> What is unusual --- I think unprecedented, in fact --- is for the victim's negligence to negate criminal culpability. You know more about these issues than m

> What is unusual --- I think unprecedented, in fact --- is for the victim's negligence to negate criminal culpability. You know more about these issues than me, but I expect that people who are thinking this way might be thinking in terms of an analogy of a conversation with a bank teller (the analogy being that network communication is just like a conversation between your system and theirs). So if an attacker talks to a bank teller working at a bank and tricks them into revealing lots of private information about other customers that they shouldn't reveal, and it later comes out that the bank had not provided training to the bank teller about customer privacy, and had given them access to all kinds of data that they didn't need access to (which they shared in the 'attack'), I would expect there to be some liability on the Bank. I agree though - even though they've 'just' spoken to the teller (and perhaps not told any direct lies), this doesn't negate the culpability of the attacker - if they've deliberately set out to trick the teller then they've committed fraud. If the 'attacker' didn't set out to trick the teller, and the teller just confused themselves, then yes, I'd expect there to be no culpability on the attacker but culpability on the bank. In cases where it's less clear (maybe the attacker tricked the teller into giving them information in a way different to that desired by the bank, even though the attacker is normally allowed to access that information), I would very much want to err on the side of caution. A world where using an unsupported browser or a scraper or unknowingly clicking a link or writing software that accesses data that you are otherwise allowed to read can make you liable for committing a serious crime would be a very worrying world.