Cybersecurity counterattack is a very legal and ethical issue. In the United States, countering threat actors is illegal under legislation such as the Computer Fraud and Abuse Act of 1986 and the Cybersecurity Information Sharing Act of 2015. If the attacker is a state actor, there are serious global implications. An individual’s only legal right to respond on his or her own behalf is as a federal employee or military member.
Although the international rules on counterattack are not as strict as domestic ones, they are still quite strict. The International Court of Justice (ICJ) allows counterattacks under certain conditions: it must only target the first aggressor, express a demand to stop the attack, do not increase violence, and allow for a one-step withdrawal. But it is difficult to mount a counterattack because there are legal and ethical issues that are not easily quantified and contained.
Countering other frameworks such as Confidentiality, Integrity, and Availability (CIA) is unethical for a number of reasons. By definition, cybersecurity professionals have an ethical responsibility to protect personal information, flag issues, and integrate security with the law. These obligations are supported and reinforced by laws, such as HIPAA in healthcare, ensuring legal permissibility, legal reasonableness and respect for legal privacy. Finally, cybersecurity experts must follow the philosophy of “do unto others as you would have them do unto you,” and refrain from engaging in any illegal or unethical activities in response to attacks.