15

I was wondering if it's legal to do what most people call a "hack back." Suppose someone tricked you into downloading software onto your computer that was designed to steal your data, but it was advertised as an online security software. Then you found out. Would it be legal to shut down their servers, or maybe even delete all the data on them, to prevent yourself and other people from this attacker?

Because I think of it sort of like self-defense: Someone tries to attack you, you can defend yourself (mostly). If a hacker attacks your computer, could you go and prevent them from doing so (by shutting down their servers)? I would think yes, but I don't have any idea of the law.


I have taken a look at this post, and though it does clear a small bit up about this, it does not fully answer my question.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Nov 19, 2020 at 1:25

3 Answers 3

32

Generally, no.

The Computer Fraud and Abuse Act (CFAA), which is the law that generally forbids breaking into or damaging computer systems, does not have any exceptions for "hacking back." Congress has considered amending the law on multiple occasions (in 2017 and 2019) to add limited exceptions for so-called "active cyber defense," but neither the 2017 version nor the 2019 version ever went anywhere.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Nov 19, 2020 at 1:25
6

Of course not. That would be equivalent to mugging a mugger back, or stealing from a thief.

Your one defence might be that you set booby-traps in your firewalls, which automatically slapped the hacker down.

Failing that, you would be committing a separate offence.

In true self defence and the heat of the moment, you'd be entitled to kill a mugger. Mugging the mugger back a day later would be a separate crime. You might be lucky enough to get your sentence reduced for provocation, but you'd still be clearly guilty.

Breaking into a thief's premises to "steal" back your own property might be justified but "stealing back" other things belonging to the thief, even things exactly matching the value of your property, should cut no mustard in any court.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Nov 19, 2020 at 1:25
-2

Simple. Collect data about attacker and send it to FBI. If institution do nothing (as they did not in my case, decide by yourself what to do.) IMO. If institutions do nothing to protect you (does not their job), you have no choice than to try "selfdefense" (including counterattack). This is just my opinion and you decide what you wish to do. https://www.american.edu/sis/centers/security-technology/hack-back-toward-a-legal-framework-for-cyber-self-defense.cfm

I had similar and more detailed question, but admins consider it "terms violated" question and closed it. No big deal. I've made my decision. If hackers (including government's hackers) can try hacking me without consequences, it was not hard to me to make decision what to do.

4
  • 1
    There is a moral argument in favor of such ":self-defense" but it is not a legal argument. Such hacking-back is usually unlawful (depending on exactly what is done) and the authorities might well prosecute it. May 21 at 19:36
  • If authorities not well prosecute attackers (and they do not), why they prosecute one who defend itself?
    – A.T.
    May 21 at 20:25
  • When and whether to prosecute is a matter of almost totally free choice by the relevant authorities. I do not try to predict that they will or will not prosecute in any given case, merely to say that legally they could do so. It might be a matter of how much evidence they have, or it might be something else. May 22 at 18:14
  • U can make experiment. Inform authorities about attack and send them all data you logged. Pls, let me know if they even give you any answer. Also, who is in charge if someone hack you website and use you site to perform attacks on gov?
    – A.T.
    May 24 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.