US is right to indict alleged hackers and could go further, but it must also address concerns over its own surveillance