This whole policy assumes that attacks would only occur at a national level - ie government initiated/sponsored attack towards US assets.
Aside from the issue of it being hard it is to be able to successfully geographically locate the source of an attack, what if a bunch of hackers in China, operating privately, decide to hack the US. Is US going to bomb China if the level of the attack is severe enough? Diplomatic efforts will fail pretty quickly if it genuinely isn't anything conducted by the Chinese government.
But hey, let's swap out the contentious example of China for Australia or France - is America going to bomb either of those countries because private citizens in those locations are pursuing a national cyber-security warfare-level attack?
If Al Quedia et al have taught us anything it is that we cannot assume national security attacks (and our defense strategies) to be state-sponsored any more.
Think of how outraged we'd be if Iran responded to Stuxnet by attacking the U.S. or Israel militarily. In general, hacking (aka "cyberwarfare") poses an intelligence challenge to determine whether an attacker is affiliated with or acting on behalf of a state. If United States infrastructure were attacked by a group of highly skilled individuals inside Iran or China, like you suggested, who had no apparent government connections, it would be very hard to determine whether they had been surreptitiously aided or manipulated by a government intelligence agency, perhaps by anonymously sharing technical information to aid their attack or by infiltrating the group with an agent who pushed them to action and steered them toward particular targets.
Aside from the issue of it being hard it is to be able to successfully geographically locate the source of an attack, what if a bunch of hackers in China, operating privately, decide to hack the US. Is US going to bomb China if the level of the attack is severe enough? Diplomatic efforts will fail pretty quickly if it genuinely isn't anything conducted by the Chinese government.
But hey, let's swap out the contentious example of China for Australia or France - is America going to bomb either of those countries because private citizens in those locations are pursuing a national cyber-security warfare-level attack?
If Al Quedia et al have taught us anything it is that we cannot assume national security attacks (and our defense strategies) to be state-sponsored any more.