David, You have a simple view of China-Taiwan relations, but you are more of a computer specialist than an Asia one, so your deficiency is quite forgivable. I recently heard a story about policeman in Taiwan who is close to retiring. When he was asked what he planned to do when he retires, he said that he wanted to go back to the Mainland. To the outsider, this would seem strange, but it would be hard to believe that Taiwan and China do not have a workable and effective MO. Someone who responded to your post stated that it is far more likely that China would be the aggressor in a cross-strait spat. Now, where the Taiwan-China working MO might break down would be when individuals act. In a way, hacking is the attack of the powerless: it allows geeks like us to launch an assault when we cannot afford tactical weapons. So it is wrong to think that angry Taiwanese would hesitate from waving the red in front of the bull. As you state, there is no cyberterror treaty governing how information regarding attacks is treated. Many of us take for granted that other informal arrangements govern how this information is treated. The questions you ask are valid. Indeed, they are some of the reasons why this listserve exists. You are asking core questions as to how we should treat state activity and personal responsibility. When you find the answers, let me know ; )
What happens if Taiwan's government says it wants to normalize relations with China (and vice versa), but the attacks continue? Will they have to find and punish their own citizens in order for the normalization to move forward? Where do treaty obligations compel a state to prosecute citizens for behavior which it may have tacitly encouraged before?
Interestingly enough, an attack where the originator is identified seems to be more of a problem. At least with an anonymous attack, a state can plausibly deny that one of its citizens was involved. In fact, you could see identified attacks on Chinese systems coming to be a form of civil disobedience if Taiwan were to go this route.
(I don't think Taiwan will - I'm just interested in this interplay between private action and the state's responsibility.)
Suppose Taiwan proves unwilling or unable to stop private citizens from attacking mainland Chinese systems. Now there seems to be a parallel with situations where states are considered either supportive of terrorism or too incompetent to prevent terrorist activity. Israel occupied southern Lebanon because it didn't see any other way to prevent terrorist activity. The alleged use of Libya and Sudan as "training grounds" could be viewed as a kind of jurisdictional arbitrage, and a kind which has been reacted against violently in the past. Fear of an analogous situation online seems to be behind the "world cyber-crime treaty" mentioned here recently.
Now bringing it closer to home, does that mean opposition to the world cyber crime treaty could be cast as "support for cyber-terrorism"?
-David