Cyberattacks and the Legality of Hackbacks: International and Transatlantic Law Perspectives

Jacky Lui, Frankfurt am Main¹

Imagine it is the lead up to the 2016 US presidential elections. You go to work at a factory, not in the United States, but some 4,500 miles away. This is no ordinary factory – it is a ‘troll factory’ – based out of St. Petersburg, Russia. The Internet Research Agency was a phenomenon that took the world by surprise. It was a company engaged in cyber propaganda and influence operations for Russian business and political interests. Foreign interference into election processes has grown as a security issue for States and regional blocs.² Cyber attacks take shape in various forms, their unifying feature is their origination in cyberspace. In some instances, cyber attacks have real world influence. In 2019, the US Cyber Command conducted operations, beyond its borders, to disable the operations of the Internet Research Agency.³ This was to prevent interference with the 2018 US midterm elections.

Hackbacks and active cyber defense are emerging tools used against malicious cyber attacks. Active cyber defense extends to measures taken by states or private actors to actively defend their own networks, systems, and data from cyber threats. Hackbacks are a type of active cyber defense which employs 'hacking back' at an attacker. Both strategies may be controversial and, as will be seen in this article, perspectives vary as to how they may be legitimately employed.

The US considers China and Russia to be adversaries in cyberspace. The Department of Defense cites China's use of cyber espionage to steal information from the US, and Russia's use of cyber operations in Ukraine to disrupt command and control of Ukrainian forces.⁴ Earlier this year, the Department of Defense requested in its FY 2024 budget request for USD 13.5 billion for cyberspace activities.⁵ In this, USD 7.4 billion was marked for cyberspace operations, and USD 2.9 billion for the US Cyber Command.⁶ Across the transatlantic, Germany continues to focus on the Russian armed conflict in Ukraine.⁷ Since 2014, German-Russian relations have remained tumultuous with the Russian annexation of Crimea. The German Government has repeatedly condemned Russia's role in the cyber attacks on the German Bundestag and its attempts at influencing the political process. In 2023, Germany announced a National Security Strategy which committed 2% of its GDP over a "multi-year period", to achieving its integrated security goals and developing its defense capabilities.⁸

This article sketches an overview of hackbacks and active cyber defense from the perspectives of international law and views across the transatlantic. Throughout, it discusses the practicalities of active cyber defense and hackbacks and an outlook is drawn.

The term active cyber defense has been used by national security and defense communities for decades.⁹ However, there remains no uniformly agreed definition. Active cyber defense encompasses a set of actions aimed at proactively safeguarding computer networks, systems, and data from malicious cyber attacks.¹⁰ It differs to passive cyber defense, as its objective is to neutralize or mitigate impacts of an ongoing cyber attack.¹¹ Active cyber defense may incorporate any or all elements of threat detection and monitoring, information gathering, honeypots and deception, active response, attribution and forensics, threat mitigation, active hunting and information sharing amongst organizations or government agencies.¹² Hackbacks may be included within an active cyber defense strategy, which includes a cyber counterattack, where the initial hacker's IT systems becomes the target. It may result in the destruction of such systems.

The existing international legal framework has been applied to State engagement in active cyber defense and hackbacks. In particular, States must be cognizant of the prohibition on the use of force enshrined under Art. 2(4) of the United Nations Charter ("UN Charter"). The prohibition is delimited around two generally accepted exceptions, being the inherent right to self-defense as reiterated in Art. 51 of the UN Charter and collective enforcement actions pursuant to Chapter VII of the UN Charter.¹³

Around this prohibition, the decisive element is the notion of 'force', which is considered to comprise only armed or military force.¹⁴ In the cyber context, question surrounds whether a cyber operation amounted to a use of force. Usually such a question is answered negatively, as cyber operations originate and remain in virtual space. However, academic and political literature covering the topic are vast,¹⁵ where an 'effects-based approach' has been applied to this question, determinable by the consequences, or the effects, of the conduct in question.¹⁶ In the cyber context, the Stuxnet malware attack on Iran is an often-cited example. There, approximately 1,000 centrifuges at the Natanz nuclear plant were damaged, which was considered a use of force.¹⁷ In this instance a threshold of significance – the scale and effect of the impact – was exceeded and the equivalent of the use of weapons, causing injury, casualties, or significant damage to property.¹⁸

As to exceptions, States are often in debate as to whether an active cyber defense measure was exercised within its inherent right to self-defense, as reiterated in Art. 51 of the UN Charter.¹⁹ As its pre-condition, a valid exercise of self-defense requires an 'armed attack' on the State. For long, 'armed attack' and 'use of force' were not congruous. This was clarified in the Nicaragua decision, which considered that while every armed attack constituted a use of force, only "the most grave forms of the use of force" qualified as armed attacks.²⁰ It followed that an armed attack would justify a State's reaction in using force.²¹ Without such, there could be no justification in a State's retaliatory use of force. In the context of cyber attacks, these concepts are complicated when it comes to active cyber defense and hackbacks. As cyber attacks usually exist in virtual space, even the most disruptive cyber operations would not amount to an armed attack. A large-scale DDoS (distributed denial-of-service) attack involving millions of botnets that disrupts national critical infrastructure for a short duration of time, would not cross this threshold. Cyber operations causing human casualties, injuries to persons or damage or destroy property, may on the other hand, qualify so.²²

Where self-defense is not available as a remedy, States may resort to justification under the law of countermeasures as expressed under Art. 22 and Chapter II of the ILC Articles on State Responsibility ("ILC Articles").²³,²⁴Countermeasures are a customary remedy permitting otherwise unlawful conduct of a State in response to a violation of its rights by the targeted State.²⁵ The aim is to induce that State into compliance with its international obligations.²⁶ As its precondition, an injured State may only take countermeasures against a responsible State where there were a prior internationally wrongful act, following from the language of Art. 49(1) of the ILC Articles. This roughly resembles the approach of self-defense. However, in variation, countermeasures are not limited to an 'armed attack' under Art. 51 of the UN Charter. The language of Art. 49(1) of the ILC Articles provides that countermeasures may be taken against any "internationally wrongful act".²⁷ Literature in more traditional contexts refer to 'sanctions' or 'reactions' against prior internationally wrongful acts.²⁸ Resort to countermeasures are delimited by a number of factors. Primarily, countermeasures should not impinge on a State's obligation to refrain from the threat of or use of force, and to observe other obligations such as the protection of human rights, and obligations of a humanitarian character prohibiting reprisals or other peremptory norms of general international law.²⁹ In the cyber context, increased malicious cyber attacks on critical infrastructure have seen States interested to engage countermeasures as a justification for active cyber defense and hackback strategies.³⁰ Over the years, the US Department of Defense has considered a strategy of "defending forward".³¹ In Germany, a constitutional basis for active cyber defense and hackbacks have been discussed by various state representatives.³²

IT infrastructure has quickly developed into a complex, cross-border affair. Applying an existing international legal framework has introduced further layers of complexity. Both self-defense and countermeasures require attribution of conduct to a State where the attack originated. As IT infrastructure often spans across borders, this task difficult under the customary rules of attribution.³³ In practice, States neither openly claim responsibility for an attack. Instead, victim States needs to collate evidence to attribute the attack to a State. This complexity was demonstrated in the Russian intelligence agency's attack on the German Bundestag in 2015.³⁴ Sophisticated actors will likely complicate attribution through hiding techniques such as false flagging and other deceptive techniques. Cyber operations are also a space occupied by hacktivist groups and cybercriminals, whom ordinarily are non-state actors. False attribution brings about the possibility to heighten tensions between States.

Necessity as a defense under customary international law has also been considered in the cyber context. Necessity may preclude wrongfulness of active cyber defense measures, where the conduct were the only way for the State to "safeguard an essential interest against a grave an imminent peril".³⁵ The defense is further delimited to acts that do not seriously impair an essential interest of the State towards which the obligation exists or the international community as a whole.³⁶ The threshold to assert necessity is considered high, as the discussion takes focus on whether a State's critical infrastructure was an "essential interest".³⁷ Some views consider that necessity is reserved for genuinely exceptional and unforeseen circumstances, where this may not be a sound basis for domestic active cyber defense legislation.³⁸

Approaches to legislating for active cyber defense and hackbacks varies in Germany and the US. In Germany, the discussion surrounds the constitutionality of such activities. In the US, legislators are attempting to legislate for a framework to regulate private sector hackbacks. In effect, such a framework would tolerate private sector engagement in active cyber defense and hackbacks.

German legislators and academic views are mixed as to legislating to permit active cyber defense and hackbacks. Perceptions are that these measures may be intrusive and have a tendency to undermine domestic and international law. The German experience is characterized by an anti-military, anti-surveillance sentiment.³⁹ International law implications have also been considered. For example in 2021, the German Federal Government published a position paper confirming that international law was of critical importance to handling opportunities and risks in the use of information and communication technologies (ICT). It noted that international law, including the UN Charter and international humanitarian law, applied without reservation in the context of cyberspace.⁴⁰

In 2018 and 2019 respectively, a similar view was reiterated by the German Federal Parliament, in papers of its Scientific Services Department analyzing the constitutionality of conducting hackbacks in foreign jurisdictions. The Department raised awareness that hackbacks may not be compatible with Art. 26 of the German Constitution. Particularly, as Art. 26(1) is concerned with securing international peace, and renders unconstitutional, any acts with the intent to disturb peaceful relations between nations, particularly to prepare for wars of aggression. It recognized that acts that engage Art. 26(1) must lead to a serious impairment of interstate relations. It suggested that absent of precedent, interpretation of cyber operations should draw on the general prohibition of the use of force under Art. 2(4) of the UN Charter.⁴¹ The Department recognized that an exception may arise in self-defense under Art. 51 of the UN Charter, and as a collective coercive measure of the UN Security Council under Arts. 39 and 42 of the UN Charter.⁴² Reiterating the above discussions, the Department noted as important, the scale and effect of the measures and particularly if it caused physical destruction on a significant scale.⁴³ The German armed forces were identified as the only authorized body to engage in cyber operations.⁴⁴

The Department cautioned that a distinction between attack and defense, their legitimacy and the threshold of their effects were not entirely clear. It identified that hackbacks would be more in line with preparing an offensive attack, which may be contrary to past practices of a more cautious German foreign and security policy.⁴⁵ In particular, use of digital weaponry increased the risks of an arms race or the militarization of the Internet. The US, UK and France were identified as warning examples.⁴⁶

The other concern is to which governmental authority would be permitted to conduct hackbacks and active cyber defense. Currently, the country's national cyber security authority, the Federal Office for Information Security (BSI), is responsible for the protection of federal IT systems. The problem here is that currently, most cybersecurity policy is organized at a state level, where IT security law and state-level authorities handle respective cyber security issues. Over the years, the German Federal Minister of the Interior has considered proposals to amend to the Constitution to expand the powers of the federal authorities.⁴⁷ The proposal was firstly to expand the powers of the Federal Criminal Police Office (BKA) to conduct hackbacks and active cyber defense, and secondly to expand the capacity of the BSI as the central office for federal and state governments As is the current case, the BSI only supports state-level authorities only through a framework of administrative assistance.⁴⁸ It's expansion into a central authority would enhance coordination of cybersecurity policy across Germany.

In the US, a different approach is being considered. Debate surrounds reforming the domestic legal framework to allow for private sector active cyber defense and hackbacks. This has been discussed in Congress and in thinktanks across the US and raises questions as to the legitimacy of public-private security and whether there are sufficient measures to mitigate any negative externalities. This has been criticized as to whether, at an international level, such a policy would be escalatory or provocative in nature.⁴⁹

Currently in the US, launching a counterattack into a hacker's network is a federal offense under the United States Code.⁵⁰ Such activity would violate the computer trespass act, the Computer Fraud and Abuse Act (CFAA). Under that law it is (inter alia) a federal offense where a person "intentionally accesses" or "exceeds authorized access" to and thereby obtains information from any "protected computer".⁵¹ Under that law, civil liability also exists for violations of the CFAA.⁵² As it stands, private sector hackbacks are observed to risk violation of the CFAA.⁵³

The discussion is best summarised in the Active Cyber Defense Certainty Bill (“ACDC Bill”).⁵⁴ This was submitted to Congress in 2017 and reappeared in 2019.⁵⁵ What continues to trouble the debate has been defined by the US Center for Cyber and Homeland Security, to be the 'spectrum' in which an active cyber defense strategy takes place. Particularly, consideration should be given to the technical interaction between defender and attacker, and the operations that enable the defender to collect intelligence on a threat actor.⁵⁶ Hackbacks and active cyber defense takes place anywhere on this continuum, for which a mix of passive and active defense mechanisms may be employed. For example, 'honeypots' may be used to lure in attackers with fake information so their behavior may be surveilled. A botnet outside of the defender's network may also be taken down. This would require an active intervention into an end user's computer or intervention to take down a command and control server. A cyber operation may involve any number of these activities, which could be intrusive and compromising of third parties. These activities may cross jurisdictional boundaries, which attracts public-private cyber security questions.⁵⁷

The ACDC Bill would amend Section 1030 of title 18 of the United States Code, by introducing a defense to criminal prosecution where the conduct were an "active cyber defense measure".⁵⁸ No equivalent defense for civil liability has been proposed.⁵⁹ In effect, the ACDC Bill would permit a "defender" to hack back where there is a "persistent unauthorized intrusion" to their computer.⁶⁰ A defender would (inter alia) be able to access the attacker's computer without authorization to gather information to establish attribution of criminal activity to share with law enforcement and US cybersecurity agencies, disrupt continued unauthorized activity against the defender's network, monitor the attacker's behavior to develop cyber defense techniques.⁶¹ It can be seen that the proposal for the ACDC Bill would legitimize private sector active cyber defense. It has been noted that broad authorization of companies to hackback against attackers could be dangerous, particularly if the defender were technically incapable or lacked sophistication.⁶²

One author has suggested that where private sector hackbacks were tolerated in domestic law, may have an impact on the rule of law and the characteristics of the law's generality, publicity, predictability, clarity and constancy.⁶³ However, the same author noted that the solution is neither as black nor white, as efficiency of the private sector is also to bear in mind. As such, appropriate licensing and supervision over a small number of cybersecurity companies may be a mutual solution for private sector engagement in active cyber defense.⁶⁴

Novel active cyber defense and hackback strategies continue to emerge in the cybersecurity world. There remains no uniform description for what such strategies may entail, as these vary on a case-by-case basis. At the international level, an existing international legal framework has been applied to State engagement in active cyber defense and hackbacks. In particular, States must refrain from the threat of or the use of force in international relations. States may find justification under their inherent right to self-defense or the law of countermeasures. However, in the evolving world of cyber attacks, this is no easy task, as preconditions, such as whether there were an 'armed attack' or an 'internationally wrongful act', delimit whether a State can legally justify their engagement in active cyber defense or hackbacks. IT infrastructure is also complex, which makes other aspects, such as attribution, difficult. The customary plea of necessity may also present debatable grounds for domestic legislation for active cyber defense and hackbacks.

Across the transatlantic, different approaches have emerged towards regulation. In Germany, a constitutional basis for State-authorized active cyber defense has been discussed. The US have showed a greater preparedness towards private sector active cyber defense and hackbacks. Criticism remains as to whether active cyber defense or hackbacks may escalate or provoke international tensions.

This article was written by Jacky Lui and published in the Transatlantic Law Journal (January 2024). You can also read it at LINK ↗.