29 April 2025

Back & Forth 4: Should the United States Adopt a “Hack-Back” Cyber Strategy?

Matt Pearl and Alexander Klimburg

Since the emergence of the commercial internet in the United States in the 1990s, we have experienced many transformations, including the explosion in e-commerce, the rise of social media, and the development of cloud computing. During that time, we have also experienced remarkably consistent trends when it comes to cybersecurity: The volume, diversity, and sophistication of attacks have increased, as have resultant costs borne by individuals, businesses, and governments.

In response, for many of those years, governments largely focused on cyber defense and coordination, including strengthening defensive capabilities, cyber diplomacy and international cooperation, cybercrime laws and enforcement, public-private sector partnerships, and cybersecurity awareness and education. These efforts are necessary and laudable, but they have also proved to be insufficient. In that context, the United States announced in recent years that it would engage in offensive cyberoperations, and more recently, it is—along with several of our allies and partners—considering vastly expanding such efforts.

As the U.S. government decides how to go on offense, this Back & Forth issue will address whether Congress and the administration should authorize some form of “hack back,” or, in other words, allow nongovernment entities to engage in offensive hacking in response to being hacked.

No comments: