Feeds

Firms turn to vigilante tactics against crackers

Cyber-anarchy looms

  • alert
  • submit to reddit

The essential guide to IT transformation

Firms are becoming prepared to adopt vigilante tactics against crackers in response to a rise in cybercrime that law enforcement measures alone cannot be expected to control.

That was the conclusion of a panel of security experts at London's Infosecurity show yesterday who warned that the reluctance of business to use the law when they are subject to Internet attack is leading to a state of "cyber anarchy".

Bob Ayers, former Head of the US Information Warfare Programme, said that a survey by Infowar.com suggests that 70 per cent of companies who have suffered a hack attack said they would fight back.

"The private sector is adopting vigilante tactics to respond to cybercrime," said Ayers.

Ayres, who is now director of security consultancy Para-Protect, cited other studies which suggest that 32 per cent of Fortune 500 companies had installed counter-offensive software, which he suggested had similar capabilities to the tools crackers themselves use.

Whether this 'counter-offensive' software refers to intrusion detection software or something more nefarious wasn't clearly explained but the argument firms might take the law into their own hands is fairly persuasive.

Peter Sommer, a security expert from the London School of Economics, said that in the same way that routine burglaries don't warrant the use of a lot of police resources, many cases of hacking are unlikely to be fully investigated by police, whose resources are limited.

If firms report hacking attacks to the police they risk public disclosure of their problems and are embarking on a uncertain legal process which might tie a great deal of their resources. Even if a cracker is arrested and convicted his punishment courts are reluctant to levy out heavy sentences or fines.

Also the police can only act after an attack, which might cause thousands of even millions of dollars of damage to a firm and its reputation, has taken place.

These factors might lead firms to take the law into their own hands and hire shadowy "information brokers" to hunt down hackers or authorise their own staff to strike back at crackers by trying to disable their machines through mounting a denial of service attack.

But by taking up information warfare tactics firms could fall foul of laws like the UK's Computer Misuse Act. It's also possible they might hit back at the wrong target.

Commodore Patrick Tyrrell, deputy chief executive of the UK's Defence Communication Services Agency, a group in the Ministry of Defence, said we may be headed for what he described as "short term cyber-anarchy".

Whether the situation will improve in the longer term was left unclear at the end of the debate, which emphasised the need for firms the get their security infrastructure robust enough to frustrate attacks in the first place. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.