NSA had cyber-attack authority since 1997

You wouldn't really know it from reading press accounts about cyber-warfare, but the National Security Agency has been the executive agent for precisely that capability since 1997, according to newly declassified documents. "Executive agent" is the government's term for "the entity that does the stuff." "Capability" is the government's way of saying "weapon."  

In 1997, the following fact was classified as "SECRET," releasable to a few U.S. allies. "On 3 March 1997, the Secretary of Defense officially delegated to the National Security Agency the authority to develop computer network attack techniques." William Black, who held the title of "Special Assistant to the Director for Information Warfare," noted that the new authority "is sure to be a catalyst for major changes in the NSA's processes and its workforce." Actually, it was a "third dimension" to the NSA's dual mission: To make and break codes, and to steal signals. 

Another SECRET fact simply notes that computer network protection (we call it "defense" now), exploitation (or, basically, spying on a network), and attack are to be exercised in concert. One cannot "do" one without thinking about all three.

Interestingly, the NSA also surmised at the time that its own perception as "the bad guy," along with legislation limiting what it can do vis-a-vis computers that don't belong to the government, would make it harder to become a cyber mission force. They were damned right. Information Warfare, however, would now take the form of "digital coercion," where enemy public infrastructure systems were fair game for attack. (That fact was also classified SECRET). 

By the way, whenever you see the phrase "INTEGRATED JOINT SPECIAL TECHNICAL OPERATION" in a government document, you're probably seeing a reference to very elaborate information warfare and cyber-exploitation techniques used by the CIA and the NSA. "IJSTO" is the unclassified euphemism of choice for that stuff.