Pretty much. The US were kinda embarrassed by this guy. From what I've read, the $800K of damages was actually just him logging in with a VNC client using a blank password, then clicking around. I wouldn't be surprised if they spent $800K securing the systems he accessed and then claimed that was the 'damage'.