Gucifer more or less said this at DefCon this summer, blame the IT companies, and I'm definitely in agreement.

I don't think anyone should go to jail, like pretty much ever (let me pay a fine or kill me rather than lock me up), but I don't see a reason why whoever set this up, for example, shouldn't be held liable in the same way a doctor is liable with malpractice insurance to cover it.

It seems it'd fit the US laws very well, tech companies would buy insurance policies that'd pay out when their shit software or infrastructure is hacked.

Huge companies like Google or Apple could self insure.

That'd also give some incentive to the MBA's to take security seriously, as proving they take the extra steps would lower their premiums.