Active Cyber Defense,which has been traditionally associated with the phrases “hacking back” or “attacking the attacker”, denotes retaliation or retribution with the likelihood of harming irrelevant third parties. Due to some legal and ethicalimplications it echoes in minds, Active Cyber Defense (ACD) has long been severely criticized.
1. Cyber incidents draining wealth
Inspired from air and missile defense taking affirmative, forcible and proactive actions to detect and remove threat of attack, ACD has gradually been developed and employed as Passive Cyber Defenses have fallen short to address the increasingly sophisticated cyber incidents endangering the cyber space. According to General Keith Alexander, the former head of the National Security Agency and U.S. Cyber Command, these cyber incidents cost the United States approximately $340 billion per year, further describing the situation as “the greatest transfer of wealth in human history”. In the face of so grave peril, States have effectively begun deploying some proactive measures, which engage the attacker before and during a cyber operation in an effort to detect and avert those attacks.
Parallel to that, invocation of those measures, namely ACD, triggers some legal and ethical issues surrounding it. Namely, ACD measures, which result in destructive consequences in scale, meet the use of force level, and therefore must be evaluated with the scope of the prohibition of the use of force enshrined in article 2 of the UN Charter. On the other hand, some ACD measures can effectively be deployed using the legal framework of preemptive self-defense, which constitutes an exception to what is required in article 2 of the UN Charter, with a view to cushioning ACD’s ethical and legal ramifications. The requirements set out by the Caroline formulation of the preemptive doctrine offer useful legal instruments, which ensure an ACD measure be kept within the limits of the prohibition of use of force laid out in Article 2. To put it differently, smart combination of ACD and the Caroline formulation would assurecompliance of a victim State’s response with international law, granting it a justified and legitimate standing on international stage.