I don't think the EFF should be spending donated money defending black hats from potential criminal prosecution. There are far more white hats out there that have been unfairly targeted for true responsible disclosure. There are also a lot more important free speech issues to defend than your right to shout private AT&T account information in a public theater...
I would have been 100% behind him if he had said, "hey, I noticed this hole, visit http://att.com/account_info.php?omg=noes and have a look!" By actually publishing the information, he proved that he accessed information he was not authorized to have, which the law does technically say you are not supposed to do. (The "hey, I noticed this hole", IMO, is not enough to build a solid case against him for accessing data he was not supposed to have. IANAL, though.)
Either way, though, prison is not an acceptable outcome for this behavior. "Don't do this again," maybe, but not being locked in a cage for years. How would that help anyone?
