What you're convicted for in a plea deal is usually a step or two down from what you actually did. So the prosecutor office can claim a large number of success

What you're convicted for in a plea deal is usually a step or two down from what you actually did. So the prosecutor office can claim a large number of successful cases in exchange for lighter punishment. There's different stories for what you actually did, what they think you did, what they can prove you did, what they think they can convince a non-technical jury of what you did, what the DOJ/FBI traditionally self congratulatory press release claims, what the plea bargain deal was for. Usually those multiple stories are only minimally tangentially related at best. The somewhat overly self congratulatory DOJ US attorney press release from May 14, 2010 claims the guy got himself hired as a security guard to gain partial physical access, then did all this Hollywood style breaking and entering into secured locations he wasn't authorized to be in, removed the anti-virus from at least 14 machines, downloaded a password cracker from the internet, made an "instructional" video of the process. They couldn't prove he did anything TO the HVAC controller or nurses confidential access station, so the press release is full of "could have" and "would have" but kinda imply he sorta did but nothing bad happened and they can't prove nothing so... Now in contrast to the above, his plea deal was exactly two counts of transmitting a malicious code. No breaking and entering, the other dozen machines seem to have disappeared, nothing illegal was accessed or modified, nobody seems concerned he cracked the passwords solely what he did afterwards on two of the machines, etc. I can see how his description of what he did vs what he did time for vs what he actually did seems a bit dissociated.