I take it as a matter of practicality. Network intrusions are, as a rule: a) much harder to attribute, b) impossible to prosecute (Assume it is Russia or Chin

I take it as a matter of practicality. Network intrusions are, as a rule: a) much harder to attribute, b) impossible to prosecute (Assume it is Russia or China, what is your recourse? the U.S. is already hacking them too, under slightly different rules, and any other response is just a needless international incident. If it is people in another country, not associated with their government, there is even less you can do), and c) possible, at least in theory, to defend against robustly (compared to doors and locks which are always vulnerable to literal brute force, without the need to be particularly clever about it). So, given that punishment is impossible and prevention is possible, focusing on the second is a good idea. Or, at least, in some combination of prevention and mitigation (including insurance, or say, ways of detecting and changing stolen SSNs or credit card numbers with minimal disruption). Now, I am not saying it's the fault of a single insurance company. Security is pretty hard to get right and we systematically under-prioritize it when developing the technologies and systems we use. But as a society, making our computer systems more secure is more cost effective than keeping pilling up cyber crime laws that are unenforceable unless you happen to get lucky enough that the hacker is among the 1/20th of the world population you have jurisdiction over, or getting into a harmful retaliatory mode under ideas like "cyber-warfare". p.s. By "possible to defend against robustly", I mean when you trust the suppliers of your computing base to be non-malicious and you have ensured physical security (which you can enforce by law and national defense and whatever other age tested methods people/groups/nations have used to secure their property for millenia).