Firms turn to vigilante tactics against crackers

Cyber-anarchy looms

Firms are becoming prepared to adopt vigilante tactics against crackers in response to a rise in cybercrime that law enforcement measures alone cannot be expected to control.

That was the conclusion of a panel of security experts at London's Infosecurity show yesterday who warned that the reluctance of business to use the law when they are subject to Internet attack is leading to a state of "cyber anarchy".

Bob Ayers, former Head of the US Information Warfare Programme, said that a survey by Infowar.com suggests that 70 per cent of companies who have suffered a hack attack said they would fight back.

"The private sector is adopting vigilante tactics to respond to cybercrime," said Ayers.

Ayres, who is now director of security consultancy Para-Protect, cited other studies which suggest that 32 per cent of Fortune 500 companies had installed counter-offensive software, which he suggested had similar capabilities to the tools crackers themselves use.

Whether this 'counter-offensive' software refers to intrusion detection software or something more nefarious wasn't clearly explained but the argument firms might take the law into their own hands is fairly persuasive.

Peter Sommer, a security expert from the London School of Economics, said that in the same way that routine burglaries don't warrant the use of a lot of police resources, many cases of hacking are unlikely to be fully investigated by police, whose resources are limited.

If firms report hacking attacks to the police they risk public disclosure of their problems and are embarking on a uncertain legal process which might tie a great deal of their resources. Even if a cracker is arrested and convicted his punishment courts are reluctant to levy out heavy sentences or fines.

Also the police can only act after an attack, which might cause thousands of even millions of dollars of damage to a firm and its reputation, has taken place.

These factors might lead firms to take the law into their own hands and hire shadowy "information brokers" to hunt down hackers or authorise their own staff to strike back at crackers by trying to disable their machines through mounting a denial of service attack.

But by taking up information warfare tactics firms could fall foul of laws like the UK's Computer Misuse Act. It's also possible they might hit back at the wrong target.

Commodore Patrick Tyrrell, deputy chief executive of the UK's Defence Communication Services Agency, a group in the Ministry of Defence, said we may be headed for what he described as "short term cyber-anarchy".

Whether the situation will improve in the longer term was left unclear at the end of the debate, which emphasised the need for firms the get their security infrastructure robust enough to frustrate attacks in the first place. ®

Sponsored: 10 ways wire data helps conquer IT complexity