Given that he is not a US citizen, one could make the argument that he was engaged in cyber warfare against the US, thus legally classified as an enemy combatant, subject to special magistrate court and incarcerate-able at an offshore detention facility. Rules on detainee handling there are more lax and sentencing has no guidelines at least no published ones. I would consider that possible path of prosecution and even the threat of it to be torture.