Into the Gray Zone

24 | A Framework for Active Defense Against Cyber Threats
is required in most realms of active defense. A strong
framework will help to alleviate the advantage that
malicious actors gain from current ambiguity in
terms of who takes the lead in defending businesses
in cyberspace. The framework would also provide
for greater transparency and accountability in private
sector active defense.
The framework also balances the need to enable private
sector active defense measures with other important considerations
such as the protection of individual liberties,
privacy, and the risks of collateral damage. While a strong
framework for responsible active defense will bolster the
tools that the private sector can employ to safeguard the privacy
of their customers’ sensitive personal information, the
importance of guaranteeing the responsible use of active defense
measures cannot be overstated. Activities that extend
beyond the networks that a company is authorized to access
raise legitimate privacy concerns (among other issues) for
innocent third parties, so the
framework must ensure that
any measures taken by the
private sector are proportional
to the threat and limited
in scale, scope, duration, and
effect. By providing a clear
framework for these activities,
practices that exceed or
circumvent the framework’s
carefully crafted best practices
may be curtailed before undue infringement on the
privacy rights of innocent parties can occur. There are a
variety of oversight mechanisms and legal reporting requirements
that could be utilized to ensure that such considerations
are integrated into the framework.
A key aspect of this framework is a risk-driven
methodology that can be used to weigh the risks and
benefits of action vs. inaction, and to then choose
and utilize appropriate tools if and where actions is
warranted. As discussed later in the paper, government
should work with the private sector to establish
such a risk-driven methodology, developing it
through an open, consultative process.
Some cyber capabilities cross
into a "gray area" of activities
that fall below the level of
hacking back but still push
the limits of current U.S. law.
Key Actors in the Active
Defense Framework
Before looking at how this framework can be used,
we need first to understand the capabilities and interests
of the key actors within it. The framework’s first
relevant set of actors includes the various businesses
that make up the U.S. private sector. The Task Force
quickly recognized that due to the enormous diversity
of private entities operating in the United States, not
all sectors operate at the same level of sophistication.
Referring only to the capacity of the “private sector”
as a whole is an overgeneralization. Indeed, there is
no “single” private sector. While many “mom-andpop”
shops operate with only the most basic firewalls
installed on their computers, others, like the defense,
technology, finance, and energy sectors, have developed
and actually employed comparatively advanced
cyber defense capabilities to protect their networks.
Many large companies
utilize advanced cyber capabilities
that cross into
a “gray area” of activities
that fall below the level of
hacking back but still push
the limits of current U.S.
law. In 2013, the FBI investigated
whether a number
of U.S. banks had used
active defense techniques
to disable servers in Iran
that were conducting malicious attacks against their
networks. 93 No charges were brought, but major banks
reportedly advocated strongly for such activities. 94 The
next year, an industry coalition including Microsoft,
Symantec, and Cisco dismantled a sophisticated, allegedly
Chinese-backed APT known as Axiom, 95 removing
the group’s malware from 43,000 computers
around the world. Today, companies in the United
States and Israel are selling increasingly advanced cybersecurity
solutions to top financial and defense firms
that push the limits of measures that can be fairly called
“passive defenses.” 96
Many private sector actors are increasingly implementing
their own progressively aggressive defensive