Behind the debate on whether the CFAA should be amended to allow private companies and citizens that are victims of cybercrimes to “hack back”
American companies that fall victim to data breaches want to retaliate against the culprits. But can they do so without breaking the law? Tweets: @hatr , @ericgeller , and @malwaretechblog Tweets: @hatr : Great article on hacking back in the @NewYorker. Some private companies are dying to be legally allowed do it, but often don't realize what they might be up against http://www.newyorker.com/... http://twitter.com/... Eric Geller / @ericgeller : This New Yorker article about hacking back makes a point I hadn't considered: DOJ will likely never prosecute a company for it because no jury would convict. http://www.newyorker.com/... http://twitter.com/... MalwareTech / @malwaretechblog : This is something I've been saying for a long time. Hacking back is already a thing, many companies already do it, nobody gets prosecuted for it. No point making it “legal”. http://twitter.com/...
Context & Ripple Effects
The New Yorker piece lands in a moment when offensive capability is no longer a government monopoly: agencies like the NSA have been prioritizing offense over defense in a global cyberweapons arms race, and the Shadow Brokers episode showed even the NSA can lose control of the weapons it builds. Against that backdrop, American breach victims are asking why they alone must stay passive.
The article's sharpest point, echoed by Eric Geller, is that the law already runs on discretion: many private companies reportedly hack back after breaches and are rarely prosecuted, because DOJ assumes no jury would convict. The CFAA amendment debate is thus less about permitting retaliation than about admitting that it is already happening.
First-order effects
- Breach victims gain a legal framework for what many already do informally — intruding on attackers' infrastructure to recover data or disrupt operations — while DOJ's de facto non-prosecution posture becomes explicit policy rather than quiet practice.
- Companies that currently hesitate get cover to act, shifting the immediate decision from 'is this illegal?' to 'can we attribute the attacker well enough to strike?'
Second-order effects
- Misattribution becomes the central risk: attackers routinely launder their identity — as seen when criminals [[a:977343|use hacked law-enforcement emails to send Emergency Data Requests that ISPs and platforms quickly obey]] — so a company hacking back can easily strike an innocent intermediary or a state actor's proxy.
- State-sponsored adversaries treat corporate retaliation as escalation: a victim company striking infrastructure tied to a nation-state's operation drags a private firm into the same conflict the NSA-level arms race describes.
Third-order effects
- If the pattern holds, amending the CFAA would formally blur the line between private self-help and national offensive cyber operations, creating a civilian layer of the arms race where companies act as uncoordinated, unaccountable combatants.
- The longer-term structural shift is toward codified offensive cyber as standard corporate practice — with liability, insurance, and rules of engagement becoming board-level questions rather than matters left to DOJ's prosecutorial discretion.
The trend: Cyber conflict is moving from a government monopoly on offensive action toward legalized private retaliation, with attribution failure and state-actor entanglement as the unresolved constraints.