2. The payout to the hackers should form part, but not all of the penalties. Pay those guys for their great service to humanity they earned it.