Pretty much. The US were kinda embarrassed by this guy. From what I've read, the $800K of damages was actually just him logging in with a VNC client using a blank password, then clicking around. I wouldn't be surprised if they spent $800K securing the systems he accessed and then claimed that was the 'damage'.
See also the raid on Steve Jackson games where documents available in public libraries (and which were also sold to the public) were claimed to be sensitive secrets worth many thousands of dollars.
