U.S. urged to let companies 'hack-back' at IP cyber thieves
Best defense against American IP theft may be legalizing cyber offense, U.S. commission says
Computerworld - U.S. companies should be allowed to take aggressive countermeasures against hackers seeking to steal their intellectual property, contends the private Commission on the Theft of American Intellectual Property.
The 100-page report, released this week, stops just short of recommending that the U.S. allow businesses to actively retrieve stolen information from within an intruder's network and to disable or destroy it without any limitations.
However, the report makes clear that some so-called hack-back options should be available if simpler attempts to deter IP theft fail, which will likely gain the attention of rights advocacy groups.
The commission is co-chaired by Dennis Blair, former U.S. director of National Intelligence and Jon Huntsman, former U.S. ambassador to China.
The report, released Wednesday, largely blames China for the what it says is the theft of hundreds of billions of dollars worth of U.S. intellectual property each year. Such theft leads to significant U.S. revenue loss while hurting U.S. innovation and jobs, the report noted.
"The American response to date of hectoring governments and prosecuting individuals has been utterly inadequate to deal with the problem," the commission said in the report.
Data from court cases, the U.S. trade representative and from specialized firms and industry groups show that Chinese cybercriminals account for roughly 70% of all IP theft today.
The stolen IP is used to help Chinese companies and the Chinese government close the technology gap with the U.S. That finding is similar to one cited in the recently released Department of Defense Annual Report to Congress.
Countries like India and Russia are also seen as posing a strong threat to American IP, the reports said.
Existing laws and IP protection provisions in international trade agreements have failed to address the issue so far. Similarly, emerging cybersecurity laws and policies implemented by the Obama administration to tighten U.S. economic espionage laws will only have limited effect, the IP commission argued.
In order to better deter intellectual property theft, U.S. companies should be allowed to implement measures that make it more costly for someone to steal their property, the report said.
"Effective security concepts against targeted attacks must be based on the reality that a perfect defense against intrusion is impossible," the IP commission said. It argued that it's more important to raise the stakes for cybercriminals than to create more laws aimed at stopping all attacks.
For instance, the commission said that federal laws should allow U.S. owners of intellectual property to recover or render inoperable any IP that's stolen over the Internet. Such laws would allow companies to consider a broader use of "meta-tagging," "beaconing" and "watermarking" tools to digitally mark any files containing proprietary data.
- NSA defends collecting data from U.S. residents not suspected of terrorist activities
- Groups fear bill would allow free flow of data between private sector and NSA
- Google's move into home automation means even less privacy
- Bill to require warrant for email searches gains ground in House
- Coming soon to a fridge near you -- targeted ads
- Snowden leaks prompt tech firms to tout privacy, transparency policies
- License reader lawsuit can be heard, appeals court rules
- Is EU's 'right to be forgotten' really the 'right to edit the truth'?
- Tails 1.0: A bootable Linux distro that protects your privacy
- Privacy jitters derail controversial K-12 big data initiative
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to... All Cybercrime and Hacking White Papers | Webcasts