> There's a perception in society that you can get away with certain
> extremely harmful things, like hacking or financial crime or
> environmental pollution, because it's hard to pin down intent
> and the results are hard to measure.
I think that you're mis-directing anger here. 'Hacking' in some cases (in the US at least) carries harsher penalties than other more heinous crimes (regardless of the amount of damage done). Hackers usually face stiff minimum penalties (in the US). Had he been tried in the US he probably would have spend a decade or more in federal prison, and been destitute and/or a 'product of the system' by the time that he got out. This would have increased the chance that he would re-offend (and just not be stupid enough to get caught this time).
> * Hacking Valve. Damage: $250,000,000. Punishment: 2 years probation.
Do you
really believe that Valve lost $250M? That number is probably equivalent to the amount of money that Valve had invested into the Half-Life 2 source code at that point in time or the amount of money that they expected to earn through that source code. In hind-sight, Valve didn't lose much. They were still able to monetize their source code, and were very successful at it. Do you really think that there are people out there that did not buy Half-Life 2 because they downloaded the source code to a broken pre-release version of it? Do you really think that there are any serious commercial game companies out there that are using the leaked source code in their code base rather than licensing the engine from Valve?
The amount of 'damages' that Valve incurred due to this is/was speculative. Of course, once the initial estimate comes out, Valve isn't going to go back and state what the actual damages were, because then people would question why the initial estimate was so high. There are also perverse incentives to inflate those numbers:
- Larger damages get more attention from the FBI.
- Larger damages are more likely to see harsher action by the justice system (aka courts).
- Larger damages garner more sympathy from the public.
- Larger damages can make you look like a hero to investors when the reality turns out to not be so bleak. You can always spin yourself as the hero that saved the company from financial ruin.
- Larger damages make the incident a likely scapegoat should the financial quarter be tough on the company (much like piracy is the scapegoat for the MPAA). E.g. "Yea we did poorly, but it wasn't our fault! It was all that darn hacker!" When in reality the leak had nothing to do with the losses.
> Yeah, it worked out with Bernie Madoff, actually. Still it
> doesn't seem proportionate to his crimes.
What exactly should the punishment for Madoff be? 1000 years in prison? I somehow don't think that extra prison time would be much of a deterrent or a punishment. (Unless you're advocating torture, but in that case, you've really shown us your true colors.)