Managing The Legal Risks Of Active Defense

Legal considerations must come to bear in risk management calculations made with regard to implementing active defense measures with IT security practices

As increasingly more organizations deliberate adding active defense strategies to their IT security practices, theyll need to consider the risk management baggage that accompanies these aggressive maneuvers. One of the top risk considerations to factor into a decision about active defense activities should be legal concerns, according to a cyber law expert who last week at Black Hat outlined the legal ramifications of a number of common active defense scenarios.
Among the highlights, Robert Clark, distinguished professor of law for the Cyber Operations Center for Cyber Security Studies at the US Naval Academy, recommended that enterprises bear in mind two important points. First, that the right to protect property is not unlimited—in the physical world, for example, one cant kill someone who has stolen their stuff. And, second, that if IT risk managers are contemplating going down the path of active defense they should be involving their attorneys early and often in the decision-making process.
If youre going to do this, youre going to need a great team of lawyers, or at least one really great lawyer, to handle this for you, said Clark, who said he was speaking in a personal capacity as a cybersecurity law expert. Explain the technology to them at a third-grade level so that they can turn to senior leaders or judge and jury to explain it at a first-grade level.
Clark detailed some of the legal aspects of common active defense situations, including the legal pitfalls of seeding networks with deceptive information or decoy honeypots. For example, if an organization sets up fake internal documents with no intent for them to be made public but they are nevertheless stolen and sent to the media these seemingly legitimate documents could be confused as public disclosure to the Securities and Exchange Comission (SEC).
If Im the SEC and I see the documents coming out there, I can tell you, Im going to be knocking at your door. And your shareholders are going to be knocking at your door as youre sitting there trying to explain it is part of a deception plan, he said. Thats why you have to get your SEC lawyers involved when youre having this discussion of what you want to do.
Even more common, though, are the situations Clark went over with regard to recovery of stolen intellectual property or other sensitive data when an organization can locate where the data is housed outside of the network. Every scenario is different, but he advised his audience that the law will likely look more favorably if the organization has done everything it can on the prevention side before it takes an intrusive measure against an antagonist.
The law favors prevention over post-trespass recovery, he said. Also, the courts are likely to consider whether an organization is supposed to be where it is from a permissions standpoint, using the real-world analogy of sitting in a bar frequented by a competitors executives versus using a hidden microphone in a private office.
So, there would be a lot more grey area to work around if an organization erased data from an anonymous FTP server with open privileges than if they escalated privileges or broke into an attackers private machine. Meanwhile if an innocent and unknowing third partys machine is being used to host data, the organization would likely have no legal standing to simply go in and act , but they could ask permission to delete the data. However, even situations like the first one with the anonymous FTP server could have the potential to land an organization in hot water with the Department of Justice (DOJ) for Computer Abuse and Fraud Act violations. According to Clark, organizations that dont like it shouldnt blame the DOJ.
Ill tell you something. When youre talking about recovery operations, I really do believe that this is a no-win situation, Clark says. Dont blame doj for anything. Blame congress. If youve got a problem with something, you need to talk to congress about changing the law. You elected them, they work for you, thats what needs to be changed.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Managing The Legal Risks Of Active Defense