[Jensson]

They key difference is this:

> ING’s Chief Executive Ralph Hamers said no individual at the bank was found to be responsible for the failures

Closed source means it is easy to hide whose fault it was, and then all you can do is fine the company since you can't arrest everyone. This is also why companies are so keen on deleting old message logs etc, to avoid leaders going to prison.

[Arnt]

I heard on IRC that the person they arrested was the one who generally merged PRs. With closed source the closest equivalent is the leader of the development team. I would be surprised if a law enforcement agency is unable to locate that developer.