Hacked? Proposed Bill Would Allow Firms to Hack Back

Kvitka wondered if the proposal could pave the way for the Financial Industry Regulatory Authority and the Securities and Exchange Commission to require advisory firms to take more aggressive tactics against entities that breach their cybersecurity defenses.

“If you’re breached, do you have to go after the guy who breached you? Do you have to have the means, policies and procedures in place to go after that data and assist in the prosecution of the person who breached you?” he said.

Kvitka doubts regulators would go that far, but “I think they would say, especially the SEC, [that firms should] consider those options when they’re drafting their policies and procedures and leave it open.”

If a bill like this were to pass and financial advisors could respond in kind to cyberattacks, Kvitka suggested they consult with their legal counsel before undertaking their own cyberattack, “not only to assess criminal liability or civil liability, but also whether their actions could breach regulatory authority from FINRA, the SEC or any other applicable regulatory bodies.”

He acknowledged that it might be hard for advisors who have just discovered malware on their network to refrain from retaliating until they get the go-ahead from their attorney.  

“Firms might consider adopting polices that identify specific actions and designated reactions if this were to happen,” he suggested.

Even in that case, firms would need to keep up with changing regulations and make sure those pre-approved responses are still allowed when an attack happens.

For example, if a firm gets its attorney’s blessing on a cyber counterstrike policy, then “two years later something happens but the regulatory landscape has changed, that advisor or that affected firm is exposed” to liability, he said. “By adding another arrow to your quiver, you also have all the commensurate obligations that go along with it.”

MacKillop noted that if a proposal like Graves’ passed, taking advantage of it “would require a lot of education on everybody’s part because nobody has that kind of software today.”

“It reminds me of the reason why citizens on the street aren’t allowed to just pull guns and shoot people when they see crimes being committed. There’s a certain level of restraint and discretion in order to police these kinds of things,” MacKillop said. “Loosing the world of financial advisors and others on the world with aggressive software doesn’t really seem like a very good idea.”

As for whether any information gathered could be later used against the hacker in court, Kvitka pointed out that the proposal is just for “an amendment to a particular statute that holds somebody liable for this type of fraud. The person would not be liable criminally for engaging in this activity.”

However, “outside of this particular statute, what if that person has a civil case: Somebody hacks the firm, the firm retaliates and destroys the hacker’s hardware in the process, and the hacker sues the firm? There’s a certain element of fundamental fairness in everything, but when you’re looking at a strict statutory or civil law interpretation of a particular cause of action, sometimes that doesn’t factor in.”

— Check out 5 Cybersecurity Trends Dominating the Early 2017 Discourse on ThinkAdvisor.