America tells private firms to “hack back”

https://www.economist.com/united-states/2026/03/22/america-tells-private-firms-to-hack-back

by andsoitis • 4 months ago

159 171 4 months ago

jen203• 4 months ago

Relying on good will and people doing the right thing is clearly bullshit - any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not.

However, the law needs to reflect that if people are to actually take the suggestions seriously.

thatguy0900• 4 months ago

Is there practical ways other than spending a couple billion dollars to protect yourself from nation state hacking groups? Especially if you'd doing something like internet connected medical devices? Honest question

jen203• 4 months ago

The problem is, it doesn't matter. If the "good guys" are prevented from testing your system to uncover vulnerabilities without legal threats, but the "bad guys" are not, you still effectively do need to spend that anyway.

malwrar• 4 months ago

You can’t really avoid paying for security, which seems to historically be why it is ignored and risked. I’ve always felt the right approach is for an internal security & reliability org be formed to provide an owner and maintainer for core services and libraries, so that things are built robustly from the get-go. Think premade formulations an integration for auth, hosting, data storage, etc. Some companies have small security teams that _kind of_ fill this role, but usually they’re a gate you must pass rather than an ally helping you navigate hard problems by providing and maintaining prebuilt solutions. I’d rather just require that normal devs not need to solve these problems and instead be provided an appropriate sandbox to deploy software in.

megous• 4 months ago

They did login on a global admin account and wiped devices via whatever turd technology is used currently to have complete control over your employee's devices centrally.

Central control over everything gives you central way to shoot yourself in the foot. Duh. Don't be a control freak company maybe, or if you are, have 2FA on your admin's accounts.

"Nation state" my ass.

They also demonstrated that one rogue admin could have deleted the entire company in like one evening, too, if he felt bad enough.

Well, they also relied on this company to protect them, so...

https://www.bleepingcomputer.com/news/security/microsoft-ent...

drivingmenuts• 4 months ago

any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not

And what is the limit on that, because the only actually-secured system is one that is not connected to anything or accessed by anyone.

Look, I agree that people are shit and the only person you can trust is one you've killed yourself, but that's not really a workable solution.

jen203• 4 months ago

Well then how do you propose to police that outside of your own jurisdiction?

VladVladikoff• 4 months ago

his front door used an old style of insecure lock, so I spent 4 hours picking it. It’s his fault for not having a more secure lock.

kstrauser2• 4 months ago

Say I do everything right and still get compromised because an AWS 0-day lets attackers read the RAM of my virtual server. It’s my responsibility, but is it my fault?

There’s no such thing as a secure system that’s usable. You can asymptomatically approach it giving infinite money, in the same way you can approach physical security (“if it were really important to you, you would’ve cloned Fort Knox, so I guess you don’t care”) or even the speed of light. But even Fort Knox is vulnerable to a highly determined invading army.

Getting compromised doesn’t inherently mean you made mistakes.

fn-mote3• 4 months ago

Getting compromised doesn’t inherently mean you made mistakes.

I entirely agree, but I think the reason you see such upset posts is that they are thinking of situations where EGREGIOUS mistakes were made and no liability was found.

Hasslequest• 4 months ago

You chose to use AWS

epolanski• 4 months ago

I have this huge looming sensation private credit will trigger a mini 2008, but instead of investors sucking up the losses, as they should, american taxpayers will be left with the bill.

allthetime2• 4 months ago

Not if American tax payers stand up, fight back, and demand better. I won't hold my breath though.

joe_mamba8• 4 months ago

Not if American tax payers stand up, fight back, and demand better.

How?

tombert7• 4 months ago

A part of me was hoping that with LLMs getting better and better at mimicking corporate nothing-speak that we'd realize that we can automate away a lot of the executives, Vice Presidents, and CEOs. Of course that was a naive hope on my end; if history has taught us anything, executives at big companies appear to only be skilled at one thing: shielding themselves from the consequences of their awful decisions.

Instead of automating away a job that is mostly about blathering on with half-truths about the future of the company (something that AI could actually do perfectly fine), they instead think they can fire half the engineers and replace them with a Claude Code.

ep103• 4 months ago

I see this sentiment repeated so often, and its so surprising to me that people have this train of thought.

If our society was organized around the needs of workers, and existed to help workers compete at their crafts (somehow), then this would make sense.

But it isn't. Every one of our jobs exists as a contract that was initially offered by an owner of capital, and created in order to make that person more money.

As such, ownership is literally the _only_ job that will never be replaced, because it is the atom from which all the rest of the market's building blocks have been built.

AI could replace every job in the market, and company-owner would be the only job left untouched, because every other job in existence, ultimately, has been created to serve that person, not the other way around.

HPsquared• 4 months ago

A critical part of the job is to NOT say certain things, which LLMs are only just getting good at.

rchaud4• 4 months ago

AI may be able to mimic the cadence and vocabulary of CEO-speak, but it can't possess in-group signifiers like fraternity rings, golf club memberships or be able to trade favors like getting invites to the right kind of parties. All of these are required as part of an elaborate dance to placate a merry band of institutional investors, earnings analysts and politicians.

BigTTYGothGF2• 4 months ago

american taxpayers will be left with the bill

So just like 2008.

krsw• 4 months ago

Socialize the losses, privatize the profits has never been more true

anjel• 4 months ago

Large Pension Funds have significant exposure to private credit... https://www.calpers.ca.gov/documents/202603-invest-agenda-it...

guzfip• 4 months ago

american taxpayers will be left with the bill.

If the country isn’t on fire afterwards, I’m giving up on it.

ericmcer• 4 months ago

I mean that was what happened in 2008 just over a multi-year timeline. In 2020 they managed to get the market to recover in a few months.

Maybe this time they will only let it go down for a couple days.

Natfan• 4 months ago

https://archive.ph/vwuA1

cjs_ac2• 4 months ago

I agree with the characterisation of this activity as 'cyber-warfare', but that has the consequence that telling businesses to 'hack back' is inviting them to raise private armies, with which I strenuously disagree. That sort of thing does, however, to fit with the present administration's ideology.

ImPostingOnHN• 4 months ago

That was my immediate thought as well: Legitimizing in people's minds that it's ok to commit crimes in a self-coordinated fashion as long as it benefits the people in the current administration. It's very dangerous, and is also happening right now with regards to physical violence [0][1], in addition to all the white collar crime (too much to list).

0 – https://en.wikipedia.org/wiki/Pardon_of_January_6_United_Sta...

1 – https://www.nbcnews.com/politics/politics-news/trump-calls-a...

alephnerd3• 4 months ago

telling businesses to 'hack back' is inviting them to raise private armies
That sort of thing does, however, to fit with the present administration's ideology

These kinds of firms (usually branded as boutique consultancies) have already existed in the OffSec space for over a decade now in most countries and with tacit approval of their law enforcement agencies.

It was BSides this weekend and RSAC right now so you will bump into plenty of them walking around Moscone.

cjs_ac2• 4 months ago

That made sense when it was just businesses defending their own operations from criminals, akin to banks having to use armed guards to move cash and bullion around. But when it's businesses defending against state-sponsored actors in the context of an actual shooting war, that's very different.

aidenn0• 4 months ago

It seems like this is analogous to "letters of marque" which the constitution gives the power to Congress to issue.

scuff3d• 4 months ago

That's what we want, corporations waging "cyber-war" in the name of national security. Brilliant...

FerretFred• 4 months ago

If a company's already been hacked, what makes them think they have the knowledge/expertise to fight back?

OutOfHere2• 4 months ago

Exactly. They don't even have the know-how to defend themselves -- there is no hope of them getting on the offensive, at least not without extensive external help.

follie3• 4 months ago

This has nothing to do with the reality of computer security. Not getting hacked requires doing everything right and some luck. Hacking requires some luck or doing one thing right.

blourvim• 4 months ago

Nvidia has done it before, I think they included a virus in their data which encrypted the stolen data

dathinab6• 4 months ago

okay that is kinda funny and much less legally problematic (because they didn't actively hack back and depending on what that virus did in detail could be seen more like how money bags can spray color on the bills if forcefully opened making them useless but not quite destroying them)

lonelycompiler• 4 months ago

I looked into it, looks like they attempted to counter-attack. [1]

1.https://videocardz.com/newz/nvidia-allegedly-hacked-the-rans...

everforward3• 4 months ago

Even better, why would they bother? If it's a non-monetary hack (i.e. for data), hacking them back won't undo leaking the data. If it's a monetary hack, there are surely much better recovery options than trying to do a hack-in-kind to take it back.

It also seems incredibly risky. This US admin might be okay with it, but will the next? For multi-national corporations, will other nations be okay with it? I wouldn't think countries unassociated with the conflict would be happy with digital privateering.

dathinab6• 4 months ago

For multi-national corporations, will other nations be okay with it?

imagine hacking back and accidentally hitting a hospital killing someone in the process

that is a fast line to get an Interpol terrorist arrest request on your head, sure the US won't hand you over, but have fun to never leave the US and get assets abroad sized

dylan6044• 4 months ago

Just because you didn't prevent your opponent from scoring doesn't mean you can't score yourself.

wheelerwj• 4 months ago

Can you elaborate on that?

Barrin92• 4 months ago

except this isn't a game of sports and a private company doesn't gain anything from attempting to "hack back" a foreign adversary. It just costs them resources and makes them an even larger target. And given that those adversaries are in all likelihood state sponsored the actual opponent is the US government, which is abdicating their responsibility.

It's like saying "the police doesn't care any more citizen, so you know just punch back". It's also incredibly dangerous btw to tell private firms they have the authority to engage in what is basically an act of warfare.

conductr5• 4 months ago

What are you “scoring” though. US firm loses data, has downtime, lost revenues, etc. If they attack back, what damages are they doing that they even care about? Seems to me they just are asking to be continually targeted.

Also, why burn the resources? Attacking isn’t free.

robotnikman2• 4 months ago

This might be the start of hacker mercenary groups which corporations hire.

ordu• 4 months ago

I don't think corporations are that stupid: they have no means of knowing if mercenaries they hire are not the same people who hacks them.

justinclift• 4 months ago

Looks like we're doing the Cyberpunk 2077 timeline?

antonymoose2• 4 months ago

This already exists to some degree. It’s the “Brand Protection” industry and they’ve been doing it for years. Our clients were all Blue Chips that need additional help and or want plausible deniability.

Having worked in the space, the normal flow would look something like:

1. Random WordPress blog is hacked, hosts a fake iCloud page, the is linked to in phishing emails. 2. We find it, either by direct reporting or by our internet crawling 3. We reach out to the hacked company, their hosting provider, and their DNS. The goal being take this site offline no matter how.

This worked for the vast majority of hacks. Some random plumbing company has no clue their marketing site is compromised and happily works with us. Or maybe they host at GoDaddy and we have a privileged relationship with them and they disabled the site. Last resort the DNS company will just delete their records.

Sometimes, though, we get a compromised site on a host in a foreign land that won’t cooperate. Then what? Well, it’s a legal grey area that our in-house counsel felt was perfectly fine: hack the site and take it down the hard way. We didn’t advertise or document when we did this. It was an open-secret inside the company however.

All this does is legitimize the sadly necessary work we face in a modern world.

kmeisthax• 4 months ago

On the Internet, attackers have about the same ratio of advantage that defenders do IRL. They absolutely can hack back, because hacking is easy.

The real question is if they can even properly attribute to the correct target. Nobody hacks from their home IP. Anyone remember Uplink? You'd make it way easier to avoid getting arrested (which wipes your save) if you proxied through the tutorial machine first and wiped its logs after you were done. Likewise, even the most basic cybercriminals know to hack with machines they've already compromised, so that all the owners of those machines and their ISP's abuse desks spend all their time pointing the finger at each other.

wrboyce• 4 months ago

Jump across borders of non-cooperative nations, too. Say using boxes in Iran and USA, or India and Pakistan.

dathinab6• 4 months ago

they don't

worse hacker do like using jump hosts

so wherever you "hack back" to has a good chance to be another victim

it's also a good point to remind people that most cases of "knowing who was it but not catching the people behind it" are either wild guesses without proof or the attacker leaving recognizable traces (like a literally "it has been us <group>" note /not a joke). But the problem with that is any other advanced enough hacker group/apt could also have made it look like that...

mc32• 4 months ago

I guess this means if you know your attacker as IDd by your MDR, you don't have to feel helpless in not being able to fight back against the likes of Cozybear, Romcom, Lazarus, etc., if you're up to it. Now, I don't think many orgs would be up to it, but perhaps the bigger orgs in the US might quietly fight back -Microsoft and others typically fight back in the legal space with takedowns, etc., but who knows, they could venture further afield.

overfeed• 4 months ago

Now, I don't think many orgs would be up to it, but perhaps the bigger orgs in the US might quietly fight back

Sony's movie division financed a movie North Korea disapproved of, and DPRK retaliated[1] by hacking Sony Pictures and released executive salaries, emails, private employee information, unreleased movies, scripts, and set loose wiper malware on Sony Pictures' internal network. Sony was also forced to cancelled the theatrical release because there were threats of terrorist attacks at theaters that showed the film.

"Hacking back" is not a great strategy for most companies, except those that were already juicy targets and are battle-tested against state actors. But what do I know, I'm no fancy CSO.

1. https://en.wikipedia.org/wiki/2014_Sony_Pictures_hack

chromacity• 4 months ago

I don't think that follows. There's not a single large organization - private business or a government - that can claim to be 100% hacker-proof. A lot of "cyber" problems are also people problems: humans make mistakes, deliberately circumvent policies and security mechanisms to "get stuff done", can be coerced or bribed. That doesn't mean they are incompetent, just that defense is never perfect.

Making criminals' lives more complicated is a good strategy. Corporate vigilantism, I don't know.

JumpCrisscross2• 4 months ago

what makes them think they have the knowledge/expertise to fight back?

If the goal is simply breaking shit (versus e.g. exfiltrating data) offense is way easier than defense. Also, security is an ongoing expense. Retaliation is one time.

conductr5• 4 months ago

Also, security is an ongoing expense. Retaliation is one time.

Disagree. Retaliating draws a larger target on you. Increasing need for ongoing security. And increasing need to retaliate. You’re retaliating against multiple fronts and vectors. It’s all very expensive and an arms race.

rdtsc2• 4 months ago

what makes them think they have the knowledge/expertise to fight back?

That fact that they have money to hire someone to do it?

Now one might ask why didn't they use that money to defend themselves to start with.

Bender• 4 months ago

If a company's already been hacked, what makes them think they have the knowledge/expertise to fight back?

Not required. This is unlikely to be random SecOps and SecEng corporate employees as the legal risk is too high as government administrations are replaced every few years.

Just like real piracy at sea companies would hire mercenaries or nowadays referred to as private military contractors. The fight back would just be to initially identify them (attribution) then activate PMC's at or near their location and neutralize the root cause.

With time countries will tire of random PMC's showing up and will take a stronger approach to dealing with their own hackers in addition to making the internet less anonymous. The effort to make the internet less anonymous has clearly already started as HN have been witnessing. Efforts like bcp38, 84 [1] authenticated packets likely using a nonce after government ID based auth and many other methods will be implemented as previous efforts have stalled.

[1] https://www.rfc-editor.org/bcp/bcp84.txt

SilverElfin• 4 months ago

State sponsored cyberattacks by China should be considered an act of war by the US government. Telling private firms to hack back isn’t a solution. Unfortunately Trump has been spineless and weak on China, as we have seen in the tariff debacle and in the TikTok ban debacle.

_slih• 4 months ago

hack back assumes you know who hit you. attribution in cyber is hard enough for the NSA

clcaev• 4 months ago

The referenced policy says "We will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities."

https://www.whitehouse.gov/wp-content/uploads/2026/03/Presid...

I don't see where the policy instructs the private sector to "hack back", a quoted term in the article.

iamnothere• 4 months ago

I look forward to the first instance of a DDoS or targeted exploit used against security researchers who have been misidentified as “hackers” by some corporate IDS.

yabones• 4 months ago

Yeah, considering the number of corporate IT products that count anything from a port scan to requesting /wp-admin a "thwarted cyberattack" I can see this going very poorly when every cowboy IT manager gets their sheriff badge.

red-iron-pine• 4 months ago

the distinction between "security researchers" and "APT" is often quite blurry

SahAssar• 4 months ago

I don't think you are using APT correctly there.

nitwit005• 4 months ago

I was imagining retaliation against AWS, where some compromised EC2 instance happened to be running.

rolandog• 4 months ago

I don't look forward to corporations "automating" (unleashing) their "defenses" (hackbots) with AI, and ending up bricking random people's and businesses' phones and devices because they start hallucinating attacks.

mikkupikku• 4 months ago

Jennifer Government anyone?

booleandilemma• 4 months ago

I love this book and it doesn't get enough recognition.

BLKNSLVR• 4 months ago

I think there may be adversaries smart enough to coordinate a situation to get a little hacking war going on between two friendlies who both think they're 'hacking back' at enemies.

Verifying the actual source of a hack is not necessarily easy, as far as I know.

MrLeap• 4 months ago

Sorta reminds me of UDP amplification attacks.

dylan6044• 4 months ago

Verifying the actual source of a hack is not necessarily easy, as far as I know.

The Geneva convention says that combatants must be identifiable by uniform, so we can just enforce that, right? /s

type0• 4 months ago

It's a kind of digital munition, there's no conventions for that

daotoad• 4 months ago

RFC 3514 perhaps?

https://www.ietf.org/rfc/rfc3514.txt

LunaSea• 4 months ago

Should we introduce a new HTTP header : `X-CTF-TEAM: NSA` ?

mmooss• 4 months ago

Governments must have a monopoly on violence.

One reason: When a corporation attacks someone, how do they decide who they are attacking? What if they attack the wrong person due to misattribution? What if they do it due to incompetence (stretch your mind adn try to imagine incompetence in IT) or just to look like they did something? What if they attack enemies or competitors? I'm sure they can find some excuse.

In every other domain of justice, there is a warrant, an arrest, indictment, and trial, involving they agreement of many people in two branches of government.

Also, does this mean I can 'hack back' the endless scammers?

actionfromafar• 4 months ago

Another similarity with North Korea!

skywhopper• 4 months ago

“Everyone should become a criminal” does seem to be the organizing principle of the current administration.

movedx• 4 months ago

Cyberpunk 2026.

Havoc• 4 months ago

This is giving Hollywood hacker movie levels of technical understanding

pimlottc• 4 months ago

They just need to type faster

testing22321• 4 months ago

In the dark with a mask on

alifeinbinary• 4 months ago

They just need to create a GUI interface with Visual Basic and see if they can track the IP address.

condiment• 4 months ago

sounds like a good opportunity to bring back "letters of marque." These were less about authorizing ships to fight back against pirates, and more about authorizing private to your army to find and capture pirate vessels with the expectation that they would be allowed to keep whatever loot they captured. sounds like we're taking a step in that direction as the Internet is being identified as Lawless as the sea.

https://en.wikipedia.org/wiki/Letter_of_marque

foxyv• 4 months ago

I guess that would put a different spin on the idea of Software Piracy...

RealityVoid• 4 months ago

I guess it would be more akin to smuggling at this point.

monarchwadia• 4 months ago

Are you indirectly referencing this bill? https://burchett.house.gov/media/press-releases/burchett-int...

Bratmon• 4 months ago

It says something about modern Congress that when one of the powers explicitly granted to Congress became relevant for the first time in 100 years, their first instinct was to delegate it away to the President.

hardlianotion• 4 months ago

He could be referencing this:

https://en.wikipedia.org/wiki/The_Letter_of_Marque

tdiff• 4 months ago

more about authorizing private to your army to find and capture pirate vessels

I think important detail is that it authorised attacks on any foreign vessel (of a specific nation), not only on pirate ships.

zenmac• 4 months ago

https://archive.ph/vwuA1

Link seems to be down ATM. Is this caused by that cloud flare issue affecting archive.today that was just posted recently?

voxgen• 4 months ago

It works for me Firefox's Cloudflare DNS over HTTP.

For clarity, the recent issue[0] likely wasn't intermittent. Cloudflare's malware blocking DNS server now blocks those archive.today sites. Doesn't affect the non-malware-blocking DNS server (1.1.1.1).

[0] https://news.ycombinator.com/item?id=47474255 "Cloudflare flags archive.today as \"C\&C\/Botnet\"; no longer resolves via 1.1.1.2"

rdtsc2• 4 months ago

Would this open "interesting" possibilities for false flags: make one entity attack another entity you don't like, and now watch them fight each other.

sandy_coyote• 4 months ago

There's no profit in hacking back, only cost.

ineedaj0b• 4 months ago

Overtime, if everyone who robs gas stations ends up dead and shot, people will significantly stop robbing gas stations.

The attendant does not want smoke… but if circle K can hire top talent to “eliminate”?

How cool would a team of 12 guys charged with hurting the hacking firm be? Awesome job. And if successful you’d have a cool story. White hat but you don’t need to work for the NSA.

Surac• 4 months ago

There one was a pen and paper rollplaying system called shadowrun. reading all this makes me think of the game world

doom2• 4 months ago

It's still around and up to 6th edition! Catalyst Game hasn't been the best steward of the IP, with the rules still being internally inconsistent and usually needing a lot of house rules to fix.

hulitu• 4 months ago

America tells private firms to “hack back”

Only if they know that they have been hacked. Hello Microsoft

America tells private firms to “hack back”

Related Stories