This is another bad analogy. In your post the gun manufacture's offer is one that is clearly illegal. While I despise adware what they are offering is not a reward for illegal activity. The solely responsible parties here are the students without question. The adware companies are despicable but they are not offering money for implicitly illegal acts. The hospital has a responsibility to secure their network but they are not at fault for the attack. They could be found at fault for negligence if a patient had been injured as a result of the attack but the simple fact is that there are no laws surrounding securing your networks. I think a more apropos analogy would be a little old lady whose grandson set up a website for her and installs a contact us page (read: formmail) so she can sell her little crafts on the net. She knows nothing about web design and doesn't update her script at all. Her script of course gets used for spam. Is it the fault of the little old lady? Not even close. In the real world she is in fact punished by having her site shut down but she is not culpable in the situation. Hospital management is not culpable for not securing their network. In fact it is likely they were told by the IT department that is was secure. The hospital, overall, is not staffed with IT folks it is staffed with medical personel. These people are not at fault for the network not being secure. The only culpable party here is the group of students who knowingly exploited an unsecure network for illegal activity.