"The cyberattack was not intended for the hospital, according to a report from the German news outlet RTL. The ransom note was addressed to a nearby university. The attackers stopped the attack after authorities told them it had actually shut down a hospital."
Source: https://www.theverge.com/2020/9/17/21443851/death-ransomware...
If this was just some ransomware attack it would be barely newsworthy, and we sure wouldn't be discussing it. The death is what makes it interesting. And in this context it is important that the hospital wasn't even the intended target but was caught in the crossfire.
That doesn't justify anything, but I think we can all agree that extortion is a less severe crime than murder.
But if I had to assign jail sentences, a ransomware author would get a decade or two (add another decade in this case for manslaughter), a murderer would get a life sentence. Life over property.
It is important to recognize that crimes have different levels. Society understands that, and it's encoded in our laws in the way we define scaling punishments, and have a difference between misdemeanors and felonies.
For thefts, there's a distinction between "burglary", "robbery", and "robbery with a deadly weapon".
And in this case-- comparing ransomware of a university to terrorism is disproportionate.
So in this case, the better analogy would be explosives - someone tried to blow a safe to get the money inside but the explosion also killed an innocent bystander.
Prosecuting them for man slaughter and arson and everything else what applies would be perfectly fine.
The Morris worm's DOS nature was a programming error; it was still prosecuted as a felony for total amount of damage done.