5 ms·

Seems like his mental conditions (psychosis, Asperger syndrome and depression according a psychologist who testified on his behalf) should have been enough to h

Seems like his mental conditions (psychosis, Asperger syndrome and depression according a psychologist who testified on his behalf) should have been enough to have the request denied. Edit: Apparently he's facing 99 years for the charges (yes I know he might get much less). I wonder if he can appeal to the European Court of Human Rights. I know in the past they've said whole-life sentences are ok but I can't see how such a sentence wouldn't be considered inhumane for computer hacking.

tptacek 10y ago
No. He will get "much less". If he's given a custodial sentence at all (he could plausibly be given probation, given his cognitive issues and the fact that his crime was non-remunerative), it'll almost certainly be low single-digits. These "99 year" sentences are conjured by taking every charged count of an offense, assuming the maximum possible sentence for that class of offense, and then adding all the charges together. But that's not how federal sentencing works. Like: at all. What happens in reality is that "like" charges group, and you're sentenced only according to the most severe count in the group of charges. The federal sentencing guidelines are freely available. You can read through them to get a ballpark of where this case will land. There's a reason most convicted hackers who aren't running giant credit card rings spend single digit years in prison: the sentencing guidelines won't allow for a different sentence.
- celticninja 10y ago
  Single digits is still excessive, we are talking 5 or 6 years in jail for crimes which were void of any financial gain. I'm thinking g of weev and swartz who are both dealt with in the article. https://www.eff.org/deeplinks/2013/03/41-months-weev-understanding-how-sentencing-guidelines-work-cfaa-cases-0 https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...
  - tptacek 10y ago
    I agree†. Sentences in general are too long. I don't think there's a corrective goal that a 5 year sentence for a non-financial computer crime that isn't served just as well in 1. † With the nit that I don't believe a 5 year sentence would be in the cards for this particular offender.
    - celticninja 10y ago
      I'm not so certain, his targets meet the "official victim" requirement, they will be free to choose the loss value which is unlikely to be Conservative, means of identification is likely met as it is a simple as accessing email addresses and even though they attacks have been called simplistic and the weaknesses well known they will claim that sophisticated means were used by virtue of a computer being involved. This on the face of it seems worse than weev as there were multiple targets involved.
      - tptacek 10y ago
        He's not the first person to get caught hacking the USG, and thus far insane sentences haven't been a consequence of that sort of thing. We'll see, I guess.
- maxlybbert 10y ago
  e.g., https://popehat.com/2015/10/08/bad-reporting-on-matthew-keys-possible-sentence-conceals-prosecutorial-power/ https://popehat.com/2015/10/08/bad-reporting-on-matthew-keys... .
catnaroek 10y ago
> Seems like his mental conditions (...) should have been enough to have the request denied. No, not because of that. There's this thing called “jurisdiction”, and countries have it over their own territory, but not that of others. The US should sue him in the UK, and try to get him sent to prison in the UK.
- blackbagboys 10y ago
  The U.S. absolutely has jurisdiction over crimes committed against computer systems within its territory. Why would you think U.S. law enforcement does not have jurisdiction over a criminal who committed crimes against U.S. property and persons located in U.S. territory? I see comments like this one in a lot of threads involving prosecutions - off the cuff statements that "well, it FEELS like things should work this way, rather than the way they actually do." If you're not an expert on the legal issues at hand, perhaps consider refraining from making these types of comments.

tptacek 10y ago

No. He will get "much less". If he's given a custodial sentence at all (he could plausibly be given probation, given his cognitive issues and the fact that his crime was non-remunerative), it'll almost certainly be low single-digits. These "99 year" sentences are conjured by taking every charged count of an offense, assuming the maximum possible sentence for that class of offense, and then adding all the charges together. But that's not how federal sentencing works. Like: at all. What happens in reality is that "like" charges group, and you're sentenced only according to the most severe count in the group of charges. The federal sentencing guidelines are freely available. You can read through them to get a ballpark of where this case will land. There's a reason most convicted hackers who aren't running giant credit card rings spend single digit years in prison: the sentencing guidelines won't allow for a different sentence.

celticninja 10y ago
Single digits is still excessive, we are talking 5 or 6 years in jail for crimes which were void of any financial gain. I'm thinking g of weev and swartz who are both dealt with in the article. https://www.eff.org/deeplinks/2013/03/41-months-weev-understanding-how-sentencing-guidelines-work-cfaa-cases-0 https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...
- tptacek 10y ago
  I agree†. Sentences in general are too long. I don't think there's a corrective goal that a 5 year sentence for a non-financial computer crime that isn't served just as well in 1. † With the nit that I don't believe a 5 year sentence would be in the cards for this particular offender.
  - celticninja 10y ago
    I'm not so certain, his targets meet the "official victim" requirement, they will be free to choose the loss value which is unlikely to be Conservative, means of identification is likely met as it is a simple as accessing email addresses and even though they attacks have been called simplistic and the weaknesses well known they will claim that sophisticated means were used by virtue of a computer being involved. This on the face of it seems worse than weev as there were multiple targets involved.
    - tptacek 10y ago
      He's not the first person to get caught hacking the USG, and thus far insane sentences haven't been a consequence of that sort of thing. We'll see, I guess.
maxlybbert 10y ago
e.g., https://popehat.com/2015/10/08/bad-reporting-on-matthew-keys-possible-sentence-conceals-prosecutorial-power/ https://popehat.com/2015/10/08/bad-reporting-on-matthew-keys... .

catnaroek 10y ago

> Seems like his mental conditions (...) should have been enough to have the request denied. No, not because of that. There's this thing called “jurisdiction”, and countries have it over their own territory, but not that of others. The US should sue him in the UK, and try to get him sent to prison in the UK.

blackbagboys 10y ago
The U.S. absolutely has jurisdiction over crimes committed against computer systems within its territory. Why would you think U.S. law enforcement does not have jurisdiction over a criminal who committed crimes against U.S. property and persons located in U.S. territory? I see comments like this one in a lot of threads involving prosecutions - off the cuff statements that "well, it FEELS like things should work this way, rather than the way they actually do." If you're not an expert on the legal issues at hand, perhaps consider refraining from making these types of comments.