Active Response Continuum Research Project

Project members and collaborators

• David Dittrich, University of Washington Information School
• Ken Himma, University of Washington Information School
• Marc Lampson, University of Washington Information School
• Ivan Orton, King County Prosecutor's Office
• Alisha Ritter, Seattle University Law School (externing to King County Prosecutor's Office)
• John Christiansen, Preston Gates Ellis, LLC
• Dave Cullinane, International President, ISSA
• Laurie Leer, Premera
• Kirk Bailey, City of Seattle
• Ray Lewis, Cisco CIAG
• Mike Schiffman, Cisco CIAG
• Darrin Miller, Cisco CIAG

Terminology

• Glossary of Information Warfare terms
• NCSC-TG-029: Blue book (NCSC & DoD Rainbow series -- See Appendix A) [PDF version]
• CNSS Instruction No. 4009: National Information Assurance (IA) Glossary
• (The DoJ has their own lexicon of Active Defnse terms: We are attempting to get a copy.)

Project related documents

• Narrative describing project goals, milestones, and deliverables (Updated 09/02/03)
• Outline of technical framework for active defense
• Outline of technical framework for active defense (Power Point slides)
• Notes from meeting at Preston Gates Ellis, 07/18/03
• Private resources

Post-Agora AD Workshop, September 12, 2003

• Summary of Workshop presentations and discussion
• Background: Framework of Active Defense (PDF) (MP3 Audio, Power Point)
• Notes taken by Alisha Ritter during the workshop
• The Ethics of Active Defense, by Ken Himma (Power Point Slides)
• Results of survey of UW network administrators re: Active Defense responses to worms, compiled by Marc Lampson
• Active Defense Scenario first documented by John Christiansen
• Suggested Reading List for Agora Active Defense Workshop
• Slides from the first Agora meeting on Active Defense, June 8, 2001 (Power Point)
• Audio from 09/12/03 workshop
• Resources mentioned by participants at the workshop
  • Statutes re: use of force in defense of property (c/o Ivan Orton)
    • 9 GCA: Crimes and Corrections, Chapter 7 (See Section 7.90: Force in Defense of Property: Defined and Allowed)
    • Judges and Legislatures in 21st Century Torts: Integrating Cases and Statutes, by David W. [Jake] Barnes, Seton Hall University School of Law, (See pp. 2-4)
    • State of South Carolina v. Jeffrey M. Thompson, South Carolina Supreme Court opinion 25459 (Use of force against fur bearing animals)
    • Bear Shootings under fire, by Stefan Hard, Times Argus, July 25, 2003 (Laws re: use of force against moose more specific than laws re: use of force against bears)
  • Private Intrusion Response, by Stevan D. Mitchell and Elizabeth A. Banker, 11 Harvard Journal of Law & Technology 699 (Spring 1998) (.pdf) [brief of article (.pdf)]
  • GAO-04-140T: Critical Infrastructure Protection: Challenges in Securing control Systems (SCADA system security)
  • The "Invita" (Russian hackers) case
    • Lawyers slam FBI 'hack', by Robert Lemos, ZDNet News, May 1, 2001
    • Judge OKs FBI hack of Russian computers, MSNBC, May 30, 2001
    • 'Stung' Russian Hacker Guilty, by Michelle Delio, October 17, 2001
  • Sarbanes-Oxley Public Comany Accounting Reform and Investor Protection Act
  • Health Insurance Portability and Accountability Act (HIPAA)
  • The BITS Financial Services Roundtable
  • 1994 Rome Labs breakin incident

Presentations/Panels

American Bar Association Annual Meeting, Atlanta, 8/04

Panel: "Self Help on the Internet: The Law, Ethics and Tactics of Hacking Back Against Computer Attack"
John R. Christiansen, David Dittrich, Kenneth Einar Himma, Ivan Orton, and Jody Westby

IEEE Information Assurance Workshop, US Military Academy, West Point, 6/11/04

Panel: "Proactive Defense
Tom King, Bill Caeli, Bill McCarty, and David Dittrich

Continuing Legal Education Seminar, King County Bar Association, 11/14/03

Presentation on Computer Security
John Christiansen

CYBERCRIME III, King County Bar Association, 11/21/03

Panel: "Actively Defending Against Security Breaches: Is it Legal to 'Hack Back?' Is it Ethical? Is it Smart?"
David Dittrich, John Christiansen, Ken Himma

Society for the Policing of Cyberspace (POLCYB) International Conference, Richmond, BC, Canada, 11/01/03

Keynote Address: "Honeypots, Honeynets, Active Defence and Changes in Thinking about Cybercrime"
David Dittrich

SecureWorld Expo, 9/25/03

Panel: "Active Defense"
David Dittrich, John Christiansen

I4 meeting, 3/03

What if you hit back? Counter-intelligence and Counter-attack
David Dittrich (pre-dates this project)

References to this research

• Fighting Internet Worms With Honeypots, by Laurent Oudot, SecurityFocus Online, October 23, 2003

Acknowledgement