A new US bill makes it legal for private companies to hunt hackers.
Specifically, a draft US bill allows victims of a cyberattack to legally pursue suspects.
The law, known as the Cyber Defense Certainty Act (ACDC), gives victims the freedom to track down hackers by breaking into the systems of organizations they suspect malicious users have used to launch attacks.
Often, these organizations may be other companies that are unaware that their computers have been hacked. On the other hand, an existing US law prohibits this type of stalking, which is known as “hacking back.”
Only a few government agencies, like the FBI, have the authority to pursue alleged hackers in this way.
Supporters of the cybersecurity bill, recently introduced in the US Congress, say the FBI and other government agencies are already dealing with many cyberattack, including the ransomware that has paralyzed computer systems in cities like Atlanta and Baltimore and massive data thefts at major companies like the Marriott hotel chain.
Theoretically, providing the ability for businesses and individuals to take the law into their own hands works complementarily to the efforts of organizations.
Fighting back
Tom Graves and Josh Gottheimer, who argue that businesses and other private sector organizations need more freedom to defend themselves, also pointed out that some businesses have already engaged in some forms of digital surveillance and that their bill would clear up the gray area around that.
The proposed legislation would amend an existing U.S. law, the Computer Fraud and Abuse Act (CFAA), to allow businesses and individuals to “respond” to hackers. They could also monitor systems and disrupt their operations.
The bill states that these capabilities should only be used by “experts” who are certain of the attackers’ identities. They must notify the FBI and seek guidance from it before fighting back, and make every effort to avoid damaging third-party systems.
Of course, taking into account the above, the ACDC law has serious shortcomings, namely:
- Most companies do not have the qualifications to “respond” to hackers.
- It is truly difficult to know with certainty who is hiding behind a cyberattack
- The legislation provides no protection or guarantee if the situation becomes uncontrolled
- It is likely that enmities and destructive retaliatory behaviors will arise.
- Companies could find themselves facing nation-states
