A distributed denial-of-service attack makes the Web site for a top electronic retailer inaccessible for an entire day. As a result of the attack, nearly a million customers were inconvenienced, and the retailer lost millions of dollars of sales to its competitors. Law enforcement agencies apprehend the person who launched the attack. Should the punishment be determined strictly by considering the crime that was committed, or should the identity of the culprit be taken into account? If the identity of the perpetrator should be taken into account, what punishment do you think would be appropriate if he were: