I have read it, and he still has a 3 year probation after his prison term.

When they accuse him of "fraudulently obtaining user names and passwords and stealing personal identification and financial information" - does that mean he went after this information, or more likely one of the computers in the botnet happened to have such information residing on it. It's possible he didn't know of any financial information and they would throw the book at him anyway just to get the initial charge and work down from there. We all know there are differences in computer crime, that our legal system isn't able to make a distinction does not make an argument.