“ The only reason we know about this breach is because, earlier this month, the security company FireEye discovered that it had been hacked. During its own audit of its network, it uncovered the Orion vulnerability and alerted the US government.”
Legal where? It's legal in the US for the CIA to hack Russia, and the reverse is also true. International law doesn't really forbid anything (and even when it does it is mostly a joke).
The US was also posturing about actual cyberwarfare during the Gulf war. Not the brightest move since it probably helped focus foreign interest in a field where one can never buy total superiority.
Why is it always FireEye blaming the Russians, and why do they never share their evidence of attribution?