主动自我防御是对付网络攻击的最好方法

With the threats of cybercrime, cyberterrorism and cyberwarfare looming¹ over our hyper-connected world, the best defense² for the U.S. might be a good offense³, says new research by a University of Illinois expert in technology and legal issues. Law professor Jay P. Kesan warns that an active self-defense regime, which he terms "mitigative（缓和的） counterstriking," is a necessity in cyberspace⁴, especially to protect critical infrastructure⁵ such as banking⁶, utilities and emergency services.

"The threats from cyber-attacks are real, and the harm of a potential attack can be far greater than what we can currently combat," Kesan said.

Kesan's analysis, co-written with former U. of I. law student Carol M. Hayes and published in a forthcoming issue of the Harvard Journal of Law and Technology, concludes that mitigative counterstriking against attacks instead of simply relying on passive defense options (firewalls, patches and anti-virus software) is legally justifiable⁷ as self-defense, although a more exhaustive legal framework needs to be implemented⁸.

"The principles of mitigative counterstriking are legally justifiable under several areas of domestic and international law, and can be made consistent with other areas of law by amending⁹ or reinterpreting the law," he said.

Kesan says an active defense regime consists of three distinct elements: detecting intrusions, tracing the attack back to the attacker, and executing a counterstrike.

A counterstrike can be characterized in one of two ways: retributive（报应的，惩罚的） counterstrikes, which punish the attacker; and mitigative counterstrikes, which minimize the damage to the victims' information-technology infrastructure.

According to the authors' study, there currently is no effective domestic or international legal apparatus¹⁰ to deter¹¹ cyber-attacks. Criminal law enforcement is complicated by the lack of a consistently enforced international law, jurisdictional¹³ issues and the difficulty of identifying an attacker in a manner specific enough to justify¹⁴ criminal prosecution¹⁵. Resorting to civil litigation（诉讼，起诉） would likely be slow and impractical¹⁶.

"Cyber-attacks are fundamentally different from crime," Kesan said. "The person may be physically¹⁷ very far away from you, and you may not be able to use traditional legal remedies against that person, since civil and criminal remedies require jurisdiction¹² over a person. In those circumstances, what do you do?"

Kesan suggests that a government-affiliated agency, preferably a public-private partnership¹⁸, should be responsible for an active defense program, including providing resources for private parties to detect and trace intrusions, and executing counterstrikes.