The scale is obviously different, so in that sense I wasn't fair. But the defense is exactly the same, disclaiming responsibility for the acts of your contractors. I don't think any victim (Craigslist, NoTW phone hackees) cares about the fine point of the employment relationship.
EDIT: took EJ off the parenthesized list of victims, as she was not the victim of a contractor.
1. Whether there was an ongoing culture of doing the wrong thing - NotW yes, AirBnb not so much (afaik).
2. Whether there is an indication that the defence is actually completely false (i.e. whether the guys in charge actually did know and sanction these things) - again there are some strong indications that this was the case at the NotW, especially if you take the culture into account (i.e. - how did that culture come about if there wasn't some degree of either asking for hacking to be performed or not wanting to know whether it was - both equally worthy of blame). Again AirBnB - not so much.
3. And of course, scale, though I didn't mean to criticise that particular difference.
The victims might not care about the finer points, but in terms of determining who is to blame it does matter. Obviously there is the point that employees are the responsibility of the company, however if they do something the employer was not aware of then that seems to me to be a sort of technicality.
Anyway, getting into [1] territory now so should probably just leave it at that :)
EDIT: took EJ off the parenthesized list of victims, as she was not the victim of a contractor.