Overview
In a 1799 letter(opens in new window) to John Trumbull, an American painter best known for his historical paintings of the American Revolutionary War, George Washington wrote, "Not less difficult is it to make them believe, that offensive operations, often times, is the surest, if not the only (in some cases) means of defence." This statement captures an aspect of military strategy that suggests strong offensive actions are more likely to lead to victory than passive defensive actions.
Over time, this adage has found its way into many different domains, including games, law, and business, as well as cybersecurity. However, the situation in the cyberworld can be much different than in the physical world. In the domains mentioned above, it is usually easy to determine who your adversary is: the military organization of your opponent, other players in the game, the party on the other side of the courtroom, or your competition in a market. In the cyberworld, adversaries can masquerade as allies, they can take control of friendly computational assets and networks, and hide behind layers of obfuscation.
Writing for Booz Allen Hamilton (BAH), Angela Messer and Brad Medairy note(opens in new window):
Does it help you sleep thinking that your cyber team has a plan to respond after you’ve been hacked? It shouldn’t. Your organization may have used a “react-and-defend” approach to cybersecurity for years. However, if you think this strategy is enough to protect your organization from a breach, you’re wrong.
Too many organizations wait to be notified that they’ve been breached. Yet with the increasing number and scale of cyberattacks—and the sophisticated techniques threat actors are using to mask their activities—the traditional approach of “building bigger fences” will no longer suffice.
Messer and Medairy are writing to advocate for the company's "Threat Hunting(opens in new window)" service, a part of Booz Allen that has matured significantly in the years since their piece was delivered. The idea behind Threat Hunting is to search through an organization's computing resources to identify hidden and obfuscated threats and respond to them offensively - attacking the attacker before the adversary is able to launch their attack.
Considering that BAH has been named one of the World's Most Ethical Companies®(opens in new window) 5 times, one might think that all of the ethical issues surrounding offensive hacking have been laid to rest. Even more, The Guardian(opens in new window) reported that in 2012, then US President Obama "ordered his senior national security and intelligence officials to draw up a list of potential overseas targets for US cyber-attacks." So if it is OK for both companies and governments to engage in offensive cyber-operations, it must be OK, right?
However, the ethics of hacking involve more than just the ethical justification of the action itself. Most people understand that physical conflicts can escalate in unforeseen ways, and cyber-attacks carry the same risks, though compounded by the speed at which computers and networks operate.
You are a junior network administrator for a regional non-profit organization that provides essential food and medical services to vulnerable populations across seven states. As part of a project to update and modernize the organization's systems, your organization has contracted with a high-end security firm to perform a comprehensive security evaluation of your network, computers, and software.
You meet with the leaders of the security team to get their results and they tell you that your brand new network has already been compromised. An "Advanced Persistent Threat" (APT) associated with two known malicious groups has installed sleeper malware across your systems, just waiting for a trigger to launch their attack. Based on the groups' past activities, this will likely be a ransomware attack with the threat of leaking private records of the people your organization serves.
The security firm offers a "preemptive strike" option. They can use the attackers' own command-and-control tools to disable the hackers' servers entirely. This would not only protect your non-profit but also potentially save other unknown victims currently in the attackers' sights. However, they warn you that disabling these servers might inadvertently take down innocent hop-points (like a small business’s router being used as a proxy) or trigger an escalation, leading the hackers to retaliate even more aggressively against your non-profit.
Your task for this forum is to evaluate, from an ethical perspective, this idea of a preemptive cyberattack.
Your evaluation should clearly identify at least two different potential ethical dilemmas that might be created by such an action and explain why the dilemmas would emerge. Based on your evaluation, your response should also clearly state whether or not you would authorize the preemptive attack, justifying your decision with a clear and effective ethical argument.