acquired phones. Thereafter, the game items would be sold for money on an intermediary trading website. The Supreme Court of Korea read “game items” into the Game Industry Promotion Act: the “tangible and intangible results obtained through the use of game products [are] forbidden to make a business of exchanging such items”.15 The Court validated its position by looking to two different Enforcement Decrees for the Game Industry Promotion Act: first, the current Decree reads that “Game money or data, such as items, produced or acquired by using game products with personal information of another person”16; second, the former Decree read, “Game money or data, such as game items, produced or acquired by abnormal use of game products”.17 Thus, Korea has used both amendments and judicial interpretation to ensure that evolving forms of cybercrime remain criminalized. While countries are finding various means to criminalize the growing diversity of cybercrime, doubt has been expressed over the deterrent effect of current regulations.18 Part of the concern is cybercrime’s ubiquity and difficulties in identifying perpetrators and cross-jurisdictional prosecution.19 Additionally, however, is the concern that penalties are not sufficiently severe to deter criminal behavior.20 That said, anecdotal evidence suggests that this situation might be changing. Case 1.5: United States v. Albert Gonzalez (USA)21 On 25 March 2010, Albert Gonzalez, the so-called TJX hacker, was sentenced to twenty years in prison, the longest US prison term in history for hacking.22 Gonzalez engineered what was at the time the largest theft of credit and debit card information in US history (some eighty gigabytes of data), which resulted in the theft of over 130 million card numbers and costing individuals, companies and banks, and which amounted to nearly US$200 million in losses.23 The hacks involved the first known intrusions involving decryption of PIN codes, a key protective feature in bank card security in the United States. The sentence represents one of the toughest verdicts for both financial crimes and cybercrimes to date in the United States.24 Although sentences have been becoming increasingly robust, they have not played a significant role in reducing cybercrime due to difficulties in identifying, arresting and prosecuting offenders. Also, restitution orders are rarely, if ever, fully paid back.25 Page 31 | Chapter 1 | § C. Challenges to Fighting Cybercrime Table of Contents