Matthew Keys, a 26-year-old Reuters social media editor who has been charged with helping Anonymous attack the website of his former employer, often boasted about his interactions with the shadowy hacker group.
In a March 18, 2011, blog post on his personal Tumblr, Keys wrote that he spent two months communicating on Internet chatrooms with what he called "top level hackers within Anonymous."
"I identified myself as a journalist during my interaction with the top-level Anonymous hackers and at no time did I offer said individuals any agreement of confidentiality," he wrote. "In fact, I asked several of them for their feelings should they be exposed. They seemed, by and large, indifferent."
But on Thursday, federal authorities said Keys's interactions with the hackers went beyond journalism. The Justice Department charged him with conspiracy for giving members of Anonymous usernames and passwords to alter the website of his former employer, KTXL FOX40, after he was fired from the Sacramento, Calif., television station. Keys allegedly told the hackers to "go f**k some s**t up."
Keys faces up to 25 years in prison and fines of up to $750,000, though it’s unlikely he would receive a penalty that large if convicted. He did not return phone calls or emails Thursday seeking comment.
According to authorities, Keys used the screenname AESCracked to communicate in December 2010 with members of Anonymous in a chatroom known as #internetfeds. At one point, Keys said, "it takes a while to grant one username permission to every site. I'm doing that now," according to the indictment.
Authorities say hackers used information provided by Keys to alter a story on the website of the Los Angeles Times, which like KTXL is owned by the Tribune Co. According to authorities, Keys stated he would use a Virtual Private Network to "cover [his] tracks" but discovered the company had cut off his account.
"I'm locked out for good," Keys wrote, according to the indictment. ":(."
Keys wrote a blog post for Reuters last year about his experience communicating with members of Anonymous. In the story -- headlined “The InternetFeds: Inside hacker Sabu’s war room" -- he revealed that he gained access to a top-secret chatroom that alleged hacker "Sabu" and others used between December 2010 and January 2011.
Keys later disclosed on his blog that he provided chat logs of his online interactions with Anonymous to the website Gawker, PBS NewsHour and "an overseas news organization," whose name he did not reveal.
A separate court document in the case indicates that Hector Xavier Monsegur, the hacker formerly known as "Sabu," appeared in the chatroom and "offered advice on how to conduct the network intrusion."
“I think that Sabu might have trusted me at that time,” Keys wrote in his Reuters story, saying the hacker had “confided in me some personal details.”
Two years ago, Monsegur appeared to publicly accuse Keys of involvement in the hacking of the LA Times' website. In March 2011, a Twitter handle linked to Sabu tweeted that Keys "gave full control of LATimes.com to hackers." Monsegur later became a cooperating informant on Anonymous.
Keys, who has an extensive online presence, once wrote about leaving his job at KXTL under less-than-ideal circumstances, alleging he was fired after an argument about a tweet.
On his blog, Keys said his boss fired him four days after he announced he was leaving, though the official paperwork said Keys was “laid off.” (The DOJ indictment says Keys had been “terminated.”)
Keys wrote that he gave his boss “a reason to let me go when an argument ensued in front of the newsroom over -- of all things -- a tweet.” He called Tribune Co. a “bankrupt news organization that didn’t value its employees on the assembly line,” and wrote that he was on unemployment benefits for eight months after he left the company.
“After a few weeks, reality set in: I had a lot of good ideas, but no income, no benefits, no real network of colleagues and no idea how I was going to land somewhere new,” Keys wrote.
Brandon Mercer, the news director at KTXL, declined to comment Thursday, referring questions to Tribune Co. spokesman Gary Weitman. Weitman also declined to comment.
“The whole ‘being fired from a job you love for being just a bit too daring’ was one of the most-humbling experiences of my life,” Keys wrote in a separate blog post in early 2012.
Keys is currently a deputy social media editor at Thomson Reuters. A Reuters spokesman said the news agency was reviewing the charges.
“Thomson Reuters is committed to obeying the rules and regulations in every jurisdiction in which it operates,” spokesman David Girardin said in a statement. “Any legal violations, or failures to comply with the company’s own strict set of principles and standards, can result in disciplinary action.”
Keys is a well-known personality on Twitter, where he has more than 23,000 followers and has sent more than 68,000 tweets, mostly about breaking news. True to form, around 4:30 p.m. on Thursday, Keys re-tweeted the news of his own indictment.
A few hours later, he sent another tweet: "I am fine. I found out the same way most of you did: From Twitter. Tonight I'm going to take a break. Tomorrow, business as usual."