5 ms·

What you have to keep in mind here is the concept of "due process" and "fair punishment". You cannot simultaneously subscribe to the rule of law and autonomousl

What you have to keep in mind here is the concept of "due process" and "fair punishment". You cannot simultaneously subscribe to the rule of law and autonomously execute punishment measured with your own subjective scale. If you don't care about rule of law and justice then consider this: the wealthiest individuals and largest corporations will afford to "hack back" mercilessly without any due process while the layman will sit in the middle catching stray bullets from either side. All that said I hop at the very least,people who support "hacking back" would also support a very strict and heavy punishment for anyone who hacks back the wrong attacker or causes harm to a system that was only being abused post-compromise (as opposed to attacker-owned infrastructure). The best kinetic warfare comparison would be modern urban warfare. You can't just shoot in the direcrtion of a terrorist who attacked you, if that terrorist is hiding in civilian houses or is holding a hostage. Civilians are not trusted to make that collateral damage risk assesment due to the terrible consequence of getting that wrong

mieseratte 9y ago
> You cannot simultaneously subscribe to the rule of law and autonomously execute punishment measured with your own subjective scale. At risk of being pedantic, there exists "Stand your Ground" and "Castle Doctrine" laws in many states that allow one to autonomously execute an assailant, given certain criteria. Wouldn't hacking back be a fairly natural extension of this? Assuming there were a law permitting, it doesn't seem incompatible with rule of law.
- PostOnce 9y ago
  castle doctrine as I understand it means your home is your castle -- you have no duty to retreat from your own home, if someone has broken into your home, the odds of something going wrong and you ending up dead are high enough that those states have said you can defend yourself with violence in your own home, rather than getting shot in the back or stabbed -- where are you going to retreat to anyway? You're already home. So, it seems like the logical extension into cyberspace would be that you can do anything you want to the attacker's computer while they are connected to your systems, but you can't pursue them once they've gone, the same as kinetic castle doctrine.
  - gm-conspiracy 9y ago
    Also, if the victim's 'services' are being hacked (of which they do not host themselves), would it not be more akin to a thief breaking into a rented self-storage locker? The castle doctrine would definitely not apply in that situation.
    - mieseratte 9y ago
      > The castle doctrine would definitely not apply in that situation. This is flat-out wrong, at least in the states I'm familiar with. Most states' Castle Doctrine applies to home, work, vehicles, and property. If I'm out in the country on land used for hunting, the "Castle Doctrine" still applies assuming the normal criteria are met. If I'm at the site, I have a right to defense regardless of it being my primary residence or a rented facility.
      - gm-conspiracy 9y ago
        No, what I meant was you, as a human, not being physically present, it is just your private property that is "stored" at that location.
  - mieseratte 9y ago
    > So, it seems like the logical extension into cyberspace would be that you can do anything you want to the attacker's computer while they are connected to your systems, but you can't pursue them once they've gone, the same as kinetic castle doctrine. That's more or less what I'm imagining, not after the fact find-fix-finish. If I come home from work, power on my machine, and find someone is DoS'ing my connection should I be able to route through an alternative connection and take down the offending machine? Honestly, I don't know how to feel because there is greater potential for collateral than with, say, a man in a ski mask kicking in my door. At the same time wholesale denial of "hacking back" seems the like the wrong[0] approach. [0] - I realize many an HNer lives in a land with a duty to retreat so this might be foreign to them.
- manfredo 9y ago
  There's a very substantial difference between legal self defense and "hacking back". Self defense is an immediate response and an innate human instinct. Hacking back is more like tracking down an assailant attacked you or your family member in the past, breaking into their home, and killing them. Another analogy: if a store owner saw someone steal $100 worth of goods, would it be legal for that store owner to hire someone to break into the thief's house and steal $100 worth of the thief's property?
  - cm2187 9y ago
    Where your analogy breaks is that there is an alternative, semi functioning legal system in the case of a crime committed locally in the US that the police will investigate. In the case of a US victim from a hacker based in Russia or China, there is no realistic legal option, unless you are a large corporation with a massive legal budget and political connections. It’s really the alternative between do nothing or hack back. [edit] an alternative analogy is that a store caught a masked man robbing it and holds him and forces him to remove his mask while they call the police. Shops have no right to hold someone against their will nor to remove any piece of clothes from their customer by force, but it is acceptable in the context of being victim of a crime. Self defence is not the justification (once the robber has been neutralised he is no longer a threat). I’d argue that hacking into the attacking server to uncover its identity while the attacker is still online is very similar to removing an attacker’s mask by force after he has been caught.
    - gm-conspiracy 9y ago
      Let's modify his analogy a bit then... The thief that shoplifted $100 of goods from his store was identified, but flew back to Russia the next day. Your alternative analogy would be considered kidnapping (as you say it is acceptable under the circumstances, but a jury might wind up deciding that).
      - cm2187 9y ago
        It actually happened in the past, and as you mentioned with sympathy of the jury [1] [1] https://en.wikipedia.org/wiki/Kalinka_Bamberski_case#Abduction_to_France,_conviction_of_Krombach_and_further_proceedings https://en.wikipedia.org/wiki/Kalinka_Bamberski_case#Abducti...
arca_vorago 9y ago
<You can't just shoot in the direcrtion of a terrorist who attacked you, if that terrorist is hiding in civilian houses or is holding a hostage. Hmm I don't know why you think this is the case but that's not how it works. If I get attacked I'm going to close with and destroy the enemy by fire and close combat... regardless of where the enemy is. I think the better thing to focus on is the lack of reliable attribution. For example, during the russiagate hysteria I actually dug into the data, and noticed all the command ips listed where anywhere but Russia, and I found no evidence that tied those command ips to Russia in the past but that's the key factor in the report because crowdstrike claimed "these are all known Russian command ips" but they back that up with nothing. State level actors are good at pretending to be someone they're not (anyone remember vault 7 attribution manipulation tech?) So the real issue with this kind of hack back attitude is attribution. Otherwise good actors will likely be fooled into attacking the wrong target... And that's the different between that and mout. When I get shot at, with few exception, attribution is undeniable! For example, the entire problem with the Iraq invasion was one of attribution was it not? We were lied to about it and it got us into a war we should have had no business in... for example Cheney manipulating Intel reports to push the Yellowcake angle. Another good example is Iran. I took the time to read all the IAEA reports up until 2007 in about 09, and all indicators were that Iran was not seeking nuclear weapons nor was it seeking 2yr breakout within sub 2035 time-frame... except for the 2007 one where a lot of Intel was found on a laptop... that we later learned was mossad planted evidence in an effort to get us to beat the drums of war against Iran... (this is relevant given this silly recent story from Israel about Iran and Boltons/pompeos appointment...)

mieseratte 9y ago

> You cannot simultaneously subscribe to the rule of law and autonomously execute punishment measured with your own subjective scale. At risk of being pedantic, there exists "Stand your Ground" and "Castle Doctrine" laws in many states that allow one to autonomously execute an assailant, given certain criteria. Wouldn't hacking back be a fairly natural extension of this? Assuming there were a law permitting, it doesn't seem incompatible with rule of law.

PostOnce 9y ago
castle doctrine as I understand it means your home is your castle -- you have no duty to retreat from your own home, if someone has broken into your home, the odds of something going wrong and you ending up dead are high enough that those states have said you can defend yourself with violence in your own home, rather than getting shot in the back or stabbed -- where are you going to retreat to anyway? You're already home. So, it seems like the logical extension into cyberspace would be that you can do anything you want to the attacker's computer while they are connected to your systems, but you can't pursue them once they've gone, the same as kinetic castle doctrine.
- gm-conspiracy 9y ago
  Also, if the victim's 'services' are being hacked (of which they do not host themselves), would it not be more akin to a thief breaking into a rented self-storage locker? The castle doctrine would definitely not apply in that situation.
  - mieseratte 9y ago
    > The castle doctrine would definitely not apply in that situation. This is flat-out wrong, at least in the states I'm familiar with. Most states' Castle Doctrine applies to home, work, vehicles, and property. If I'm out in the country on land used for hunting, the "Castle Doctrine" still applies assuming the normal criteria are met. If I'm at the site, I have a right to defense regardless of it being my primary residence or a rented facility.
    - gm-conspiracy 9y ago
      No, what I meant was you, as a human, not being physically present, it is just your private property that is "stored" at that location.
- mieseratte 9y ago
  > So, it seems like the logical extension into cyberspace would be that you can do anything you want to the attacker's computer while they are connected to your systems, but you can't pursue them once they've gone, the same as kinetic castle doctrine. That's more or less what I'm imagining, not after the fact find-fix-finish. If I come home from work, power on my machine, and find someone is DoS'ing my connection should I be able to route through an alternative connection and take down the offending machine? Honestly, I don't know how to feel because there is greater potential for collateral than with, say, a man in a ski mask kicking in my door. At the same time wholesale denial of "hacking back" seems the like the wrong[0] approach. [0] - I realize many an HNer lives in a land with a duty to retreat so this might be foreign to them.
manfredo 9y ago
There's a very substantial difference between legal self defense and "hacking back". Self defense is an immediate response and an innate human instinct. Hacking back is more like tracking down an assailant attacked you or your family member in the past, breaking into their home, and killing them. Another analogy: if a store owner saw someone steal $100 worth of goods, would it be legal for that store owner to hire someone to break into the thief's house and steal $100 worth of the thief's property?
- cm2187 9y ago
  Where your analogy breaks is that there is an alternative, semi functioning legal system in the case of a crime committed locally in the US that the police will investigate. In the case of a US victim from a hacker based in Russia or China, there is no realistic legal option, unless you are a large corporation with a massive legal budget and political connections. It’s really the alternative between do nothing or hack back. [edit] an alternative analogy is that a store caught a masked man robbing it and holds him and forces him to remove his mask while they call the police. Shops have no right to hold someone against their will nor to remove any piece of clothes from their customer by force, but it is acceptable in the context of being victim of a crime. Self defence is not the justification (once the robber has been neutralised he is no longer a threat). I’d argue that hacking into the attacking server to uncover its identity while the attacker is still online is very similar to removing an attacker’s mask by force after he has been caught.
  - gm-conspiracy 9y ago
    Let's modify his analogy a bit then... The thief that shoplifted $100 of goods from his store was identified, but flew back to Russia the next day. Your alternative analogy would be considered kidnapping (as you say it is acceptable under the circumstances, but a jury might wind up deciding that).
    - cm2187 9y ago
      It actually happened in the past, and as you mentioned with sympathy of the jury [1] [1] https://en.wikipedia.org/wiki/Kalinka_Bamberski_case#Abduction_to_France,_conviction_of_Krombach_and_further_proceedings https://en.wikipedia.org/wiki/Kalinka_Bamberski_case#Abducti...

arca_vorago 9y ago

<You can't just shoot in the direcrtion of a terrorist who attacked you, if that terrorist is hiding in civilian houses or is holding a hostage. Hmm I don't know why you think this is the case but that's not how it works. If I get attacked I'm going to close with and destroy the enemy by fire and close combat... regardless of where the enemy is. I think the better thing to focus on is the lack of reliable attribution. For example, during the russiagate hysteria I actually dug into the data, and noticed all the command ips listed where anywhere but Russia, and I found no evidence that tied those command ips to Russia in the past but that's the key factor in the report because crowdstrike claimed "these are all known Russian command ips" but they back that up with nothing. State level actors are good at pretending to be someone they're not (anyone remember vault 7 attribution manipulation tech?) So the real issue with this kind of hack back attitude is attribution. Otherwise good actors will likely be fooled into attacking the wrong target... And that's the different between that and mout. When I get shot at, with few exception, attribution is undeniable! For example, the entire problem with the Iraq invasion was one of attribution was it not? We were lied to about it and it got us into a war we should have had no business in... for example Cheney manipulating Intel reports to push the Yellowcake angle. Another good example is Iran. I took the time to read all the IAEA reports up until 2007 in about 09, and all indicators were that Iran was not seeking nuclear weapons nor was it seeking 2yr breakout within sub 2035 time-frame... except for the 2007 one where a lot of Intel was found on a laptop... that we later learned was mossad planted evidence in an effort to get us to beat the drums of war against Iran... (this is relevant given this silly recent story from Israel about Iran and Boltons/pompeos appointment...)