Share Of You

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl1cm-t_Rry5cfJPly0OBoAKvANn15gABAC-8U4iQTY4iW2IASF6eeDpFdqQI6rJzK6905CwOC68f3GQYaICaHwdf3xvqLI89gRMg1MjW297Huxqun8oyDs64PatUVypv4mZrcqNHvMHc/s1600/aaaaa.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl1cm-t_Rry5cfJPly0OBoAKvANn15gABAC-8U4iQTY4iW2IASF6eeDpFdqQI6rJzK6905CwOC68f3GQYaICaHwdf3xvqLI89gRMg1MjW297Huxqun8oyDs64PatUVypv4mZrcqNHvMHc/s1600/aaaaa.jpeg"></a></div>
<br>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
If we’re losing the war against cybercrime, then should we take off the gloves and strike back electronically against hackers?</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
As banks reel from another major hacking revelation, a former US director of intelligence has joined some of them in advocating for online counterstrikes against cybercriminals.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
In February, security firm Kaspersky detailed a direct hack against 100 banks, in a co-ordinated heist worth up to $1bn. This follows growing sentiment among banks, expressed privately, that they should be allowed to hack back against the cybercriminals penetrating their networks.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
At February’s Davos forum, senior banking officials reportedly lobbied for permission to track down hackers’ computers and disable them. They are frustrated by sustained hacking campaigns from attackers in other countries, intent on disrupting their web sites and stealing their data.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Dennis Blair, former director of national intelligence in the Obama administration, has now spoken out in favour of electronic countermeasures, known in cybersecurity circles as hacking back, or strikeback.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Blair co-authored a 2013 report from the US Commission on the Theft of American Intellectual Property. It considered explicitly authorising strikeback operations but stopped short of endorsing this measure at the time.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Instead, the report suggested exploring non-destructive alternatives, such as electronically tagging stolen data for later detection. It also called for a rethinking of the laws that forbid hacking, even in self-defence.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Western law enforcers don’t have jurisdiction in the countries where cybercriminals operate. Ideally, they would pass information about hackers onto their counterparts there, said Blair, but in many cases local police are un-cooperative. It’s time to up the ante, he suggested.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“I am more leaning towards some controlled experiments in officially conducting aggressive cyber-tracking of where attacks come from, discovering their origin, and then taking electronic action against them,” he told the Guardian.</div>
<h2 style="background-color: white; color: #333333; font-family: 'Guardian Egyptian Web', 'Guardian Text Egyptian Web', Georgia, serif; font-size: 1.25rem; line-height: 24px; margin: 1.6875rem 0px 0.0625rem;">
Legal problems</h2>
<div class="js-ad-slot ad-slot ad-slot--dfp ad-slot--inline1 ad-slot--inline" data-link-name="ad slot inline1" data-mobile-landscape="1,1|300,50|320,50|300,250" data-mobile="1,1|300,50|300,250" data-name="inline1" data-node-uid="15" data-tablet="1,1|300,250" data-test-id="ad-slot-inline1" id="dfp-ad--inline1" style="background-color: #f6f6f6; color: #333333; float: right; font-family: 'Guardian Text Egyptian Web', Georgia, serif; height: 17.125rem; line-height: 24px; margin: 0.25rem auto 0.75rem 1.25rem; min-height: 4.625rem; overflow: hidden; text-align: center; width: 18.75rem; z-index: 1000;">
<div class="ad-slot__label" data-test-id="ad-slot-label" style="background-color: transparent; border-top-color: rgb(223, 223, 223); border-top-style: solid; border-top-width: 0.0625rem; box-sizing: border-box; color: #6e6e6e; font-family: 'Guardian Text Sans Web', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 0.75rem; height: 1.5rem; line-height: 1.25rem; margin: 0px auto; padding: 0px 0.5rem; text-align: right;">
Advertisement</div>
<div class="ad-slot__content" id="google_ads_iframe_/59666047/theguardian.com/technology/article/ng_2__container__" style="border: 0pt none;">
<iframe frameborder="0" height="250" id="google_ads_iframe_/59666047/theguardian.com/technology/article/ng_2" marginheight="0" marginwidth="0" name="google_ads_iframe_/59666047/theguardian.com/technology/article/ng_2" scrolling="no" style="border-width: 0px; vertical-align: bottom;" width="300"></iframe></div>
</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
There’s just one problem with strikeback operations, said Mark Rasch, a former federal cybercrime prosecutor and the head of Maryland-based Rasch Technology and Cyber-law: it’s against the law. “You have to start with the general assumption that hacking back is most likely illegal,” he said.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Long-standing laws on both sides of the Atlantic clearly forbid unauthorised tampering with a computer, even if someone is using that computer to attack you. In the UK, the Computer Misuse Act sets those rules. In the US, the Computer Fraud and Abuse Act does the same.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Even without this legislation, the law generally frowns upon what Rasch calls “self help”. Judges dislike vigilante justice.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
The stakes are getting higher, though. Since the report’s release, corporate America has seen several devastating cyber-attacks. JP Morgan suffered a breachaffecting 76 million households. Home Depot and Target were also hacked, and most recently, Sony Entertainment was embarrassed by the theft of internal documents.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“I’ve been seeing the way that technology is developing. I think it’s worth some limited legislation to post penalties back to hackers,” Mr Blair said, adding that companies should work with law enforcement rather than taking matters into their own hands.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“Law enforcement authorities can go back down the same route that [the hackers] use to attack, and cause physical damage to their equipment,” he added.</div>
<h2 style="background-color: white; color: #333333; font-family: 'Guardian Egyptian Web', 'Guardian Text Egyptian Web', Georgia, serif; font-size: 1.25rem; line-height: 24px; margin: 1.6875rem 0px 0.0625rem;">
A Gentler Poke</h2>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Is frying someone’s laptop remotely with a killer poke even possible? Even if it is, it may not achieve the desired effect, says Dave Dittrich, a computer specialist at the University of Washington’s Applied Physics Laboratory, who is a specialist in the topic. “How expensive is it to buy a new one? $500? Cyber is not the same as physical when it comes to disabling ‘weapons’ to remove a threat.”</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Frying is not the only form of counter-hack, points out Dittrich. “I prefer the term ‘active response continuum’ to make it clear and explicit that there is a wide range of actions, from benign to very aggressive and intrusive,” he said.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
These actions include simply probing an attacker’s computer to see what kinds of attack tool they are using.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“That falls on the lower end of the active response continuum, and has less chance of causing any harm to anyone (beyond trespassing, which may still be a crime, but a lesser offense),” Dittrich said.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Could laws be tweaked to allow gentler forms of active defence? Even if they were, technical problems remain, warned Jon Ramsey, chief technology officer atDell SecureWorks, Dell’s security unit. One of the biggest challenges is attribution, he pointed out. It is difficult to trace an attack to a specific individual in cyberspace.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“Without accurate traceback there is a significant and substantial risk that organisations start attacking legitimate organizations,” he said. “Where would this end? It would cascade out of control. Threat actors often use compromised devices of companies and individuals that become unwilling and unknowing participants in attacks and are attacked themselves.”</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
For example, cybercriminals frequently launch compromised computers that are part of a botnet to launch their attacks, said Bill Nelson. He is the executive director of FS-ISAC, a US industry forum for financial services firms to privately share information about cyber threats.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
A botnet is a large collection of computers owned by innocent users, which have been infected by malware. The malware enables cybercriminals to remotely control the computers.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“We do not endorse hacking back because there can be significant unintended consequences,” said Nelson.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
These issues apparently haven’t stopped financial institutions from considering the idea in private before. In December, Bloomberg reported that banks had considered using offshore contractors to carry out a counter-attack, after a widespread attack on the US banking community that US officials believed was mounted from within Iran.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
According to Bloomberg, the FBI discovered that computers used in a cyber-attack on the banking community had been disabled by a third party, and the agency had investigated banks to see if they had already engaged in strikeback activity across national boundaries. It apparently absolved banks under investigation, though.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Banks would have been particularly sensitive to the idea of hacking back across international borders, said John Pescatore, who worked in the Secret Service and the NSA before becoming director of security research and training company theSANS Institute.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“They need to cross country boundaries to do it. That’s what was really coming out of Davos,” he said, adding that these companies are well aware of the legal dangers when crossing international lines. “It’s that boundary crossing issue where I think the larger financial institutions are saying: ‘we need some help’.”</div>
<h2 style="background-color: white; color: #333333; font-family: 'Guardian Egyptian Web', 'Guardian Text Egyptian Web', Georgia, serif; font-size: 1.25rem; line-height: 24px; margin: 1.6875rem 0px 0.0625rem;">
Sharing is caring</h2>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Instead of engaging in such legally risky behaviour, banks that are attacked should simply share information about it with the government to help prepare an industry-wide response, argued John Carson. He is the executive vice president ofBITS, the technology policy division of the US Financial Services Round Table, an industry association for financial firms.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Information sharing, while good for cybersecurity, may carry its own legal risks, Carson warned: “Today if there is an attack, there’s a reluctance to share that information because it could be used against that institution in a civil suit.”</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Legislators are trying to plug that gap. In January, the Cyber Intelligence Sharing and Protection Act (CISPA) was reintroduced in the House. The Bill would allow companies to share information about cyber-threats and hacks with law enforcement without fear of legal reprisal.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
In February, Senator Tom Carper (D-Del) also introduced the Cyber Threat Sharing Act of 2015, which would accomplish similar goals. President Obama also signed an executive order advocating cybersecurity information sharing.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Armed with this information, the government might be the ideal partner to hack back against cybercriminals .</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Blair affirms that banks shouldn’t handle it themselves: “I still think it should be handled through law enforcement authorities, and I would not give some immunity to companies who try it on their own. Because then you just make it wild west, vigilante stuff.”</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
Law enforcement is equally constrained by the law, though, said Rasch. “You can get a warrant to search and seize stuff, but since when did law enforcement have the authorisation to impose punishments on their own? If that’s what you’re talking about with hacking back, I don’t think they can do it,” he said.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
The real question, he added, is whether a government would consider refusing to prosecute law enforcement in the event of a cyber strikeback. But at that point, it stops being a legal discussion. “You’re getting out of the realm of law. You’re getting into the realm of politics,” he warned.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
At this level, the problem is that one government may simply have different rules or priorities to another. If a government refuses to prosecute its own cybercriminals when they’re attacking companies in your country, then should your government support strikebacks by law enforcement that believes it has identified a hacking group?</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“It’s a dangerous game you play, when you decide that because they’re not following the rules, you’re not going to either. Because then you don’t have rules,” he said.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
The problem seems simple: do you take the high road, or stoop to their level? At stake are not only millions of dollars in intellectual property, but also elements of critical national infrastructure, and even free speech.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
As we face such threats, Blair remains convinced that strikebacks are a useful deterrent. He is less concerned with the legal debate than he is with the fact that western firms are being fleeced by shadowy cyber-crooks half a world away.</div>
<div style="background-color: white; color: #333333; font-family: 'Guardian Text Egyptian Web', Georgia, serif; line-height: 24px; margin-bottom: 1rem; padding: 0px;">
“Sitting around sucking our thumbs debating legal points is getting us nowhere,” he concluded. “We’re being robbed blind.”</div>

Should we hack the hackers?

If we’re losing the war against cybercrime, then should we take off the gloves and strike back electronically against hackers? As bank...