Active Cyber Defense

In February 2018, the German government’s network was attacked. Germany did not specify what kind of information was accessed by the foreign hackers, but it is publicly known that the hackers successfully attacked the IT system of the Ministry of Foreign Affairs.

The recent WannaCry and NotPetya global cyber incidents have fueled the debate already raging over the role of and limits on corporate self-defense in cyberspace. The emerging international practice of “active cyber defense” (ACD) moves this debate beyond the merely theoretical realm. Private sector active defense potentially shifts the balance in favor of defenders and would improve companies’ ability to complicate and disrupt attacks and mitigate damages.

We are happy to report that Episode 7 of the National Security Law Podcast ("The Less Prep the Better") has just gone live. In about 42 minutes, we discuss:

- the Trump allegation about being wiretapped

- the Trump allegation about GTMO recidivism (and the Spicer follow-up about just when judges got involved in ordering GTMO releases)

- the Vault7/Wikileaks mess

Privateering in information security is back in fashion. This is not the first time: In 2006, Michael Tanji diagnosed parallels between cyberspace and the loosely governed sea in the 17th century and explored privateering as a policy solution.