If the "attacker" exposes him/herself and he/she is in the US as he said in the open letter, I think he could be sent to prison for the hacking with bad intent.