Review - HR 8403 Introduced – Federal Cybersecurity Initiatives

Last month, Rep Swalwell (D,CA) introduced HR 8403, the Proactive Cyber Initiatives Act of 2022. The bill would establish requirements for proactive cybersecurity measures such as penetration testing and deceptive defense processes for federal information systems. It would require reports to Congress on penetration testing, active defense and proactive cybersecurity initiatives. No new funding is authorized by the bill.

Moving Forward

Swalwell is not a member of either the Oversight and Reform Committee or Armed Services Committee to which this bill was assigned for consideration. This means that there is not likely to be sufficient influence to see this bill considered in either committee. I see nothing in the bill that would engender any organized opposition. I suspect that the bill would receive bipartisan support in either committee. The bill would probably be considered in the House under the suspension of the rules process.

Swalwell is a member of the House Homeland Security Committee and I suspect that he figured that the bill would be assigned to that committee for consideration. To be fair, that is the committee to which I would have expected it to be assigned. I suspect that the Oversight and Reform assignment is a political attempt to expand the cybersecurity oversight responsibility of that Committee. The secondary assignment to the Armed Services Committee is required because of the DOD study and report requirements in Section 7.

Commentary

The active defense report requirements in Section 6 seem to be rather bland until you go back and look at the definition of ‘active defense’ in Section 2. That definition includes feeding false information to an attacker, presumably through some sort of honeypot, and the use of “proportional action taken in response to an unlawful breach”. Typically, that phrase is used as a less confrontational way of describing limited ‘hack back’ actions. This is why the report is required to address “analysis of whether there are legislative, regulatory, or resource burdens” that need to be addressed before such actions can be undertaken. What is missing from that analysis is requirement is a specific need to identify the limits that would have to be imposed on such activities. I would change §6(b)(3) to read:

“(3) An analysis of whether there are legislative, regulatory, or resource burdens that prevent such techniques from being effectively utilized, including the resources necessary to implement such techniques, and a reasonable set of limitations that should be imposed on using such techniques.”

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-8403-introduced - subscription required.

HR 4036 Introduced – “Hack Back Bill”

Earlier this month Rep. Graves (R,GA) introduced HR 4036, the Active Cyber Defense Certainty Act. The bill would amend 18 USC 1030 to, according to a Graves press release, “to allow use of limited defensive measures that exceed the boundaries of one’s network in order to monitor, identify and stop attackers.”

Attributional Technology

Section 3 of the bill would add a new paragraph (k) to §1030 that introduces the concept of ‘attributional technology’. It defines the term as “any digital information such as log files, text strings, time stamps, malware samples, identifiers such as user names and Internet Protocol addresses and metadata or other digital artifacts gathered through forensic analysis” {new §1030(k)(2)}.

The new paragraph would exempt the use of attributional technology from prosecution under §1030 when used by “a defender who uses a program, code, or command for attributional purposes that beacons or returns locational or attributional data in response to a cyber intrusion in order to identify the source of an intrusion” {new §1030(k)(1)}. The ‘program, code or command’ must have been removed from the defender’s computer by the unauthorized user being attributed. Further the ‘program, code or command’ cannot “result in the destruction of data or result in an impairment of the essential operating functionality of the attacker’s computer system, or intentionally create a backdoor enabling intrusive access into the attacker’s computer system” {new §1030(k)(1)(B)}.

Active Cyber Defense

Section 4 of the bill would add a new paragraph (l) to §1030 that introduces the concept of ‘active cyber defense’. The term is defined as actions taken by (or at the direction of) a defender accessing without authorization the computer of the attacker to the defender’s own network to gather information in order to {new §1030(l)(3)(B)(i)(II)}:

• Establish attribution of criminal activity to share with law enforcement and other United States Government agencies responsible for cybersecurity;

• Disrupt continued unauthorized activity against the defender’s own network; or

• Monitor the behavior of an attacker to assist in developing future intrusion prevention or cyber defense techniques.

The definition goes on to exclude any actions that {new §1030(l)(3)(B)(ii)}:

• Intentionally destroys or renders inoperable information that does not belong to the victim that is stored on another person or entity’s computer;

• Recklessly causes physical injury or financial loss as described under subsection (c)(4);

• Creates a threat to the public health or safety;

• Intentionally exceeds the level of activity required to perform reconnaissance on an intermediary computer to allow for attribution of the origin of the persistent cyber intrusion;

• Intentionally results in intrusive or remote access into an intermediary’s computer;

• Intentionally results in the persistent disruption to a person or entities internet connectivity resulting in damages defined under §1030(c)(4); or

• Impacts any computer described under §1030(a)(1) regarding access to national security information computers, or to §1030(c)(4)(A)(i)(V) regarding a computer system used by or for a Government entity for the furtherance of the administration of justice.

Section 5 of the bill adds a new paragraph (m) to §1030 that further limits the use of an ‘active cyber defense’ by requiring a requirement for advance notification of its use to the FBI. Approval is not required, but acknowledgement of receipt is a prerequisite for the use of ‘active cyber defense’ measures. The notification would be required to include {§1030(m)(2)}:

• The type of cyber breach that the person or entity was a victim of, the intended target of the active cyber defense measure, the steps the defender plans to take to preserve evidence of the attacker’s criminal cyber intrusion;

• The steps they plan to prevent damage to intermediary computers not under the ownership of the attacker; and

• Other information requested by the FBI to assist with oversight.

Other Provisions

Section 6 of the bill would require the FBI to establish a program “to allow for a voluntary preemptive review of active defense measures” {§7(a)}. It would provide for the review to provide an assessment of “how the proposed active defense measure may be amended to better conform to Federal law, the terms of section 4 [new §1030(l)], and improve the technical operation of the measure” {§7(b)}.

Section 7 of the bill would provide for the obligatory report to Congress.

Section 8 of the bill would require the Department of Justice to update it’s ‘‘Prosecuting Computer Crimes Manual’’ to reflect the changes made by this legislation.

Section 9 of the bill would provide for a two-year sunset provision; removing the changes to §1030 two years after the bill is enacted.

Moving Forward

Neither Graves nor his cosponsor {Rep. Sinema (D,AZ)} are members of the House Judiciary Committee to which this bill was referred for consideration. That means that it is unlikely that the bill will be considered in that Committee.

A number of attempts have been made to amend §1030 over the last couple of sessions (see for example here) carving out exemptions to the provisions of the statute. There is a natural legislative inertia when it comes to changing criminal law. I expect that the same inertia would apply to this bill, above and beyond the lack of influence that the sponsors have to move the bill forward.

Commentary

This bill has received lots of attention in the press (see here, here and here for example) when it was introduced but it seems that many have missed an important component of the legislative requirements; any tool used to ‘hack back’ would have to be extracted from the defenders computer by the attacker. The defender would have to construct a honey-target (smaller than a honey-pot) file that the attacker downloads from the defended system. That file would include some sort of communications protocol that would send information back to the defender that provides attributional information on the attacker.

If this sounds like what a hacker does when they use a phishing attack or boobytrapped web site, that is almost certainly deliberate. It requires the attacker to be explicitly involved in ultimately providing information from their system to the original defender. This may end up causing problems in using the information obtained under the self-incrimination provisions of US law. Lawyers will have fun arguing both sides of this.

What the bill does not allow, and in fact explicitly prohibits, is either the establishment of a backdoor or actively pivoting through the attacker’s system searching for information. This is the typical next step of an attack on a computer system. This is what distinguishes the bills ‘hacking back’ (the term is not actually used in the bill) from the prohibited actions of §1030.

The requirements for pre-notification help to ensure that the new provisions are not used by nefarious hackers as an extraneous tool in defending against prosecution for traditional hacking prohibited by §1030.

It is important to note that the active cyber defense provisions are not an exemption from prosecution under §1030, instead it allows them to be used as a defense against federal charges under §1030. That means that prosecution for a properly notified active defense measure is still possible at the discretion of the government. A judge would have to decide if the active cyber defense measures actually-employed met the requirements of the revised §1030. FBI ‘approval’ of the proposed active defense measures would obviously be beneficial in convincing a judge of the appropriateness of the activities.

More importantly, the active cyber defense provisions in the bill are specifically not allowed to be used as a defense in a civil action undertaken under §1030(g). That paragraph allows anyone who suffers ‘damage or loss’ from unauthorized access to a system to obtain “compensatory damages and injunctive relief or other equitable relief” in federal courts. The reasoning is that active cyber defense measures cannot, by definition, cause damage or loss, so proving damage or loss means that an authorized ‘active cyber defense’ measure was not employed.

Unfortunately, the provisions in this bill would only apply to attackers using computers located in the United States. This is an inevitable problem cause by international law; each country has sovereign control of the rules prohibiting access to computers physically located within their boundaries. Prosecution would have to take place in the target country, but extradition could be possible depending on the extradition status of the country involved.

The problem here is that, by definition, a defender would not know the location of the target computer when they initiated active cyber defense measures. Thus, a defender could end up violating foreign law by executing measures allowed by this bill and could be potentially extradited to face charges for that violation. This bill should include provisions that require a judge at an extradition hearing from taking specific cognizance of the provisions of this bill as a defense against extradition. This would not, however, protect a defender against arrest and prosecution while traveling outside of the US.