8 ms·

40 years, or even 10 years is not a reasonable sentence for cybercrime. It should be no more than 2-3 years in the severest of cases.

lm2s 10y ago
IMO it really depends on the cybercrime. Maybe in this instance 2-3 years should be sufficient. I can, however, imagine scenarios where much longer sentences should be applied. If a cybercrime results in human casualties, for (a more extreme) example.
- nitrogen 10y ago
  There are already laws against homicide, though. Use those.
  - pessimizer 10y ago
    What if the effects result in an estimated 12 suicides, 1,000 children becoming homeless, and 10,000 teenagers not being able to go to college? Probation, or not worth charging? What if someone punches you in the face and steals your wallet, resulting in minor bruising, an adrenaline dump, the loss of $42 and at least three hours spent on the process of replacing your ID and credit cards?
- djsumdog 10y ago
  ..and the board of directors of many major banks should all be in jail after the 2008 financial crisis. They're not only free, many of them kept their bonuses. 1% of Americans are in the incarnation system or out on parole. That's more than all of the other high income countries. Our legal system is hardly fair, and this is another example of it.
  - pessimizer 10y ago
    I don't understand this comment. Are you saying that it's good that bankers didn't go to jail, but bad that malicious hackers do? If so, I disagree; bankers should have gone to prison for a period of time easier measured in decades than years. What I have a problem with is all of the tears for the white collar, educated criminals, and the insistence that the people who really deserve prison are those poor, uneducated, violent criminals. Somehow everyone seems to think that the criminals that they could most easily see themselves as deserve the least punishment, so middle-class crime is seen as less criminal by the middle-class.
  - tptacek 10y ago
    Unfortunately for this argument, the framers of the Constitution were pretty firm about the idea that for people to be sent to prison, they had to violate a law already on the books at the time the crime was committed, and that the burden of proof for establishing the violation was on the prosecution, not the defendant.
sfifs 10y ago
Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area. Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments. As usual, there is no one size fits all and so Judges usually have leeway to decide severity of punishment.
- ryanlol 10y ago
  >Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area. Any such acts would be criminal on their own, not sure what point you're trying to make besides emotional appeal. > Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments. If you actually did something with such access it shouldn't be very hard to find suitable crimes to charge you with other than breaking to the servers.
ourmandave 10y ago
It also depends on whether you're the fall guy or not.
michaelmrose 10y ago
How do you arrive at this number?
- ryanlol 10y ago
  Seems reasonable, it's extremely difficult for hacking by itself to be a particularly serious crime. Of course, murdering someone by hacking their medical equipment is still murder.
  - michaelmrose 10y ago
    Its extremely easy for it to cause thousands to millions in damages. If I burned thousands -> millions in property even if nobody was hurt it would still be a serious crime. Its also a potentially lucrative area which ought to be counterbalanced with high consequences.
    - ryanlol 10y ago
      I was charged with criminal damage (like you would for damaging ones physical property) on top of hacking charges. Seems fair to me, I really don't see why cybercrime deserves special treatment. >Its also a potentially lucrative area which ought to be counterbalanced with high consequences. Yeah, copyright infringement is even more lucrative. Does that mean we should start locking up people for whats currently civil copyright infringement?
    - Nutomic 10y ago
      It's weird that bankers never get sued, after causing millions in damage.
      - GirlsCanCode 10y ago
        Huh?
      - ryanlol 10y ago
        Bankers get sued all the time. You're probably talking about criminal charges anyway, in which case the answer is that they rarely do anything that illegal, and when they do it's not very easy to prove.
pistle 10y ago
The potential impact of a hacking crime is massive. Millions to billions of dollars and a real impact on people's lives for well over 2-3?! years. If someone suffers identity theft, invasions of privacy, etc. the direct impact could easily go beyond a few years and secondary impacts almost surely would. The sentencing guidelines make available remedies for those cases - and I can imagine large scale attacks which should be punishable by life in prison. Do the merits of this case warrant max staycations in prison? I dunno, but the government should have the flexibility for the lulz.
- josho 10y ago
  And a physical analogue: The potential impact of breaking and entering is massive... So, B&E is a relatively minor offence, it's the crimes that follow (theft, destruction of property, etc) that are significant. The same should apply for a cyber-B&E. In fact do you even need a law for breaking into a computer? I wonder if we could simply revise the traditional B&E definition to apply to computers as well.
justanother 10y ago
"Hackers penetrate and ravage delicate public and privately owned computer systems, infecting them with viruses, and stealing materials for their own ends. These people, they are terrorists."
tptacek 10y ago
2-3 years is the sentence he's most likely to get. Look at the sentencing guidelines; they're public. FWIW: 2-3 years is also too harsh for a first-time offense. There's no corrective outcome you get in year 2 that you don't already have by the end of year 1. But regardless: the sentences in these press releases have absolutely no connection to reality.

lm2s 10y ago

IMO it really depends on the cybercrime. Maybe in this instance 2-3 years should be sufficient. I can, however, imagine scenarios where much longer sentences should be applied. If a cybercrime results in human casualties, for (a more extreme) example.

nitrogen 10y ago
There are already laws against homicide, though. Use those.
- pessimizer 10y ago
  What if the effects result in an estimated 12 suicides, 1,000 children becoming homeless, and 10,000 teenagers not being able to go to college? Probation, or not worth charging? What if someone punches you in the face and steals your wallet, resulting in minor bruising, an adrenaline dump, the loss of $42 and at least three hours spent on the process of replacing your ID and credit cards?
djsumdog 10y ago
..and the board of directors of many major banks should all be in jail after the 2008 financial crisis. They're not only free, many of them kept their bonuses. 1% of Americans are in the incarnation system or out on parole. That's more than all of the other high income countries. Our legal system is hardly fair, and this is another example of it.
- pessimizer 10y ago
  I don't understand this comment. Are you saying that it's good that bankers didn't go to jail, but bad that malicious hackers do? If so, I disagree; bankers should have gone to prison for a period of time easier measured in decades than years. What I have a problem with is all of the tears for the white collar, educated criminals, and the insistence that the people who really deserve prison are those poor, uneducated, violent criminals. Somehow everyone seems to think that the criminals that they could most easily see themselves as deserve the least punishment, so middle-class crime is seen as less criminal by the middle-class.
- tptacek 10y ago
  Unfortunately for this argument, the framers of the Constitution were pretty firm about the idea that for people to be sent to prison, they had to violate a law already on the books at the time the crime was committed, and that the burden of proof for establishing the violation was on the prosecution, not the defendant.

sfifs 10y ago

Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area. Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments. As usual, there is no one size fits all and so Judges usually have leeway to decide severity of punishment.

ryanlol 10y ago
>Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area. Any such acts would be criminal on their own, not sure what point you're trying to make besides emotional appeal. > Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments. If you actually did something with such access it shouldn't be very hard to find suitable crimes to charge you with other than breaking to the servers.

ourmandave 10y ago

It also depends on whether you're the fall guy or not.

michaelmrose 10y ago

How do you arrive at this number?

ryanlol 10y ago
Seems reasonable, it's extremely difficult for hacking by itself to be a particularly serious crime. Of course, murdering someone by hacking their medical equipment is still murder.
- michaelmrose 10y ago
  Its extremely easy for it to cause thousands to millions in damages. If I burned thousands -> millions in property even if nobody was hurt it would still be a serious crime. Its also a potentially lucrative area which ought to be counterbalanced with high consequences.
  - ryanlol 10y ago
    I was charged with criminal damage (like you would for damaging ones physical property) on top of hacking charges. Seems fair to me, I really don't see why cybercrime deserves special treatment. >Its also a potentially lucrative area which ought to be counterbalanced with high consequences. Yeah, copyright infringement is even more lucrative. Does that mean we should start locking up people for whats currently civil copyright infringement?
  - Nutomic 10y ago
    It's weird that bankers never get sued, after causing millions in damage.
    - GirlsCanCode 10y ago
      Huh?
    - ryanlol 10y ago
      Bankers get sued all the time. You're probably talking about criminal charges anyway, in which case the answer is that they rarely do anything that illegal, and when they do it's not very easy to prove.

pistle 10y ago

The potential impact of a hacking crime is massive. Millions to billions of dollars and a real impact on people's lives for well over 2-3?! years. If someone suffers identity theft, invasions of privacy, etc. the direct impact could easily go beyond a few years and secondary impacts almost surely would. The sentencing guidelines make available remedies for those cases - and I can imagine large scale attacks which should be punishable by life in prison. Do the merits of this case warrant max staycations in prison? I dunno, but the government should have the flexibility for the lulz.

josho 10y ago
And a physical analogue: The potential impact of breaking and entering is massive... So, B&E is a relatively minor offence, it's the crimes that follow (theft, destruction of property, etc) that are significant. The same should apply for a cyber-B&E. In fact do you even need a law for breaking into a computer? I wonder if we could simply revise the traditional B&E definition to apply to computers as well.

justanother 10y ago

"Hackers penetrate and ravage delicate public and privately owned computer systems, infecting them with viruses, and stealing materials for their own ends. These people, they are terrorists."

tptacek 10y ago

2-3 years is the sentence he's most likely to get. Look at the sentencing guidelines; they're public. FWIW: 2-3 years is also too harsh for a first-time offense. There's no corrective outcome you get in year 2 that you don't already have by the end of year 1. But regardless: the sentences in these press releases have absolutely no connection to reality.