Risk
7/27/2012
01:36 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Strike Back At Hackers? Get A Lawyer

Don't risk legal troubles. Get advice before taking the offensive against cybercriminals, military security expert says at Black Hat.

As security pros in business and government shore up their cyber defenses and contemplate striking back at hackers, they may find themselves on uncertain legal ground. To avoid costly mistakes, it's important to get legal advice before taking action.

That was the message from Robert Clark, an operations lawyer with the U.S. Army Cyber Command, in an address titled "Legal Aspects of Cyberspace Operations," on Thursday at the Black Hat conference in Las Vegas.

"Get a good lawyer. Get them involved early and often. They can be a valued team member," Clark said in an interview with InformationWeek after his presentation.

A key theme at Black Hat was the trend toward incorporating an offensive component into cybersecurity strategies, what Clark referred to as "hack back." But the use of security "beacons," disinformation, and other offensive techniques may have legal implications, he said. Clark said he was speaking in his personal capacity as a legal expert and not as a government official.

[ Consider these 5 Black Hat Security Lessons For CIOs. ]

The role of the lawyer is to ask detailed questions about what steps security teams want to take "so the people who make the decision are fully informed of the risks," Clark said.

Earlier in the week at Black Hat, former FBI cybersecurity expert Shawn Henry, now president of CrowdStrike Services, said proactive cybersecurity strategies include creating a "hostile environment" for would-be hackers and even causing them "pain." He pointed to the use of corrupt packets and disinformation as potential ways of doing that.

Clark said there's a "large area to be explored" when it comes to new techniques for defending an organization's information and IT assets. The Computer Fraud and Abuse Act of 1986, which specifies a range of computer-access offenses, sets legal parameters that continue to apply. "No lawyer's going to say, 'violate the law,'" said Clark.

Operations lawyers can and should help IT security teams finds ways to accomplish their objectives within the boundaries of the law. "No lawyer should say, 'you can't do that,'" said Clark. "They should say, 'if we do it this way,'" then the strategy is legally viable.

Computer security basics continue to be important. Clark said operations lawyers must assess the steps taken prior to engaging in more proactive defenses, such as "air gapping" sensitive information, so that it's harder to access electronically, and encrypting data at rest.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/27/2012 | 7:23:14 PM
re: Strike Back At Hackers? Get A Lawyer
A great piece of advice, always get a legal opinion if what you are doing is questionable. I am sure hack back started because some companies IT department got back at some one who penetrated their system. I like the idea giving them a taste of their own medicine. Also it does have the potential to get nasty fats if both parties involved are trying to one up the other. On the part of the business that would be very unprofessional to get in a shouting match. The professional way would be to seek the advice of a lawyer so that you know exactly what your limitations are as a business. I can also see some good in this; say someone penetrates your companies system and the IT department does not find out about it till after the fact. Hacking back could actually entice the hacker to return and therefore giving the company the second chance at identifying the infiltrator. Has anyoneG«÷s company actually done a hack back and had positive legal results form it?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9209
Published: 2015-03-30
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.