[brendoelfrendo]

Right, but the concern is that if we focus too much on the "hacker" and not enough on the vulnerable infrastructure, we may spend all our tax dollars chasing computer criminals instead of preventing computer crime. As a general rule, I don't like blaming the victims of a crime for falling victim... but the real victims here are the people downstream of the water supply, and we shouldn't absolve industry or infrastructure operators of negligence because some scary hacker attacked them.