“The likely annual cost to the global economy from cybercrime is more than $400 billion,” according to McAfee’s report, Net Losses: Estimating the Global Cost of Cybercrime.
With businesses experiencing such staggering losses worldwide, it’s no wonder some are considering ways to strike back against the cybercriminals who rob them.
This is often known as “hacking back,” or a “hack back.”
Currently, at least one Congressman wants to make it completely legal.
Rep. Tom Graves, a Georgia Republican, has drafted a bill known as The Active Cyber Defense Certainty (ACDC) Act and it would amend the Computer Fraud and Abuse Act, which bans unauthorized access of computers.
Graves said in a press release, “This bill is about empowering individuals to defend themselves online, just as they have the legal authority to do during a physical assault…I hope my bill helps individuals defend themselves against cybercriminals while igniting a conversation that leads to more ideas and solutions that address this growing threat.”
This piece of legislation is continuing the growing conversation regarding the ethical, legal, and practical ramifications of a hack back.
While we can’t get too deep into the intricacies of hacking back, we can offer a few well-reasoned pros and cons to give you a better understanding of the debate surrounding this controversial topic.
Before we go over those pros and cons, let’s define a hack back.
What Does Hacking Back Mean?
A hack back is simply a counterstrike against a cyberattacker.
Hacking back can involve any of the following 3 actions:
- Deleting or Retrieving stolen data
- Harming the hacker’s system
- Identifying the hacker and reporting him to law enforcement authorities
While this seems pretty straightforward, hacking back requires years of technical expertise and hacking experience.
And even with the right credentials, a “back hacker” may cause more harm than good.
To understand how things can go right or wrong when hacking back, let’s take a look at the pros and cons of a hack back.
Pros of a Hack Back
Looking at this issue from the perspective of companies who have been attacked or who are big targets, a hack back seems better to them than just sitting on their hands.
Most companies don’t get their data or money back after they’re attacked, and the hackers are rarely caught and prosecuted.
This has rightfully angered many companies with the resources to strike back against their attackers.
If you’re thinking about performing a hack back, here are the pros of doing so:
Law Enforcement Agencies Aren’t Stopping Cybercriminals
As we said earlier, law enforcement has been ineffective in both preventing crime and catching criminals.
“The ransomware is that good,” said Joseph Bonavolonta, the Assistant Special Agent in Charge of the FBI’s CYBER and Counterintelligence Program in its Boston office. “To be honest, we often advise people just to pay the ransom.”
So if law enforcement isn’t going to do anything about it, the argument goes that you might as well try to take matters into your own hands.
It Might Deter a Majority of Hackers
A hacker who experiences zero repercussions for successfully hacking your organization is far more likely to hack you or someone else again.
Whereas, if the hacker experiences any sort of pushback, damage, or exposure, they’re less likely to hack you or someone else again.
This may not work for all hackers, but for profit-motivated hackers, the threat of their systems being damaged or their identities being exposed might act as a powerful deterrent.
You Could Collect Counterintelligence
Besides retrieving your data, harming the hacker’s system, or preventing data loss altogether, you may be able to gather counterintelligence on your hacker in order to expose them to the authorities or guard against their attack.
He says you could hire a company to track hackers and collect information on them so that you can identify them when they attempt to hack you, and can either stop them or slow them down – which may force them to choose a different target.
Cons of a Hack Back
Even though law enforcement and software intended to prevent IT security threats aren’t as secure as we would all like them to be, that doesn’t mean you should engage in hacking your attackers.
It could make problems much, much worse.
Before you launch an attack, here are the cons of hacking back:
It’s (likely) Illegal
According to the Department of Justice’s Best Practices for Victim Response and Reporting of Cyber Incidents,
“A victimized organization should not attempt to access, damage, or impair another system that may appear to be involved in the intrusion or attack. Regardless of motive, doing so is likely illegal, under U.S. and some foreign laws, and could result in civil and/or criminal liability.”
What makes hacking back “likely illegal” is the Computer Fraud and Abuse Act. Title 18, Sec. 1030 clearly says that using a computer to intrude upon or steal something from another computer is illegal.
If you attempt to stop a hacker within your own network, that’s fine.
But the moment you leave your network to hack another computer, you’re engaged in illegal activity.
It’s Difficult to Know Who Hacked You
Hackers usually know how to cover their tracks by using computers and servers that belong to someone else, or that appear to belong to someone else.
This makes it more likely that you will end up attacking an innocent person instead of the correct cybercriminal.
In that situation, you would be criminally liable for any collateral damage you might cause.
It Won’t Deter All Hackers
While a successful hack back might deter opportunistic hackers trying to make a quick buck, ideological hackers or determined malicious hackers will probably continue to pursue their target until they get what they want.
You Can’t Steal Your Data Back
Your digital data is highly insecure once it’s stolen.
Even if you could locate the stolen data, deleting it won’t provide more security because you wouldn’t know whether or not more copies of your data exist.
Furthermore, any data that you take off of a hacker’s server should be treated as permanently compromised.
The Hackers You Hack Back Might Back Hack You
A hack back might make your attacker determined to back hack you and harm your system or ruin your business.
Take the story of Blue Security as an example of a noble hack back that resulted in the untimely demise of a good company.
Blue Security developed a software called Blue Frog that would spam spammers if the spammers refused to stop sending spam to Blue Security’s customers.
Blue Security was successful for awhile until one spammer decided to fight back.
This angry spammer targeted Blue Security so much that Blue Security had to shut down because of the damage done and the threat of more to come.
If you’re unprepared for a potential digital war, you shouldn’t rustle the feathers of dangerous cybercriminals.
Should You Hack Back?
The practice of hacking back is still in its infancy, and as long as it remains relatively illegal, it probably won’t mature any time soon.
We wouldn’t recommend you do it, both because it is illegal and because you’re still unable to do it safely and effectively.
Small business network security along with enterprise level network security can still be improved and enhanced to thwart the majority of attacks against your organization.
But you won’t get it from just one solution or software.
The only way you’ll get optimal security is from a company who can implement various security strategies on multiple levels for a totally locked down network.
Are you interested in talking to a company who can offer state-of-the-art security for your business?
We can help…
Stop Worrying About Hacking Back and Start Improving Your IT Security
We’ll perform a security audit on your system to discover your existing holes and patch them. Then we’ll help you upgrade your hardware and firmware for a stronger security posture. From firewalls to penetration tests, we’ll help you prevent the hacks, so you don’t have to worry about performing a hack back.
Contact us for your free consultation today to learn more!