Risk
7/27/2012
01:36 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Strike Back At Hackers? Get A Lawyer

Don't risk legal troubles. Get advice before taking the offensive against cybercriminals, military security expert says at Black Hat.

As security pros in business and government shore up their cyber defenses and contemplate striking back at hackers, they may find themselves on uncertain legal ground. To avoid costly mistakes, it's important to get legal advice before taking action.

That was the message from Robert Clark, an operations lawyer with the U.S. Army Cyber Command, in an address titled "Legal Aspects of Cyberspace Operations," on Thursday at the Black Hat conference in Las Vegas.

"Get a good lawyer. Get them involved early and often. They can be a valued team member," Clark said in an interview with InformationWeek after his presentation.

A key theme at Black Hat was the trend toward incorporating an offensive component into cybersecurity strategies, what Clark referred to as "hack back." But the use of security "beacons," disinformation, and other offensive techniques may have legal implications, he said. Clark said he was speaking in his personal capacity as a legal expert and not as a government official.

[ Consider these 5 Black Hat Security Lessons For CIOs. ]

The role of the lawyer is to ask detailed questions about what steps security teams want to take "so the people who make the decision are fully informed of the risks," Clark said.

Earlier in the week at Black Hat, former FBI cybersecurity expert Shawn Henry, now president of CrowdStrike Services, said proactive cybersecurity strategies include creating a "hostile environment" for would-be hackers and even causing them "pain." He pointed to the use of corrupt packets and disinformation as potential ways of doing that.

Clark said there's a "large area to be explored" when it comes to new techniques for defending an organization's information and IT assets. The Computer Fraud and Abuse Act of 1986, which specifies a range of computer-access offenses, sets legal parameters that continue to apply. "No lawyer's going to say, 'violate the law,'" said Clark.

Operations lawyers can and should help IT security teams finds ways to accomplish their objectives within the boundaries of the law. "No lawyer should say, 'you can't do that,'" said Clark. "They should say, 'if we do it this way,'" then the strategy is legally viable.

Computer security basics continue to be important. Clark said operations lawyers must assess the steps taken prior to engaging in more proactive defenses, such as "air gapping" sensitive information, so that it's harder to access electronically, and encrypting data at rest.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/27/2012 | 7:23:14 PM
re: Strike Back At Hackers? Get A Lawyer
A great piece of advice, always get a legal opinion if what you are doing is questionable. I am sure hack back started because some companies IT department got back at some one who penetrated their system. I like the idea giving them a taste of their own medicine. Also it does have the potential to get nasty fats if both parties involved are trying to one up the other. On the part of the business that would be very unprofessional to get in a shouting match. The professional way would be to seek the advice of a lawyer so that you know exactly what your limitations are as a business. I can also see some good in this; say someone penetrates your companies system and the IT department does not find out about it till after the fact. Hacking back could actually entice the hacker to return and therefore giving the company the second chance at identifying the infiltrator. Has anyoneGÇÖs company actually done a hack back and had positive legal results form it?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6278
Published: 2014-09-30
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and m...

CVE-2014-6805
Published: 2014-09-30
The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6806
Published: 2014-09-30
The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6807
Published: 2014-09-30
The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6808
Published: 2014-09-30
The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.