Should U.S. companies go on the attack to protect their cyber interests? Current law limits how far they can go.