Yes, I agree...in fact, Tribune should be secretly thanking Keys...no matter what his actual intent, the incident got them to implement proper security...the $900K they spent they would&#x27;ve had to spend anyway and is a bargain compared to what could&#x27;ve happened.<p>But &quot;oh the company should&#x27;ve had better security&quot; is a not strong legal defense, in the same way that &quot;the victim shouldn&#x27;t have been walking alone at might&quot; is not.<p>edit: just to clarify, I&#x27;m being flippant here since most of the main arguments for and against Keys have already been made...but I don&#x27;t interpret Keys&#x27;s actions as any kind of &quot;white hat&quot; hacking. According to the evidence, he most certainly tried to get Anonymous to burn the company to the ground, and he and Tribune are very lucky they didn&#x27;t.<p>However, I do think it&#x27;s dishonest for the Tribune to claim $900K in damages when that was the amount used to shore up their security after the breach. But the $17K they spent as incident response seems very reasonable. But to then tack on the $900K so that the maximum possible prison time is more politically palatable helps to perpetuate the worst parts of the CFAA and the justice system.