A recent Guardian article debated the ethics of hacking hackers, featuring opinions and ideas from some high profile cyber security bods: one of them a former US director of intelligence no less. Is “hacking back” ethical? Is it the only way to fight back against growing numbers of cyber crimes?
This translate nicely into how we need to view the Internet: a more-or-less borderless, ocean-less world which we all inhabit.It started with video games. Popular games website RockPaperShotgun coined the phrase “there are no oceans on the internet” to help describe how we are one big online community.
The double edge to this sword is that threat actors can strike from virtually anywhere worldwide at nations which likely don’t have the jurisdiction to pursue them: try and imagine the UK or the US knocking on Putin’s door and asking him to hand over Russian nationals, unlikely I think.
Should we “hack back”?
“I think the term hacking back is a bit of a curve-ball, hacking back and "tracking down hackers computers and disabling them" are very different,” explains Mark James, ESET security specialist.
“The idea of fighting back needs to be handled very carefully indeed, and let’s not forget about international laws in the countries where the perpetrators are residing, is it even going to be possible to do it legally?
“If not then we are no better than the instigators in the first place, but something more needs to be done.
It comes back to the problem of technology and the Internet being very quick to evolve and change, whilst the law is very slow by comparison.
Higher Power
I suggested to Mark that the presence of some kind of advisory or oversight group to make larger decisions and regulate “hacking back” might help.
“It certainly should be decided by a higher authority from mixed nations if possible, but the actual process in getting it sorted will be a lot harder to put into practice, if it is even possible.”
The jurisdiction problem rears its ugly head again. It seems that you essentially have to make the environment so hostile that cybercrime isn’t an option and that’s an environment that won’t be developed anytime soon.
“Jurisdiction will always be one of the biggest hurdles in cybercrime and one not easily overcome. Once the criminal has been tracked and found anything that will lead to a successful prosecution is definitely a bonus and if this comes from tracking down their computers then a wins a win.”
Another interesting counterpoint to “hacking back” raised in the Guardian article is correct attribution: with the large use of botnets how can you be 100% sure that you aren’t just targeting a middle man, completely unaware of their involvement?
Join the ESET UK LinkedIn Group and stay up to date with the blog.
If you had the know-how and the means would you strike back against a hacker?