![\"\"](\"https:\/\/blog.richmond.edu\/jolt\/files\/2017\/10\/unnamed.jpg\")
<\/p>\n<\/p>\n
By: Jon Neri,<\/p>\n
In light of the recent Equifax data breach, I feel that now is an appropriate time to be talking about current legislative pushes for the public recognition and legalization of defensive hacking efforts. Defensive hacking, sometimes referred to as \u201chackback,\u201d is a method to prevent and counteract future data breaches that has been scarcely discussed within a political forum up until recently.[1]<\/a> There is no single process to successfully hack an eminent hacker, and companies have been imploring a wide range of counter-hacking methods for well over a decade.[2]<\/a> Despite varying avenues for accomplishing a preemptive attack, strategies commonly involve collecting intel on suspect hackers, breach the hackers\u2019 data infrastructures, and then proceeding to destroy any stolen data.[3]<\/a><\/p>\n Large companies, banks, search engines, and other internet entities that store the private information of their users are known to contract private companies and individuals who specialize in this practice; the goal being to protect their own networks and data from further breach and prevent the release of confidential information.[4]<\/a> Despite the known fact that these employed hackers are breaking those same laws as threatening hackers, their methods have rarely gained large-scale public attention.[5]<\/a> Therefore, the debate on whether such practices should become deemed suitable and further condoned under federal law has never entirely culminated.[6]<\/a><\/p>\n While defensive hacking remains unsupported by codified law, it has long been observed that governing policy appears to support such efforts in countervailing data breaches.[7]<\/a> In 2005, there was a highly-publicized case in which the plaintiff sued his former employer for wrongful termination after being let go following his independent investigation of a network breach.[8]<\/a> Shawn Carpenter had been employed at Sandia National Laboratories as a network security analyst when the company\u2019s network was hacked in 2003.[9]<\/a> Carpenter took it upon himself to launch an independent investigation, utilizing hacking techniques in order to track-down a cyberespionage group centralized in China.[10]<\/a> He eventually reported his discoveries to the FBI.[11]<\/a> Once Sandia officials learned of Carpenter\u2019s sharing of information with outside agencies, they terminated him for the inappropriate use of power and confidential information that he only had access to through his position as network security manager.[12]<\/a><\/p>\n Carpenter sued and ultimately won his case, the District Court of New Mexico awarding him $4.3 million in punitive damages and over $387,000 in compensatory damages.[13]<\/a> Carpenter\u2019s attorney gave a statement indicating that the jury\u2019s verdict served as \u201cvindication of his decision to do the right thing and turn over the information he obtained to the proper federal authorities\u2026 protect[ing] the national interest.\u201d[14]<\/a> It\u2019s safe to say that over a decade later, the message sent in the Carpenter<\/em> ruling stands true today: the law intends to protect those who hack on behalf of security interests, whether those interests stem from government or otherwise.[15]<\/a><\/p>\n However, the hush around counter-hacking has steadily grown louder with every news heading boasting another large-scale cybersecurity breach. As a result, some legislatives appear ready to address hackback within the public forum. In March of this year, Representative Tom Graves presented a discussion draft bill which would amend the Computer Fraud and Abuse Act (CFAA).[16]<\/a> Representative Graves stated that the \u201cbill is about empowering individuals to defend themselves online\u2026 [amendment] will serve as a disincentive for criminal hacking because the risk of getting caught will likely go up.\u201d[17]<\/a> This is because private individuals and companies will now officially be protected under the proposed law, when implementing hacking techniques with the intent to track hackers immediately following a network breach.[18]<\/a><\/p>\n The proposed bill essentially provides a \u201cdefense to a prosecution under the CFAA that the conduct constituting the offense was an active cyber defense measure.\u201d[19]<\/a> This means that it is simply to be applied as a justification for the immediate tracking of hackers after a cyberattack.[20]<\/a> It excludes the \u201cdestruction of data\u201d or the \u201cimpairment of the functionality of the attacker\u2019s computer system.\u201d[21]<\/a> Thus, the proposed amendment does not place justice in private hands, but allows victims to conduct an instantaneous defense against hackers and then report relevant information to government agencies responsible for cybersecurity.[22]<\/a><\/p>\n While the bill has received praise from legal professionals such as University of Texas law professor Robert Chesney, who sees it as a necessity in our technological age, it is not lacking in critiques.[23]<\/a> In fact, its strongest opposition is from those who deal in cybersecurity as a profession. Brad Maryman, retired FBI agent and leader cybersecurity firm Maryman & Associates, is not of the opinion that \u201cthe average citizen is capable of appropriately identifying the hacker.\u201d[24]<\/a> This is because cyberattacks are routed through other victims\u2019 network systems after they have been attacked themselves. [25]<\/a> This creates a string of computers, known in the field as \u201cbotnet\u201d networks.[26]<\/a> Botnets are often incredibly complicated, and the notion that millions of victims engage in searches, trying to navigate such a complex maze, delivering information to authorities along the way could easily turn into chaos for everyone involved.[27]<\/a><\/p>\n Regardless of its initial feedback, Rep. Graves\u2019s bill represents a transition in legal discourse surrounding cybersecurity. As data breaches continue to plague our industries, we will undoubtedly see increased efforts to promote legislation concerning cyberattacks and the rights of victims involved. Based on recent events in our cyber community, such rights are likely to incite legal protections concerning defensive hacking techniques in the near future.<\/p>\n <\/p>\n [1]<\/a> See <\/em>Joseph Cox, Revenge Hacking Is Hitting the Big Time<\/em>, The Daily Beast (Sept. 19, 2017, 1:00 AM), https:\/\/www.thedailybeast.com\/inside-the-shadowy-world-of-revenge-hackers.<\/p>\n [2]<\/a> See <\/em>Jaikumar Vijayan, Reverse hacker wins $4.3M in suit against Sandia Labs<\/em>, Computerworld (Feb. 14, 2007, 12:00 AM), https:\/\/www.computerworld.com\/article\/2543470\/security0\/reverse-hacker-wins–4-3m-in-suit-against-sandia-labs.html.<\/p>\n [3]<\/a> Cox, supra <\/em>note 1.<\/p>\n [4]<\/a> Id.<\/em><\/p>\n [5]<\/a> See id.<\/em><\/p>\n [6]<\/a> See id.<\/em><\/p>\n [7]<\/a> Robert Chesney, Legislative Hackback: Notes on the Active Cyber Defense Certainty Act discussion draft<\/em>, Lawfare Blog (Mar. 7, 2017, 10:30 AM), https:\/\/www.lawfareblog.com\/legislative-hackback-notes-active-cyber-defense-certainty-act-discussion-draft.<\/p>\n [8]<\/a> Vijayan, supra <\/em>note 2.<\/p>\n [9]<\/a> Id.<\/em><\/p>\n [10]<\/a> Id.<\/em><\/p>\n [11]<\/a> Id.<\/em><\/p>\n [12]<\/a> See id<\/em>.<\/p>\n [13]<\/a> Id.<\/em>; see also <\/em>Carpegnter v. Sandia Corp., No. 05-06347, N.M. Dist. WL 1108465 (Feb. 21, 2007).<\/p>\n [14]<\/a> Vijayan, supra <\/em>note 2.<\/p>\n [15]<\/a> Chesney, supra<\/em> note 7.<\/p>\n [16]<\/a> See <\/em>Steven Nelson, \u2018Self-Defense\u2019 Bill Would Allow Victims to Hack Back<\/em>, U.S. News, Mar. 9, 2007, https:\/\/www.usnews.com\/news\/articles\/2017-03-09\/self-defense-bill-would-allow-victims-to-hack-back.<\/p>\n [17]<\/a> Id.<\/em><\/p>\n [18]<\/a> Chesney, supra<\/em> note 7.<\/p>\n [19]<\/a> Id.<\/em><\/p>\n [20]<\/a> See id.<\/em><\/p>\n [21]<\/a> Active Cyber Defense Certainty Act of 2017 (discussion draft), 115th<\/sup> Cong. \u00a7 2(1)(B) (2017).<\/p>\n [22]<\/a> Id. <\/em>at \u00a7 3(2)(B).<\/p>\n [23]<\/a> Chesney, supra<\/em> note 7.<\/p>\n [24]<\/a> Nelson, supra <\/em>note 16.<\/p>\n