{"id":967,"date":"2019-10-21T19:07:37","date_gmt":"2019-10-21T23:07:37","guid":{"rendered":"https:\/\/www.amp.legal\/blog\/?p=967"},"modified":"2020-05-08T10:31:23","modified_gmt":"2020-05-08T14:31:23","slug":"bring-back-hack-back","status":"publish","type":"post","link":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/","title":{"rendered":"Bring Back the Hack Back?"},"content":{"rendered":"

In 2017, U.S. House Representative Tom Graves introduced H.R. 4036<\/a>, known as the Active Cyber Defense Certainty Act (ACDC Act). The ACDC Act, or hack back law<\/a>, amends the Computer Fraud and Abuse Act of 1986 (18 U.S.C. \u00a7 1030<\/a>). The passage of this bipartisan bill into law would allow active cyber defenses for protecting computer networks from hackers. However, H.R. 4036 died in committee in the same year that it was introduced.<\/p>\n

This year, Rep. Graves reintroduced the ACDC Act under H.R. 3270<\/a>. On his website, Rep. Graves stated<\/a>, \u201cTechnology has outpaced public policy, and our laws need to catch up.\u201d He explained that the law would give the private sector a more active role in catching cyber criminals.<\/p>\n

\"\"Active Defense vs. Hack Back<\/h3>\n

The ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks. Basically, the ACDC Act<\/a> defines an \u201cactive cyber defense measure\u201d as any action a defender takes to access an attacker\u2019s computer without obtaining authorization. The measure can be used to establish attribution of an attacker, disrupt continued unauthorized activity, and monitor the attacker\u2019s behavior. The Act does not allow an intentional action that causes physical harm, financial loss, or public danger. Also, the defender cannot harm data that does not belong to the victim.<\/p>\n

At the 2016 SANS DFIR Summit, Robert M. Lee explained<\/a> that an \u201cactive defense\u201d is a strategy that militaries<\/a> used long before adding the word \u201ccyber.\u201d Lee described an active defense as monitoring the environment and being able to take action based off the adversary while adapting over time. Importantly, he emphasized that the strategy is not about hacking back or going into someone else’s territory, which includes tracking geo locations and using honeytokens<\/a>. Instead, an active defense is really about responding to adversaries and securing the environments.<\/p>\n

The ACDC Act, if passed, would legally expand the meaning of active defense beyond the classic definition. Once passed, the Act authorizes a \u201chack back\u201d type of cyber defense that may reach beyond the victim\u2019s network. However, before using an active cyber defense measure, a defender must notify the FBI National Cyber Investigative Joint Task Force<\/a>.<\/p>\n

Too Much Power?<\/h3>\n

Giving the private sector more power to fight hackers may strengthen the effort to stop cybercriminals, but big companies may end up with too much power. As an example, Microsoft has already used legal remedies to seize domains when it was threatened by botnets that distributed malware.<\/p>\n

In 2014, Microsoft targeted<\/a> domains at No-IP, a dynamic DNS provider. Microsoft analyzed data from anti-malware utilities that it received from its consumers. The data revealed that No-IP was functioning as a major hub for the distribution of the Bladabindi and Jenxcus<\/a> malware. Once a system became infected, the malware enabled an attacker to access files, record keystrokes, and turn on the camera and microphone.<\/p>\n

To stop the malware, Microsoft obtained a federal court order<\/a> to take control of almost a dozen of No-IP\u2019s high-traffic domains. No-IP claimed<\/a> that Microsoft never communicated with it about the problem. Microsoft informed No-IP that it intended to \u201cfilter out the known bad hostnames in each seized domain, while continuing to allow the good hostnames to resolve.\u201d However, No-IP announced that millions of its customers experienced outages due to Microsoft\u2019s \u201cdraconian actions.\u201d A few days later, Microsoft returned the domains back to No-IP, and the companies reached an agreement.<\/p>\n

Although Microsoft was successful in stopping the malware, its actions disrupted many innocent users. Critics of the ACDC Act believe<\/a> that big companies will take advantage of a law that would protect hack back<\/a> techniques. The big companies could bring disruptions to others if they take \u201cactive cyber defense measures\u201d to protect their own interests. But the proposed law\u2019s creator, Rep. Graves, believes that the ACDC Act would help fight cybercrime while establishing high standards and accountability for companies.<\/p>\n","protected":false},"excerpt":{"rendered":"

In 2017, U.S. House Representative Tom Graves introduced H.R. 4036, known as the Active Cyber Defense Certainty Act (ACDC Act). The ACDC Act, or hack back law, amends the Computer Fraud and Abuse Act of 1986 (18 […]<\/p>\n","protected":false},"author":1,"featured_media":968,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[27],"tags":[65,67,13,62],"yoast_head":"\nBring Back the Hack Back?<\/title>\n<meta name=\"description\" content=\"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bring Back the Hack Back?\" \/>\n<meta property=\"og:description\" content=\"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Law Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-10-21T23:07:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-05-08T14:31:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2019\/10\/Castle-Clouds.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"900\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\"},\"author\":{\"name\":\"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/2abed582dc9fbf067a8aa30d3e21453f\"},\"headline\":\"Bring Back the Hack Back?\",\"datePublished\":\"2019-10-21T23:07:37+00:00\",\"dateModified\":\"2020-05-08T14:31:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\"},\"wordCount\":668,\"publisher\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/#organization\"},\"keywords\":[\"active defense\",\"cyber defense\",\"cyber security\",\"hack back\"],\"articleSection\":[\"Cyber Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\",\"url\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\",\"name\":\"Bring Back the Hack Back?\",\"isPartOf\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/#website\"},\"datePublished\":\"2019-10-21T23:07:37+00:00\",\"dateModified\":\"2020-05-08T14:31:23+00:00\",\"description\":\"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.amp.legal\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bring Back the Hack Back?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#website\",\"url\":\"https:\/\/www.amp.legal\/blog\/\",\"name\":\"Cyber Law Blog\",\"description\":\"Exploring technology law in cyberspace\",\"publisher\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.amp.legal\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#organization\",\"name\":\"Alice M. Porch, P.A.\",\"url\":\"https:\/\/www.amp.legal\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2017\/08\/AMP-Logo.png\",\"contentUrl\":\"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2017\/08\/AMP-Logo.png\",\"width\":1104,\"height\":1114,\"caption\":\"Alice M. Porch, P.A.\"},\"image\":{\"@id\":\"https:\/\/www.amp.legal\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/2abed582dc9fbf067a8aa30d3e21453f\",\"name\":\"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b0913e4ef042f9c502b709824db43e8f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b0913e4ef042f9c502b709824db43e8f?s=96&d=mm&r=g\",\"caption\":\"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+\"},\"description\":\"Alice is a member of the Florida Bar, and she focuses on data privacy and cybersecurity compliance. She attended the Warrington College of Business at the University of Florida and earned a Bachelor of Science in Business Administration. After graduating, she earned a Juris Doctor at the Stetson University College of Law. During law school, she served as an Assistant Executive Editor for Stetson Law Review and also as a Staff Editor for Stetson Journal of Advocacy and the Law. She also served as a member of The Florida Bar Journal\/News Editorial Board from 2018-2024. She is currently a member of the Florida Bar Cybersecurity and Privacy Law Substantive Law Committee.\",\"sameAs\":[\"https:\/\/www.aliceporch.com\",\"https:\/\/www.linkedin.com\/in\/alice-m-porch\/\"],\"url\":\"https:\/\/www.amp.legal\/blog\/author\/amplegal\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bring Back the Hack Back?","description":"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/","og_locale":"en_US","og_type":"article","og_title":"Bring Back the Hack Back?","og_description":"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.","og_url":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/","og_site_name":"Cyber Law Blog","article_published_time":"2019-10-21T23:07:37+00:00","article_modified_time":"2020-05-08T14:31:23+00:00","og_image":[{"width":900,"height":525,"url":"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2019\/10\/Castle-Clouds.jpg","type":"image\/jpeg"}],"author":"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#article","isPartOf":{"@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/"},"author":{"name":"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+","@id":"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/2abed582dc9fbf067a8aa30d3e21453f"},"headline":"Bring Back the Hack Back?","datePublished":"2019-10-21T23:07:37+00:00","dateModified":"2020-05-08T14:31:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/"},"wordCount":668,"publisher":{"@id":"https:\/\/www.amp.legal\/blog\/#organization"},"keywords":["active defense","cyber defense","cyber security","hack back"],"articleSection":["Cyber Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/","url":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/","name":"Bring Back the Hack Back?","isPartOf":{"@id":"https:\/\/www.amp.legal\/blog\/#website"},"datePublished":"2019-10-21T23:07:37+00:00","dateModified":"2020-05-08T14:31:23+00:00","description":"The proposed ACDC Act would authorize individuals and entities to go beyond their networks to monitor network intruders and disrupt cyber attacks.","breadcrumb":{"@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.amp.legal\/blog\/bring-back-hack-back\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.amp.legal\/blog\/"},{"@type":"ListItem","position":2,"name":"Bring Back the Hack Back?"}]},{"@type":"WebSite","@id":"https:\/\/www.amp.legal\/blog\/#website","url":"https:\/\/www.amp.legal\/blog\/","name":"Cyber Law Blog","description":"Exploring technology law in cyberspace","publisher":{"@id":"https:\/\/www.amp.legal\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.amp.legal\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.amp.legal\/blog\/#organization","name":"Alice M. Porch, P.A.","url":"https:\/\/www.amp.legal\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.amp.legal\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2017\/08\/AMP-Logo.png","contentUrl":"https:\/\/www.amp.legal\/blog\/wp-content\/uploads\/2017\/08\/AMP-Logo.png","width":1104,"height":1114,"caption":"Alice M. Porch, P.A."},"image":{"@id":"https:\/\/www.amp.legal\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/2abed582dc9fbf067a8aa30d3e21453f","name":"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.amp.legal\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b0913e4ef042f9c502b709824db43e8f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b0913e4ef042f9c502b709824db43e8f?s=96&d=mm&r=g","caption":"Alice M. Porch, Esq., CIPP\/US, C|EH, Security+"},"description":"Alice is a member of the Florida Bar, and she focuses on data privacy and cybersecurity compliance. She attended the Warrington College of Business at the University of Florida and earned a Bachelor of Science in Business Administration. After graduating, she earned a Juris Doctor at the Stetson University College of Law. During law school, she served as an Assistant Executive Editor for Stetson Law Review and also as a Staff Editor for Stetson Journal of Advocacy and the Law. She also served as a member of The Florida Bar Journal\/News Editorial Board from 2018-2024. She is currently a member of the Florida Bar Cybersecurity and Privacy Law Substantive Law Committee.","sameAs":["https:\/\/www.aliceporch.com","https:\/\/www.linkedin.com\/in\/alice-m-porch\/"],"url":"https:\/\/www.amp.legal\/blog\/author\/amplegal\/"}]}},"_links":{"self":[{"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/posts\/967"}],"collection":[{"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/comments?post=967"}],"version-history":[{"count":17,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/posts\/967\/revisions"}],"predecessor-version":[{"id":1025,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/posts\/967\/revisions\/1025"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/media\/968"}],"wp:attachment":[{"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/media?parent=967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/categories?post=967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.amp.legal\/blog\/wp-json\/wp\/v2\/tags?post=967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}