The aim of sanctions does not have to be to directly affect the individuals doing the hacking, though in some cases this may be possible. Rather the aim is to change the attitude towards regulation and enforcement by the central government and possibly by the people as a whole. If the people of a country believe they are suffering as a result of the hackers in their midst they will be much more likely to demand their government make cracking down on such activities a priority.