Matthew Keys sentenced to 24 months under the Computer Fraud and Abuse Act for his role in 2010 LA Times hack, must surrender to custody June 15, plans appeal
Former Reuters Journalist Matthew Keys Sentenced to Two Years for Hacking — This story has been updated throughout with further information from the sentencing.
Context & Ripple Effects
Keys has been in legal limbo since he was found guilty of hacking under the Computer Fraud and Abuse Act last October, when the US attorney's office indicated it might seek less than the statutory maximum of five years. Today's 24-month sentence lands at the low end of that range but still makes him one of the few working journalists prosecuted under federal hacking statutes — a case Motherboard examined in depth when explaining why the government charged him under hacking laws rather than any other frame.
First-order effects
- Keys must surrender to custody on June 15 and immediately shifts from defense to appellate posture, keeping the CFAA question alive through another court cycle.
- The sentence sets a concrete benchmark inside this case file: the government asked for less than five years at conviction and secured half that, a data point for how prosecutors value a journalist's role in the 2010 LA Times intrusion.
Second-order effects
- Measured against comparable US sentences — Joseph James O'Connor's five years for the 2020 Twitter account hijackings and the Toronto man's five years plus $250K fine for Yahoo-breach email hacks — Keys' two years suggests judges calibrate CFAA punishment partly to scale of harm, not just the statute invoked.
- Newsrooms take note: a Reuters byline convicted under hacking law reinforces the pressure on media employers to treat reporters' security research or source-driven access as legally hazardous territory.
Third-order effects
- If the appeal holds, it becomes another test of whether the CFAA's breadth — the critique at the center of the case coverage — can reach conduct that looks like journalism-adjacent access rather than classic intrusion.
- Across the corpus of CFAA sentences here, the pattern points toward multi-year prison terms becoming the default outcome for hacking convictions, with prosecutorial discretion at charging time doing most of the work the statute's vague boundaries leave undone.
The trend: US courts are settling into multi-year sentences as the standard penalty for Computer Fraud and Abuse Act convictions, while appeals like Keys' probe how far hacking law extends into journalistic conduct.