41 months seems exceptionally high given that it was discovered before execution. It would take me an hour to dig it all up, but there are federal sentencing guidelines based on the dollar amount of damages. I don't think they take potential damages into account.
Funny, I came here looking for the exact opposite post to upvote. Seems exceptionally low to me, given the obvious malicious intent and potential damages. But I'm mostly ignorant about the relevant law.
I assume you mean relative to other sentences/crimes you're aware of? It may be low compared to those, but in general, American sentences seem exceptionally high to me, and this is a good example.
I don't think a stronger sentence would have deterred him. I doubt he sat down and thought "If I get caught, I'll only get 3 1/2 years, which isn't too bad. Now, if I would get 10 years, that's another story..." I doubt he even knew the specific penalties for doing this. It seems to me he assumed he'd never get caught.
I think others reading this article will be deterred by the thought of losing 3 1/2 years of their life, and having their life after prison ruined in many ways. For example, try to explain a 3 1/2 year gap in your employment history during a job interview. And for the ones who aren't, I don't think a 10 year sentence would somehow deter them.
I don't think this guy is likely to commit another such crime after his release. I doubt he figures that 3 1/2 years in jail and putting his life back together isn't that big a deal and planting another logic bomb feels so good that it's worth it to do it again.
The only other motivation for punishing a crime is vengeance, an emotional feeling of hurting someone who tried to hurt us. That seems a poor motivation for taking away even more of someone's life.
He did something malicious that could have caused a lot of problems. He needs to be punished. But the punishment seems way out of proportion to what's needed to reduce crime.
What annoys me about this is not the sentence, it's the way that corporations can get away with doing the same thing.
If malicious software is a bad thing -- and it is -- then let's punish everyone who does it. Starting with Sony when they put a rootkit in CDs. But of course, Sony are a big corporation, so that makes it OK.
For completeness' sake, there is a third reason for incarceration - The prisoner can't commit new crimes while detained. Not that it matters in this case.
If you'd be willing to take the time to dig something up on that I'd love to read it.
It seems surprising to me that potential damages would not be taken into account. By doing so, the accussed would essentially be rewarded based on chance - at least in this case.
Ok, let me dig. It's been a while and I'm not a lawyer.
Looking at the actual indictment, I think he was charged with just violating Section 1030 (a)(5)(A)(i) of the U.S. Code. I don't think the other two sections mentioned are separate charges.
If you've never read section 1030, it's surprisingly clumsy and vague to us non-lawyers. Two important things for most cases are that generally any computer that is (or even 'can be') connected to the internet is considered to be 'protected' as it may potentially be involved in interstate commerce. The second this is that for this section to apply, there must be at least $5000 in damages involved.
Then you can go look up sentencing guidelines. It's important to realize that these 'guidelines' are a lot more than just suggestions for federal judges. They can go outside of these guidelines but rarely do. http://www.sentencing.us has a great calculator. That quickly tells us to use section 2B1.1(a)(2) of the guidelines.
If you go look at those guidelines, there's a chart in (b)(1) that shows how much his base offense level would be increased depending on the damages. From the descriptions I've read, I would think the damage amount would be less than $120,000 (lost time, hours it took to clean up) so that's a +8 level increase.
Then there are a number of special modifiers that can increase the 'level' of the sentence guideline. It looks like (b)(14)(B) might apply due to the financial institution aspect, so that would be a +4, except if I read the awkward combination of (C) and (D) correctly, this automatically pushes him to a level 24.
The table takes his criminal history into account, which was likely none. Then we need to look at his level, which we still don't know.
If he caused under $120,000 in damages, his level should be a base of 6 plus 8 for the dollar amount. He could reduce this by 1 or 2 levels by accepting responsibility or other things. But if he was at a level 14, his sentence guideline should be 15-21 months. I would think that the damage amount could be even lower than that, especially if it had to be proved in trial. This is why I made my original statement that I thought it sounded quite high.
So they must have applied the (b)(14)(B) part to push him to level 24 for a range of 51-63. In which case his sentence of 41 months is then too low. So if he "accepted responsibility" he could reduce his 24 to a 22, getting him right at the 41-51 month range. Judges would almost always apply the lowest end of the range to a first time offender.
I think his 41 months can be split into two phases so he could spend half of it in an actual prison and then the rest on 'supervised release' - either monitored home detention or in a halfway house. He might even be able to spend the entire time on 'supervised release'. I couldn't find it but section 1030 offenses used to have a clause about mandatory 6 months 'imprisonment'.
Due to his offense level, he could have gotten 5 years probation, but 3 is typical. He will be required to make restitution to the victim for the damage amount. There's also a fine table that shows him with a $7,500 to $75,000 fine range. He'll have to make his best effort to pay those.
So that's the mechanics of federal sentencing.
This is something I wish they covered in every school program. It's amazing to realize that one angry act by a programmer or IT person could result in very severe consequences. So few people in our field realize how stiff the penalties can be, so this law isn't much of a deterrent.
