Cyber-Attacks, Retaliation and Risk: Legal and Technical Implications for Nation-States and Private Entities

Background

In the wake of recent reports of persistent cyber-exploitation globally, coupled with disclosures concerning unabashed national cyber-surveillance programs (Gorman & Valentino-Devries, 2013), the issue of cyber-defense and retaliation is very topical (Limnell, 2014; Sorcher, 2015; Yadron, 2015). Following the lead of corporate giants like Google (Nakashima, 2013; Richmond, 2010) it seems nation-states and the private sector may resort to the use of forcible cyber-defense following instances of cyber-harm and transnational transgressions via the Internet (Kesan & Hayes, 2012; Messerschmidt, 2013). In 2010, Google announced that a group purportedly identified as the ‘Elderwood Gang’ (also known as the ‘Beijing Group’) infiltrated the Company’s network, and breached at least thirty other corporations based in the United States (Cha & Nakashima, 2014; Clayton, 2012). The attackers utilized malware known as Hydraq, also referred to as Aurora, in combination with a zero-day exploit (O’Gorman & McDonald, 2012). Nicknamed “Operation Aurora”, the cyber-attack was allegedly traced to servers located at two Chinese educational institutions (Kurtz, 2010; “Protecting your critical assets,” 2010). Once identified, it is reported that Google launched a counteroffensive targeting the perceived attack source (Sanger & Markoff, 2010).