Very interesting, this is going to be a difficult task to say the least.
I don’t want to re-write the link, but there are more then a few important points;
1) How do you know where the attack is coming from? (stuxnet)
2) What about the indiscriminate nature of these attacks? (Viruses and worms kinda just do their thing, even stuxnet that was targeting is infecting more machines then it targets. What if that happens to be a machine that does air traffic control and causes it to crash?).
How would you enforce this?
Would you allow for a physical response? or at what point would that be allowed?