{
"authors": [
"Wyatt Hoffman",
"Ariel (Eli) Levite"
],
"type": "other",
"centerAffiliationAll": "dc",
"centers": [
"Carnegie Endowment for International Peace"
],
"collections": [],
"englishNewsletterAll": "ctw",
"nonEnglishNewsletterAll": "",
"primaryCenter": "Carnegie Endowment for International Peace",
"programAffiliation": "NPP",
"programs": [
"Nuclear Policy"
],
"projects": [],
"regions": [],
"topics": [
"Security",
"Nuclear Policy",
"Technology"
]
}
Source: Getty
The practice of active cyber defense moves the debate over the role of and limits on corporate self-defense in cyberspace beyond the theoretical and into reality.
Source: Lawfare
The recent WannaCry and NotPetya global cyber incidents have fueled the debate already raging over the role of and limits on corporate self-defense in cyberspace. The emerging international practice of “active cyber defense” (ACD) moves this debate beyond the merely theoretical realm. Private sector active defense potentially shifts the balance in favor of defenders and would improve companies’ ability to complicate and disrupt attacks and mitigate damages. Enhancing private sector defense might also deter future attacks by denying gains and imposing costs to attackers, including by making it easier for law enforcement to identify and punish attackers. Cumulatively, the impact could significantly alter the calculus of malicious actors.
However, aggressive active defense measures—including, most controversially, “hacking back” into attackers’ networks—carry significant risks to the defender and innocent third parties. The risk is especially pronounced if the defender is ill-equipped to attribute the attack and control its effects. The potentially systemically destabilizing effects of unrestrained conduct of active defense internationally lead opponents to warn that it is akin to unleashing the “wild west” in cyberspace.
In reality, much of this debate is academic. A nascent international “gray” market for active cyber defense services (including hacking back) already exists. The growth of private sector ACD mirrors a similar development in maritime security: the shipping industry’s adoption of private armed guards in response to the escalating threat from Somali piracy. By the late 2000s, even huge naval deployments were unable to provide sufficient defense to shipping vessels. Private maritime security contractors left many governments struggling to belatedly impose order where little prevented or discouraged the private sector from turning to its own means of defense. But through the combined efforts of ship-owners, maritime insurers, and private maritime security providers, the private sector was to implement a credible and responsible solution that defused the threat.
The same factors that catalyzed the rise of private maritime security contractors are pervading the cyber domain. Rather than continuing to debate whether to allow the practice of ACD, it is time to consider how to responsibly and credibly place ACD in the corporate tool kit. Wherever possible, this approach should draw on established private sector self-regulation mechanisms, including insurance-based solutions.
In a recently released report by the Carnegie Endowment’s Cyber Policy Initiative, we acknowledge that ACD is not a panacea, but submit that it would be a valuable addition to both international and corporate security. Its value is contingent on the creation of principles and requirements to manage the practice of active cyber defense. Consider the follow few examples.
First, the private sector should be allowed to employ only a limited spectrum of active cyber defenses. Measures carrying unacceptable risk, such as destructive hack backs, should be impermissible. The acceptable purposes of ACD activity should be similarly circumscribed to defense and mitigating damage, instead of retribution.
Second, only competent and qualified defenders should undertake active cyber defense. Legitimate ACD could be gauged to an organizations’ maturity level through a variety of means including a professional accreditation system.
Third, flexible mechanisms are needed to incentivize principled ACD conduct by the private sector. Cyber insurance is well-suited to play a role in an industry-driven approach to regulating private sector ACD based on the maturity level of the practitioners.
Fourth, whatever balance is struck, principles must work toward international harmonization. Uneven approaches between countries may disadvantage those attempting to promote norms of restraint and reward those who disregard them (while raising serious extradition issues).
Finally, our report underscores the risks inherent in the U.S. going it alone. Continuing to prohibit private sector active cyber defense entirely leaves law-abiding corporations vulnerable while rewarding those that circumvent restrictions or outsource active defense services. On the other hand, creating an overly permissive environment without international norms could increase tensions with other countries, including by opening the door to criticism that the U.S. is promoting vigilantism. We should not forget the striking lessons from several traumatic centuries of privateering before the maritime domain was pacified. The U.S. would be well-advised to adopt a cautious, evolutionary approach to the ACD domain – harmonized internationally and tailored to experience and evolving technology.
Wyatt Hoffman
Former Senior Research Analyst, Cyber Policy Initiative
Wyatt Hoffman was a senior research analyst with the Nuclear Policy Program and the Cyber Policy Initiative at the Carnegie Endowment for International Peace.
Senior Fellow, Nuclear Policy Program, Technology and International Affairs Program
Levite was the principal deputy director general for policy at the Israeli Atomic Energy Commission from 2002 to 2007.
Carnegie does not take institutional positions on public policy issues; the views represented herein are those of the author(s) and do not necessarily reflect the views of Carnegie, its staff, or its trustees.
When the U.S.-Iran memorandum of understanding was announced, the UK, France, Germany, and Italy declared their readiness to help demine the Strait of Hormuz and lift nuclear sanctions on Tehran. But does Europe need new tools to recover a diplomatic role?
Rym Momtaz, ed.
The Franco-German relationship is on the rocks again. But unlike previous moments of tension, the epochal changes on the world stage require that both step up investment in their bilateral ties.
Rym Momtaz
The EU is putting together a new security strategy to meet today’s myriad challenges. But for any proposal to be effective, the union needs to grapple with its identity and ambitions.
Pierre Vimont
Amid uncertainty caused by the Iran war, the global drive for nonproliferation has stalled. With Europe diplomatically marginalized and countries reassessing their nuclear options, efforts to curb the spread of nuclear weapons risk becoming irrelevant.
Jane Darby Menton
Between the United States’ market-driven approach and China's state-led industrial strategy, Europe is reckoning with how it can remain competitive in the global economy. But is Europe in danger of becoming a U.S. or China colony?
Noah Barkin, Anu Bradford