Given recent highly publicized cyber-attacks against companies such as Barnes & Noble, Citibank, Sony, Yahoo and Comcast (to name just a few), corporate security officers may be forgiven for wanting to take matters into their own hands by counterattacking (or “hacking back”) into the computer systems of cybercriminals.

There has been a great deal of debate among lawyers, academics and security professionals regarding the legality and effectiveness of hacking back. However, most experts believe that current U.S. law would not permit corporations to employ hacking-back tactics to defend their own systems.

The Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is one of the principal federal laws addressing computer hacking (there are also state anti-hacking and computer trespass laws). The CFAA criminalizes a number of activities, including:

• accessing “protected computers” without appropriate authorization and obtaining any information;
• intentionally damaging protected computers through the knowing transmission of programs, software code or commands; and
• intentionally accessing protected computers without authorization and recklessly or negligently damaging such computers as a result.

The CFAA broadly defines “protected computers” to include computers “used in or affecting interstate or foreign commerce.” If a computer is connected to the Internet, it is a protected computer under the CFAA.

Does hacking back violate the CFAA?

Pretty clearly, the CFAA prohibits outside hackers from gaining unauthorized access to a corporation's system—but how does it address or prevent corporate self-defense or hacking back? First, the statute contains no express self-help provision allowing a victim of a cyber-attack to counterattack. Second, the CFAA is a broadly written statute that would in many cases also criminalize any counterattacks that involve unauthorized access to the computer systems of any third party (or even the hacker). 

For example, suppose a company realizes that its systems have been infected with malware. If the company is able to track the source of the malware, it may decide to counterattack by introducing its own programs into the attacking systems. Those programs could then be used to monitor the attacking system, communicate back information to the counter-attacker or shut down the attacker's system. The problem with such a defense is that it likely violates the clear language of the CFAA as, in our example, such defense involves accessing another computer without authorization and either obtaining information or potentially damaging the attacking computer through the introduction of unauthorized programs.

Of course, as a practical matter, legal authorities may be reluctant to prosecute a victim's counterattack on a criminal's computer. It also is true that the CFAA authorizes civil actions in certain instances, but it is hard to imagine that a criminal with unclean hands would be able to succeed in civil suit against a victim that chose to defend itself.

Unfortunately though, cybercrime often involves a criminal taking over the machines of other innocent parties. The criminal then uses this network of captured machines (or “botnet”) to undertake further attacks. Any company defending itself by hacking back into this botnet would likely find itself in danger of creating collateral damage on machines that innocent third parties own. In addition to potential criminal liability, the counter-attacker may also find itself facing the risk of civil claims from such third parties whose systems were inadvertently accessed as a result of the hack-back.

Concluding thoughts

Given the lack of any currently existing hack-back safe harbor to the CFAA's statutory prohibitions, companies should avoid taking any active self-help cyber defense activities that would result in them accessing (or introducing computer programs or code) into computer systems that other parties own or operate.