Opinion
No. 2:13-cr-00082-KJM
04-19-2021
United States of America, Plaintiff, v. Matthew Keys, Defendant.
ORDER
The government alleges Matthew Keys deleted his former employer's YouTube channel while serving a term of supervised release. As explained in this order, it has carried its burden to prove that allegation by a preponderance of the evidence.
I. EVIDENCE
Keys was originally indicted in 2013 on charges related to a scheme that resulted in unauthorized changes to an article on the Los Angeles Times website. See Indictment, ECF No. 1; Superseding Indictment, ECF No. 44 (citing 18 U.S.C. §§ 371, 1030(a)(5)(A)). The government also suspected Keys had sent threatening emails to employees at a local TV station where he used to work. See Order on Mot. Suppress at 4-5, ECF No. 34. Keys later confessed to sending the emails and to his role in changing the Los Angeles Times article. See id. at 19-25; see also generally Interview Tr., ECF No. 23-5. After a jury trial to resolve other disputes, for example about the amount of the losses the Los Angeles Times suffered, see generally, e.g., Def.'s Trial Br., ECF No. 88, Keys was convicted on all three counts of the superseding indictment. See Verdict Form, ECF No. 123. This court sentenced him to twenty-four months' incarceration and twenty-four months' supervised release. J. & Commitment, ECF No. 155; Am. J. & Commitment, ECF No. 175. The terms of Keys's supervised release included a prohibition against committing any federal, state, or local crimes. Am. J. & Commitment at 4. The Ninth Circuit upheld his sentence and conviction on appeal. See generally United States v. Keys, 703 F. App'x 472 (9th Cir. 2017) (unpublished).
After Keys completed his custodial term, he began working as the digital editor at Comstock's Magazine. Hr'g Tr. 20-21, 62. Comstock's is a monthly business magazine with both print and online editions. Id. at 29-30. Keys wrote stories for Comstock's and managed its website and social media accounts, including a YouTube channel. See id. at 21-22, 36, 40-41, 62-63; see also Ex. 47 at 1. The magazine published all of its videos on YouTube, and it used embedded links to YouTube videos in stories published on its own website. See Hr'g Tr. at 22.
Exhibits cited in this order are those listed for potential admission at evidentiary hearing. See Gov't Ex. List, ECF No. 200; Def. Ex. List, ECF No. 204. The government's exhibits are numbered, and Keys's exhibits are identified by letters.
Keys resigned abruptly in late January 2020, a little less than a year after he started and about three months before his term of supervised release was set to expire. See id. at 33, 63; see also Pet. for Warrant or Summons at 4, ECF No. 185. His resignation "stunned" the magazine's publisher, who valued his work "immensely" and had a good working relationship with him. Ex. I; Hr'g Tr. 44-45, 47. She refused his resignation, she asked him to wait, not to quit, and she urged him to spend some time recovering from an illness and to talk with her later when he was better. Ex. I. Despite her pleas, Keys did not stay, and although his personal interactions with the publisher herself did not founder, his departure with the magazine as a business entity was not on good terms. He "refused" to turn over the "credentials" for "all" of the magazine's "log-in accounts." Hr'g Tr. at 63. A few weeks after he left, he emailed the publisher, copying the executive editor. See id. at 33-35, 43; Ex. 49. He described his frustrations with "mismanagement, micromanagement, and aggressive vindictiveness" by the editors. See generally Ex. 49. He accused editors of badgering him after hours, interrupting his sick leave, creating a hostile work environment, "making comments about protected classes," spreading lies about his work, and lying about the reasons for his departure. See id. at MK 000101. He also pursued complaints at the California Department of Labor and Federal Trade Commission; he claimed that the magazine had violated federal advertising regulations. See id.; Ex. 47 at MK 000071.
A new assistant editor was hired to take Keys's place after he left. Hr'g Tr. at 20, 37, 62. Soon after she started, she checked the magazine's YouTube channel to see what was available to her as a resource. Id. at 22. She was able to see dozens of videos. Id. at 22-23. This was a Friday—February 7, 2020, about two weeks after Keys resigned. Id. at 22-23, 65. The next Thursday—six days later, February 13, 2020—she went back to the magazine's YouTube channel because she wanted to share some videos about chocolate making for Valentine's Day. Id. at 23, 65. But she found she couldn't log into the Google account associated with the magazine's YouTube channel. Id. at 23. The password had been changed without her knowing. See Ex. 50 at MK000011. And the YouTube channel itself was gone. Id.; Hr'g Tr. at 23. She checked the magazine's website, where normally there were embedded links to its YouTube videos. Hr'g Tr. at 23, 27. The links were "broken." Id. at 27.
The magazine had no choice but to start a new YouTube account. It recovered some of the lost videos from its backups, but not all of them, id. at 24-25; Ex. 48, and it lost its nearly 700 YouTube subscribers, see Ex. 48, which it could not recover, Hr'g Tr. at 76. Recreating the lost channel took almost sixty hours of work, Hr'g Tr. at 25, and investigating and responding to the deletion required another week's work, see id. at 76.
Comstock's filed a police report. Id. at 38. Before anything came of that report, the magazine's own investigation led it to suspect that Keys had deleted the YouTube channel. See id. The employee who had revoked Keys's access rights after he resigned had not known about the Google account hosting the channel, so Keys could have logged into that account, changed the password, and deleted the YouTube channel even after he resigned. See id. at 63-64. The magazine was stymied in its attempt to secure the Google account because Google's two-factor authentication system was sending the necessary verification numbers to Keys. See id. at 65-68; Ex. 7. Comstock's eventually recovered the account using an alternative verification method, relying on Keys's old work email address. See Hr'g Tr. at 69-70; Exs. 3 & 50. It then checked the account history. It learned someone in California had logged in with an iPhone during the early morning hours of February 9, 2020, the Sunday before the magazine discovered that its YouTube channel had disappeared. See Ex. 50 at MK 000012. A few minutes later, the same iPhone sent instructions to change the recovery email and to change the Google account's password. See id. Keys had used an iPhone to manage the account while he worked at Comstock's. See id. at MK 000013. After checking the account history, the magazine contacted federal prosecutors and the FBI with its suspicions. Hr'g Tr. at 38-39.
One way the government was able to investigate the magazine's allegations was to check the computer monitoring software the Probation Office used to track Keys's laptop use during his supervised release, which was still in effect at the time. Id. at 90-91. The monitoring software took periodic screenshots, which were sent to his supervising officer. Id. It had captured screenshots of someone using Keys's computer to log into an Apple iCloud account related to Comstock's at about the same time the Google password was changed in the early morning hours of February 9, 2020. See id. at 95-96; Exs. 1 & 39. Other screenshots from about the same time show log-in screens for other accounts bearing the magazine's name, including for a password management service. See Hr'g Tr. at 105-08; Exs. 34, 36-41, 43.
The government also obtained Google's records of login and logout activity for the magazine's account. See Hr'g Tr. at 197; Ex. A. These records confirmed that someone had logged into the account in the early morning hours of February 9, 2020. See Ex. A at MK 00272; Hr'g Tr. at 198-99. The government also obtained Google's records for Keys's personal email account. See Hr'g Tr. at 200; Ex. B. Both the Comstock's and personal email records included IP addresses, but those addresses do not match. Compare Ex. A at MK 000272 with Ex. B at MK 000262; see also Hr'g Tr. at 201-02. The government offered the testimony of an FBI special agent, Heriberto Cadena, about these records and the discrepancy. Agent Cadena is trained in cyber investigations and cyber intrusions, including through coursework and certifications. See Hr'g Tr. at 179-80. He has been on the Sacramento Field Office's cyber squad for a little more than four years. See id. at 180. He found the difference between the IP addresses in the record here to be inconclusive; IP addresses may change over time and location, they may differ if someone is using a virtual private network, and they can be obfuscated, for example with software such as Tor. See Hr'g Tr. at 223-25, 229, 231.
Unlike his laptop, the Probation Office did not remotely monitor Keys's iPhone during his supervised release. Id. at 91-92. The Probation Office searched Keys's apartment on March 11, 2020, a little more than a month after he had resigned, and it found an iPhone, which was sent to a specialist for a search. See id. at 98, 109-10, 125-26; Ex. 2 at 1-2. The data on the phone confirmed it belonged to Keys. For example, the phone contained text messages in which Keys described his decision to resign from Comstock's. See Ex. 2 at 6.
The specialist also found suspicious browsing history from the early morning hours of Monday, February 10, 2020, the night after someone had changed the Google account password. Someone had used Keys's phone to visit the mobile version of Comstock's YouTube channel, i.e., the page displayed for the address https://m.youtube.com. Ex. 2 at 6-7; see also Hr'g Tr. at 135-36, 181-82. Seventeen seconds later, the phone recorded a Google search for "how to delete youtube channel." Ex. 2 at 7; Hr'g Tr. at 183-84. And twenty seconds after that, the browser history showed a visit to YouTube's desktop website, i.e., http://www.youtube.com, where the user logged into a Google account and then navigated through several addresses of advanced options. Ex. 2 at 7-8. These addresses followed the sequence that would have occurred if someone followed the steps described in search results for "how to delete youtube channel." See Hr'g Tr. at 183-85. Finally, after a few more seconds, the following web address appeared in the phone's browser history:
https://myaccount.google.com/u/0/youtubeoptions/deletesuccess Ex. 2 at 8; see also Hr'g Tr. 140-41. Agent Cadena attempted to replicate this trail of addresses using a different iPhone and a different YouTube channel. See Hr'g Tr. at 186, 190-92. The exercise generated a "strikingly similar" web history and resulted in the successful deletion of the test YouTube channel and all of its videos. Id. at 186, 190-92.
Keys's supervising probation officer interviewed him after this investigation. Id. at 99. His attorney was present. Id. Despite the evidence described above, Keys denied deleting the YouTube account. See id. He suggested the allegations against him were in retaliation for his whistleblower complaint. Id. He also denied having access to the Google account after he resigned in a written statement, and he said that someone at Comstock's, likely the executive editor, had accidentally deleted the YouTube channel. See id. at 99-101; Ex. 47 at MK 000070, 72. He suspected the magazine had revoked his access to the Google account without first transferring control of the YouTube channel to another user. See Ex. 47 at MK 000070, 72. He did not claim to have had authorization to access the Google account or delete the YouTube channel after his resignation. Keys also claimed the magazine's executive editor had lied to police. According to Keys, it would have been impossible for the editor to know what exactly had been lost unless he or another Comstock's employee had personally and intentionally closed the YouTube account. See id. at MK 000072-73.
A few days after the interview, Keys's supervising probation officer filed a petition alleging Keys had violated the terms of his supervised release. ECF No. 185. It asserted two new law violations under 18 U.S.C. § 1030(a)(5)(A) and California Penal Code section 502(c)(4), which include similar prohibitions against causing damage to computers, as discussed in more detail below. The court held an initial revocation hearing on August 31, 2020, in which it granted Keys's request for an evidentiary hearing. See Minutes, ECF No. 198. The parties each submitted prehearing briefs, see Gov't Br., ECF No. 199; Def. Br., ECF No. 213, and the court held an evidentiary hearing by videoconference on February 18, 2021, see Minutes, ECF No. 214. The government presented testimony from the assistant editor hired to take Keys's place, the magazine employee who had investigated the deleted channel, the magazine's executive editor, Keys's supervising probation officer, the investigator who analyzed Keys's iPhone, and Agent Cadena, the FBI special agent mentioned above. Keys cross-examined these witnesses and had an opportunity to call his own witnesses but declined to do so. Neither party called the magazine's publisher, who, as summarized above, had initially refused Keys's resignation and had urged him not to leave. The matter was submitted after written closing arguments. See Gov't Post Br., ECF No. 217; Def. Post Br., ECF No. 216; Gov't Reply, ECF No. 219; Def. Reply, ECF No. 220.
II. LEGAL STANDARD
A district court may revoke a term of supervised release if it "finds by a preponderance of the evidence that the defendant violated a condition of his supervised release." 18 U.S.C. § 3583(e)(3). The court must give notice of the hearing, the alleged violation, the evidence, and the person's right to representation by counsel. See Fed. R. Crim. P. 32.1(b). The court must also give the person an opportunity to appear and present evidence and an opportunity to question any adverse witnesses. See id. The Federal Rules of Evidence do not govern the admission of evidence in revocation hearings, see Fed. R. Evid. 1101(d)(3), but people who are alleged to have violated the conditions of their supervised release "are entitled to certain minimal due process requirements," including "the right to confront and cross-examine adverse witnesses." United States v. Walker, 117 F.3d 417, 420 (9th Cir. 1997) (citation and quotation marks omitted).
III. DISCUSSION
The government alleges Keys violated conditions of his supervised release that required him to comply with all federal, state, and local laws. It cites both federal and California laws. The federal law is 18 U.S.C. § 1030(a)(5)(A), a provision of the Computer Fraud and Abuse Act. That section imposes criminal liability on anyone who "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer." The definition of "protected computer" includes computers "used in or affecting interstate or foreign commerce or communication," among others not relevant here. 18 U.S.C. § 1030(e)(2)(B). "[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8).
The government has carried its burden to prove a violation of § 1030(a)(5)(A) by a preponderance of the evidence. The weight of the evidence shows Keys transmitted the command that deleted Comstock's YouTube channel. Managing that channel was one of his responsibilities at the magazine, where he controlled the user name and password. He kept those credentials after he resigned. And soon after he resigned, in the early morning hours between February 9 and 10, the password for the magazine's Google account was changed, a recovery email address deleted, and the only recovery tools available to secure the account were Keys's old Comstock's email address and his phone number. Google's records for the same timeframe confirmed that someone logged into Comstock's account. Monitoring software captured screenshots of someone using Keys's laptop to look at accounts and passwords related to Comstock's during that same early-morning window. And the next night, the browsing history on Keys's iPhone shows it was used to search for "how to delete youtube account," that it navigated through the YouTube options necessary to delete an account, and that it landed on a YouTube address containing the text string "deletesuccess." A few days later, the magazine discovered its YouTube account had been deleted. No evidence suggests anyone other than Keys had access to his iPhone.
The evidence also shows Keys acted intentionally. The deletion occurred only a few weeks after Keys resigned abruptly and acrimoniously. The YouTube channel was deleted only a few minutes after Keys's iPhone recorded a late-night Google search for "how to delete youtube account." And when Probation asked whether he had deleted the YouTube channel, he denied that he had access to the Google account after he resigned. Not only does his denial undercut any suggestion that he in fact had authorization; given the extensive evidence of his post-resignation access, the denial is best understood as a false exculpatory statement and evidence of a culpable state of mind.
It is impossible to conclude on this record that Comstock's authorized Keys to access its Google account or delete its YouTube channel after he resigned. The magazine attempted to revoke his access to all of its accounts immediately after his resignation. The only reason it did not revoke his access to the Google account was its employee's initial ignorance of that account. No evidence suggests anyone at the magazine wanted to delete the YouTube channel or would ///// ///// ///// have agreed that Keys could do so. Rather, the opposite is true. One of the first things Keys's replacement did after she arrived was check what videos were available on the YouTube channel. She discovered the channel was missing because she wanted to use it. Keys's behavior confirms he had no authorization. As noted above, he denied having access.
Finally, Keys does not dispute that the government has carried its burden to prove the damaged computer was used in or affected interstate commerce. See Gov't Post Br. at 8 n.2. The court agrees it has. See United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012) (en banc) (explaining definition of "protected computer" encompasses "effectively all computers with Internet access").
The government also alleges Keys violated California Penal Code section 502(c)(4). That section imposes criminal liability on anyone who "[k]nowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network." This section therefore imposes a similar burden as the federal statute. Keys himself argues the burdens are "the same." See Def. Post Br. at 2 n.1. The government has likewise carried its burden to prove a violation of this section under the relevant standard. Keys knowingly accessed the Google account Comstock's used to manage its YouTube channel. He deleted the channel without permission, thus deleting the videos and subscriber data on that channel.
Keys's contrary interpretations of the record are not plausible. He argues first that he had authorization from Comstock's publisher to access the Google account and to delete the YouTube videos, relying primarily on the Ninth Circuit's decision in Nosal and emails between the publisher and an elusive "freelance journalist" named Leonard Karetnikov, which were not admitted into evidence during the evidentiary hearing, see generally Def. Post Br.; Ex. K. He asks now to admit those emails, and he argues they prove his authorization to access the Google account after his departure. See Def. Post Br. at 5-7.
In Nosal, the court interpreted the phrase "exceeds authorized access." It limited that phrase "to violations of restrictions on access to information, and not restrictions on its use." 676 F.3d at 864 (emphases in original). The phrase "exceeds authorized access" does not appear in the provision of the Computer Fraud and Abuse Act that Keys is alleged to have violated, § 1030(a)(5)(A). Section 1030(a)(5)(A) punishes anyone who "intentionally causes damage without authorization." And these two phrases—"without authorization" and "exceeds authorized access"—mean different things. See Nosal, 676 F.3d at 858. "Without authorization" refers to access by people "who have no authorized access to the computer at all." Id. "Exceeds authorized access," by contrast, refers to access by people "whose initial access to a computer is authorized but who access unauthorized information or files." Id. Here, Keys acted "without authorization." After his departure, he did not have authorization to access the magazine's account at all. Distinctions between "use" and "access" are irrelevant here, so Keys's citation of Nosal is not persuasive.
The court also denies Keys's request to admit and give consideration to the emails Comstock's publisher exchanged with Karetnikov. In these emails, Karetnikov asked the publisher for comments on the allegations against Keys, which she briefly offered before asking in a follow-up email not to be quoted. Neither the publisher nor Karetnikov testified during the evidentiary hearing, and the contents of these emails raise more questions than they answer. According to the government, there is no such person as "Leonard Karetnikov," and the real sender cannot be identified because the email account the sender used, Proton Mail, makes it "very difficult" to identify its accountholders. See Gov't Reply at 2 n.1; Hr'g Tr. at 208. Even if the emails were admitted, the court would give them no weight. At most they might show (1) Comstock's publisher thought it was possible Keys had permission to access the magazine's accounts after he resigned and (2) if Keys had deleted the YouTube channel, she thought it was an accident. If anything, her belief that the deletion was an accident suggests Keys did not have authorization to delete the channel. Nor does this email exchange outweigh the evidence described above, which shows clearly that Keys did not have authorization to access the magazine's accounts: he resigned, his employment ended, the magazine attempted to revoke his access to all of its accounts, and Keys did not claim he had authorization or access after he left when the Probation Department confronted him about the deleted channel. /////
Keys also argues the theory on which the government relies to meet its burden here is implausible because it depends on the incorrect assumption that a YouTube account can be deleted with a mobile device. Def. Br. at 3; Def. Post Br. at 8 (citing Ex. E). The only evidence Keys cites to support that claim is an undated Google support page stating that "you can't delete a channel on mobile devices right now." As shown at the evidentiary hearing, that statement is not absolute. The government has proven it is possible to delete a YouTube channel on a mobile device by requesting the desktop site. See, e.g., Hr'g Tr. at 186, 190-92, 202-03, 221-22.
The court admits the support page into the record and takes judicial notice that the same phrase appears at the same URL at the time of this writing. See YouTube Help, "Delete or Hide Your YouTube Channel," available at https://support.google.com/youtube/answer/55759?hl=en#zippy=%2Cdelete-your-channel-permanently, last visited April 19, 2021.
Keys next contends he could not have been the one who changed the Google password because the IP address associated with the late-night logins was different than the IP address associated with a device used to access Keys's own Google account. See Def. Br. at 2. This evidence deserves little weight. As noted above, the government elicited unrebutted testimony from Agent Cadena that the differences between these IP addresses are inconclusive. See Hr'g Tr. at 223-25, 231.
Finally, Keys argues the testimony of the Comstock's employee who investigated the password change shows she was the one who used an iPhone to access the Google account. Def. Post Br. at 7. His argument misconstrues her testimony. She said only that a report of suspicious activity referred to an iPhone, not that this iPhone belonged to her. See Hr'g Tr. at 83 ("Q. . . . What I'm getting at is this screenshot here came from . . . Google, right? And it tells us the recent suspicious activities, right? A Correct. Q And it says—it will tell us what device did that as well, right? A Yes. Q And it says this is an iPhone, Apple iPhone, right? A Correct.").
IV. CONCLUSION
The government has proven by a preponderance of the evidence that Keys violated the terms of his supervised release as set forth in the pending petition charging violations in the form of committing a new law violation under 18 U.S.C. § 1030(a)(5)(A) (Charge 1) and committing a new law violation under California Penal Code section 502(c)(4) (Charge 2). See ECF No. 185. The matter is set for a dispositional hearing on May 24, 2021 at 9:00 a.m.
IT IS SO ORDERED. DATED: April 19, 2021.
/s/_________
CHIEF UNITED STATES DISTRICT JUDGE