Even after they rumbled his name, I wonder if he could have avoided direct culpability by keeping his net connection three hops away from the source systems, and using forged identity docs for anything official (mobile wifi connection and visa debit card)?