Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices. Digital security is not like physical security -- it's so "easy" to secure systems (in comparison to securing a physical location against e.g. looting or vandalism) that it's better to preemptively close all known classes security holes than it is to be lax with security and expect the law to sort things out.

There's the issue that digital data is much more valuable (and/or damaging). Nobody is going to break into an office building to steal their filing cabinets in the hopes of finding enough info there to guess someone's mother's middle name and subsequently hope to steal their credit card or bank account. Being able to effectively search, filter, and map against other sources makes digital data particularly valuable. In essence, digital crime scales.

That said, I'm not sure I agree with your claim of the ease of digital versus physical security - physical security is something we're fairly good at, having had a few thousand years of practice. I suspect the number of bank robberies in which human factors (The physical equivalent of rubber-hose cryptanalysis being 'pointing a shotgun at the manager') massively outweighs those that were exploited by technical means.

That's not to say that they weren't negligent in not even taking the basic precautions that are common sense to anyone working in the field, and even many who aren't.

>Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices.

Ah, no. That's simply not true. "It was easy" is no justification for criminality, either legally or morally.

HN user rtm is a YC partner and the infamous Robert Morris, of the Morris worm which had a nice impact on the internet back before it was the internet.

I guess we're lucky that rtm had a few years left after he was released.