Which is why a significant fine and significant probationary time would serve as a deterrent. The only plus in the incarceration is making money for the prison system.
Personally, I think the Times should be fined for not adhering to best IT practices and contributing to the cost of an investigation. (In this case, I’m corporate-victim blaming.)
