Aaron and a couple of his buddies should have formed a corporation, done the exact same stuff Aaron did on his own, and called it a business. Even if they didn't make any money on it, criminal law is MUCH more forgiving to businesses than to individuals. The worst that would have happened would be to shut the business down, with minimal criminal charges against the business owners.

Look at all of the various malware companies that committed all kinds of computer tampering and wire fraud, only to be hit with fines and then allowed to go on their merry ways.