I don't understand why punishment in hacker cases isn't always the exploitation of the guilty hacker's skills redirected towards societal benefit for extensive periods rather than expensive prosecutions, expensive prison sentences, and ultimately disenfranchisement of a valuable resource. When they catch them, they should just give them a choice, prosecution, or "you work for us for as long as we say," draft them into the Cyber Force as closely watched grunts that can advance with merit, accomplishments and earning trust, with positive reinforcement effectively eliminating recidivism. It is incredibly cheap to keep a hacker happy and producing compared to the cost of prosecution, etc. Granted, the vast majority of criminal "hacks" involve unimpressive retaliations for being mistreated by an employer, but even some of those were impressive, at least among the hacks we know about. I know a few convicted hackers went into security after restitution, but I think we can avoid the expensive and slow process of heavy justice for most of these crimes that entirely happened on computers, where most had little effect on the material world... few were maimed, physically injured, suffered immensely before dying horribly at their hands. Three years is not enough for murdering someone, but 5 years is far too much for anything that happened only on a computer and left no actual legitimately human carnage.