“If there's a cyberattack from China or Russia or Romania or Mexico, it may well run through a server in another country. And it may take months before you know where it really came from.”