An April report by the National Research Council highlighted the need for a national policy on cyber-attack. If a foreign country flew a reconnaissance plane over the United States and took pictures, for instance, the United States would reserve the right to shoot it down in U.S. airspace, experts said. But if that same country sent malicious code into a military network, what should the response be? 'That question is under active debate at the highest levels of government,' said Herbert Lin, who directed the National Research Council study. Some intelligence officials believe that a sustained network penetration that results in theft of operational documents shows 'hostile intent' and may justify an aggressive response, Lin said. But taking down a power plant that serves a number of hospitals that treat civilians may not be a 'proportional' response, said Harvey Rishikof, a national security law professor at the National War College. 'In the cyberworld, we're trying to move to a new regime,' he said. 'What are the rules of the road that dictate when you can use cyber-weapons in an offensive manner?' 