There was no potential for a 25 year sentence in this case. The statute caps any possible CFAA sentence, but that cap captures a wealth of factors not at play in this case: no intent to make money or commercialize the attack, no priors, &amp;c.<p>The 25 year maximum describes a case where someone caused damage to critical infrastructure, helped stole a zillion credit cards, and potentially caused loss of life, but due to the idiosyncracies of the case, was only able to be charged under CFAA and wire fraud law. That&#x27;s not this case.<p>Ken White has pointed out the discrepancy between DOJ press releases and actual sentencing procedures at length. See [popehat whale sushi]. White is, again, a former white-collar crime prosecutor, and is himself no friend of the DOJ.<p><i>On the very, very remote chance that the person who signed up as &quot;matthewkeys&quot; on HN is actually &quot;matthewkeys&quot;, and acknowledging that I am not a lawyer: it is probably a fantastically bad idea to be commenting on this case on HN prior to sentencing.</i>