ROE for cyber are fundamentally different. You deliberately do not "shoot to kill" in cyber, for tons of reasons, at least one being it's a much more opportuni

ROE for cyber are fundamentally different. You deliberately do not "shoot to kill" in cyber, for tons of reasons, at least one being it's a much more opportunistic environment; hacking isn't magic, and many systems aren't penetrable at will. You often don't get to choose exactly what you target, you just hit what's vulnerable and see how you can pivot. Flip the incentives for a sec; the group that executed this hack can present it as an "attack on American infrastructure" to their superiors, even though we here in the US know it was 100% ineffective.