When ransomware attacks US infrastructure, it's tricky to know when to return fire