Hacked companies fight back with controversial steps
(Reuters) - Frustrated by their inability to stop sophisticated hacking attacks or use the law to punish their assailants, an increasing number of U.S. companies are taking retaliatory action. — Known in the cyber security industry as …
Context & Ripple Effects
A year after Reuters reported that a hacking blitz was driving demand for cyberinsurance, the story has moved from transferring risk to taking it back: U.S. companies frustrated by their inability to stop sophisticated attacks — or to punish assailants through the courts — are turning to retaliatory action, what the security industry calls 'hacking back.' The piece traveled quickly through the infosec community, with security commentators picking up the syndicated report within hours.
The frustration is the point: existing law offers victims little practical remedy against often foreign-based attackers, so some boards are weighing options that sit in a legal gray zone under the Computer Fraud and Abuse Act.
First-order effects
- Companies that retaliate gain a deterrent signal but immediately expose themselves to CFAA liability and misattribution risk — striking the wrong server makes the victim an attacker in the eyes of the law.
Second-order effects
- Cyberinsurers and outside counsel are pulled into pricing and vetting active-defense decisions, since a client's retaliation could void coverage or trigger third-party claims; law enforcement simultaneously risks losing incident visibility if victims stop reporting and start acting alone.
Third-order effects
- If retaliation becomes routine, pressure builds to amend the CFAA or create a licensed framework for private active defense — forcing Congress to decide whether response to cyberattacks stays a state function or is partially privatized.
The trend: Corporate cyber response is drifting from passive defense and insurance toward active retaliation, with legal frameworks lagging behind practice.