Exactly. If I own a bank, and keep a shed with all my money in it, with no padlock, and someone robs me, I'm going to prosecute them to the fullest. Meanwhile,

Exactly. If I own a bank, and keep a shed with all my money in it, with no padlock, and someone robs me, I'm going to prosecute them to the fullest. Meanwhile, I'm just as guilty for failing to secure the holdings of my customers. Now, what happens if instead of robbing, someone informs me, "your vault (shed) is highly vulnerable, you need to fix it." Right now, businesses say, "Ha! That's theft! You're going to prison, and you probably stole some money too!" The problem is not with the hacker, but with the system.