The sentence will scale with the money they made added to the amount of damage attributed to the victims; they're in essentially the same boat as SBF with respect to sentencing, albeit with lower numbers. If they made + caused more than six figures, they'll be looking at multiple years; over a million, something in the vicinity of 5-6 years.
(I'm not a lawyer, I've just got the sentencing guidelines hotkeyed).
They are not in the same boat in terms of sentencing whatsoever. SBF's guidelines are going to be maxed because of the loss amount. His criminal history score will be 0, yes, but I imagine a few of these young men will have a criminal history score of 0 as well.
The scale for financial loss is really weird. $150k will get you 10 points. $1.5MM will get you 16 points. $550MM will get you 30 points. https://guidelines.ussc.gov/gl/%C2%A72B1.1
We are saying the same thing. I agree, of course, that SBF's sentence will be much higher than these dipshits. But the mechanism by which they're calculated is basically the same --- SBF will have some level accelerators that the DDoS'ers don't have, and the DDoS'ers will have some 18 USC 1030 accelerators (circumvention devices, domain names, maybe PII) that SBF doesn't.
If you do the actual exercise of picking out a realistic loss number and doing the calculation, you'll find that the 2B1.1 loss table dominates the sentence.
Circumvention is just 1 point, is it not? Domain names I don't think count? But you could use that as total number of victims (usually they just wing it — the calculation, the feds); PII I didn't see mentioned.
I think SBF is in deep shit and I think the world is better for it. These guys? I don't know, probably not as deep as it looks; certainly not the 10 years that another poster was saying, though.
It's 2 points (pretty much everything is 2 or 4 points). But it doesn't matter, really: the accelerators are nothing compared to the loss table. Again, I think we're saying the same thing! I deliberately tripped as many of the 18 USC 1030 enhancements as I could just to demonstrate to myself that it didn't much matter.
SBF will serve something close to life if convicted because the losses he incurred blow out the guidelines table.
The DDoS'ers will serve something scaled to the amount of losses they actually caused. I think $1MM is a reasonable ballpark, which gets you into the high single digit years.
(I'm not a lawyer, I've just got the sentencing guidelines hotkeyed).