There's an interesting symposium involving several Volokh Conspiracy bloggers regarding whether or not the Computer Fraud and Abuse Act actually prohibits hackback activities. Given that I'm a fan of offensive countermeasures (though the guys really need to get more information up on that site), I tend to support Baker's arguments more.