Attacking the attackers: Can active cyber defense stay within the rules?

http://gcn.com/articles/2013/05/28/can-active-cyber-defense-stay-within-rules.aspx

 

Attacking the attackers: Can active cyber defense stay within the rules?

• By Kevin McCaney
• May 28, 2013

The growing number of cyberattacks on U.S. networks and infrastructure is prompting calls for a more aggressive response, particularly for those attacks involving espionage and the theft of intellectual property.

And in at least one case, more forceful responses could become policy. The Joint Chiefs of Staff is about to OK new standing rules of engagement (SROE) that would allow the military to strike back at attackers without, as it does now, first getting approval from the National Security Council, according to a report in Defense News.

The new rules, in the works since 2010, signal a more aggressive stance that military sources say is essential to combatting attackers in the cyber domain, the report said. But because the SROE is classified, there were no details on what steps military commands could take.

Meanwhile, an independent commission studying the theft of U.S. intellectual property, considered among the biggest cyber threats, is recommending a couple specific steps — that companies and organizations essentially steal back stolen files and develop other ways to prevent information from being taken in the first place.

The Commission on the Theft of American Intellectual Property, a panel co-chaired by former Ambassador to China John Huntsman and Jon Huntsman Jr. and former Director of National Intelligence Dennis Blair, and including former Deputy Defense Secretary William Lynn III, said in a report that: “Without damaging the intruder’s own network, companies that experience cyber theft ought to be able to retrieve their electronic files or prevent the exploitation of their stolen information.”

The commission says that files can be protected by meta-tagging, beaconing and digital watermarking techniques, which could alert organizations if files had been taken from an authorized network and potentially allow those organizations to find where they’ve gone.

The report also suggests writing software that not only prevents an authorized user from opening a file, but which could lock down the thief’s computer, leaving him with instructions on how to contact law enforcement agencies to unlock the account. The idea is to make stealing information more trouble than it’s worth.

“Such measures do not violate existing laws on the use of the Internet, yet they serve to blunt attacks and stabilize a cyber incident to provide both time and evidence for law enforcement to become involved,” the report says.

The report’s reference to existing Internet laws underscores the ongoing debate over offensive cyber defense, which many security experts say could do more harm than good. Conducting cyberattacks is illegal, and even an attack to retrieve stolen intellectual property or pursue a cyber criminal is complicated by the problems of attribution. Because IP addresses can be spoofed and attacks can be routed through botnets or other servers, it’s difficult to know exactly who is behind an attack. An aggressive response to a cyberattack could wind up wounding innocent third parties.

While acknowledging that some active cyber defense tactics are currently against the law — the report mentions, without recommending, tactics such as photographing a hacker with his PC’s camera, infecting his network or destroying his computer — the commission argues that a new approach is needed. The report estimates annual loses of U.S. intellectual property to be comparable to $300 billion, the level of annual U.S. exports to Asia. The authors attribute between 50 percent and 80 percent of the thefts to China.

And although the commission report concentrates on U.S. commercial interests, its concerns extend to government systems. Many of the most targeted industries involve government contractors and critical infrastructure, and agencies have long been a target of foreign hackers.

Most recently, the Washington Post, citing a confidential report prepared for the Pentagon, said that Chinese hackers had compromised designs for some of the U.S. military’s most sophisticated weapons, including missile defense systems, the F/A-18 fighter jet, V-22 Osprey, the Black Hawk helicopter, the Navy’s Littoral Combat Ship and the F-35 Joint Strike Fighter.

The commission’s report concludes that defensive measures have not kept pace with attacks. “Almost all the advantages are on the side of the hacker; the current situation is not sustainable,” the authors write. “Moreover, as has been shown above, entirely defensive measures are likely to continue to become increasingly expensive and decreasingly effective, while being unlikely to change the cost-benefit calculus of targeted hackers.”