A couple of weeks back, FBI Director James Comey gave a lengthy televised interview, during which he talked about retaliation when an individual or organization experiences a cyberattack. He reminded individuals, militias and organizations that it is a violation of U.S. law to take such an action. I have addressed this topic multiple times over the years and I think it is worth addressing once again.
Last October, HP, along with the Ponemon Institute, published an article about their fifth annual cyber study. In that article, they stated organizations experience an average of 138 successful attacks per week. Those attacks are costly: They found that the average cost of cyber crime was $12.7 million annually per organization.
Resource: Read the HP/Ponemon report
While teaching a class, I asked the students whether they would strike back during a cyberattack that was about to take their systems down. The answer was overwhelmingly yes. At a conference a few years back participants were asked if they had returned fire in cyber space. Over one-third said they had.
In running the numbers, I found that the Fortune 500 companies alone would experience more than 3.5 million successful cyberattacks per year, with an annual cost exceeding $6.3 billion. That translates to over 100 successful cyber attacks for each and every FBI employee. Just imagine what those figures must look like for every business in the United States (about 18 million businesses). How many local police departments in the U.S. have cyber capabilities, much less the resources, necessary to investigate all of the cyberattacks that are occurring? Keep in mind that many of these attacks are being routed through compromised systems in multiple countries, adding to the complexity of these investigations.
Based on the FBI director’s comment, under U.S. law no one has the right to defend themselves (their systems) when they experience an attack from cyber space. One individual I talked to stated emphatically he believes he has the right to cyber self defense. Think about this: If someone is sitting in their own home and their home server/system is attacked, could there be grounds for cyber self defense? What if a home health monitoring system was involved for a patient with heart problems? One could see this going all the way to the Supreme Court. The FBI is certainly in a difficult situation.
