Note: Young Fella, If You’re Looking for Trouble I’ll Accommodate You: Deputizing Private Companies for the Use of Hackback

A computer operator sits in front of a computer screen, monitoring a tank of toxic chemicals.[1]  A series of computers control the tank’s physical hardware.  All of a sudden, the lights in the control room fail, the computers go offline, and the computer operator yells, “[t]hey’re hitting one of our servers!”[2]  Hundreds of miles away, a team of hackers hired by Barney Advanced Domestic Chemical Co. (“BAD Company”) stare as lines of code scroll by on their laptops.[3]  BAD Company has just infiltrated and taken command of their business rival’s servers.[4]  With the click of a mouse, hackers from BAD Company order the toxic chemical tanks to overflow.[5]  Toxic chemicals seep out of the tanks and contaminate the surrounding countryside.[6]  The computer operators immediately call for a hazmat team.[7]  The exercise ends.[8]

This episode was just a Department of Homeland Security (“DHS”) cybersecurity exercise, but it highlights a massive national security threat: the ability for malicious computer code to infiltrate computer systems, cripple critical infrastructure, and steal massive quantities of intellectual property.[9]  The United States National Counterintelligence Executive (“ONCIX”) noted that “[s]ensitive [U.S.] economic information and technology are targeted by the intelligence services, private sector companies, academic and research institutions, and citizens of dozens of countries.”[10]  The loss of this technology has already cost the United States (“U.S.”) anywhere from $2 billion to $400 billion.[11]  Furthermore, the pace of U.S. data loss is increasing.[12]  Foreign intelligence services, private individuals, and foreign corporations have increased their efforts directed at stealing intellectual property, costing U.S. companies millions of dollars in development costs and tens or hundreds of millions of dollars in potential profits.[13]

There is no doubt that these cyber threats pose a huge problem for both the U.S. government and U.S. companies.  How, then, can we effectively prevent these threats?  Should we pour more money into network defenses?  Should we focus on attack response and recovery from the inevitable network penetration?[14]  Should we pursue an offensive doctrine that establishes a deterrent policy?  Perhaps the best approach is a combination of all three?

Furthermore, who should prevent these intrusions?  Should the U.S. government protect private networks, and does it have the legal ability to do so?  Should U.S. companies shoulder the burden of protecting themselves?  Do we want to empower companies to defend themselves outside their own perimeters?[15]  If so, how far does a company’s ability to defend itself extend?

These questions highlight a disturbing reality: many of the networks that control our electricity, water, financial systems, and other critical industries operate in a largely unregulated and unprotected cyberspace.[16]  In fact, cyberspace has drawn comparisons to the American Wild West; in both areas, black hat criminals have taken advantage of the lawlessness of their respective domains.[17]  To bring order to this chaos and tame the Wild West, private companies must have the ability to protect themselves in cyberspace.  As such, this note advocates for a form of cyber self-defense called active defense.  Active defense, colloquially known as “hackback,” is when a targeted entity uses a counter-cyberattack against an attacker’s system, thereby stopping the cyberattack in progress and discouraging future attacks.[18]

Part I of this note will analyze the cyber threat that both the U.S. government and U.S. companies currently face.  Part II will consider who is best suited to respond to these cyber threats—whether it is the private or the public sector—and what options each entity can pursue.  Part III assesses how the law of self-defense applies in cyberspace, paying particular attention to both the benefits and drawbacks of hackback.  Part IV transitions to a discussion of the Computer Fraud and Abuse Act (“CFAA”), the basic federal anti-hacking statute, and explains how the Department of Justice (“DOJ”) might view hackback.[19]  In doing so, I will propose a legal framework that allows companies to hackback under a deputy arrangement with the U.S. government, providing the benefits of hackback with the oversight of government regulation.

View Full PDF

Zach West: Juris Doctor Candidate 2013, Syracuse University College of Law.