40 years in prison is way out of proportion, guilty or not. Are there black hats in the US currently serving this kind of sentences?
But if he wrote the trojan and if a lot of people had their life turned upside down (identity theft and credit report issues aren't fun) I don't see why he shouldn't go to jail, for quite a while.
This guy is doing 20 years.