I would have been 100% behind him if he had said, "hey, I noticed this hole, visit http://att.com/account_info.php?omg=noes and have a look!" By actually publishing the information, he proved that he accessed information he was not authorized to have, which the law does technically say you are not supposed to do. (The "hey, I noticed this hole", IMO, is not enough to build a solid case against him for accessing data he was not supposed to have. IANAL, though.)

Either way, though, prison is not an acceptable outcome for this behavior. "Don't do this again," maybe, but not being locked in a cage for years. How would that help anyone?