Whether you believe in my innocence or not, the CFAA actually does have a line about "password trafficking," which was alleged by the government -- but not charged.
To be clear, people are not upset at the _actual_ or _likely_ sentence, they are upset at the _potential_ sentence.
When reporters say "Keys faces," they are talking about the potential sentence I face (as put forth by the Department of Justice in its own press releases), and when people are critical of it, they are taking the position that the potential sentence is absurd.
Aside from the fact that I didn't do it (despite what prosecutors were able to convince a jury), this case has opened my eyes to the antiquated and draconian computer laws of which we are all governed under in the United States. Any reasonable person would agree that the punishments simply don't fit the alleged offenses, and the law is in desperate need of reform. Any offside discussion about potential versus actual sentences takes away from the very serious, very important discussion about reform.
There was no potential for a 25 year sentence in this case. The statute caps any possible CFAA sentence, but that cap captures a wealth of factors not at play in this case: no intent to make money or commercialize the attack, no priors, &c.
The 25 year maximum describes a case where someone caused damage to critical infrastructure, helped stole a zillion credit cards, and potentially caused loss of life, but due to the idiosyncracies of the case, was only able to be charged under CFAA and wire fraud law. That's not this case.
Ken White has pointed out the discrepancy between DOJ press releases and actual sentencing procedures at length. See [popehat whale sushi]. White is, again, a former white-collar crime prosecutor, and is himself no friend of the DOJ.
On the very, very remote chance that the person who signed up as "matthewkeys" on HN is actually "matthewkeys", and acknowledging that I am not a lawyer: it is probably a fantastically bad idea to be commenting on this case on HN prior to sentencing.
Because the conviction, much like the government's accusations and case, is bullshit.