We need to succeed every time and they only need succeed once. The odds are that eventually all the legislations being pushed, for no matter how bad they are, will pass and that is what really worries me.

I am afraid I disagree with you. Making the company accountable of crimes committed by the employee, even if unaware of such crimes, is dangerous. Only total monitoring and control can ensure a company detects such illegalities. Think about it – an employee can send an email with malicious links, or social engineering attacks. How can you prevent that? Monitor and block any outgoing email until a person reads and approves it. How can you prevent an employee for committing a crime through a phone call? Not allowing personal mobile phones and having someone listing on every phone-call with the ability to stop the call at the instant a crime starts to be committed is really the only way. To do such things would make the work environment way too hostile and oppressive which will, in turn, create disgruntled employees that are yet another security risk. This will reduce productivity, increase cost and increase the security risk. All in all it will just create negativity with nothing really positive coming out of it.

Bottom line, security needs to be a balance between mitigating a certain level of risk and personal freedom. If the consequence of that mitigation failing is increased, the whole equation will lean towards the need to mitigate more and more risk. This is both more expensive and oppressive.

Then both parties can work hand in hand as a team to counter any illegal acts and attacks on their network.