone had claimed to have an internal list of employees, according to an affidavit for a search warrant submitted by Los Angeles-based Federal Bureau of Investigation agent Gabriel Andrews.
A former colleague suggested Keys as a suspect, according to the FBI affidavit, because he had been terminated as an employee in October 2010 and then refused to hand over control of the Facebook and Twitter accounts he had run for Fox 40.
Within weeks of the first suspicious email, the affidavit said Keys told the same colleague that he had penetrated an elite chat group used by some of the most sophisticated members of Anonymous. According to the affidavit, Keys said he had learned of upcoming attacks on the Tribune’s Los Angeles Times, eBay’s PayPal and other companies. Two days later, a story on Latimes.com was defaced.
When Keys learned that a member of the hacking group had changed the Times story, Keys responded “nice,” according to the indictment.
Transcripts of the electronic chats excerpted in the affidavit and the indictment show someone using the nickname AESCracked offered to grant access to Tribune computers to others in the chat group. “Let me see if I can find some other users/pass I created while there,” he wrote after previous credentials were denied access, the indictment said. Keys was believed to be AESCracked, according to the indictment.
The documents appear to show Keys playing a dangerous double game for weeks before getting kicked out of the chat group. As a journalist between jobs, he took screenshots of the hacking group’s chats and sent them to media outlets, he wrote later on a personal blog cited by the FBI.
He claimed credit for that work in a posting on his personal website in March 2011, writing: “I identified myself as a journalist during my interaction.”
But others in the chat room were furious at the leaks. The leading figure, known as Sabu, said on Twitter days later that Keys was AESCracked and “gave full control of LATimes.com to hackers.”
Sabu, subsequently identified as Hector Xavier Monsegur, was arrested later in 2011 and began cooperating secretly with the FBI while continuing to lead an Anonymous spinoff called LulzSec, according to court documents.
Keys, now 26 and living in New Jersey, went to work for another television station before joining Reuters in January 2012 as deputy social media editor. He was relatively well known on Twitter, amassing more than 23,000 followers for his personal account, apart from his tweets under the Reuters brand.
He also wrote longer blog entries for Reuters, including at least two about Anonymous. In a March 2012 entry, after Sabu’s exposure, Keys blogged about how he had gained entry to the elite chat group called InternetFeds and said Sabu had confided his New York location and other details.
The case against Keys is being prosecuted by Benjamin Wagner, U.S. Attorney for the Eastern District of California, which includes Sacramento.
In an interview, Wagner said that Keys appeared to have been acting against Tribune primarily as an angry former employee.
But because Keys could have claimed he was acting as a journalist, Wagner said the case was taken to high-level officials at the Justice Department in Washington for approval multiple times “out of an abundance of caution.”