Rethinking Corporate Active Cyber Defense

The recent WannaCry and NotPetya global cyber incidents have fueled the debate already raging over the role of and limits on corporate self-defense in cyberspace. The emerging international practice of “active cyber defense” (ACD) moves this debate beyond the merely theoretical realm. Private sector active defense potentially shifts the balance in favor of defenders and would improve companies’ ability to complicate and disrupt attacks and mitigate damages. Enhancing private sector defense might also deter future attacks by denying gains and imposing costs to attackers, including by making it easier for law enforcement to identify and punish attackers. Cumulatively, the impact could significantly alter the calculus of malicious actors.

However, aggressive active defense measures—including, most controversially, “hacking back” into attackers’ networks—carry significant risks to the defender and innocent third parties. The risk is especially pronounced if the defender is ill-equipped to attribute the attack and control its effects. The potentially systemically destabilizing effects of unrestrained conduct of active defense internationally lead opponents to warn that it is akin to unleashing the “wild west” in cyberspace.

Self-Restraint among Private Security Contractors: What Can ACD Learn from Somali Piracy?

In reality, much of this debate is academic. A nascent international “gray” market for active cyber defense services (including hacking back) already exists. The growth of private sector ACD mirrors a similar development in maritime security: the shipping industry’s adoption of private armed guards in response to the escalating threat from Somali piracy. By the late 2000s, even huge naval deployments were unable to provide sufficient defense to shipping vessels. Private maritime security contractors left many governments struggling to belatedly impose order where little prevented or discouraged the private sector from turning to its own means of defense. But through the combined efforts of ship-owners, maritime insurers, and private maritime security providers, the private sector was to implement a credible and responsible solution that defused the threat.

The same factors that catalyzed the rise of private maritime security contractors are pervading the cyber domain. Rather than continuing to debate whether to allow the practice of ACD, it is time to consider how to responsibly and credibly place ACD in the corporate tool kit. Wherever possible, this approach should draw on established private sector self-regulation mechanisms, including insurance-based solutions.

Elements of a Strategy for Managing ACD

In a recently released report by the Carnegie Endowment’s Cyber Policy Initiative, we acknowledge that ACD is not a panacea, but submit that it would be a valuable addition to both international and corporate security. Its value is contingent on the creation of principles and requirements to manage the practice of active cyber defense. Consider the follow few examples.

First, the private sector should be allowed to employ only a limited spectrum of active cyber defenses. Measures carrying unacceptable risk, such as destructive hack backs, should be impermissible. The acceptable purposes of ACD activity should be similarly circumscribed to defense and mitigating damage, instead of retribution.

Second, only competent and qualified defenders should undertake active cyber defense. Legitimate ACD could be gauged to an organizations’ maturity level through a variety of means including a professional accreditation system.

Third, flexible mechanisms are needed to incentivize principled ACD conduct by the private sector. Cyber insurance is well-suited to play a role in an industry-driven approach to regulating private sector ACD based on the maturity level of the practitioners.

Fourth, whatever balance is struck, principles must work toward international harmonization. Uneven approaches between countries may disadvantage those attempting to promote norms of restraint and reward those who disregard them (while raising serious extradition issues).

The U.S. Should Not Ignore the Global Context

Finally, our report underscores the risks inherent in the U.S. going it alone. Continuing to prohibit private sector active cyber defense entirely leaves law-abiding corporations vulnerable while rewarding those that circumvent restrictions or outsource active defense services. On the other hand, creating an overly permissive environment without international norms could increase tensions with other countries, including by opening the door to criticism that the U.S. is promoting vigilantism. We should not forget the striking lessons from several traumatic centuries of privateering before the maritime domain was pacified. The U.S. would be well-advised to adopt a cautious, evolutionary approach to the ACD domain – harmonized internationally and tailored to experience and evolving technology.