As lawmakers mull outlawing poor security, what can they really do to tackle online gangs?