In practice of course, you have to assume its already copied a trillion times.

If you've hacked my server and locked it's drive with ransomware and I can hack you back to retrieve the private key then I should be allowed to do so. If you're DOSing me I should be able to take out your C&C and patch the botnet with as many security fixes as possible.

Are you aware of any other circumstances where a private party breaking the law allows you to turn around and do the same?

For example, it is illegal to kill another human being. However, nearly all jurisdictions recognize "killing in self-defense" as permissible, if unfortunate.

I can't say if the same argument applies in this situation, but I _could_ see some parallels. If a malicious party is willing to cause you financial harm for their own gain, and you can reasonably prevent this financial harm by quickly inflicting equal-or-less harm on them, perhaps that's justifiable.

I can see how this is better - especially for society in general - than taking things into your own hands, but then insurance sometimes will try to screw you (is there insurance for insurance?), and lawyers are prohibitively expensive for many.

Also, is it really the case that "virtually all attacks" would go through pivot machines? Certainly the sophisticated ones would, but there are plenty of script kiddies to bring down the hammer on.

If a script kiddie does something directly from his home computer, then the source of attack is clear and you can just subpoena his home address from his ISP and get a cop to educate his parents or whatever. However, if pivot machines are used, then you need to obtain data from every machine in the chain to trace the source of attack, and doing so by a chain of subpoenas is extremely slow, and compared to that hackback provides a practical (though usually not legal) option to do so.

Also, hackback provides a venue for stopping distributed attacks - if you're attacked from a large number of compromised machines, you need data from them (again, either by subpoena and physical retrieval or by hackback) to identify the command&control servers and possibly other victims.