Hacker News Reader

Comment by aviraldg | Hacker News Reader

40 years, or even 10 years is not a reasonable sentence for cybercrime. It should be no more than 2-3 years in the severest of cases.

View on HN

2-3 years is the sentence he's most likely to get. Look at the sentencing guidelines; they're public.

FWIW: 2-3 years is also too harsh for a first-time offense. There's no corrective outcome you get in year 2 that you don't already have by the end of year 1.

But regardless: the sentences in these press releases have absolutely no connection to reality.

Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area. Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments.

As usual, there is no one size fits all and so Judges usually have leeway to decide severity of punishment.

>Consider that cybercrime could potentially turn off power for half of United States, launch a nuclear missile or deorbit a satellite over a populated area.

Any such acts would be criminal on their own, not sure what point you're trying to make besides emotional appeal.

> Ability to say break into a say a Ubuntu or Red Hat binary server could server malware to hundreds of organizations including Governments.

If you actually did something with such access it shouldn't be very hard to find suitable crimes to charge you with other than breaking to the servers.

"Hackers penetrate and ravage delicate public and privately owned computer systems, infecting them with viruses, and stealing materials for their own ends. These people, they are terrorists."

IMO it really depends on the cybercrime. Maybe in this instance 2-3 years should be sufficient. I can, however, imagine scenarios where much longer sentences should be applied. If a cybercrime results in human casualties, for (a more extreme) example.

There are already laws against homicide, though. Use those.

What if the effects result in an estimated 12 suicides, 1,000 children becoming homeless, and 10,000 teenagers not being able to go to college? Probation, or not worth charging?

What if someone punches you in the face and steals your wallet, resulting in minor bruising, an adrenaline dump, the loss of $42 and at least three hours spent on the process of replacing your ID and credit cards?

..and the board of directors of many major banks should all be in jail after the 2008 financial crisis. They're not only free, many of them kept their bonuses.

1% of Americans are in the incarnation system or out on parole. That's more than all of the other high income countries.

Our legal system is hardly fair, and this is another example of it.

I don't understand this comment. Are you saying that it's good that bankers didn't go to jail, but bad that malicious hackers do? If so, I disagree; bankers should have gone to prison for a period of time easier measured in decades than years.

What I have a problem with is all of the tears for the white collar, educated criminals, and the insistence that the people who really deserve prison are those poor, uneducated, violent criminals. Somehow everyone seems to think that the criminals that they could most easily see themselves as deserve the least punishment, so middle-class crime is seen as less criminal by the middle-class.

Unfortunately for this argument, the framers of the Constitution were pretty firm about the idea that for people to be sent to prison, they had to violate a law already on the books at the time the crime was committed, and that the burden of proof for establishing the violation was on the prosecution, not the defendant.

How do you arrive at this number?

Seems reasonable, it's extremely difficult for hacking by itself to be a particularly serious crime. Of course, murdering someone by hacking their medical equipment is still murder.

Its extremely easy for it to cause thousands to millions in damages. If I burned thousands -> millions in property even if nobody was hurt it would still be a serious crime. Its also a potentially lucrative area which ought to be counterbalanced with high consequences.

I was charged with criminal damage (like you would for damaging ones physical property) on top of hacking charges.

Seems fair to me, I really don't see why cybercrime deserves special treatment.

>Its also a potentially lucrative area which ought to be counterbalanced with high consequences.

Yeah, copyright infringement is even more lucrative. Does that mean we should start locking up people for whats currently civil copyright infringement?

It's weird that bankers never get sued, after causing millions in damage.

Bankers get sued all the time.

You're probably talking about criminal charges anyway, in which case the answer is that they rarely do anything that illegal, and when they do it's not very easy to prove.

It also depends on whether you're the fall guy or not.

The potential impact of a hacking crime is massive. Millions to billions of dollars and a real impact on people's lives for well over 2-3?! years. If someone suffers identity theft, invasions of privacy, etc. the direct impact could easily go beyond a few years and secondary impacts almost surely would.

The sentencing guidelines make available remedies for those cases - and I can imagine large scale attacks which should be punishable by life in prison.

Do the merits of this case warrant max staycations in prison? I dunno, but the government should have the flexibility for the lulz.

And a physical analogue: The potential impact of breaking and entering is massive...

So, B&E is a relatively minor offence, it's the crimes that follow (theft, destruction of property, etc) that are significant. The same should apply for a cyber-B&E. In fact do you even need a law for breaking into a computer? I wonder if we could simply revise the traditional B&E definition to apply to computers as well.

Reply on news.ycombinator.com