They are putting all their eggs in the ISP enforcement basket. I'm sure that will do wonders.

Part of the issue here is that just because he submitted a write up on what he claims he did doesn't mean he didn't leave a backdoor. Chances are he didn't but until they analyze everything (which takes forever given the number of servers a university department has), how do they know? It could be a way of covering tracks. Look at it this way, you got home one day and found a 16 page write-up about how a guy broke into your house, disabled the motion detector, and finally video taped it all, how would you feel? Jail is beyond what I would do personally but I'm pretty sure I wouldn't be peachy for such a kind gesture.

"The bookstore would know you had an outstanding parking ticket" - how and why? The current bank card we use in a bookshop links to all our bank details but a bookshop cannot access them - no system would let retail outlets interrogate a database for that information or any other info that didn't directly refer to them - that would be a serious design flaw and would never be accepted.