Hack Back or Step Back? Exploring An Ethical Dilemma Between Cyber Defense and Cyber Vigilantism

This paper examines the ethical and legal implications of private sector "hack back" operations in response to cyberattacks.With the Sony incident and the Colonial Pipeline Company incident as the backdrop, we raise issues of cyber defense versus cyber vigilantism.The paper includes discussion of state-sponsored attacks, ransomware, and the societal impacts that result.We discuss the legal aspects of technology in a global context.In the context of cyberattacks, the concept of self-defense raises questions about whether hack back operations can be considered a legitimate form of protection against harm caused by cyberattacks.We address the classification of hack back as a cyber-vigilante action, where individuals or organizations take justice into their own hands without legal authority.We recognize that successful hack back actions require expertise and attribution.Thus, questions arise: Does the victim possess the necessary technical expertise to conduct hack-back operations effectively and safely?Moreover, can the victim, as a practical matter, hack back with a certainty that no uninvolved person is affected?