USA v. Keys: Defense Motions in Limine

Tor Ekeland, Pro Hac Vice
tor@torekeland.com
Tor Ekeland, P.C.
195 Plymouth Street, 5th Floor
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5147
Jason S. Leiderman, SBN 203336
jay@criminal-lawyer.me
Law Office of Jay Leiderman
5740 Ralston Street, Suite 300
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
Pro Bono Attorneys for Defendant
Matthew Keys
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF CALIFORNIA
2:13-CR-00082-KJM
UNITED STATES OF AMERICA,
Plaintiff,
v.
MATTHEW KEYS,
Defendant.
DEFENDANTS NOTICE OF
MOTIONS IN LIMINE
Date:
Time:
Court:
September 25, 2015

9:00am
Hon. Kimberly J. Mueller
PLEASE TAKE NOTICE THAT on the above date and time, or as soon thereafter as the
matter can be heard in the above courtroom or such other courtroom to which the motion is
assigned, Defendant Matthew Keys, by and through counsel, will move the court to exclude the
following pieces of evidence for the reasons in the attached Memorandum In Support of His
Motions in Limine:
1
Notice of Defendants Motions in Limine
1
2
3
4
1) irrelevant, speculative, and prejudicial loss numbers unrelated to the alleged Computer
Fraud and Abuse Act (CFAA) charges;
2) all loss numbers because the government has not noticed any expert that can substantiate
them;
3) irrelevant and prejudicial emails allegedly sent by the defendant that are unrelated to the
alleged CFAA damage and that are also inadmissible under Federal Rule of Evidence
404(b);
4) irrelevant, prejudicial evidence of a 2008 restraining order against the Defendant; and
5) chat and server logs seized from the late Dennis Owen Collins, an unindicted third party,
10
which cannot be authenticated.
11
12
DATED:
September 9, 2015
13
Respectfully submitted,
/s/Tor Ekeland
Tor Ekeland
Tor Ekeland, P.C.
Brooklyn, NY 11201
tor@torekeland.com
(718) 737-7264
www.torekeland.com
14
15
16
17
Notice of Defendants Motions in Limine
Tor Ekeland, Pro Hac Vice

tor@torekeland.com
Tor Ekeland, P.C.
Brooklyn, NY 11201
Tel: 718-737-7264
Fax: 718-504-5147
Jason S. Leiderman, SBN 203336
jay@criminal-lawyer.me
Law Office of Jay Leiderman
5740 Ralston Street, Suite 300
Ventura, California 93003
Tel: 805-654-0200
Fax: 805-654-0280
Pro Bono Attorneys for Defendant
Matthew Keys
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF CALIFORNIA
UNITED STATES OF AMERICA,

Plaintiff,
v.
2:13-CR-00082-KJM
MATTHEW KEYS,
Defendant.
DEFENDANTS MEMORANDUM IN SUPPORT OF HIS MOTIONS IN LIMINE
TABLE OF CONTENTS
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
TABLE OF AUTHORITES........................................................................................................ iii

INTRODUCTION ........................................................................................................................ 1
BACKGROUND ........................................................................................................................... 1
LEGAL STANDARD ................................................................................................................... 2
ARGUMENT................................................................................................................................. 4
I. THE COURT SHOULD EXCLUDE THE GOVERNMENTS LOSS NUMBERS .. 4
A. The loss numbers are irrelevant, speculative, and unduly prejudicial .................... 4
B. The loss numbers are impermissible opinion evidence ............................................. 6
II. THE COURT SHOULD EXCLUDE THE CANCERMAN EMAILS BECAUSE
THEY ARE IRRELEVANT AND PREJUDICAL................................................................ 9
III.
THE COURT SHOULD EXCLUDE ANY REFERENCE TO A PRIOR
RESTRAINING ORDER AS PREJUDICIAL AND IRRELEVANT ............................... 10
IV.
IRC LOG FILES OBTAINED FROM DENNIS OWEN COLLINS CANNOT BE
AUTHENTICATED AND ARE THEREFORE INADMISSIBLE ................................... 12
CONCLUSION ........................................................................................................................... 13
ii
Memorandum in Support of Defendants Motions in Limine
TABLE OF AUTHORITES
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Cases
AtPac, Inc. v. Aptitude Solutions, Inc., 730 F. Supp. 2d 1174 (E.D. Cal. 2010) ........................ 4, 9
BHRAC, LLC v. Regency Car Rentals, LLC, 2015 WL 3561671 (C.D. Cal. June 4, 2015) .......... 5
Brodit v. Cabra, 350 F.3d 985 (9th Cir.2003) ................................................................................ 2
C & E Services, Inc. v. Ashland Inc., 539 F. Supp. 2d 316 (D.D.C. 2008) .................................... 3
Farmers Ins. Exch. v. Steele Ins. Agency, Inc., 2013 WL 3872950 (E.D. Cal. July 25, 2013) .. 4, 5
Huddleston v. U.S., 485 U.S. 681 (1988)...................................................................................... 10
Jonasson v. Lutheran Child & Family Services, 115 F.3d 436 (7th Cir.1997) .............................. 2
Luce v. U.S., 469 U.S. 38 (1984) .................................................................................................... 2
New Show Studios LLC v. Needle, 2014 WL 2988271 (C.D. Cal. June 30, 2014)......................... 5
Old Chief v. U.S., 519 U.S. 172 (1997) ........................................................................................ 10
Reeves v. Sanderson Plumbing Products, 530 U.S. 133 (2000) ..................................................... 3
U.S. v. Bland, 908 F.2d 471 (9th Cir. 1990) .................................................................................... 3
U.S. v. Ellis, 147 F.3d 1131 (9th Cir. 1998) .................................................................................... 3
U.S. v. Layton, 767 F.2d 549 (9th Cir. 1985)................................................................................... 3
U.S. v. Rincon, 28 F.3d 921 (9th Cir. 1994), cert denied 513 U.S. 1029 (1994) ............................. 3
U.S. v. Westbrook, 125 F.3d 996 (7th Cir. 1997)............................................................................ 3
U.S. v. Black, 767 F.2d 1334 (9th Cir. 1985)................................................................................. 12
U.S. v. Hadley, 918 F.2d 848 (9th Cir. 1990) ............................................................................... 10
U.S. v. Heller, 551 F.3d 1108 (9th Cir. 2009)................................................................................. 3
U.S. v. Merino-Balderrama, 146 F.3d 758 (1998)........................................................................ 10
U.S. v. Ramirez-Robles, 386 F.3d 1234 (9th Cir. 2004) ................................................................ 11
U.S. v. Tank, 200 F.3d 627 (9th Cir. 2000).................................................................................... 12
U.S. v. W.R. Grace, 526 F.3d 499 (9th Cir. 2008) .......................................................................... 8
U.S. v. Yagi, 2013 WL 10570994 (N.D. Cal. Oct. 17, 2013).......................................................... 8
27
28
29
Statutes
18 U.S.C. 1030......................................................................................................................... 2, 4
18 U.S.C. 371............................................................................................................................... 2
30
31
32
33
34
35
36
37
38
39
Rules
Fed. R. Crim. P. 16 ......................................................................................................................... 7
Fed. R. Evid. 401 ............................................................................................................................ 3
Fed. R. Evid. 403 ...................................................................................................................... 3, 10
Fed. R. Evid. 404 .......................................................................................................................... 10
Fed. R. Evid. 701 ............................................................................................................................ 6
Fed. R. Evid. 702 ........................................................................................................................ 6, 7
Fed. R. Evid. 703 ............................................................................................................................ 7
Fed. R. Evid. 705 ............................................................................................................................ 7
Fed. R. Evid. 901 .......................................................................................................................... 12
iii
INTRODUCTION
1
2
Defendant Matthew Keys, through his pro bono counsel, moves to exclude the following
evidence it expects the government to introduce at trial: 1) irrelevant, speculative, and prejudicial
loss numbers unrelated to the alleged Computer Fraud and Abuse Act (CFAA) charges; 2) all
loss numbers because the government has not noticed any expert that can substantiate them; 3)
irrelevant and prejudicial emails allegedly sent by the defendant that are unrelated to the alleged
CFAA damage and that are also inadmissible under Federal Rule of Evidence 404(b); 4)
irrelevant, prejudicial evidence of a 2008 restraining order against the Defendant; and 5) chat and
server logs seized from the late Dennis Owen Collins, an unindicted third party, which cannot be
10
authenticated.
BACKGROUND
11
12
The charges in this case stem from edits to one paragraph of a story on the Los Angeles
13
Times website on December 14, 2010. That day, using the Los Angeles Times/Tribune
14
Companys content management system (CMS), the user ngarcia allegedly altered a
15
paragraph of a latimes.com story. The articles title and byline originally appeared as follows:
16
Pressure builds in House to pass tax-cut package
17
18
19
20
House Democratic leader Steny Hoyer sees very good things in the taxcut deal, which many representatives oppose. But with the bill set to clear
the Senate, reluctant House Democrats are feeling the heat to pass it.
By Lisa Mascaro, Tribune Washington Bureau1
21
After the minor edits by ngarcia, the articles title and byline allegedly read:
The original article is still available on the Los Angeles Times website, see Lisa Mascaro, Pressure builds in house
to pass tax-cut package, http://articles.latimes.com/2010/dec/14/news/la-pn-hoyer-tax-vote-20101215 (last
visited Sept. 9, 2015).
Pressure builds in House to elect CHIPPY 1337
2
3
4
5
6
7
House Democratic leader Steny Hoyer sees very good things in the deal
cut which will see uber skid Chippy 1337 take his rightful place, as head of
the Senate, reluctant House Democrats told to SUCK IT UP.
By CHIPPYS NO 1 FAN, Tribune Washington Bureau2
The website administrators restored the original in less than an hour. For the foregoing, Mr. Keys
has been charged with one count of conspiracy to violate the Computer Fraud and Abuse Act, in
violation of 18 U.S.C. 371 and 1030(a)(5)(A); one count of knowingly transmitting a code
10
with the intent to cause damage to a protected computer in violation of 18 U.S.C.
11
1030(a)(5)(A); and one count of attempt to transmit a code with the intent to cause damage to a
12
protected computer in violation of 18 U.S.C. 2 and 1030(a)(5)(A). For this he faces a
13
maximum sentence of 25 years in jail, $750,000 in fines, 9 years of supervised release, and
14
criminal forfeiture. U.S. v. Keys, Superseding Indictment, 2:13-CR-00082 (Dec. 4, 2014) (ECF #
15
44).
LEGAL STANDARD
16
17
Although the Federal Rules of Evidence do not explicitly authorize in limine rulings, the
18
practice has developed pursuant to the district court's inherent authority to manage the course of
19
trials. Luce v. U.S., 469 U.S. 38, 40 n. 4, (1984). The Ninth Circuit has explained that motions
20
in limine allow parties to resolve evidentiary disputes ahead of trial, without first having to
21
present potentially prejudicial evidence in front of a jury. Brodit v. Cabra, 350 F.3d 985, 1004
22
05 (9th Cir.2003) (citations omitted). Motions in limine are an important tool available to the
23
trial judge to ensure the expeditious and evenhanded management of the trial proceedings.
24
Jonasson v. Lutheran Child & Family Services, 115 F.3d 436, 440 (7th Cir.1997).
See U.S. v. Keys, Superseding Indictment, 2:13-CR-00082 (Dec. 4, 2014) (ECF # 44 at p. 4)
[A] motion in limine should not be used to resolve factual disputes or weigh evidence,
C & E Services, Inc. v. Ashland Inc., 539 F. Supp. 2d 316, 323 (D.D.C. 2008), because that is the
province of the jury. See Reeves v. Sanderson Plumbing Products, 530 U.S. 133, 150 (2000).
Rather the motion in limine process should be used to limit in advance testimony or evidence in
a particular area. U.S. v. Heller, 551 F.3d 1108, 1111 (9th Cir. 2009).
The Federal Rules of Evidence require that for any evidence to be admitted it must be
relevant. Fed. R. Evid. 401. Evidence is irrelevant if there is no connection between the
evidence and the issues of the case or material facts at issue. U.S. v. Westbrook, 125 F.3d 996,
1008 (7th Cir. 1997). Additionally, even where evidence is found to be relevant, the relevancy of
10
that evidence must be weighed against the potential for serious prejudice. Fed. R. of Evid. 403.
11
The Rule 403 weighing process- balancing the probative value of the proffered evidence against
12
its potential for unfair prejudice or confusion of issues- is primarily for the district court to
13
perform. U.S. v. Layton, 767 F.2d 549, 553 (9th Cir. 1985); U.S. v. Rincon, 28 F.3d 921, 925 (9th
14
Cir. 1994), cert denied 513 U.S. 1029 (1994).
15
The 9th Circuit is especially cautious about admitting potentially inflammatory evidence
16
with little to no probative value. See U.S. v. Ellis, 147 F.3d 1131, 1136 (9th Cir. 1998) (reversing
17
conviction of defendant charged with receiving and concealing stolen explosives because the
18
improper admission of evidence of the destructive capability of the stolen explosives.); U.S. v.
19
Bland, 908 F.2d 471, 474 (9th Cir. 1990), (holding details of murder inadmissible); U.S. v.
20
Layton, 767 F.2d 549, 553 (9th Cir. 1985) (reversing conviction because of unduly prejudicial
21
tape recordings of multiple suicides).
ARGUMENT
2
3
I.
THE COURT SHOULD EXCLUDE THE GOVERNMENTS

LOSS NUMBERS
4
5
6
The government will likely seek to use a document produced in discovery, or seek to
introduce testimony related to the information in it, entitled Valuation on time/disruption of
business (Attached as Exhibit A) to establish loss under the CFAA. The Court should bar
introduction of this document and any testimony related to its contents. A significant portion of
10
the entries in this document are categorically impermissible to show loss under the CFAA. As a
11
result, these numbers should be excluded as they will only serve to confuse and prejudice an
12
accurate valuation of any alleged loss caused by the alleged CFAA damage.
13
A. THE LOSS NUMBERS ARE IRRELEVANT, SPECULATIVE, AND UNDULY

PREJUDICIAL
The CFAA defines damage as any impairment to the integrity or availability of data,
14
a program, a system, or information. 18 U.S.C. 1030(e)(8) (emphasis added). The statute
15
defines loss as any reasonable cost to any victim, including the cost of responding to an
16
offense, conducting a damage assessment, and restoring the data, program, system, or
17
information to its condition prior to the offense, and any revenue lost, cost incurred, or other
18
consequential damages incurred because of interruption of service. 18 U.S.C. 1030(e)(11)
19
(emphasis added). Thus, damage under the CFAA is not the same as loss under the CFAA.
20
To allege loss under the CFAA plaintiffs must identify impairment of or damage to the
21
computer system that was accessed without authorization costs not related to computer
22
impairment or computer damages are not compensable under the CFAA. Farmers Ins. Exch. v.
23
Steele Ins. Agency, Inc., No. 2:13-CV-00784-MCE, 2013 WL 3872950, at *21-22 (E.D. Cal. July
24
25, 2013); see also AtPac, Inc. v. Aptitude Solutions, Inc., 730 F. Supp. 2d 1174, 1184 (E.D. Cal.
25
2010) (finding clear congressional intent to limit loss to the traditional computer hacker
4
scenariowhere the hacker deletes information, infects computers, or crashes networks.); New
Show Studios LLC v. Needle, No. 2:14-CV-01250-CAS, 2014 WL 2988271, at *7 (C.D. Cal.
June 30, 2014) (Subsequent economic damage unrelated to the computer itself does not
constitute loss.); Sprint Solutions Inc. v. Pac. Cellupage Inc., No. 2:13-CV-07862-CAS, 2014
WL 3715122, at *6 (C.D. Cal. July 21, 2014) (business loss . . . is not a cognizable loss under
the CFAA.).
The court in Farmers Ins. Exch. held inadmissible harm in the form of lost present and
future business revenue in a calculation of CFAA loss where the harm was not directly related
to either interruption or damage to a computer system. No. 2:13-CV-00784-MCE, 2013 WL
10
3872950, at *21-22 (E.D. Cal. July 25, 2013). Additionally, the court in BHRAC, LLC v.
11
Regency Car Rentals, LLC, No. CV 15-865-GHK MANX, 2015 WL 3561671, at *3 (C.D. Cal.
12
June 4, 2015) excluded business losses that resulted from theft of information that allowed the
13
defendant to poach plaintiffs customers. The BHRAC court reasoned that the lost revenue was
14
not the sort of injury for which the CFAA provides a remedy as it was not caused by an
15
interruption of service but only the misuse or misappropriation of information. See id. Thus,
16
under the CFAA, the vast majority, if not all, of the governments alleged loss is not cognizable.
17
At minimum, the following entries in Exhibit A are unrelated to any interruption of or
18
damage to the Tribune Companys (the parent company of the Los Angeles Times) computer
19
systems, and refer only to business losses that occurred separately from any alleged CFAA
20
damage, and therefore any testimony or evidence related to them should be excluded:
21
22
23
24
25
Financial impact of a television show rating decline (not charged in the Indictment),
estimate at $409,612.00
Financial impact of database loss (not charged in the Indictment), current revenues loss
estimated at $25,000 and forward revenues estimated at $250,000
1
2
3
4
5
6
7
8
9
Greenlinks Database loss (not charged in the Indictment), iPad Contest, estimated at
$15,000
Greenlinks Database loss (not charged in the Indictment), Database impact estimated at
$200,000
Total loss not cognizable under the CFAA: $899,612
These purported losses are not only irrelevant to either loss or damage as defined by
the CFAA, they also render the document highly prejudicial. They constitute 96 percent of the
10
total loss figures sought to be introduced by the government. As these economic loss entries
11
comprise the overwhelming majority of the governments claimed losses, their admission would
12
unavoidably distract, confuse, and prejudice any accurate determination of either loss or damage
13
as defined by the CFAA. As a result, they at minimum must be excluded.
14
15
B. THE LOSS NUMBERS ARE IMPERMISSIBLE OPINION EVIDENCE

Additionally, all the loss figures contained in Exhibit A, as well as all the loss numbers
16
that the government is going to allege in this case, require an opinion based on scientific,
17
technical, or other specialized knowledge within the scope of [Fed. R. Evid.] 702 and their
18
introduction would require financial and statistical expert or experts. See Fed. R. Evid. 701. The
19
government has noticed no such expert to the defense. To introduce the loss estimates as lay
20
witness testimony they must be rationally based on the witnesss perception. Fed. R. Evid. 701.
21
Neither the losses contained in Exhibit A nor any of the governments other alleged losses can
22
possibly be substantiated by any of the governments lay witnesses as CFAA losses.
23
24
For example, on page 2 of Exhibit A, the government alleges that the CFAA violations
caused a .1 decline3 in morning news t.v. show ratings4, a .4 decline in early news ratings, and a
It is unclear from the document what these decimal numbers represent. They appear to be percentages (e.g. .4
would represent 0.4%), but the document does not clarify them or provide any context for how they were
calculated or created.
The document refers to News rating A2554 in discussing the decimal increases and decreases. On information
and belief, A25-54 refers to a Nielsen television rating for viewers aged 25 to 54.
.2 increase in late news ratings, somehow equaling an estimated business loss totaling $409,612.5
It defies reason that any lay witness could discern the impact the alleged CFAA damage had on a
morning t.v. news show ratings to a fraction of a percentage point, correcting for all other
factors, based on their own perception and without the aid of scientific, technical, or other
specialized knowledge and analysis. Moreover, this case is about the alleged unauthorized access
to the Los Angeles Times website content management system and the changing of a few words
in one paragraph on the L.A. Times site for roughly half an hour. It has nothing to do with a
Sacramento television news show.
To submit this opinion evidence, the government would need an expert witness. Upon
10
request of a defendant, the government must provide a written summary of any testimony that
11
the government intends to use under Rules 702, 703, or 705 of the Federal Rules of Evidence
12
during its case-in-chief at trial. Fed. R. Crim. P. 16 (a)(G). The defense provided such a request
13
to the government on April 22, 2013. (Exhibit B, at p. 3.) The defense has yet to receive any
14
notice or other information regarding experts who are qualified to substantiate the governments
15
alleged loss figures, or the methods and expertise used to calculate those figures.
16
Although Fed. R. of Crim. P. 16 does not explicitly state a time the government must
17
disclose in response to a request, the Advisory Committee Notes state it is expected that the
18
parties will make their requests and disclosures in a timely fashion. Fed. R. Crim. P. 16,
19
advisory committees note. The Defense submitted its request over 2 years ago. At the time of
20
filing this motion in limine, only 19 days before trial the government has not provided notice of
5
Assuming, as the above footnote does, that these decimal numbers are percentages of market revenue, the
documents estimated business loss total simply does not add up. It purports an estimated business loss of
$409,612.00. However, a 0.3% loss, derived from a 0.5% total morning and early news decrease offset by a
0.2% late news increase, would be $490,935.00. The basis for their loss numbers lacks foundation and a lay
witness cannot meaningfully interpret these estimated loss claims.
any expert that can testify to the loss numbers even if they were relevant. Therefore, the loss
numbers should be excluded in their entirety.
The court in U.S. v. Yagi, No. CR-12-0483 EMC, 2013 WL 10570994, at *16 (N.D. Cal.
Oct. 17, 2013) excluded the introduction of new experts where defendants made their request one
year before trial and the government disclosed information about its expert witness less than one
month before trial. The court in Yagi was unpersuaded by the governments justification for their
failure, that they believed the witnesses in question could testify as lay witnesses[,] finding that
the defense has been prejudiced in its ability to evaluate the proffered expert testimony and, if
necessary, secure rebuttal witnesses to testify as to the value of a potentially diverse set of
10
items. See id. The exclusion of undisclosed expert witnesses is the appropriate remedy for
11
violation of Rule 16s disclosure requirements. See U.S. v. W.R. Grace, 526 F.3d 499, 514-15
12
(9th Cir. 2008) (upholding exclusion of such evidence even where the failure to provide notice of
13
an expert witness was neither willful nor motivated by a desire to obtain a tactical advantage).
14
The government has failed to timely disclose any information regarding proposed expert
15
witnesses who could substantiate their highly speculative, non-CFAA, loss figures. As a result, it
16
would be improper and prejudicial to the accuseds fundamental right to present witnesses in his
17
own defense to allow the government to introduce a new expert witness with days remaining
18
before trial. Accordingly, any loss figures requiring expert testimony should not be admitted into
19
evidence as they lack the necessary foundation.
1
2
3
4
II.
THE COURT SHOULD EXCLUDE THE CANCERMAN

EMAILS BECAUSE THEY ARE IRRELEVANT AND
PREJUDICAL
The Cancerman emails refer to a series of emails sent from the addresses
cancerman4099@yahoo.co.uk, walterskinner@yahoo.co.uk, and foxmulder4099@yahoo.co.uk,,
and possibly others, to Fox40, a Sacramento television station, employee Brandon Mercers
email address (brandon.mercer@fox40.com), as well as to email addresses registered for
Fox40s iPad giveaway contest in December of 2010. These emails are irrelevant to the present
case, highly prejudicial, and, to the extent they are related or probative in any way, less
10
prejudicial alternative evidence exists to show the same set of facts. The Cancerman emails were
11
sent, prior to the CFAA acts alleged in the Indictment, to addresses registered for a Fox40 iPad
12
giveaway and warned the recipients that the contest was a scam. The list of registered
13
contestants was allegedly downloaded from the Tribunes content management system.
14
The government does not allege, and cannot show, that the Cancerman emails impaired
15
or damaged any computer systems. The Cancerman emails, at most, show misuse or
16
misappropriation of information that allegedly caused a loss of business opportunities. As
17
discussed above, disruption to or loss of business opportunities, or other business losses, due to
18
information misuse or misappropriation can never be used to establish loss or damage under the
19
CFAA. See, e.g., AtPac, Inc. v. Aptitude Solutions, Inc., 730 F. Supp. 2d at 1184 (E.D. Cal.
20
2010) (the loss must result from the unauthorized breach itself.).
21
The Cancerman emails predate, and are not related to, the alleged brief editing of a
22
paragraph on the Los Angeles Times web page, and cannot be included in the same loss
23
calculation for CFAA purposes. Any loss that could be attributable to these emails is unrelated to
24
the alleged editing of the L.A. Times webpage, and cannot be included in any CFAA loss
25
amount.
9
Even if these emails were somehow construed as related to the alleged CFAA loss,
alternative evidence exists which would be less prejudicial. Alternative evidence should be
considered when evaluating the probative versus prejudicial balance of a particular piece of
evidence. See Old Chief v. U.S., 519 U.S. 172, 184-85 (1997). Once the court is aware of the
danger of unfair prejudice under Fed. R. of Evid. 403, available substitutes must be considered as
part of that analysis. U.S. v. Merino-Balderrama, 146 F.3d 758, 762 (1998) (citing Old Chief v.
U.S., 519 U.S. at 181 (1997). Any showing of loss from investigating these emails would be
better demonstrated by financial documents and expert testimony, which avoid the prejudicial
taint of these inflammatory emails. The substance of these emails is irrelevant to this matter, and
10
far less prejudicial evidence exists for any relevant points which might be shown through the
11
Cancerman emails.
12
13
14
15
III.
THE COURT SHOULD EXCLUDE ANY REFERENCE TO A

PRIOR RESTRAINING ORDER AS PREJUDICIAL AND
IRRELEVANT
Under Fed. R. of Evid. 404(b), the Government may attempt to introduce a restraining
16
order issued against Mr. Keys in August 2008, over 2 years before the alleged acts in this matter,
17
as a prior bad act. The restraining order must be excluded as it is irrelevant to any issue in this
18
case and highly prejudicial.
19
The relevance of a prior bad act is determined by the application of several factors. First,
20
sufficient evidence must be shown for a jury to reasonably conclude that the acts occurred and
21
that the defendant was the actor. See Huddleston v. U.S., 485 U.S. 681, 689 (1988); U.S. v.
22
Hadley, 918 F.2d 848, 851 (9th Cir. 1990). The 2008 restraining order was issued ex parte, while
23
law enforcement investigated a series of messages and emails received by someone Mr. Keys
24
knew. That investigation concluded without determining the source of those messages or emails,
10
and no evidence from that investigation or elsewhere supports the theory that Mr. Keys was
involved in any way. Based on the limited evidence provided in the restraining order, it would be
highly unlikely that any reasonable jury could conclude that Keys was the actor without resorting
to speculation and innuendo.
Additionally, a prior bad act must be similar to the offense charged. See id. The emails
discussed in the restraining order hold no relationship to the charged CFAA violations. The
CFAA violations at issue in this case involve misuse of login credentials to briefly alter a
paragraph on a Los Angeles Times web page. The restraining order describes an unknown
individual or individuals sending disruptive messages to, and posting embarrassing private
10
photos of, an uninvolved third party. The only similarity between the prior bad act and the
11
charged offense is the misuse of computers by unknown actors.
12
Even if relevant, the prejudicial impact of the restraining order vastly outweighs any
13
probative value it may have. The court should exclude relevant evidence if the danger of unfair
14
prejudicial impact substantially outweighs its probative value. See U.S. v. Ramirez-Robles, 386
15
F.3d 1234, 1246 (9th Cir. 2004). Given that the actions described in the 2008 restraining order
16
were never attributed to anyone, combined with the highly scandalous nature of the allegations
17
made therein and the lack of similarity between the acts related to the 2008 restraining order and
18
the charged CFAA offenses, the probative value of the restraining order is entirely outweighed
19
by its prejudicial impact. The 2008 restraining order should be excluded.
11
IV.
1
2
3
4
IRC LOG FILES OBTAINED FROM DENNIS OWEN

COLLINS CANNOT BE AUTHENTICATED AND ARE
THEREFORE INADMISSIBLE
The government may seek to introduce a number of IRC 6 chat and server log files
obtained through the search and seizure of an unindicted alleged member of Anonymous, the late
Dennis Owen Collins. Mr. Collins passed away on July 16, 2015.7
These logs include what appear to be chat records related to the alleged editing of the Los
Angeles Times webpage paragraph, and server logs showing Internet Protocol addresses and
nickname information that may provide identifying or location information about nicknames in
10
relevant IRC channels (collectively the Logs). The Logs were stored as text files and as other
11
files containing plain text but obfuscated, presumably by Mr. Collins, using various file names
12
and extensions.
13
A proponent of a particular piece of evidence must produce evidence sufficient to show
14
that the item is what the proponent says it is. Fed. R. Evid. 901. For admissibility, the proponent
15
must make a prima facie showing of authenticity by showing sufficient proof for a reasonable
16
juror to find in favor of authenticity or identification. See U.S. v. Black, 767 F.2d 1334, 1342 (9th
17
Cir. 1985). For chat log data, a prima facie showing of authenticity may be made by the logs
18
creator testifying to how the logs were made and to the accuracy of what they represent. U.S. v.
19
Tank, 200 F.3d 627, 630 (9th Cir. 2000). As Mr. Owen died during the pendency of this trial, that
20
is not possible.
Internet Relay Chat, a form of internet text chat popular among programmers, computer enthusiasts, and other
technically savvy individuals. Chatting on IRC takes place on channels run within servers. Many IRC client
and server programs are able to create log files, essentially text files into which chat content or server output
will be recorded, which are stored on the machine running that IRC client or server.
See Dennis Owen Collins memorial page, at http://www.forevermissed.com/dennis-owen-collins/#about (last
visited September 9, 2015).
12
Upon information and belief, Mr. Collins was the sole custodian of these log files
between the time they were created until they were seized by federal law enforcement. He was
the only person with access to and control of these files, and the only person able to testify to the
accuracy of the data and content contained therein. Before the government seized the Logs, Mr.
Collins or anyone else who may have had access to the Logs could have edited or changed
entries in the text. Unlike email or offsite server logs, no third party exists which might
independently verify the accuracy of these logs. It would also be trivially easy for an individual
with Mr. Collinss technical skill to alter or obfuscate data in these files.8 While a law
enforcement agent may be able to testify to the forensic methods used to assure the data was not
10
altered after seizure,9 they are in no position to authenticate the Logs veracity prior to seizure.
CONCLUSION
11
12
For the above stated reasons, Matthew Keys respectfully requests that the Court exclude:
13
1) irrelevant, speculative, and prejudicial loss numbers unrelated to the alleged Computer Fraud
14
and Abuse Act (CFAA) charges; 2) all loss numbers because the government has not noticed
15
any expert that can substantiate them; 3) irrelevant and prejudicial emails allegedly sent by the
16
defendant that are unrelated to the alleged CFAA damage and that are also inadmissible under
17
Federal Rule of Evidence 404(b); 4) irrelevant, prejudicial evidence of a 2008 restraining order
18
against the Defendant; and 5) chat and server logs seized from the late Dennis Owen Collins, an
19
unindicted third party, which cannot be authenticated.
For example, a basic find-and-replace script could easily and effortlessly change IP address numbers, nickname
entries, or the creation or modification date metadata on the files.
Although at this time, the defense is not aware of any such forensic verification, such as MD5 or SHA
checksums, for either the Logs or the hard drive(s) on which they were stored.
13
1
2
DATED:
September 9, 2015
3
4
5
6
7
8
9
10
11
Respectfully submitted,
/s/ Tor Ekeland_
Tor Ekeland
Tor Ekeland, P.C.
Brooklyn, NY 11201
tor@torekeland.com
Tel: 718-737-7264
Fax: 718-504-5147
www.torekeland.com
14
EXHIBIT A
Valuation on time/disruption of business

Meetings
1.) Brandon & John Cauthen
$75.00
2.) Jerry, Brandon & Cauthen
$225.00
3.) Jerry and Cauthen
$150.00
4.) Jerry with Brandon
5 (1/2 hour meetings)
$562.50
1.) Brandon to John Cauthen
1/1 + research
$225.00
2.) Sam Cohen w / corporate
14 emails from 12/6/22010 thru 12/14/2010
$700.00
3.) Brandon to Chuck Sennet
3 emails/FOX Mulder emails/FBI (5 emails)
$975.00
4.) Brandon to Jerry
Draft for approval/FOX Mulder Court Docs/FOX Mulder
Emails
5.) Sam to News Managers (8)
Emails/Santa's Lap/iPad Contest
$1,125.00
FOX Mulder Court Documents
$450.00
6.) Brandon to Jerry, News Mgrs, Charlier, Gable, Sennet and Saunders
$1,425.00
FOX Mulder update

7.) Brandon to Gable, Cauthen, Sennet, Kersting
3 emails
8.) Brandon to Jerry, Gable, Jedlinski and Sennet
Cancer Man aka FOX Mulder/Cancer Man

Update
$6,015.00
$1,475.00
9.) Jerry to Kersting and Schonbak 1/1/1
$3,450.00
10.)Cancerman4099 to Brandon
$1,550.00
20+/too many
Thread of 20 emails include Brandon & FOX Mulder, Joseph Huerta to FOXMulder4099
ll.)FOXMudler4099 to Brandon
Santa's Ear/iPad Contest/
$150.00
12.) Brandon to Jerry and Ray Nelson
$275.00
13.)Brandon to Ray
Try to block access to all others
$125.00
Initiated a chain of 4 emails + conversations
$1,500.00
14.)Viewer emails
4 hours estimated in meetings

15.)Jedlinski to Brandon
$325.00
16.)Brandon to Jerry, Friedman, Saunders, Conhain, Bernard, Nelson, Silverman and Jedlinski
17.)Mohanani to Brandon
"This is what FOX Mulder is doing to us"
$1,025
Viewer email-FOX40 sold my info!
$75.00
18.) Brandon to News Department and Department Heads
$850.00
19.) Brandon to News Department and Jerry
$2,500.00
20.)Troy to Brandon
"30 minutes spent with upset viewers"/impact Kathy Paez &

Bhavisha Patel/+1
$200.00
21.)Troy to News Department
$150.00
22.)Huerta to FOX Mulder
$50.00
23.)FOX Mulder to Jerry
$150.00
24.)Charles Bernard to Brandon
$125.00
25.)FOX Mulder emails to Jordan DeNoon, Josh Baar, Mark Demsky, Bill Hudson, Charles Bernard,
Tim King and Brandon RE: Santa's Lap email
$375.00
Phone calls
21 (1/2 hour each on average)
$787.50
2.) Brandon with Cauthen
1 hour?
$75.00
3.) Brandon with Keys
4 hours ?
$300.00
4.) Jerry with Kersting and Schonbak
2 (1/2 hour)
$1,150.00
5.) Jerry with Schonbak
5 (1/2 hour)
$1,625.00
6.) Jerry with Cauthen
4 (1/2 hour)
$150.00
1.) FOX40 Rewards Members
Greenlinks Database loss

Estimated loss: $15,000.00
1.) iPad Contest

2.) Database impact
lost database of 20,000 viewers; had to find a new vendor & rebuild a new database.
Financial impact of Database loss
Current revenues
Forward revenues
Note: Took three (3) years to build new database back to 2011 level of 20,000 viewers
Rating impact
News ratings A2554
Morning news declined .1 (5 hours)

Early news declined .4 (1/2 Hour)
Late news increased .2 (1 hour)
Financial impact of rating decline

Financial Impact
Total market revenue = $163,875,000

1% = $1,638,450
. 1 % = 163,845
(from am news rating losses)
(-.4 early news and +.2 late news effectively cancel each
other out)
Total Loss estimate: $929,977.00

Values of Manager time usage:
1.) Sr. Executives
$500/hour
2.) Sr. Managers
$250/hour
3.) General Manager
$150/hour
4.) Staff Managers
$75/hour
5.) Staff Employees
$50/hour
EXHIBIT B

USA v. Keys: Defense Motions in Limine

Uploaded by

Document Information

Original Title

Copyright

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

USA v. Keys: Defense Motions in Limine

Uploaded by

Copyright:

Tor Ekeland, Pro Hac Vice

September 25, 2015

Notice of Defendants Motions in Limine

which cannot be authenticated.

Notice of Defendants Motions in Limine

Tor Ekeland, Pro Hac Vice

UNITED STATES OF AMERICA,

DEFENDANTS MEMORANDUM IN SUPPORT OF HIS MOTIONS IN LIMINE

TABLE OF AUTHORITES........................................................................................................ iii

Memorandum in Support of Defendants Motions in Limine

Memorandum in Support of Defendants Motions in Limine

Pressure builds in House to pass tax-cut package

Memorandum in Support of Defendants Motions in Limine

Pressure builds in House to elect CHIPPY 1337

with the intent to cause damage to a protected computer in violation of 18 U.S.C.

protected computer in violation of 18 U.S.C. 2 and 1030(a)(5)(A). For this he faces a

See U.S. v. Keys, Superseding Indictment, 2:13-CR-00082 (Dec. 4, 2014) (ECF # 44 at p. 4)

Memorandum in Support of Defendants Motions in Limine

Cir. 1994), cert denied 513 U.S. 1029 (1994).

tape recordings of multiple suicides).

Memorandum in Support of Defendants Motions in Limine

THE COURT SHOULD EXCLUDE THE GOVERNMENTS

introduce testimony related to the information in it, entitled Valuation on time/disruption of

A. THE LOSS NUMBERS ARE IRRELEVANT, SPECULATIVE, AND UNDULY

a program, a system, or information. 18 U.S.C. 1030(e)(8) (emphasis added). The statute

consequential damages incurred because of interruption of service. 18 U.S.C. 1030(e)(11)

Memorandum in Support of Defendants Motions in Limine

to either interruption or damage to a computer system. No. 2:13-CV-00784-MCE, 2013 WL

At minimum, the following entries in Exhibit A are unrelated to any interruption of or

Memorandum in Support of Defendants Motions in Limine

as defined by the CFAA. As a result, they at minimum must be excluded.

B. THE LOSS NUMBERS ARE IMPERMISSIBLE OPINION EVIDENCE

possibly be substantiated by any of the governments lay witnesses as CFAA losses.

Memorandum in Support of Defendants Motions in Limine

Sacramento television news show.

Memorandum in Support of Defendants Motions in Limine

numbers should be excluded in their entirety.

evidence as they lack the necessary foundation.

Memorandum in Support of Defendants Motions in Limine

THE COURT SHOULD EXCLUDE THE CANCERMAN

cancerman4099@yahoo.co.uk, walterskinner@yahoo.co.uk, and foxmulder4099@yahoo.co.uk,,

email address (brandon.mercer@fox40.com), as well as to email addresses registered for

misappropriation of information that allegedly caused a loss of business opportunities. As

Memorandum in Support of Defendants Motions in Limine

THE COURT SHOULD EXCLUDE ANY REFERENCE TO A

case and highly prejudicial.

Memorandum in Support of Defendants Motions in Limine

to speculation and innuendo.

charged offense is the misuse of computers by unknown actors.

by its prejudicial impact. The 2008 restraining order should be excluded.

Memorandum in Support of Defendants Motions in Limine

IRC LOG FILES OBTAINED FROM DENNIS OWEN

A proponent of a particular piece of evidence must produce evidence sufficient to show

Memorandum in Support of Defendants Motions in Limine

unindicted third party, which cannot be authenticated.

Memorandum in Support of Defendants Motions in Limine

Memorandum in Support of Defendants Motions in Limine

Valuation on time/disruption of business

2.) Jerry, Brandon & Cauthen

3.) Jerry and Cauthen

4.) Jerry with Brandon

5 (1/2 hour meetings)

1.) Brandon to John Cauthen

2.) Sam Cohen w / corporate

14 emails from 12/6/22010 thru 12/14/2010

3.) Brandon to Chuck Sennet