A visible reaction would indicate to other adversaries how the U.S. will respond to cyberattacks in the future. “We’ve got to demonstrate and be a little more transparent about some of our own attack capabilities,” said Frank Cilluffo, the director of George Washington University’s Center for Cyber and Homeland Security. “That is part of this delicate dance. We shouldn’t be treating this as black magic.”

A doxing campaign would have to aim high to be effective. Lewis says officials have considered leaking Putin’s botox-injection schedule, or photos of his girlfriend. That won’t embarrass him, he said. “That’s not just going to happen with this guy.”

Obama made it clear that deterrence is one of the main objectives of responding to cyberattacks. “Our goal continues to be to send a clear message to Russia and others not to do this to us—because we can do stuff to you,” he said at a press conference Friday.

But he said his answer to Russia’s election meddling might have a secret element to it, too, without making it clear what he has in mind. A quiet, targeted cyberattack—on Russian intelligence networks, for example, or on military infrastructure—would send a message about the American government’s offensive capabilities, and could make Putin think twice about using hackers to meddle so directly in U.S. politics in the future.

But the administration will need to tread carefully: Hacking back risks escalating the situation. “A cyberattack could be interpreted by the Russians as the use of force, justifying a military response,” said Lewis. Obama wants to leave a legacy of strength and leadership in cyberspace—not of provoking war. “We have been working hard to make sure that what we do is proportional, and that what we do is meaningful,” the president said on NPR.

There are always traditional, non-technological forms of retaliation to fall back on. As Russia made moves to annex a part of Ukraine in 2014, the U.S. and the European Union placed coordinated economic sanctions on individuals and businesses close to Putin. To the extent there’s anything left to sanction, further penalties could cause targeted harm on sectors of the Russian economy and people in power—and, unlike a hacking campaign, imposing sanctions is a familiar tactic that’s less likely to spiral out of control into a larger conflict. Another, softer option is to expel Russia’s ambassador, a classic public rebuke.

The cyberwar experts I spoke with were exasperated that the conversation has turned to retaliation only now, more than a month after the election and with just weeks left in Obama’s presidency. “It’s like, what clock are you using?” said Singer.

The DNC announced in June that its networks had been infiltrated by two separate Russian intelligence agencies, but according to a report in The New York Times, the FBI knew as early as September 2015 that Russian hackers were targeting the organization. But the administration didn’t retaliate before the election. Obama said Friday that he didn’t retaliate publicly at the time in order to avoid further politicizing an already “hyper-partisan atmosphere,” especially because Donald Trump had repeatedly questioned the integrity of the elections. “I wanted to make sure that everybody would know that we were playing this thing straight,” Obama said.