Inside the Matthew Keys case and why the government charged him under hacking laws
Why the Government Went After Matthew Keys — On October 4, 2012, two FBI agents visited the home of Matthew Keys, aged 25, in Secaucus, New Jersey. At the time, he was the deputy social media editor for Reuters.
Context & Ripple Effects
This explainer lands three days after a jury found Matthew Keys guilty under the Computer Fraud and Abuse Act, and it reconstructs how the case started: two FBI agents visiting the then-deputy social media editor for Reuters at his Secaucus home in October 2012, over his role in the 2010 Los Angeles Times intrusion.
What makes the case worth dissecting is who ended up as the defendant. [[a:836026|Leaked FBI documents show the agency knew the actual hacker's identity for at least two years without charging him]], leaving Keys — the man accused of handing over access — to carry the prosecution alone.
First-order effects
- Keys heads into a January sentencing hearing where the US attorney's office has signaled it may seek less than the five-year statutory maximum, after the CFAA conviction.
- A working journalist is being prosecuted as a hacker in his own right: the charge attaches to his facilitation of the 2010 LA Times breach, not any intrusion he personally executed.
Second-order effects
- Accountability looks asymmetric once the leaked documents revealed the FBI sat on the real hacker's identity for two years — ammunition for critics who argue CFAA charging decisions punish facilitators more readily than principals.
- Press–FBI friction compounds: AP, Vice Media, and Gannett are separately suing the agency for records on the San Bernardino iPhone break-in, carrying the same adversarial dynamic into transparency litigation.
Third-order effects
- The charging playbook scales across borders and roles — DOJ's pursuit of the 2020 Twitter breach ran from charges against suspects including a 19-year-old in the UK to Joseph James O'Connor's five-year sentence, extending CFAA-style liability to foreign nationals and accessory conduct.
- With sentences escalating — Keys ultimately drew 24 months and an appeal — the pattern feeds a widening structural debate over whether the statute's breadth criminalizes journalism-adjacent conduct and needs legislative narrowing.
The trend: US prosecutors are steadily extending Computer Fraud and Abuse Act liability from the intruders themselves to facilitators and foreign suspects, with sentences ratcheting upward from Keys's two years to O'Connor's five.