Washington, D.C. associate Anand Shah co-authored “Adequate Attribution: A Framework for Active Defense” for the University of Maryland, Cary School of Law’s Journal of Business & Technology Law.
In recent years, the notion of an “active defense” has become an increasingly discussed topic. Previously seen as a tool utilized primarily by the federal government and specialists, as cyber security has become more complex, organizations have started to use their cyber capabilities as offensive tools for preventing cyberattacks. This has led to questions regarding the determination of attackers and what constitutes appropriate retribution. Complicating matters is a lack of clarity in law and policy, leaving considerable uncertainties as to what is—and is not—acceptable defense. The article examines cyber defense and what future national policy may look like for the private sector’s use of active defense. The article has been recommended by the American Bar Association’s Cybersecurity Law Taskforce as an essential guidance on the topic.