Governments can't be trusted to enforce laws vigorously that are politically sensitive, as prosecutions of DDOS cases might be (who to prosecute? are you going to charge another government? etc). So go with big big civil penalties. There'll always be someone who will sue anybody--like the 9/11 victims families in the US trying to sue Saudi Arabia against the wishes of the US govt.