0:00
Yeah, sure, so when we first started chatting,
I said that one of the things that makes this problem tricky, and hard, and
different from earlier instances of data security is attribution.
So if you think about, the data security problem that a hospital faced 50 years
ago, it was basically people gaining unauthorized access to the building,
right?
And if you had cameras, you could see who was coming and going, and maybe a badge
system would help, but you sort of knew who was going into which rooms, right?
And if it turned out that a room had been broken into, you could go back and look at
the logs and see who had gained access to that room at a certain time, right?
And it wasn't too hard to attribute the source of the problem,
you had a high likelihood of knowing who caused the problem.
That's really not true in the cyberspace.
0:52
You look at your logs, if you are even lucky enough to have discovered that
there's been a breach of your security.
And it will appear as if the attacker is coming from my grandma's house.
I mean, because now the attack will be routed through a hop, and
then a hop, and then a hop, and then a hop.
So it'll look like it's coming from a nice person,
a law-abiding citizen's house in Sweden, and
if you were to respond to that, you would be responding to the wrong person, right?
It was actually a state actor who routed it through a private home in one country
to a business in another country to attack a government entity in another country.
That problem is very real, it's not limited to medical devices, but
it's a very real problem in all cybersecurity contexts, right?
How do you respond to an intrusion if you aren't certain about where it comes from?
And certainty in this space is something that you never have,
all you can do is have a high level of confidence about the source.
But let's say, even hypothetically, that you had a very high level of confidence
about where the source was coming from.
Who's the right actor to respond to a cybersecurity attack?
2:02
That's another open and tricky question, right?
Say that it's an American company that makes a medical device that has been
hacked to learn about the vulnerabilities in the devices, right?
That's a very scary and real possibility, maybe the intruder was actually just
looking for intellectual property because they wanted to copy the design and
sell cheaper devices, right?
But they also learn about vulnerabilities, and the company brings this information.
They discover that there's been a breach, and
they bring this information to the American government.
And the American government says, it's a little bit like when you show up at
the cops, at the police station, and you say, my bike was stolen, right?
The guy, he's drinking his coffee and he kind of chuckles and says, yeah, you and
everybody else.
I mean, what do you want us to do about it?
There's only so much we can do,
we're dealing with just untold numbers of intrusions.
2:53
We'll deal with yours when we get to it, which may mean never.
This is starting to be addressed and fixed, and
there's a closer relationship between private companies and
the government than there has been in previous years.
But private companies very much feel like their hands are tied and
they can't go to the government to get help when there's been a cyber intrusion.
3:18
And a number of people have floated the idea that these private companies could
attempt to hack back at the person who attempted to gain access to their network,
or maybe gained access to their network.
So the so-called hack back debate is happening now,
it's incredibly complicated.
So, first of all, under American law it's probably illegal to launch a hack back.
I mean, however you gain access to that person's network,
even though they've intruded yours.
You're very likely violating the Computer Fraud and Abuse Act because
you're gaining unauthorized access to their network, right?
That's the law that we were talking about earlier.
4:00
Suppose it's an international actor, or suppose this all happens outside the US,
and the CFDA doesn't have extraterritorial reach,
so this is happening outside of the realm of the law.
But if an American company responds to an attack, That they think came from,
let's say, the Chinese government, right?
So they respond by attacking an IP address that they know is linked,
or they think was linked, to an attack on their servers.
What's the Chinese government's response going to be?
They're going to say the Americans are attacking us, right?
And they may launch retaliatory attacks on the US, not necessarily aimed at that
company, and the American government is going to be very concerned about that.
And so you could have two private entities, right?
An IP thief in one country who routes, let's say, they're not in China,
they route the attack through China to make it look like it's a Chinese company.
The American company thinks it's the Wild West, there are no laws regulating this.
We've got the advice of smart lawyers who told us that we can do this.
They fight back, right, and now the Chinese government takes it seriously,
defends their companies, and attacks back, and now we're talking about cyber warfare.
I mean, that's a fancible scenario, but it's not impossible to see, and
the reason it's so scary is because attribution in this space is so tricky.
Lauren SolbergAssistant Professor
