The punishment should be measured by sense of justice, common good and mercy and not to be the most severe as possible. You confuse conservatism with the cruelty.
Actually the punishment should be determined by:
1) the intent of the hacker
2) the harm caused by the hacker
3) the nature of what was hacked--(e.g. consumer product vs. national security product)