Both are. Common sense dictates that if you're moving millions around, you MUST have enough money to buy yourself some security at physical or digital level. I'

Both are. Common sense dictates that if you're moving millions around, you MUST have enough money to buy yourself some security at physical or digital level. I'm not saying CERN-level security, but at least SOME security standards should be fulfilled. If the bank doesn't care, then it should be punished IMHO. Same goes for the criminal.No matter how lax the security precautions of the bank are, an individual is judged for his crime. The problem with cybercrimes and digital-rights related material (piracy, etc.) is that punishments are usually disproportionately severe. I believe that the fault lies to lawyers who over-sensationalize these crimes and judges who are totally unable to understand the real vs possible damage. For example, a 15 year old hacker who found a 5-years old XSS and hacked (as in copied 15 MySQL databases) from a CIA/NSA/FBI website and post his IRC nick on the page to brag about on his friends vs a 35-year old spy who sold these info to some other country for huge profits. These are different situations but are most of the time treated equally by judges.