During a recent cybersecurity competition, teams of students conducting a mock exercise unintentionally caused the U.S. to start a (fake) war. The students were given a variety of options, including diplomatic ones, for responding to a cyberattack by China. The majority of them took an aggressive approach, known as “hack back,” with disastrous consequences. The mock exercise shows how tempting it is to launch a counterstrike in response to a cyberattack — and the potential for significant unintended consequences.
As the CEO of a publicly traded security company, I would like to urge businesses and individuals to beware those very same dangers. In the United States, the Computer Fraud and Abuse Act (CFAA) prohibits private parties from accessing or damaging computer systems, even if they’re being used to attack you or your business.
But legislation in Congress would change that, giving private-sector businesses and individuals the right to strike back and hack their hackers. The idea behind the proposal is to empower people “to defend themselves online, just as they have the legal authority to do during a physical assault.” I believe the measure would do more harm than good. Here’s why.
Holes in the Self-defense Defense
It may sound reasonable that the same principle that allows homeowners to defend themselves against intruders, even if it involves causing harm to the attackers, should hold true for cyberattacks. But the reality is, unfortunately, that it would be akin to lobbing grenades from your front yard, hoping to get lucky and hit an attacker you haven’t seen as they flee the scene of the crime. Even if you do manage to hurt your attacker, you’ll likely hurt other people, too. In hack back, it’s almost impossible to ensure that an action targeted at a specific actor or group of actors will affect only the intended targets. After all, the internet is designed specifically for the purpose of systems interacting and communicating. Technology and users are increasingly interconnected.
It’s Difficult to Identify Your Attacker
Another significant challenge is that cyberattacks, which are sometimes discovered years after a security breach, are difficult to attribute to the correct actor. Hackers are constantly evolving their techniques to stay one step ahead of defenders and law enforcement. Sometimes they use deception techniques to plant indicators that point to some other perpetrator, either to throw off suspicion or to incriminate another party.
This is even more problematic when you consider that devices operating as unwilling parts of a botnet may be used to carry out an attack. These infected devices — and their owners — are as much victims of the attacker as the primary target, yet any attempt to hack back could cause them harm. Even governments, which possess the large-scale, sophisticated intelligence-gathering programs needed to accurately attribute cyberattacks, can take a long time to do so. Private-sector organizations typically do not have these resources.
Running Afoul of the Law of Proportionality
In the wake of a cyberattack, even if the attacker has been identified, it is difficult to judge motivation accurately and to determine an appropriate response. Remember the students competing in the mock cybersecurity exercise, the ones who ended up at war? They thought their response was proportional, but the situation quickly got out of hand.
Sometimes the need for information is used as an argument for hacking back. The argument is that it can help with intelligence gathering. However, intelligence gathering is not the same as mounting a digital counterstrike. There are a number of intelligence-gathering measures that U.S. organizations can take that do not run afoul of the CFAA. For example, organizations can deploy honeypots in their own networks to capture information on the attacker and their methods.
Essentially, hack back legislation would put the ability to launch cyberattacks, decide proportional responses, and infiltrate systems into the hands of companies and individuals. If hack back is legalized and private-sector companies have it in their arsenals, I fear it could become the de facto response — rather than considering the broad range of options that do not involve hacking back.
New Pressure on Company Resources
Clearly, hacking back effectively would require specialized skills and costly investments. Were it legalized with an authorization framework that is insufficiently stringent, I fear that many organizations may try to participate without the necessary tools and expertise to carry it out. That is likely to be ineffective, damaging, or both.
Other companies cannot afford a great deal of in-house security expertise and technologies to protect themselves today. Hack back capability is a nonstarter for them. That will make them even more vulnerable if hack back is legalized. Profit-motivated attackers may try to avoid companies that threaten to strike back. Instead, they’ll target the unfortunate organizations below this security poverty line.
Legal Landmines in a Lawless “Land”
While the internet is a borderless space accessed from every country in the world, each of those countries has its own legal system and expects its citizens to abide by it. It would be very risky for companies and individuals who hack back to avoid running afoul of the laws of another country and international law.
When national governments do this, it tends to occur within existing international legal frameworks and under some regulatory oversight. It must meet a stringent burden of proof for attribution. There are parameters determining the types of targets that can be pursued and which actions can be taken. Any hack back authorization would need considerable government oversight to avoid abuse by the private sector and minimize collateral damage.
For example, what if a company hacks back and accidentally hurts another company or individual? The company could incur expensive legal proceedings, reputational damage, and loss of trust. Making organizations exempt from this kind of legal action around unintended consequences is problematic. How could we spot and stop accidental or intentional abuses of the system? Giving the private sector hack back capability would require a complex legal framework and oversight system. Who would run it? How would it be funded? This seems impractical and costly.
It’s hard to blame companies for feeling helpless in the wake of cyberattacks that have shut factories, paralyzed hospitals, and publicized proprietary corporate data. From phishing scams to ransomware to vulnerabilities in medical devices, connected electronics, and even the entire power grid, no one likes to feel that they are constantly on the losing end of a shadowy war against clandestine cyberattackers, with no hope in sight. That feeling of helplessness is behind a growing call for companies to be able to hack back.
Yet the potential costs of a misstep and the unintended consequences should deter business leaders from undertaking such an effort. We must instead work together to find solutions to our complex cybersecurity problems that are better than legitimizing vigilantism, particularly given its significant risks and dubious benefits. It’s one thing for students to unintentionally trigger a disaster in the safe confines of a competitive mock scenario. It’s another thing entirely to be a business leader that does so in the real world.
