The Pentagon can't nuke somebody for a cyber attack that causes some emails to be leaked, or some secrets to be stolen.
They can use physical response force in the event that a cyber attack can/will cause actual physical harm, such as disabling a power grid, etc. There is actually a very heated debate about what specifics actions will evoke a physical retaliation to a 'cyber' attack.
Iranians may construe stuxnet as an attack that they are hoping to prevent from reoccuring, and thus use the self-defense justification, but 'casus belli' must be the absolute last resort of a nation. Assuming they follow international law that is.
Another important aspect to remember is that retaliation and the use of force does not mean 'war' in and of itself.
I've been wondering about the insanity of this declaration. Surely the Pentagon hasn't the slightest intention of picking a meat war with China over industrial espionage.
Maybe they had Wikileaks and Anonymous in mind. That would make Go To Jail, Do Not Pass Go much more straightforward, and scary.