Featured Research

from universities, journals, and other organizations

Active self-defense strategy best deterrent against cyber-attacks

Date:
June 28, 2011
Source:
University of Illinois at Urbana-Champaign
Summary:
With the threats of cybercrime, cyberterrorism and cyberwarfare looming over our hyper-connected world, the best defense for the U.S. might be a good offense, says new research by an expert in technology and legal issues.

With the threats of cybercrime, cyberterrorism and cyberwarfare looming over our hyper-connected world, the best defense for the U.S. might be a good offense, says new research by a University of Illinois expert in technology and legal issues.

Law professor Jay P. Kesan warns that an active self-defense regime, which he terms "mitigative counterstriking," is a necessity in cyberspace, especially to protect critical infrastructure such as banking, utilities and emergency services.

"The threats from cyber-attacks are real, and the harm of a potential attack can be far greater than what we can currently combat," Kesan said.

Kesan's analysis, co-written with former U. of I. law student Carol M. Hayes and published in a forthcoming issue of the Harvard Journal of Law and Technology, concludes that mitigative counterstriking against attacks instead of simply relying on passive defense options (firewalls, patches and anti-virus software) is legally justifiable as self-defense, although a more exhaustive legal framework needs to be implemented.

"The principles of mitigative counterstriking are legally justifiable under several areas of domestic and international law, and can be made consistent with other areas of law by amending or reinterpreting the law," he said.

Kesan says an active defense regime consists of three distinct elements: detecting intrusions, tracing the attack back to the attacker, and executing a counterstrike.

A counterstrike can be characterized in one of two ways: retributive counterstrikes, which punish the attacker; and mitigative counterstrikes, which minimize the damage to the victims' information-technology infrastructure.

According to the authors' study, there currently is no effective domestic or international legal apparatus to deter cyber-attacks. Criminal law enforcement is complicated by the lack of a consistently enforced international law, jurisdictional issues and the difficulty of identifying an attacker in a manner specific enough to justify criminal prosecution. Resorting to civil litigation would likely be slow and impractical.

"Cyber-attacks are fundamentally different from crime," Kesan said. "The person may be physically very far away from you, and you may not be able to use traditional legal remedies against that person, since civil and criminal remedies require jurisdiction over a person. In those circumstances, what do you do?"

Kesan suggests that a government-affiliated agency, preferably a public-private partnership, should be responsible for an active defense program, including providing resources for private parties to detect and trace intrusions, and executing counterstrikes.

"We're at a particularly interesting moment in time because the technologies available to do this are getting better," Kesan said. "Trace-route and trace-back technologies -- where we pinpoint where certain intrusions are coming from, even if they're going through intermediaries -- are getting better. The swiftness of the technologies is getting better, which itself might be a deterrent."

Kesan says the confluence of better technology and inadequate legal protection provides a unique opportunity to think through the issues associated with creating new legal policy.

"Obviously, some sort of self-defense in cyberspace is justifiable," he said. "But how far do we go? Do we just block packets, or do we send them back? That's something we need to think carefully about."

Active defense, however, has been and continues to be a controversial subject. Kesan says the reason the government has been tentative is that, in some quarters, an active defense is viewed as tantamount to vigilantism. It also carries the risk of inflicting significant collateral damage.

"There will be consequences to engaging in that kind of conduct, so we don't want to take actions that are perceived as being lawless or could potentially cause lots of collateral harm," Kesan said. "Technologies are never 100 percent perfect or foolproof."

But if the U.S. is subject to an attack, "then we should have the ability to enact some measures to at least minimize the damage," he said. "Additionally, I would argue that a system to promote active defense and permit mitigative counterstriking should also include a liability rule to protect innocent third party intermediaries whose systems are compromised by attackers and counterstrikers."

Kesan says it's vital that formal policy is finalized soon, while there is still time for thoughtful deliberation and analysis of all of the potential implications of an attack.

"We rely on our online infrastructure for just about everything," he said. "That represents a good choke point, one that might be an attractive target for people who wish to do harm to us. If they were successful, it would have the potential to cause a great deal of economic hardship. That's why we need to be prepared before we are faced with the fallout from an attack."


Story Source:

The above story is based on materials provided by University of Illinois at Urbana-Champaign. Note: Materials may be edited for content and length.


Cite This Page:

University of Illinois at Urbana-Champaign. "Active self-defense strategy best deterrent against cyber-attacks." ScienceDaily. ScienceDaily, 28 June 2011. <www.sciencedaily.com/releases/2011/06/110627184002.htm>.
University of Illinois at Urbana-Champaign. (2011, June 28). Active self-defense strategy best deterrent against cyber-attacks. ScienceDaily. Retrieved October 22, 2014 from www.sciencedaily.com/releases/2011/06/110627184002.htm
University of Illinois at Urbana-Champaign. "Active self-defense strategy best deterrent against cyber-attacks." ScienceDaily. www.sciencedaily.com/releases/2011/06/110627184002.htm (accessed October 22, 2014).

Share This



More Science & Society News

Wednesday, October 22, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

CDC Revamps Ebola Guidelines After Criticism

CDC Revamps Ebola Guidelines After Criticism

Newsy (Oct. 21, 2014) The Centers for Disease Control and Prevention have issued new protocols for healthcare workers interacting with Ebola patients. Video provided by Newsy
Powered by NewsLook.com
Robots to Fly Planes Where Humans Can't

Robots to Fly Planes Where Humans Can't

Reuters - Innovations Video Online (Oct. 21, 2014) Researchers in South Korea are developing a robotic pilot that could potentially replace humans in the cockpit. Unlike drones and autopilot programs which are configured for specific aircraft, the robots' humanoid design will allow it to fly any type of plane with no additional sensors. Ben Gruber reports. Video provided by Reuters
Powered by NewsLook.com
WHO: Ebola Vaccine Trials to Start a in January

WHO: Ebola Vaccine Trials to Start a in January

AP (Oct. 21, 2014) Tens of thousands of doses of experimental Ebola vaccines could be available for "real-world" testing in West Africa as soon as January as long as they are deemed safe in soon to start trials, the World Health Organization said Tuesday. (Oct. 21) Video provided by AP
Powered by NewsLook.com
Urgent-Care Clinics Ill-Equipped to Treat Ebola

Urgent-Care Clinics Ill-Equipped to Treat Ebola

AP (Oct. 21, 2014) Urgent-care clinics popping up across the US are not equipped to treat a serious illness like Ebola and have been told to immediately call a hospital and public health officials if they suspect a patient may be infected. (Oct. 21) Video provided by AP
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Science & Society

Business & Industry

Education & Learning

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins