I have always maintained that the only penalty that is acceptable for being convicted of hacking is swift and painful execution. No exceptions. That would make the enterprise quite a bit less attractive.
The problem is apprehension and conviction.
The other issue is correctly determining who is really doing the “hacking”. I have had angry people call me up accusing me of making spam phone calls after my phone number was spoofed. It is the same with computer hacking, you might think the hacker is the kid across the street when it is actually someone in China. And if politics are involved you could definitely be looking at selective and false prosecution.