Businesses could be liable for criminal offences under proposed cyber attack laws