Security failure: who is responsible?