I'm not opposed to this at all but I question how exactly enforcement would/can work. We don't know with 100% accuracy who was responsible for Stuxnet, Flame, Operation Aurora, etc and especially with code, it is going to be exceedingly difficult in most cases to get evidence such that blame can be leveled with any certainty.