I think that attacking businesses and commercial services is fundamentally different from attacking, say, the DOD intranet. But these are philosophical discussions that the American public (not to mention, ugh, Congress) hasn't really thought through critically. It's so difficult to articulate what an appropriate "military" response could/should be. Should we simply reinforce our Cyber defensive capabilities and not respond at all offensively? If the North Korean military (I want to deliberately draw the distinction here between the people of North Korea and the North Korean Regime) launched a physical attack against a US commercial interest how would we respond? I doubt it would be a huge investment in star wars missile defense tech.

So I guess to touch back on the parent thread, it's not that we're not capable of responding...it's that we haven't invested the intellectual capital to formulate what an appropriate response should be.