[alt2319]

Well he was kind of railroaded by a law that sucks. $9,000 in damages by planting 3 files on a website? Worse, it's impossible to argue intent / mens rea in these cases. It doesn't matter if your intent was to cause no damage because the crime isn't defined by the damage but by the access. As long as you intended to access the internet-connected device, and knew you were exceeding your permitted access, you're guilty. The "damage" doesn't have to be intentional.

The opportunity is gone now, but I really wish he'd fought this case and gotten it in front of a jury. It's very technical testimony and I think a jury could really question the damage amount. If it were below $5,000 this law doesn't apply. How much did it really cost? They had to delete 3 files and apply patches that they should have applied all along.

It's also just weird how punishment scales work. I used to go to my probation officer's office and see all the other guys he was monitoring. Most were serious drug dealers or weapons violations. It seemed so out of whack. But then when I'd go do community service I'd see people sentenced to 20 hours of community service, hundreds of dollars in fines, and weeks in jail for crap like shoplifting a 99 cent air freshener or a pack of cigarettes.

[tptacek]

His lawyer was probably very right. He's conceding on this thread a fact pattern that will, by the jury instructions, mechanically result in a conviction. He'd spent many tens of thousands of dollars to achieve the same guilty verdict, with the sweetener of a short custodial sentence.

I'm not entirely sure what the punishment Scott received actually was, but he served no time, so it sounds like his sentencing level was below the noise floor.

[alt2319]

I believe he got almost exactly what I got: six months "imprisonment" (served as home detention), five years probation, restitution ($9,000-ish for him), 100 hours of community service, and a few assorted court and administrative fees. Probably also had to pay fees for an ankle monitor system while on home detention, but not sure.

Unless it's changed, I think under the normal federal sentencing guidelines, that amount of "damage" doesn't even qualify for any prison time at all, but the specific offense overrides that to impose a minimum of six months. That's because of a little outcry in the 1990s over hackers not serving any time and the (maybe valid) perception that they actually benefited from the notoriety of a conviction.