He won't get 25 years. But federal sentences for any type of fraud, including those issued under the CFAA, are based upon the actual or intended loss - whichev

He won't get 25 years. But federal sentences for any type of fraud, including those issued under the CFAA, are based upon the actual or intended loss - whichever is higher. In other words, if the government argues at sentencing that his intent was to seriously disrupt the entire paper's site for an extended period of time by giving out these credentials to a known hacking group, they can claim an intended loss of millions of dollars. A sentence based upon an intended loss of more than $1 million will start at about two years and go up from there, basically depending on how the judge feels that particular day.