Associated Press/Rich Pedroncelli
The case has provoked outrage online over federal prosecutors' handling of computer crimes.
Keys was indicted in 2013 for conspiracy to cause damage to a protected computer and two other counts, after being accused of giving hackers access to Tribune computer systems in December 2010. He was found guilty by a California jury last October.
The Justice Department had requested a five year sentence, while Keys sought probation.
In a statement posted Wednesday on the website Medium, Keys wrote that he is innocent, and expressed hope that the policies and laws governing Americans' online conduct would change as a result of his case.
"Under today's
Keys was prosecuted under the Computer Fraud and Abuse Act (CFAA), the federal anti-hacking statute which has been criticized in recent years for its harsh penalties. The law sparked national debate in 2013 after internet activist Aaron Swartz took his own life just months before he was scheduled to go to trial under the law. The 26-year-old had been indicted for downloading academic articles from JSTOR - crimes that could have yielded a 50-year prison sentence and $1 million fine.
In response to Swartz's case, some lawmakers proposed "Aaron's Law," a bill that attempted to ease the CFAA's stiff penalties before it stalled in Congress.
"The CFAA is so inconsistently and capriciously applied it results in misguided, heavy-handed prosecution," one of the bill's supporters, Senator Ron Wyden (D-Ore.), said last April, according to The Hill. "Aaron's Law would curb this abuse while still preserving the tools needed to prosecute malicious attacks."
Later in 2013, the law again attracted scrutiny when it was used to sentence the Anonymous hacker Jeremy Hammond to 10 years in prison. Hammond had faced a potential 30-year prison sentence before he pleaded guilty to one count of computer fraud and abuse for hacking into Stratfor, a private intelligence firm, and delivering 5 million stolen emails to WikiLeaks.
Keys sounded off on his displeasure with CFAA in a series of tweets on Wednesday.
BTW: Sharing a Netflix password is a terrorism offense under the broken CFAA law. Worth reading considering today. - https://t.co/y9tDUINA2h
- Matthew Keys (@MatthewKeysLive) April 13, 2016
Critics of the law took to Twitter on Wednesday to protest the outcome of Keys' case, pointing out the disproportionate harshness of his sentence in contrast to the severity of his crime. Many noticed that Ethan Couch, the so-called "affluenza teen" who was ordered by a judge to remain in jail Wednesday, received the same prison sentence as Keys, despite causing the deaths of four people.
Others pointed out that despite Keys' prosecution, the hackers who committed the actual website defacement have never been charged. Wired reported last year that US authorities have known the identity of the real hacker - allegedly a 35-year-old living in Scotland - but never pursued charges.
"Affluenza Teen" who murdered people got 2 years in prison today, as did @MatthewKeysLive who only defaced a website https://t.co/pGYcmUoiXi
- Xeni (@xeni) April 13, 2016
to say what happened to @MatthewKeysLive is a travesty doesn't even begin to describe it, but it's a start. https://t.co/bltnWNip9T
- chelsea hassler (@chelseaadelaine) April 13, 2016
Attorneys for Keys could not immediately be reached for comment. A spokesman for Tribune Media Co also could not be reached for comment.
The charges against Keys alleged that in 2010, shortly after Keys left a job at a Tribune-owned television station in Sacramento, Calif., following a dispute with a supervisor, a story on the Tribune's Los Angeles Times website was altered by Anonymous hackers.
Prosecutors contended that Keys urged on the hackers after supplying a password. Keys's lawyer argued he was operating as a professional reporter trying to gather information about members of Anonymous, an amorphous group that often conducts multiple hacking campaigns at once.
The alleged events in the indictment occurred before Keys joined Thomson Reuters as an editor for Reuters.com in 2012. A month after Keys was charged, he said Reuters dismissed him. A Thomson Reuters representative had declined to comment on the case.
(Reporting by Dan Levine; Editing by Tiffany Wu)