LAUNCH ON WARNING: AGGRESSIVE DEFENSE OF COMPUTER SYSTEMS

I. INTRODUCTION There has been a growing interest in "self help" mechanisms to counter Internet-mediated threats. Content providers such as record labels and movie studios have favored proposed federal legislation that would allow them to disable copyright infringers' computers. (1) Software licensors have backed multiple-state legislation, permitting the remote disabling of software in use by the licensee when the license terms are breached. (2) Internet security professionals debate the propriety, and legality, of striking back at computers which attack the Internet through the introduction of worms, viruses, and so on, collectively "malware. " (3) Systems administrators are frustrated that the usual means of enforcing rights do not work on the Internet. Although national laws and civil jurisdiction usually stop at the border, attacks are global, and those responsible for infringements and network attacks are not only legion, but anonymous. The Internet's massive, instantaneous distribution of software tools and data permits very large numbers of unsophisticated users access to highly efficient decryption tools, as well as to very powerful data attack weapons. Small children in Hanoi, Prague and Fairbanks can collapse central web servers in Silicon Valley and Alexandria, Virginia, and freely distribute the latest films and pop tunes. The irony is that as more of the global economy is mediated by the Internet--that is, as we increasingly rely on the Internet--the technologies become more complex, and more vulnerable to attack from more people. Even a cursory look at the figures suggests an almost exponential increase in these vulnerabilities. (4) Simultaneously, the legal system is increasingly incapable of policing the illegal behavior. The United States court system is ponderous and expensive. One simply cannot go after every malefactor, and as a practical matter, it is usually impossible to pursue infringers outside the United States. The Internet and its language of code are global. They are not coterminous with any of the usual means of enforcement of laws and values, because the Internet is not coterminous with any country, region, or cultural group. The Internet gathers those who have no contractual relationship, speak no common language, and are not bound by a common law. Trade sanctions will not assist. Nations will not permit their citizens to be policed directly by authorities across the globe. In my own work, I have tracked anonymous malefactors to towns in Australia, Eastern Europe and the Bahamas; and there, the trail went cold. Only in Australia could we have retained local counsel and perhaps pressed matters with the police, but it was too expensive, all told. Resorting to domestic police is frustrating. The FBI has understandably re-routed resources to combating terrorism, (5) and local authorities do not have the wherewithal to rapidly react to assaults from other parts of the country. By many accounts, conventional law enforcement authorities simply do not have the skills to deal with cyberattacks, and victims such as banks, financial institutions, and others that deal in sensitive data are reluctant to go public and in effect turn over the investigation to the authorities. (6) Fundamentally, going to law enforcement does not stop an attack, at least in the short term. Rather, it starts an investigation that could take months or longer to result in an arrest. That's an eternity in Internet time. As legal systems become less effective in addressing these concerns, attention naturally turns to technology, and traditionally, defensive technology. There is a broad range of products that help to protect networks, to keep content encrypted, and so on. In the networks security area, firewalls, intrusion detection systems, (7) authentication devices, and perimeter protection devices are among the services and products available. But two general trends of increasing complexity undermine the efficacy of defensive technologies: increasingly complex systems and increasing connectivity. …