[Excerpted from] The Active Response Continuum: Ethical and Legal Issues of Aggressive Computer Network Defense

by David Dittrich
May 27, 2013

1  Introduction

There are many challenges facing those who are victimized by computer crimes, who are frustrated with what they perceive to be a lack of effective law enforcement action to protect them, and who want to unilaterally take some aggressive action to directly counter the threats to their information and information systems. This has been called active defense, aggressive self-defense, counter-attack, and even hacking back. We will look at the reasons why someone would want to take such actions, discuss the options, acknowledge the risk and benefit tradeoffs, and even suggest how aggressive actions can be taken in a manner that is safe, controlled, and justifiable (as best this can be accomplished). It is drawn from many sources, including previously published and unpublished manuscripts, articles, white papers, and tech reports.

1.1  Defining the Terms of the Debate

The discussion of what is or is not ethical, or legal, in aggressive responses to computer network attack is perhaps made most difficult due to disagreements about semantics. The first paragraph in this chapter used four of the most common terms, each of which can be interpreted by two different people as having diametrically opposed meanings.

To have meaningful discussion of such complex and potentially harmful activities, it is helpful to start with clear definitions of terms and to use them consistently – or at least clearly define the way they will be used if and when a speaker holds a different definition in their mind – in order to avoid needless debate, or worse, to mislead the listener into going along with a decision they otherwise would not take.

These terms, derived with input from some of the voices of reason in the computer security field (Thanks to Aiden Riley Eller, Rik Farrow, Dan Farmer, Dan Geer, David Kane-Parry, John McDonald, Ryan Permeh, and Frank Rieger, for their feedback), are presented in alphabetical order and cross-reference each other as appropriate.

Active Defense
The term active defense, while a popular phrase, is problematic from many perspectives. It combines the terms active (meaning to engage, as opposed to its antonym passive) and the term defense (implying defending from or reacting to an attack). Some have included honeypots in their definition of active defense, when this is actually a passive technology in which you simply observe an attacker, while others consider a preemptive active defense to be morally equivalent to the opposite of passivity (i.e., offense, as in “the best defense is a good offense.”) It often shows up in arguments in the form of the logical fallacy known as a false dichotomy as in, “you can sit there and do nothing, or you can actively defend yourself.” Advocates who use language suggesting striking or fighting back when attacked further confuse the issue and degrade the utility of this term (see also Retribution). What is more, to someone who was in the military in the 1990s, this term invoked a special negative connotation that made their involvement in discussions about this topic in the early 2000s problematic.
Active Response Continuum (ARC)
During the very first Agora workshop on this topic it became clear that a richer term than Active Defense was needed that clearly and concisely embodies the three salient attributes at the heart of understanding the active measures in responding to computer network attacks that fall along a continuum. From this workshop the attendees teased out the term Active Response Continuum, which was first defined publicly by Dittrich and Himma in 2005 [DH05], accompanied by descriptions of levels of Response Capacity, and Aggressiveness, the key concept of acting cooperatively vs. uncooperatively with involved parties, and the ethical principles and their application useful in justifying taking uncooperative actions outside of one’s zone of authority. None of the other popular terms – hack back, active defense, strike back, aggressive self-defense, or even self-help – embody the full complexity of the topic, and in some cases only represent the most extreme end of the Aggressiveness spectrum.
Aggressive Self-Defense, Aggressive Network Self-Defense
These terms have been used to describe only the most aggressive or risky activities along the Active Response Continuum. The word aggressive is not sufficiently rich to clearly delineate which actions are or are not ethically justifiable, and in some cases cooperative actions at ARC Level 3 could be called “aggressive.” The sub-term self-defense also suffers from similar problems as the term self-help.
See Cyber Attack.
Inserting content into a media file or document that causes it to connect back to a system controlled by the party who inserted it in order to establish a feedback loop as to when and from where the document is opened is known as a beacon. This can range from inserting a URI for an image (e.g., a business logo), which does nothing but request a file from a specific server, all the way up to use of an exploit that takes full control of the computer. Thus the act of beaconing cannot be the deciding factor as to legality or ethics, but rather the mechanism chosen for implementing the beacon and its aggressiveness (or level of risk), and what else is done after the beaconing is performed (such as taking full remote control of a system outside one’s zone of authority or ownership, turning on the computer’s camera and taking a photograph of the person using the computer [Osb12] as seen in Figure 1.1, which goes far beyond simple beaconing). So while a beacon and a marker are both things inserted into a document, the beacon is an active measure whereas a marker is passive.

Figure 1.1: Screen shot of suspected intruder from [CER]

Collateral effect
The military defines this term as, “unintentional or incidental effects including, but not limited to, injury or damage to persons or objects that would not be lawful military targets under the circumstances at the time. Includes effects on civilian or dual-use computers, network, information, or infrastructure. Such effects are not unlawful [under the Laws of War] as long as they are not excessive in light of the overall military advantage anticipated from the activity [Car10].” A range of effects, similar to the ARC Levels of Aggressiveness, is included (No, Low, Medium and High). The military attempts to minimize collateral effects through two related concepts: Weapons Control Status (WCS) and Warning Status (WS).

WCS imposes a “degree of fire control” that ranges from (least to most restrictive) [Car10]:

WS is, “determined by Combatant Commander to identify threat and support implementation of appropriate Rules of Engagement (ROE). Standard WS levels are:

  1. White: Attack by hostile forces is improbable without adequate warning;
  2. Yellow: Attack by hostile forces is probable; and
  3. Red: Attack by hostile forces is imminent or is in progress.

In the miltary context, “WS and WCS are paired to provide awareness of and control of operations.” [Car10] In the civilian context there exist no equivalent mechanisms, even though similar issues with collateral effects exists (i.e., there is a range of potential unintentional or incidental harms, as well as the conditional “not excessive” applying to the actions being taken, neither of which can be determined without performing a comprehensive stakeholder analysis and being able to clearly articulate the objectives, alternatives, proportionality, and necessity, of any potential actions.) Discussions of private sector use of ARC Level 4 actions rarely include any discussion of similar rules of engagement, effectively creating a default of the least restrictive WCS status of Weapons Free, and WS is a subjective assessment that tends to occur during the “in progress” conditional of WS Red.

Computer Network Attack (CNA)
The military defines this term as, “A category of fires employed for offensive purposes in which actions are taken through the use of computer networks to disrupt, deny, degrade, manipulate, or destroy information resident in the target information system or computer networks, or the systems and networks themselves. The ultimate intended effect is not necessarily on the targeted systems itself, but may support a larger [effort.] [Car10].” The same terms “disrupt, deny, degrade, and destroy” are used by individuals in the private sector, sometimes in relation to actions at ARC Level 3 (e.g., cooperative removal of domains being used by spammers), as well as for actions at ARC Level 4 (e.g., destroying the contents of a suspected attacker’s computer in an attempt to increase their costs for deterrent effect.) In both cases, potential for negative collateral effects is present, requiring careful thought and planning. See also Computer Network Defense and Computer Network Exploitation.
Computer Network Defense (CND)
The military has replaced this term with Defensive Counter-Cyber.
Computer Network Defense Response Actions (CND-RA)
See Defensive Counter-Cyber.
Defensive Counter-Cyber (DCC)
The military defines this term as, “all defensive countermeasures designed to detect, identify, intercept, and destroy or negate harmful activities attempting to penetrate or attack through cyberspace. DCC missions are designed to preserve friendly network integrity, availability, and security, and protect friendly cyber activities from attack, intrusion, or other malicious activity by pro-actively seeking, intercepting, and neutralizing adversarial cyber means which present such threats. DCC operations may include: military deception via honeypots and other operations; actions to affect adversary and/or intermediary systems engaged in a hostile act/imminent hostile act; and redirection, deactivation, or removel of malware engaged in a hostile act/imminent hostile act [Car10].” Proponents of unrestricted aggressive response often focus exclusively on “detect, identify, intercept, and destroy or negate harmful activities” while ignoring the part about being “designed to [preserve and protect] friendly network integrity, availability, and security.” Any new authorities granted to private sector actors must include both parts. See also Computer Network Attack and Computer Network Exploitation.
Computer Network Exploitation (CNE)
The military defined this term as, “enabling operations and intelligence collection capabilities conducted through the use of computer networks to gather data about target or adversary automated information systems or networks [Car10].” See also Computer Network Attack and Computer Network Defense. This term has been replaced by Intelligence, surveillance, and reconnaissance [Car10].
Cyber Attack
In addition to the term active defense being problematic in discussions with people in the military, the term cyber attack also has a meaning that differs from the civilian context. According to James Lewis, “A cyber attack is not espionage or stealing intellectual property [Lew10].” This is because the word attack has a specific meaning under the international laws of war [Sch12]. Using the term cyber attack too loosely in the case of intellectual property theft conflates criminal acts and acts of war in ways that can present the potential for private sector entities to accidentally cause escalation from the criminal realm into the military realm. See also Computer Network Attack.
The word detain has two common meanings, one that suggests holding someone in custody until law enforcement can arrive, and the other to deny access or progress. This term has been used by some advocates of uncooperative, aggressive responses to cyber attacks, however it is impossible to accomplish the first definition in the cyber context (nobody actually physically enters a computer system in a way in which they can be held captive.) Asserting the first meaning in argument would be the logical fallacy of Appeal to Emotion (or Appeal to Consequences). At best, there can be some degree of attribution by circumstantial evidence (which can be faked relatively easily in the digital context.) If someone actually means deny access when they say detain, this can be accomplished at ARC Level 3 in most cases, which means it may be unecessary to resort to ARC Level 4 responses except in special circumstances that can be ethically justified under principles such as Defense and Necessity.
Exploit, exploits, exploiting
To exploit a vulnerability means to use it to one’s advantage, in the context of this discussion meaning to bypass access controls and take control of a system. A program or module of program code to perform this task is known as an exploit (plural exploits).
Flexible Deterrent Option (FDO)
The military defines this term as, “A planning construct intended to facilitate early decision making by developing a wide range of interrelated responses that begin with deterrent-oriented actions carefully tailored to produce a desired effect. The flexible deterrent option is the means by which the various diplomatic, information, military, and economic deterrent measures available to the President are included in the joint planning process. (Note: Cyber operations, to include defensive counter-cyber options which if known by an adversary to have the likely effect of rendering his operation ineffective, and that would thereby deter that operation, can be part of the FDO spectrum.)”

The mention of the President, and diplomatic or economic measures, explicitly makes this term apply only to Constitutional government authorities, not the private sector. Language in the private sector context that uses “deterrent” in the same way is often euphemism for retribution, retaliation, punishment, etc., which are not ethically justifiable actions to be taken by private sector entitites.

It is also important to point out two things about FDO. First, the use of the words range and spectrum in this definition are complementary to the ARC Levels and should be understood as beginning with Benign actions before escalating. Second, the concept of FDO does not exist in isolation, but is closely related to Weapons Control Status, Warning Status, and collateral effects. The qualifier “carefully tailored to produce a desired effect” implies that a comprehensive stakeholder analysis is performed, as well as identification of a range of actions and their potential collateral effects, in order to allow a Combatant Commander to appropriately balance desired and undesired outcomes in terms of Necessity, Proportionality, and other factors surrounding the Laws of War. To analogize to the private sector context requires similar comprehensive stakeholder analysis and justification of potential actions based on ethical principles.

In this context, a hacker is someone who engages in hacking, be it for good reasons or for bad. The meaning of the term hacker in the context of computer technology and computer security have both changed over time. Facebook uses the term to mean “creative coding,” which is in line with its original meaning. The term has different meanings in other contexts (e.g., in golf, it means an average golfer, and on one travel site, it means a round-trip flight itinerary derived by booking two or more one-way fares.)
The intentional exploitation of a computer system or program to achieve results unintended by the owner is often called hacking. This use of the word denotes willful use of technical means to overcome obstacles both natural and man-made. The technical means are often derived from reverse engineering the algorithms and or implementation details of the system and identifying vulnerabilities that can be exploited in order to achieve the goals of manipulating the system to the hacker’s chosen ends. In the early days of computing, hacking and being a hacker were badges of honor and illustrated mastery of an emerging and opaque technical discipline.

The context for the discussion in this book involves malicious and harmful attacks that warrant a response beyond simply installing defensive measures and letting them perform their function. A criminal hacker is one who exploits a computer system, program, or even the human’s using these systems and programs, to further profitable activities like unsolicited email, money laundering, industrial espionage, or identity theft. The targets could be personal computers or enterprise assets.

Hack back
When the target of a criminal hacker, or an agent acting on the targets’ behalf, decides to turn the tables, she may be said to be hacking back. This is an exceptional case of hacking because the target of an attack initiates the relationship with the attacker or attacker’s malware system, but none the less using an exploit against vulnerabilities (or even stolen attacker credentials) to take control of an attacker’s infrastructure is hacking back.

Noting that some criminal hackers will target a huge class of machines, security experts may deploy false networks instrumented to observe the attacker in detail. These honeypots may then be used to analyze vulnerabilities in the attacker, synthesized into a counterattack, and delivered through the attacker’s own connection. So the perpetrator of a hack back may be a human or possibly even an automated process [Hig13].

Hacking back is a technique, not a classification, and can fall into either or both ARC Levels 3 and 4 (depending on whether it is part of cooperative or benign action, such as the sinkholing of Conficker domains, or uncooperative or aggressive action, such as inserting an exploit into a document that when viewed by an attacker wipes clean the entire hard drive contents on the system from which it is viewed.)

The act of hacking itself is often subtle, sophisticated, and may barely be detectable. The aftermath, however, can involve devastating destruction (as was seen in the attacks on Saudi Aramco in August, 2012 [Hig12]). What matters then in terms of the Active Response Continuum is not the fact that hacking back is involved, but rather what are the intentions for hacking back, what are the effects, and is the actor hacking back capable of justifying their choices on ethical and legal grounds.

This term, in the computer security context, was defined by the Honeynet Project1 , as an information system resource whose value lies in unauthorized or illicit use of that resource. Use of this term has been extended from servers (which are often passive and must be sought out by attackers) to clients (which by their nature are active and initiate communication with other systems, such as with browser exploit kits like Blackhole and Cdorked [UnsBur13Uns11Bue11Fis11]), but the definition above still holds true regardless of the passive vs. active distinction. Honeypots are often used as instruments in reverse engineering and monitoring, and can be automated to hack back [Hig13]. Such automated hack back mechanisms are extremely risky as there is no human decision making, nor any qualitative evaluation at all, increasing liability for negative collateral effects.
A marker, similar to a hidden watermark, is unique data that allows tracing the provenance of a document by verifying the presence of the marker in a copy of the document. A technique for hiding data, known as steganography may be used to attempt to conceal the marker from anyone examining the document. If a specially crafted unique copy of a document containing a unique marker is stolen, it may be possible to obtain a copy from someone suspected to have obtained the stolen document and by verifying the presence of the marker, can infer that suspect obtained the copy from (or may actually be) the party who stole it. In all cases, a marker is a purely passive technique (as opposed to a beacon).
The act of collecting data from within, or communications flows between, information systems, in this case for the purpose of protecting, detecting, or reacting to attacks on information and information systems. The act of collecting this data implicates many laws. In the United States, these include: privacy of stored communications, communication metadata, or contents of communications as defined by the Electronic Communications Privacy Act (ECPA); unauthorized use of protected computers under the Computer Fraud and Abuse Act (CFAA); various trespass statutes; as well as equivalent laws at the state or other local jurisdictional level. The use of honeypots, for example, may raise content of communications collection concerns under one or both of the Wiretap or Pen-Trap sections of ECPA. The act of monitoring cannot be the deciding factor as to legality or ethics, as some exceptions apply to certain laws, however the complexity of routing communications through multiple systems, combined with actions that involve monitoring on systems outside of one’s zone of authority (and possibly without knowledge or consent of the owner of those systems) makes evaluating monitoring activities quite complicated and case-specific.
The end goal of reverse engineering is to know the implementation of a computer system or program so well that vulnerabilities can be identified and new program code written to exploit those vulnerabilities, or hack the system. While reverse engineering is the first necessary step in hacking, actually taking control of a system (e.g., sinkholing the distributed attack agents in a botnet by poisoning their poison peer lists using a specially designed command and control server) requires taking the next difficult step of re-engineering the command and control protocol, bypassing protections, etc., in order to obtain desired effects.
To pay back a hurtful act with another hurtful at (taking an eye for an eye, a tooth for a tooth) is retaliation. While this may satisfy the ethical principle of proportionality, it fails the ethical principles of retribution and punishment. Retaliation is synonymous with strike back, revenge, and other emotional responses to being attacked. It is often combined with self-defense rhetoric and false analogies to fighting, being attacked on the street, boxing matches, etc., which is a form of logical fallacy known as Appeal to Emotion.
Someone who believes they are morally right and fully justified in punishing another who they believe has done them wrong is engaging in retribution. Retribution is taking justice into one’s own hands, bypassing the courts (who in the United States are Constitutionally empowered to make judgments of guilt or innocence, and render punishment when guilt is determined by due legal process). Punishment is not an ethically justifiable act for private citizen’s to engage in within the United States’ system of Constitutional justice and is unacceptable as a response to computer network attack (regardless of how angry or frustrated a victim may be.) Language that exhibits a retributive motivation is often used by advocates of aggressive network defense is usually easy to spot, and in arguments shows up as the logical fallacy known as Appeal to Emotion (specifically, an Appeal to Consequences).
See retribution and retaliation.
Reverse engineering
The act of taking something apart to understand how it is constructed, identify vulnerabilities, modify it to serve a new purpose, or fix it without requiring instructions from its manufacturer, is known as reverse engineering. The ultimate product of reverse engineering can be a design inferred from observation of something’s construction as opposed to getting the plans from the person who originally engineered it. Reverse engineering is often used to learn how an attacker’s tools work in order to counter them, so just like hacking, it is a neutral term that comes down to final intent as to whether it is beneficial or harmful. Laws, such as the Digital Millenium Copyright Act (DMCA), [Con98] have implications for reverse engineering in terms of circumvention of technological protection mechanisms.
The term self-defense applies to human beings, protecting themselves (and sometimes others) from physical harm. When used in the context of Stand your ground style laws, this includes use of deadly force. In the context of computer network attack, this same kind of protection of life scenario is extremely rare, but does exist and must be addressed equally in both discussion of justifications for taking aggressive and risky actions at the upper end of ARC Level 4 as well as explanation of mitigating those potential harms that may result from those actions. When modified by the word aggressive, it clearly suggests the more risky end of the spectrum in terms of ARC Level 4 actions. If there is no risk to life from a computer network attack, but instead only theft of intellectual property or other financial crimes, great care must be taken when engaging in arguments based on notions of self-defense to avoid the logical fallacies of irrelevant appeals, such as the appeal to pity. When discussing property crimes, these arguments may be more appropriately framed in terms of trespass.
Some advocates of uncooperative, aggressive responses to computer attack, usually independent of law enforcement involvement (or instead of reporting to law enforcement at all) use the term self-help as a synonym for self-defense. Self-help implies that no other help (i.e., from law enforcement or other government agencies) is available and that the only option is to take matters into one’s own hands. There are times when this may be true, but in such situations the responsibility to be able to clearly articulate justification of Necessity (at minimum) is raised. The term self-help may become meaningless when a third-party is engaged to act on a victim’s behalf, in which case the word self loses its common meaning altogether. In most cases, self-help is a euphemism for acting outside of criminal legal process without the involvement of law enforcement, in other words bypassing ARC Level 3 (cooperative response) and going straight to the higher end of ARC Level 4 (uncooperative response).
This is the art and science of hiding information as part of some object such that the information is concealed from the veiwer. Simon Singh, in “The Code Book,” [Sin99] describes an early example of steganography involving shaving someone’s head, tatooing a message on the scalp, then waiting for the hair to grow back. The message is then concealed from view until the scalp is again shaved. Steganography is meant to hide information (such as a message, not necessarily another image) in ways that are not visible to the eye, unlike a watermark that is intended to be easily viewable. Steganography is also a purely passive technique.
Strike back
See Retaliation. The use of the word strike in the context of the Active Response Continuum suggests the extreme end of spectrum of aggressiveness and risk and thus demands a correspondingly greater degree of transparency, explanation of actions (and resulting risks), as well as justifications for actions taken under this banner.
In the context of this discussion, a vulnerability is a flaw in program logic, a specific implementation of programming logic in code (e.g., not checking to see if an input buffer’s contents exceed the length of a variable in a computer’s memory), or a weakness in a human’s ability to detect when an attack is being directed to them (e.g., a phishing email asking for someone to provide their password, or to open an attachment that contains an exploit directed at the operating system or applications on the computer the target of the phishing attack is currently using.)
A watermark is a purely passive alteration of a digital file, usually adding an image to another image or rendered document, that visibly identifies the source or authenticity of the document. Commonly known forms of watermarks are found on bank notes and checks. There are several watermarks of the number “5” in the blank areas on the right hand side and between the Federal Reserve System seal and the portrait of President Lincoln, on some U.S. Five Dollar bills (e.g., Series 2006) that are only visible when the bill is held in front of a light source. The word “VOID” will show up on black and white photocopies of some checks printed with subtle colored dot patterns. Digital photographic images often have a copyright statement or the photographer’s name integrated into the image such that it is difficult (if not impossible) to remove without destroying the image itself. Even more subtle mechanisms for digitally marking documents exist (see Marker).


[Bue11]   Pedro Bueno. Updates on ZeroAccess and BlackHole front... http://isc.sans.edu/diary.html?storyid=12079, November 2011.

[Bur13]   Pierre-Marc Bureau. Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. http://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/, April 2013.

[Car10]    James E. Cartwright. Joint Terminology for Cyberspace Operations. http://www.projectcyw-d.org/resources/items/show/51, November 2010. Vice Chairman for the Joint Chiefs of Staff.

[CER]   CERT.GOV.GE. CYBER ESPIONAGE Against Georgian Government (Georbot Botnet). http://dea.gov.ge/uploads/CERT%20DOCS/Cyber%20Espionage.pdf.

[Con98]   United States Congress. Digital Millenium Copyright Act, 1998. www.copyright.gov/legislation/dmca.pdf.

[DH05]   David Dittrich and Keneth E. Himma. Active Response to Computer Intrusions. Chapter 182 in Vol. III, Handbook of Information Security, 2005. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=790585.

[Fis11]   Dennis Fisher. Black Hole Exploit Kit Available for Free, May 2011.

[Hig12]   Kelly Jackson Higgins. Shamoon, Saudi Aramco, And Targeted Destruction. http://www.darkreading.com/attacks-breaches/shamoon-saudi-aramco-and-targeted-destru/240006049, August 2012.

[Hig13]   Kelly Jackson Higgins. Honeypot Stings Attackers With Counterattacks. http://www.darkreading.com/vulnerability/honeypot-stings-attackers-with-counterat/240151740, March 2013.

[Lew10]   James Lewis. The Cyber War Has Not Begun. http://csis.org/files/publication/100311_TheCyberWarHasNotBegun.pdf, March 2010.

[Osb12]   Charlie Osborne. Georgia turns the tables on Russian hacker. http://www.zdnet.com/georgia-turns-the-tables-on-russian-hacker-7000006611/, October 2012.

[Sch12]   Michael N. Schmitt. Tallinn Manual on the International Law Applicable to Cyber Warfare. http://the-beacon.info/blog/wp-content/uploads/2011/03/Tallinn-Manual-on-the-International-Law-Applicable-to-Cyber-Warfare-Draft-.pdf, December 2012. Prepared by the International Group of Experts at the Invitation of The NATO Cooperative Cyber Defence Centre of Excellence.

[Sin99]   Simon Singh. The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography. Doubleday of New York, ISBN 0-385-49531-5, 1999.

[Uns]    Unspecified. Black Hole Exploit Kit 1.0.2. http://www.airdemon.net/blackhole.html.

[Uns11]   Unspecified. Deconstructing the Black Hole Exploit Kit. http://blog.imperva.com/2011/12/deconstructing-the-black-hole-exploit-kit.html, December 2011.