> If your web browser hacks a bank, but you didn't know and didn't expect it to, have you hacked a bank?

Depends, as usual. Intent can matter, but depends on the statute (and jurisdiction) in question.