A 20-year-old California man who pleaded guilty in January to federal charges of hijacking more than 400,000 PCs, using them to build a botnet, then renting out the system to spyware distributors, hackers, and spammers was sentenced Monday to 57 months in prison.

Jeanson James Ancheta, of Downey, Calif., was arrested by the FBI in November 2005 and charged in a 17-count indictment of conspiracy, damaging federal government computers, and illegally accessing PCs to commit fraud and money laundering.

In late January, Ancheta pleaded guilty to four counts of conspiring to violate the Computer Fraud Abuse Act, conspiring to violate the CAN-SPAM Act, causing damage to federal computers, and accessing protected computers without authorization.

Although he faced as many as 25 years in prison, Ancheta was sentenced to four years, nine months by U.S. District Judge Gary Klausner, who also ordered him to give up $60,000 in cash, as well as a late-model BMW and computer equipment Ancheta bought with proceeds from the botnet. He is also to pay $15,000 in restitution to the government for damage his Trojan horses did to a pair of defense networks.

According to the original indictment, Ancheta had made $3,000 from renting the botnet to others, who used it to launch denial-of-service (DoS) attacks and spew spam. With an unidentified co-conspirator, Ancheta pocketed an additional $107,000 by seeding the botnet's PCs with adware and raking in affiliate fees for displaying pop-up ads on the commandeered computers.

After his jail term, Ancheta will serve three years of supervised release, during which time his access to computers and the Internet will be limited, the judge said.

"Your worst enemy is your own intellectual arrogance that somehow the world cannot touch you on this," Klausner told Ancheta at the end of the sentencing hearing.

Ancheta was the first American botnet controller, or "herder," to be convicted and sentenced. In a statement released Monday, the office of U.S. District Attorney Debra Wong Yang in Los Angeles also touted the sentence as "the longest-known sentence for a defendant who spread computer viruses."