Private “hackback” is back in the news, with Sen. Sheldon Whitehouse (D-R.I.) raising the issue of “how and when to license hack-back authority so capable, responsible private-sector actors can deter foreign aggression.” Encouraging online vigilantism in cyberspace is fraught with peril. It threatens to make a chaotic cyber battleground more dangerous and takes the government off the hook for protecting us in cyberspace.
What is hackback? To simplify, it describes actions outside an entity’s network that are designed to defeat a cyber attack, as well as certain attempts to repossess stolen data. On one end of the spectrum, there are fairly benign and possibly legal techniques, such as the use of software “beacons” that a hacker might unknowingly pick up from a victim, which transmit code to the victim from the attacker’s network. It could refer to more aggressive actions like taking an attackers’ servers offline. And, at the far end of the spectrum is the digital equivalent of O.J. Simpson going to that Vegas hotel room to steal back sports memorabilia he claimed was stolen.
