Surprised it hasn't happened yet, not sure what the penalty would be but I'd guess months rather than years.
This isn't exactly the kind of thing US law treats as a minor offence, especially if it involves computers. Get the right prosecutor involved and this is a national security concern, an act of treason and a cybercrime all at once.
Treason is _minimum_ 5 years, capital punishment at worst.