requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.