Both are. Common sense dictates that if you&#x27;re moving millions around, you MUST have enough money to buy yourself some security at physical or digital level. I&#x27;m not saying CERN-level security, but at least SOME security standards should be fulfilled. If the bank doesn&#x27;t care, then it should be punished IMHO.<p>Same goes for the criminal.No matter how lax the security precautions of the bank are, an individual is judged for his crime.<p>The problem with cybercrimes and digital-rights related material (piracy, etc.) is that punishments are usually disproportionately severe. I believe that the fault lies to lawyers who over-sensationalize these <i>crimes</i> and judges who are totally unable to understand the <i>real</i> vs <i>possible</i> damage. For example, a 15 year old hacker who found a 5-years old XSS and <i>hacked</i> (as in copied 15 MySQL databases) from a CIA&#x2F;NSA&#x2F;FBI website and post his IRC nick on the page to brag about on his friends vs a 35-year old spy who sold these info to some other country for huge profits. These are different situations but are most of the time treated equally by judges.