The media rhetoric on this incident is really high, in part because Russia became the bogey man sometime between Obama telling Romney the 80s wanted it’s foreign policy back and 2016, but let’s be careful to call this what it is. Espionage. Extremely successful and sophisticated espionage, but espionage. It was not an act of war, nothing was damaged or shut down. There is room for debate as to whether the creation and insertion of the malware itself might be an “attack,” but it’s an attack in the same way as the following imaginary scenario: some foreign agents infiltrate a dry cleaner that many members of the government use and is sewing small listening devices into their shirts as they come in for cleaning.
This is important because the retaliation rhetoric is really over the top and we shouldn’t contribute to a climate of approval for us actually attacking whomever we think might have spied on us. We currently live in a world where it is possible for power plants to be shutdown (Ukraine) or uranium purifiers to be destroyed (Iran) by remote hacks, we must not conflate attacks and espionage.