A confluence of errors—a health clinic allowed their employees’ computers to be contaminated with malware; a certification authority issued a certificate to a knave; and a blood-testing laboratory let that knave see much more than he should have. The result is a massive data breach of medical records, a lawsuit, and a mock hearing. But whose fault is it?