A So-Called "Hack Back" Bill Has New Supporters

[ProjectBox153]

A new bill was proposed back in October that, if passed, would allow companies to legally "hack back" someone who hacked them. For instance, is company A was hacked by company B, and company A had enough proof to back that up, they could legally hack company B and destroy their data.

Sources:

About the bill: The Register (https://www.theregister.co.uk/) (https://www.theregister.co.uk/2017/10/13/us_hack_back_law/)

Update about the bill: The Hill (http://thehill.com/) (http://thehill.com/policy/cybersecurity/358679-hack-back-bill-picks-up)

Quote

"The bill would allow victims of hackers to hack back their assailants under a limited set of circumstances, in order to identify the attacker or retrieve or delete stolen data."

 

"The original bill was released in mid-October and was co-sponsored by Rep. Kyrsten Sinema (D-Ariz.). 

 

New sponsors come from both sides of the aisle: Reps. Buddy Carter (R-Ga.), Henry Cuellar (D-Texas), Trey Gowdy (R-S.C.), Walter Jones (R-N.C), Barry Loudermilk (R-Ga.), Stephanie Murphy (D-Fla.) and Austin Scott (R-Ga.).

 

Graves held private hearings on hacking back and released discussion drafts of the bill dating back to early 2016."

I can see a few things about this that could be good or bad. First, it could make companies think they have powers they don't, but who's to decide where the line is drawn? What size security breach makes a "hack back" OK? What are your opinions?

Spoiler

This is my first Tech News topic. If I got something wrong, let me know. Picture (Happy now @iamdarkyoshi ) from Infowars.

 

[Zacm101]

I see the individual side of this, like "oh hey who just stole all my credit card info" but there are so many things that could go wrong. I mean if its identity purposes, understandable. But its basically a line to draw of cyber self defense.

 

IE You can stop a robber who just mugged you and get your wallet back, but at what point is it assault v self defense. and you cant steal their wallet

[iamdarkyoshi]

6 minutes ago, Jamiec1130 said:

This is my first Tech News topic. If I got something wrong, let me know.

Just an image related to the topic, but its not a requirement.

 

I personally like this idea though

[WereCat]

Sooo, this is not international, right?

[ProjectBox153]

Just now, WereCat said:

Sooo, this is not international, right?

Nope, US bill.

Just now, iamdarkyoshi said:

Just an image related to the topic, but its not a requirement.

 

I personally like this idea though

I'll find a super generic image of congress debating a law.

 

1 minute ago, Zacm101 said:

I see the individual side of this, like "oh hey who just stole all my credit card info" but there are so many things that could go wrong. I mean if its identity purposes, understandable. But its basically a line to draw of cyber self defense.

 

IE You can stop a robber who just mugged you and get your wallet back, but at what point is it assault v self defense. and you cant steal their wallet

From my understanding of it, it is limited to companies only. I think they'd be crazy if individuals were given this power, even if they do have to tell the FBI first. It'd be cool though.

[Zacm101]

1 minute ago, Jamiec1130 said:

From my understanding of it, it is limited to companies only. I think they'd be crazy if individuals were given this power, even if they do have to tell the FBI first. It'd be cool though.

Questions I have, 1. Is it legal to hack your own company(As an owner). 2. Could they limit this further to pure identity?, Because if a rogue employee from Company B hacked company A, A could do serious unrelated damage.

 

TLDR; CYBER WARS

[ProjectBox153]

Just now, Zacm101 said:

Questions I have, 1. Is it legal to hack your own company(As an owner). 2. Could they limit this further to pure identity?, Because if a rogue employee from Company B hacked company A, A could do serious unrelated damage.

 

TLDR; CYBER WARS

I’m thinking of the same things. What would stop A from doing damage, hiding it and claiming it wasn’t them?

[laminutederire]

Does this mean we can hack into facebook servers to delete our data back?

[Trulop]

Hmm.. I do like the sound of being able to "defend" yourself in such a manner, and might even deter some people from hacking in the first place if theres more assurance they will be found out or gone after. However there's gotta be some tight regulations put into place or i can see this being somewhat abused.

Also, to hack back to "delete data", couldn't you just save the data somewhere else or externally so they couldnt just take it away from you after you've already gotten it? So in a lot of cases this wouldn't even work if you were allowed to do it?

[ProjectBox153]

2 minutes ago, Trulop said:

Hmm.. I do like the sound of being able to "defend" yourself in such a manner, and might even deter some people from hacking in the first place if theres more assurance they will be found out or gone after. However there's gotta be some tight regulations put into place or i can see this being somewhat abused.

Also, to hack back to "delete data", couldn't you just save the data somewhere else or externally so they couldnt just take it away from you after you've already gotten it? So in a lot of cases this wouldn't even work if you were allowed to do it?

With the regulations, so far it’s been laid out to where only attacks originating from and destined for computer systems in the US are included, so someone using a system in France, even if physically in the US, wouldn’t allow this bill to work. All elements (to my understanding) have to be within the US (at least to a certain degree) to be included and legal. 

[Shreyas1]

What if someone outside the us hacks you 

[ProjectBox153]

Just now, Shreyas1 said:

What if someone outside the us hacks you 

That’s as I said above. If the attack originated outside the US, the company cannot hack back. 

[captain_to_fire]

Mr. Robot in real life 

 

 

[Delicieuxz]

1 hour ago, Jamiec1130 said:

From my understanding of it, it is limited to companies only. I think they'd be crazy if individuals were given this power

You think it's less crazy to "allow" companies to do this? The whole idea is loony. Anyone could hack a company and deliberately make it look as though it was done by a different company, or state actor. And how is this different than saying that if somebody steals from you, you're allowed to steal from them, or that if anyone hurts your family, that you're allowed to beat up theirs? The concept behind this is fundamentally depraved, contrary to civilized society, and feeding of people's worst instincts.

 

Such a law can be very easily exploited by competitors, domestic and foreign: If another country, or a foreign tech company wants to create a cyber war between US companies, or to bog them down in costly legal fights over the right to "hack back", then all they have to do is hack one of them and leave traces of another US company.

 

It is also could be expanded to create a legal pretext for all kinds of international espionage and false-flag operations: If the CIA wants major US tech companies to engage in cyber warfare against another nations, they'll just hack those companies and leave traces to make it appear as though it was done by the country they want to be targeted by those companies. WikiLeaks Vault 7 documents proved that the CIA is already doing that, posing as Russia, China, and others when hacking.

 

If anyone was seeking to turn their society into a bunch of predatory and scheming psychopaths devouring each other as they please, then this bill would be a big step in that direction.

[leadeater]

I don't think this is a good idea.........

[divito]

Pretty terrible idea. Not only is tracing a hack almost impossible to be 100% sure of, experts commonly disagree on the interpretation of the very data that goes into identifying the guilty party. 

[Kamina]

What if normal hackers just want to take down a company and frame another?

[ProjectBox153]

10 minutes ago, Kamina said:

What if normal hackers just want to take down a company and frame another?

It really depends on what happens in the specific case. I don't know how it'd affect an individual or group attacking a company though. 

[mr moose]

I think you guys over there should base these new laws on your gun laws,  because hey, if it's good enough to allow deranged people access to guns in the name of self defense then why not let them have access to the tools to carry out the same "self defense" online.   What could go wrong?

 

 

[BuckGup]

Lol BAD idea

[Rune]

eye for an eye and the world goes blind

[vanished]

What on earth are they thinking?  Seems insane to me.  What's next, a "murder back" bill?  If someone gets killed or attacked you can just get revenge and call it a day?  I thought he had a legal system for this very reason that would act as intermediary and sort things out.  I guess they intend to shut it down and let people go back to the wild west where you just handle everything yourself?  I mean, I suppose that could work but seems like kind of a backward decision...

[Master Disaster]

1 hour ago, Ryan_Vickers said:

What on earth are they thinking?  Seems insane to me.  What's next, a "murder back" bill?  If someone gets killed or attacked you can just get revenge and call it a day?  I thought he had a legal system for this very reason that would act as intermediary and sort things out.  I guess they intend to shut it down and let people go back to the wild west where you just handle everything yourself?  I mean, I suppose that could work but seems like kind of a backward decision...

A thousand times this.

 

How can the government suggest that the response to a crime being committed should be to allow the victims to go and commit a revenge crime? I'm guessing this shit is sponsored by big business corporations.

 

Honestly the entire world is loosing it's collective minds right now.

[LAwLz]

This seems insane. Is there any other instance in law where "you're allowed to do to them what they did to you" exists? He robbed your house so now you can rob theirs? It sounds absurd. 

 

I have not read the article or bill, but I wonder what they define as "hack". Some gray hat finds an exploit in Google's software and all of a sudden Google can hack him back?

The US government spreading malware and everyone effected are allowed to hack them back?

[leadeater]

35 minutes ago, LAwLz said:

This seems insane. Is there any other instance in law where "you're allowed to do to them what they did to you" exists? He robbed your house so now you can rob theirs? It sounds absurd.

I'd say the stand your ground law or what ever it's called is fairly similar to this sort of thing, not that it's a law that applies to the entire nation mind you. I feel threatened so I'm allowed to kill you seems even more insane than this to me.