Managing The Legal Risks Of Active Defense

As increasingly more organizations deliberate adding active defense strategies to their IT security practices, they'll need to consider the risk management baggage that accompanies these aggressive maneuvers. One of the top risk considerations to factor into a decision about active defense activities should be legal concerns, according to a cyber law expert who last week at Black Hat outlined the legal ramifications of a number of common active defense scenarios.

Among the highlights, Robert Clark, distinguished professor of law for the Cyber Operations Center for Cyber Security Studies at the US Naval Academy, recommended that enterprises bear in mind two important points. First, that the right to protect property is not unlimited—in the physical world, for example, one can't kill someone who has stolen their stuff. And, second, that if IT risk managers are contemplating going down the path of active defense they should be involving their attorneys early and often in the decision-making process.

"If you're going to do this, you're going to need a great team of lawyers, or at least one really great lawyer, to handle this for you," said Clark, who said he was speaking in a personal capacity as a cybersecurity law expert. "Explain the technology to them at a third-grade level so that they can turn to senior leaders or judge and jury to explain it at a first-grade level."

Clark detailed some of the legal aspects of common active defense situations, including the legal pitfalls of seeding networks with deceptive information or decoy honeypots. For example, if an organization sets up fake internal documents with no intent for them to be made public but they are nevertheless stolen and sent to the media these seemingly legitimate documents could be confused as public disclosure to the Securities and Exchange Comission (SEC).

"If I'm the SEC and I see the documents coming out there, I can tell you, I'm going to be knocking at your door. And your shareholders are going to be knocking at your door as you're sitting there trying to explain it is part of a deception plan," he said. "That's why you have to get your SEC lawyers involved when you're having this discussion of what you want to do."

Even more common, though, are the situations Clark went over with regard to recovery of stolen intellectual property or other sensitive data when an organization can locate where the data is housed outside of the network. Every scenario is different, but he advised his audience that the law will likely look more favorably if the organization has done everything it can on the prevention side before it takes an intrusive measure against an antagonist.

"The law favors prevention over post-trespass recovery," he said. Also, the courts are likely to consider whether an organization is supposed to be where it is from a permissions standpoint, using the real-world analogy of sitting in a bar frequented by a competitor's executives versus using a hidden microphone in a private office.

So, there would be a lot more grey area to work around if an organization erased data from an anonymous FTP server with open privileges than if they escalated privileges or broke into an attacker's private machine. Meanwhile if an innocent and unknowing third party's machine is being used to host data, the organization would likely have no legal standing to simply go in and act , but they could ask permission to delete the data. However, even situations like the first one with the anonymous FTP server could have the potential to land an organization in hot water with the Department of Justice (DOJ) for Computer Abuse and Fraud Act violations. According to Clark, organizations that don't like it shouldn't blame the DOJ.

"I'll tell you something. When you're talking about recovery operations, I really do believe that this is a no-win situation," Clark says. "Don't blame doj for anything. Blame congress. If you've got a problem with something, you need to talk to congress about changing the law. You elected them, they work for you, that's what needs to be changed."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.