In November 2023, a cyberattack shut down emergency rooms at numerous hospitals across three U.S. states. No missiles were fired. No bombs fell. Yet ambulances were diverted to other cities, lives were at risk, and professionals were unsure for a long time what sensitive patient data had been involved in the incident. This scenario illustrates the growing risk faced by today's policymakers, lawyers, and IT professionals: cyberspace can cause real-world harm. One could argue