The day Mr. Meng returned home, China's official state news media quoted him as saying that the Chinese government would crack down on criminal hackers, though the statement was vague about what would happen to those acting on behalf of the Chinese government.
In classified sessions, American intelligence agencies have told members of Congress that while computer attacks on the United States emanating from Iran decreased during the negotiations over the nuclear accord, they believe that an Iran stymied in developing a nuclear ability over the next 10 to 15 years is likely to pour more resources into cyberweapons. Such weapons have already been used against the Navy, American banks, a Las Vegas casino and Saudi Arabia's largest oil producer, without setting off significant retaliation.
The day before Mr. Obama spoke at Fort Meade, the director of national intelligence, James R. Clapper Jr., said at a congressional hearing that the United States lacked "both the substance and the mind-set of deterrence." But he went on to say that he was far less worried about a "large Armageddon strike" that would take out America's power systems than about the kind of smaller but persistent attacks that damaged Sony Pictures Entertainment.
With both Iran and China, Mr. Obama is struggling with variants of the same problem: How do you contain a rising power that has discovered the benefits of an anonymous, havoc-creating weapon that can also yield vast troves of secret data? And how do you convince them that actions for which "they have paid no price," as the director of the N.S.A. and the Cyber Command, Adm. Michael S. Rogers, put it the other day, will no longer be cost-free?
"We have a deterrence deficit," said David Rothkopf, the author of "National Insecurity: American Leadership in an Age of Fear."
"The U.S. is very good at dealing with the gravest global challenges, like global thermonuclear war, and also very good at empty gestures and rhetoric," he said. "The problem we have is with our middle game, and yet most of the challenges we face are, of course, in the middle."
With Iran and China, of course, cyberwarfare is only part of those middle-game challenges. Containing Iran's growing influence in Iraq, Syria, Yemen and throughout the region is central to the administration's post-accord challenge. And containing China's effort to reclaim islands in the South China Sea, a bet by Beijing that neither Washington nor Asian nations will stop it from developing a new base of operations and exclusive claims to air and sea territory, is the subtext of much of the tension with Mr. Xi's government.
But the escalating cyberconflict poses a particularly complex problem, because there is no equivalent of the Nuclear Nonproliferation Treaty for computer networks. That is exactly what makes the use of cybertechniques and weapons so attractive to the Russians, the Chinese, the Iranians and the North Koreans — and, to some extent, the United States.
So far, the administration's response has seemed inconsistent, and to many incoherent.
When North Korea was identified as the country that attacked Sony, Mr. Obama — in possession of evidence gleaned from the N.S.A.'s yearslong penetration of North Korean networks — went to the White House press room, declared that the leadership in Pyongyang was responsible, and said the United States would retaliate at the time and in the manner of its choosing.
The public retaliation was a series of modest financial sanctions that did little additional damage to the most sanctioned country on earth. If there was a lasting response to the attack, only North Korea knows about it.
And when Unit 61398 of the People's Liberation Army in China was exposed as the force behind the theft of intellectual property from American companies, the Justice Department announced the indictment of five of the army's officers. Justice officials hailed that as a breakthrough. Inside the intelligence community and the White House, however, it was regarded as purely symbolic, and the strike on the Office of Personnel Management continued after the indictments were announced.