Earlier quoted context omitted.
Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicit…
Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker.
If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute.
Someone else being stupid doesn't give you a "Get away with being an asshat" card.