The CID is not transmitted by the calling party, it is handled by the call origination provider, the one with the connection to the telephone network. It used to be possible to instruct the origination equipment to pass and arbitrary CID string, but not any more.

And, if a spoofer had direct access to the network, there is nothing about the “spoofed” CID they would send to distinguish it from “real” because the spoofing isn’t at the physical layer, it’s a logical thing.

 

So still, spoofing a caller ID is not a crime in itself. If there were a $10 fine per instance, then that $30 million fine for the 5 billion calls could have been at least $50 BILLION, certainly a legal judgement that could do some serious damage, and just possibly enough to discourage a few from the activity.
Given that all internet access requires an access provider, including the provider in the legal redress might also be useful.
And my solution could certainly include the destruction of whatever equipment was used for the activity. That would provide at least some delay before that source could bother us again.