The hackers are the ones actually responsible for the damage that occurred, as evidenced by the fact that they did not do as much as he asked of them.<p>You leave your bike propped up against a wall, unlocked.  Someone starts shouting &quot;<i>Hey, steal this bike!  Steal it!</i>&quot;  When you return, your front wheel is gone.  Someone tells you about the shouting guy.  So you sue him for the loss of your front wheel.  You are able to get a recording of that guy complaining that only the front wheel got stolen.  It doesn&#x27;t matter.  He didn&#x27;t steal your wheel.  He could have <i>wanted</i> someone to steal your whole bike <i>and</i> your wallet, but the fact remains that he didn&#x27;t <i>do</i> it.<p>Now suppose that you did lock up your bike.  But you used a TSA-approved luggage lock.  Now the guy passes out copies of the TSA master key along with the shouting.  But anybody could have had that key already.  He still didn&#x27;t steal your wheel.<p>Now instead of a known-insecure lock, you use a good lock, but you had at some point given the shouting guy a key to it.  After you two have a falling-out, you keep using the same lock.  While on the surface it looks different, this is the same situation as the TSA lock, because your lock is not truly secure if its keys are not controlled by you, and you alone.  He <i>still</i> didn&#x27;t steal your wheel.  At worst, you can recover from him the cost of replacing your u-lock, as he made it unfit for its intended purpose.<p>Wishing misfortune on others is not a crime.  It isn&#x27;t very nice, but it is not criminal, and does not create civil liability.  I can say as often as I like that I would be happier if Bank of America&#x27;s corporate headquarters were destroyed by a lucky meteorite strike.  If an arsonist tries to burn it down instead, I am in no way responsible.  I didn&#x27;t give that guy any tangible benefit for doing the crime.  I could not have harmed him in any way if he did not do it.  The person was not acting as my proxy.  If the arsonist cannot be identified, I am not an acceptable scapegoat simply because I wished harm upon the victim.  I have malicious intent, it is certain.  But I have not performed the malicious act.<p><i>(I won&#x27;t be able to respond further, because &quot;HN: You&#x27;re submitting too fast. Please slow down. Thanks.&quot;  It looks like tptacek can post about 10 times more often than I can, so I can&#x27;t meaningfully participate in a discussion with that account.)</i>