If he were guessing passwords jail time might be appropriate.
It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?