Hefty prison time for hackers, such as Heartland intruder Albert Gonzalez, is an effective deterrent.

FOR

Kim Peretti, director, PricewaterhouseCoopers, & former senior counselor, U.S. Department of Justice

Unquestionably, I believe the 20-year sentence Albert Gonzalez received is an effective deterrent. Will it put an end to cybercrime? No. Will it likely deter those cybercriminals in the possible-to-be-deterred category? Absolutely.

In my eight years of prosecuting this type of crime, I've read hundreds of chats among hundreds of young cybercriminals who bragged of impunity, who bravely asserted they were outside the reach of law enforcement, and who, despite their youth, correctly saw the risk-benefit calculation at that time tipping in favor of crime versus time in jail. A risk of probation is hardly a risk when cashing PINs brings in $50,000 a week. But when that risk analysis changes to a few years in jail for providing malware (without profit), a few more years for laundering money, a few more years for providing hacking expertise with profit, and ultimately a sentence comparable to the most serious of white-collar criminals, it is no longer a child's game.

AGAINST

Avivah Litan, VP and distinguished analyst at Gartner

Severe penalties for cybercrimes send important and necessary messages about society's unwillingness to tolerate fraud, but will not notably deter would-be cybercriminals. This does not mean that stiff penalties should not be levied; it simply means society cannot expect them to have much of an effect on the fraud landscape. Fraudsters will surely take note of them, however, and the more sophisticated among them will simply learn from the mistakes made by those caught and change their tactics accordingly. Instead of large-scale attacks against large targets, the hackers will shift their schemes to targeted attacks in distributed hacking environments. This way, they can still make off with their digital goods, but with a much lower risk of being exposed. Cybercrime is simply too lucrative for the crooks to shy away from. They can yield significantly more gains from a clever cyberattack – with much lower risk of being nabbed – than they can from a physical world attack where they must carry weapons and avoid being seen.