There was an incident where forbes.com was delivering viruses through Javascript exploits found in their ads. This happened just by clicking a link (before you can "agree" to anything).
Are they liable under anti-hacking regulations?
What about ad networks?