The DAO was created with the intention to allocate its funds according to a certain voting scheme, with everyone's power determined by the number of tokens they held. But the program did not correctly implement this intention, and the DAO hack exploited the difference to bring the funds under control of the attacker. This most likely violated the Computer Fraud and Abuse Act, and was thus illegal.
But the question that is to be debated is, was the intention of the DAO too follow the code of the contract EVEN IF it had a bug.
There is an argument to make that, given that "the code is law" was plastered all over the DAO, that being hacked and having all their money stolen, was explicitly allowed.
