Yeah, this act was wildly indiscriminate. Russia could easily have limited the propagation of NotPetya to Ukraine only, but chose not to. That makes the act irresponsible and comparable to distributing an infectious biological agent via randomly addressed mail bombs that were posted in Kiev.

An appropriate response needs to arise from a cooperative authority like the UN or Interpol, and needs a policy suited to address future events before they arise.