From this Washington Post story on the new Pentagon cyberstrategy:

The strategy, which has been two years in the making, is expected to emphasize that officials consider a military response to current cyber intrusions unlikely.

“Although it is certainly possible that a destructive or disruptive cyber attack could have an impact analogous to physical hostilities and therefore constitute an act of war, the vast majority of malicious cyber activity today would not cross this threshold, or justify a military response,” says another draft of Lynn’s speech.

…and then there is this Associated Press story:

Marine Gen. James Cartwright said the new strategy is focused on defending against attack, but he believes the U.S. government broadly and the Pentagon in particular need to develop offensive approaches that reduce incentives to attack U.S. computer systems. Cartwright is vice chairman of the Joint Chiefs of Staff.

“If it’s OK to attack me and I’m not going to do anything other than improve my defenses every time you attack me, it’s difficult” to stop that cycle, Cartwright said.