There is always the possibility of things like insecure wifi, compromised PC's etc which should be carefully taken into account.
You are responsible for having an insecure network, this should not even be a discussion point as it is quite clear in all facets of the law that negligence is not a defense.
Stuff like this where you are 'guilty until proven otherwise' is just wrong
Spoken with the IRD lately? :P - I do agree with you however.