HN user
It's exactly this unrealistic notion of having your cake and eating it too that landed us in this mess in the first place. And what do you mean by "defensive capability"? Secretive military organizations isn't going to protect civil society. In fact their influence is often in opposition to such protection.
There are other ways to have an impact with laws than punish the aggressor. Airplanes aren't safe because the pilot or mechanic gets punished when something happens, it's because (very simplified) the airlines and manufacturers do.
I don't really see how that fits into this scenario. Computer Security is more like chemical warfare. Were you can either do research or try to make everyone more secure by international treaties. Here you can either undermine encryption, infiltrate networks, keep exploits to yourself or you can make everyone secure by patches, standards and encryption that works.