International law says governments who've been cyberattacked don't have to reveal the evidence underlying the response they choose.