Active self-defense strategy best deterrent against cyber-attacks

Jun 27, 2011

With the threats of cybercrime, cyberterrorism and cyberwarfare looming over our hyper-connected world, the best defense for the U.S. might be a good offense, says new research by a University of Illinois expert in technology and legal issues.

Law professor Jay P. Kesan warns that an active self-defense regime, which he terms "mitigative counterstriking," is a necessity in cyberspace, especially to protect such as banking, utilities and emergency services.

"The threats from are real, and the harm of a potential attack can be far greater than what we can currently combat," Kesan said.

Kesan's analysis, co-written with former U. of I. law student Carol M. Hayes and published in a forthcoming issue of the Harvard Journal of Law and Technology, concludes that mitigative counterstriking against attacks instead of simply relying on passive defense options (firewalls, patches and ) is legally justifiable as self-defense, although a more exhaustive legal framework needs to be implemented.

"The principles of mitigative counterstriking are legally justifiable under several areas of domestic and international law, and can be made consistent with other areas of law by amending or reinterpreting the law," he said.

Kesan says an active defense regime consists of three distinct elements: detecting intrusions, tracing the attack back to the , and executing a counterstrike.

A counterstrike can be characterized in one of two ways: retributive counterstrikes, which punish the attacker; and mitigative counterstrikes, which minimize the damage to the victims' information-technology infrastructure.

According to the authors' study, there currently is no effective domestic or international legal apparatus to deter cyber-attacks. Criminal law enforcement is complicated by the lack of a consistently enforced international law, jurisdictional issues and the difficulty of identifying an attacker in a manner specific enough to justify criminal prosecution. Resorting to civil litigation would likely be slow and impractical.

"Cyber-attacks are fundamentally different from crime," Kesan said. "The person may be physically very far away from you, and you may not be able to use traditional legal remedies against that person, since civil and criminal remedies require jurisdiction over a person. In those circumstances, what do you do?"

Kesan suggests that a government-affiliated agency, preferably a public-private partnership, should be responsible for an active defense program, including providing resources for private parties to detect and trace intrusions, and executing counterstrikes.

"We're at a particularly interesting moment in time because the technologies available to do this are getting better," Kesan said. "Trace-route and trace-back technologies – where we pinpoint where certain intrusions are coming from, even if they're going through intermediaries – are getting better. The swiftness of the technologies is getting better, which itself might be a deterrent."

Kesan says the confluence of better technology and inadequate legal protection provides a unique opportunity to think through the issues associated with creating new legal policy.

"Obviously, some sort of self-defense in cyberspace is justifiable," he said. "But how far do we go? Do we just block packets, or do we send them back? That's something we need to think carefully about."

Active defense, however, has been and continues to be a controversial subject. Kesan says the reason the government has been tentative is that, in some quarters, an active defense is viewed as tantamount to vigilantism. It also carries the risk of inflicting significant collateral damage.

"There will be consequences to engaging in that kind of conduct, so we don't want to take actions that are perceived as being lawless or could potentially cause lots of collateral harm," Kesan said. "Technologies are never 100 percent perfect or foolproof."

But if the U.S. is subject to an attack, "then we should have the ability to enact some measures to at least minimize the damage," he said. "Additionally, I would argue that a system to promote active defense and permit mitigative counterstriking should also include a liability rule to protect innocent third party intermediaries whose systems are compromised by attackers and counterstrikers."

Kesan says it's vital that formal policy is finalized soon, while there is still time for thoughtful deliberation and analysis of all of the potential implications of an attack.

"We rely on our online infrastructure for just about everything," he said. "That represents a good choke point, one that might be an attractive target for people who wish to do harm to us. If they were successful, it would have the potential to cause a great deal of economic hardship. That's why we need to be prepared before we are faced with the fallout from an attack."

Explore further: Study shows role of media in sharing life events

More information: The paper, "Mitigative Counterstriking: Self-Defense and Deterrence in Cyberspace," is available online.

Related Stories

US reviewing ways to fight cyber attacks: general

Sep 24, 2010

The White House is looking at boosting the authority of the US military and other agencies to protect the country's infrastructure from possible cyber attack, a top general said Thursday.

Recommended for you

Study shows role of media in sharing life events

8 hours ago

To share is human. And the means to share personal news—good and bad—have exploded over the last decade, particularly social media and texting. But until now, all research about what is known as "social sharing," or the ...

UK: Former reporter sentenced for phone hacking

15 hours ago

(AP)—A former British tabloid reporter was given a 10-month suspended prison sentence Thursday for his role in the long-running phone hacking scandal that shook Rupert Murdoch's media empire.

Evaluating system security by analyzing spam volume

16 hours ago

The Center for Research on Electronic Commerce (CREC) at The University of Texas at Austin is working to protect consumer data by using a company's spam volume to evaluate its security vulnerability through the SpamRankings.net ...

Surveillance a part of everyday life

17 hours ago

Details of casual conversations and a comprehensive store of 'deleted' information were just some of what Victoria University of Wellington students found during a project to uncover what records companies ...

European Central Bank hit by data theft

17 hours ago

(AP)—The European Central Bank said Thursday that email addresses and other contact information have been stolen from a database that serves its public website, though it stressed that no internal systems or market-sensitive ...

Twitter admits to diversity problem in workforce

20 hours ago

(AP)—Twitter acknowledged Wednesday that it has been hiring too many white and Asian men to fill high-paying technology jobs, just like several other major companies in Silicon Valley.

User comments : 5

Adjust slider to filter visible comments by rank

Display comments: newest first

_nigmatic10
not rated yet Jun 28, 2011
The best way to counter a cyber threat is through diversity of tactics.
FroShow
not rated yet Jun 28, 2011
It's cyber-war. These guys should read up on Sun-Tzu.
axemaster
not rated yet Jun 28, 2011
Oh great, so now the government and big businesses will have a legal excuse to terrorize innocent dissidents. How is a jury supposed to tell if the evidence being submitted is total BS or not?

Also, how are they going to prove that they have hit the right target? That's kinda important since, at least last time I checked, the law presumes that people are innocent until proven guilty. Counterhacking people seems like the kind of thing that just screams for a warrent.
Graeme
not rated yet Jun 28, 2011
Since many attacks could come through a botnet, a subverted PC owner may not be aware. But it would be fair enough for the ISP to cut them off. ISPs could have a kind of safe mode network for infected machines, where they are given access to antivirus and information about cleaning the machine, but cut off from the rest of the world.
cacum3
not rated yet Jul 01, 2011
USA become a world guard? Sheriff? Do they harass territorial integrity of Poland, UK or Germany only due to some cyberterrorist hack their nuclear power plant? And what, they blow my neighbor apartment? THIS IS A CRIME! Real danger. In the name of USA GOVERMENT US Force or CIA or whatever gonna hunt for citizens of free country. Having no proof accepted by the Judge? %UCK YOU USA Gov.