Having read this article, one line in particular caught my attention:
The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the devices used in the hacking.
The following quote was more in line with what I was expecting to see:
A mobile phone and hard drive were also seized and the IP address... matched the intrusions into the organisation.
I am aware that TCP/IP packets will contain headers which expose the source IP address and that the IP address could be used to trace back to an individual network (such as the house from which the hack was conducted from).
What I'm more interested in is the first quote. Why would a laptop serial number be present in network packets leaving the machine? Is this a common "feature" used by some well known application or protocol such as SSH?