Suppose it's an international actor, or suppose this all happens outside the US,
and the CFDA doesn't have extraterritorial reach,
so this is happening outside of the realm of the law.
But if an American company responds to an attack, That they think came from,
let's say, the Chinese government, right?
So they respond by attacking an IP address that they know is linked,
or they think was linked, to an attack on their servers.
What's the Chinese government's response going to be?
They're going to say the Americans are attacking us, right?
And they may launch retaliatory attacks on the US, not necessarily aimed at that
company, and the American government is going to be very concerned about that.
And so you could have two private entities, right?
An IP thief in one country who routes, let's say, they're not in China,
they route the attack through China to make it look like it's a Chinese company.
The American company thinks it's the Wild West, there are no laws regulating this.
We've got the advice of smart lawyers who told us that we can do this.
They fight back, right, and now the Chinese government takes it seriously,
defends their companies, and attacks back, and now we're talking about cyber warfare.
I mean, that's a fancible scenario, but it's not impossible to see, and
the reason it's so scary is because attribution in this space is so tricky.